Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa Waiver Program
Published: 2006-07-28T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Visa Waiver Program enables citizens of 27 countries to travel to the United States for tourism or business for 90 days or less without obtaining a visa. In fiscal year 2004, more than 15 million people entered the country under the program. After the September 11, 2001, terrorist attacks, the risks that aliens would exploit the program to enter the United States became more of a concern. In this report, we (1) describe the Visa Waiver Program's benefits and risks, (2) examine the U.S. government's process for assessing potential risks, and (3) assess actions taken to mitigate these risks. We met with U.S. embassy officials in six program countries, and reviewed relevant laws, procedures, and reports on participating countries.
section_title: What GAO Found
paragraphs: The Visa Waiver Program has many benefits as well as some inherent risks. It facilitates travel for millions of people and eases consular workload, but poses challenges to border inspectors, who, when screening visa waiver travelers, may face language barriers or lack time to conduct in-depth interviews. Furthermore, stolen passports from visa waiver countries are prized travel documents among terrorists, criminals, and immigration law violators, creating an additional risk. While the Department of Homeland Security (DHS) has intercepted many fraudulent documents at U.S. ports of entry, DHS officials acknowledged that an undetermined number of inadmissible aliens may have entered the United States using a stolen or lost passport from a visa waiver country. The U.S. government's process for assessing the risks of the Visa Waiver Program has weaknesses. In 2002, Congress mandated that, every 2 years, DHS review the effect that each country's continued participation in the program has on U.S. law enforcement and security interests, but did not set a reporting deadline. In 2004, DHS established a unit to oversee the program and conduct these reviews. We identified several problems with the 2004 review process, as key stakeholders were not consulted during portions of the process, preparation for the in-country site visits was not consistent, and the final reports were untimely. Furthermore, DHS cannot effectively achieve its mission to monitor and report on ongoing law enforcement and security concerns in visa waiver countries due to insufficient resources. DHS has taken some actions to mitigate the program's risks; however, the U.S. government has faced difficulties in further mitigating these risks. In particular, the department has not established time frames and operating procedures regarding timely stolen passport reporting--a program requirement since 2002. Furthermore, DHS has sought to require the reporting of lost and stolen passport data to the United States and the International Criminal Police Organization (Interpol), but it has not issued clear reporting guidelines to participating countries. While most visa waiver countries participate with Interpol's database, four do not. DHS is not using Interpol's data to its full potential as a border screening tool because DHS does not automatically access the data at primary inspection.

section_title: Letter
paragraphs: The United States also issues visas to those who intend to immigrate to the United States.  In this report, we use the term “visa” to refer to nonimmigrant visas only.
The participating countries are Andorra, Australia, Austria, Belgium, Brunei, Denmark,  Finland, France, Germany, Iceland, Ireland, Italy, Japan, Liechtenstein, Luxembourg,  Monaco, the Netherlands, New Zealand, Norway, Portugal, San Marino, Singapore,  Slovenia, Spain, Sweden, Switzerland, and the United Kingdom (see app. II for a map of these  countries). Canada and Bermuda are not participants in the Visa Waiver Program; however,  nationals of Canada and Bermuda may, under certain circumstances, qualify for visa-free  travel to the United States.
The Immigration Reform and Control Act of 1986, P.L. 99-603.
The Visa Waiver Permanent Program Act, P.L. 106-396. program has on U.S. law enforcement and security interests. Effective  oversight of the Visa Waiver Program is essential to find the right balance  between facilitating legitimate travel and screening for potential terrorists,  criminals, and others that may pose law enforcement and immigration  concerns.
In response to your request, this report (1) describes the Visa Waiver  Program’s benefits and potential risks; (2) examines the U.S. government’s  process for assessing the program’s risks; and (3) assesses actions taken  to mitigate these risks.
To identify the benefits of the program, we reviewed relevant  documentation, including DHS’s Office of the Inspector General (OIG)  reports and our 2002 report on the implications of eliminating the  program. We also interviewed political, economic, consular, commercial,  and law enforcement officials at U.S. embassies in six Visa Waiver  Program countries. To determine the risks the Visa Waiver Program, we  interviewed officials from DHS’s National Targeting Center, Intelligence  and Analysis Directorate, and Forensic Document Laboratory. In addition,  we observed fraudulent document detection training of Customs and  Border Protection (CBP) agents at the Federal Law Enforcement Training  Center. To evaluate the U.S. government’s efforts to assess and mitigate  these risks, we analyzed the laws governing the program, relevant  regulations and agency operating procedures, and OIG reports. We also  examined 15 of the 25 completed reports from the 2004 review process  assessing the participation of Visa Waiver Program countries. As of June  2006, the remaining 10 assessments were pending classification review.  We met with officials from several DHS component agencies and offices,  the Department of State’s (State) Consular Affairs Bureau and its Europe  and Eurasia Bureau, and the International Criminal Police Organization  (Interpol) in Lyon, France.  We also met with the Department of Justice’s  (Justice) Interpol-U.S. National Central Bureau in Washington, D.C., which  facilitates international law enforcement cooperation among the United  States and Interpol and its other member countries. In addition to U.S.  officials in the six Visa Waiver Program countries, we spoke with foreign  government officials in three of these countries. We conducted our  evaluation from September 2005 through June 2006 in accordance with  generally accepted government auditing standards.
subsections: section_title: Background
paragraphs: The Immigration Reform and Control Act of 1986 created the Visa Waiver  Program as a pilot program. It was initially envisioned as an immigration  control and economic promotion program, according to State.  Participating countries were selected because their citizens had a  demonstrated pattern of compliance with U.S. immigration laws, and the  governments of these countries granted reciprocal visa-free travel to U.S.  citizens. In 2000, the program became permanent under the Visa Waiver  Permanent Program Act. In 2002, we reported on the legislative  requirements to which countries must adhere before they are eligible for  inclusion in the Visa Waiver Program. In general, these are the  requirements:    A low nonimmigrant visa refusal rate. To qualify for visa waiver status, a  country must maintain a refusal rate of less than 3 percent for its citizens  who apply for business and tourism visas.
A machine-readable passport program. The country must certify that it  issues machine-readable passports to its citizens. As of June 26, 2005, all  travelers are required to have a machine-readable passport to enter the  United States under this program.
Reciprocity. The country must offer visa-free travel for U.S. citizens.
Figure 1 shows the number of foreign nationals admitted to the United  States under the program in recent years (see app. III for more detailed  admissions statistics). Persons entering the United States under the Visa  Waiver Program must    have a valid passport issued by the participating country and be a national    be seeking entry for 90 days or less as a temporary visitor for business or    have been determined by CBP at the U.S. port of entry to represent no  threat to the welfare, health, safety, or security of the United States;    have complied with conditions of any previous admission under the  program (for example, individuals must have stayed in the United States  for 90 days or less during prior visa waiver visits); if entering by air or sea, possess a round-trip transportation ticket issued  by a carrier that has signed an agreement with the U.S. government to  participate in the program, and must have arrived in the United States  aboard such a carrier; and if entering by land, have proof of financial solvency and a domicile abroad  to which they intend to return.
Following the events of September 11, 2001, Congress passed additional  laws to strengthen border security policies and procedures, and DHS and  State instituted other policy changes that have affected a country’s  qualifications for participating in the Visa Waiver Program. For example,  all passports issued after October 26, 2005, must contain a digital  photograph printed in the document; passports issued to visa waiver  travelers after October 26, 2006, must be electronic (e-passports). E- passports aim to enhance border security by making it more difficult to  misuse the passport to gain entry into the United States. Travelers with  passports issued after the deadline that do not meet these requirements  must obtain a visa from a U.S. embassy or consulate overseas before  departing for the United States. In addition, the May 2002 Enhanced  Border Security and Visa Reform Act required that participating countries  certify that the theft of their blank passports is reported to the U.S.  government in a timely manner. Moreover, the act increased the  frequency—from once every 5 years to once every 2 years—of mandated  assessments of the effect of each country’s continued participation in the  Visa Waiver Program on U.S. security, law enforcement, and immigration  interests.
section_title: Visa Waiver Program Has Benefits and Risks
paragraphs: The Visa Waiver Program has many benefits, including facilitating  international travel for millions of foreign citizens seeking to visit the  United States each year, creating substantial economic benefits to the  United States, and allowing State to allocate resources to visa-issuing  posts in countries with higher-risk applicant pools. However, there are  inherent security and law enforcement risks in the program that pose  challenges to the United States.
subsections: section_title: Visa Waiver Program Facilitates Travel to the United States
paragraphs: The Visa Waiver Program was created to facilitate international travel  without jeopardizing the welfare or security of the United States,  according to the program’s legislative history. In fact, visa waiver travelers  have represented about one-half of all nonimmigrant admissions to the  United States in recent years, as demonstrated by figure 2 below.  According to economic and commercial officers at several of the U.S.  embassies we visited, visa-free travel to the United States boosts  international business travel and tourism, as well as airline revenues, and  creates substantial economic benefits to the United States. In its report  accompanying the 2000 bill to make the program permanent, the House  Committee on the Judiciary acknowledged the program’s importance to  the U.S. travel and tourism industry, and the benefit it provides to  American citizens by allowing reciprocal visa-free travel to visa waiver  countries. As we reported in 2002, any decision to eliminate the program  could discourage some business and tourism in the United States. In  addition, visa waiver countries could begin requiring visas for U.S. citizens  traveling to the 27 participating countries for temporary business or  tourism purposes, which would impose a burden of additional cost and  time on U.S. travelers to these countries.
Moreover, the program allows State to allocate its resources to visa- issuing posts in countries with higher-risk applicant pools. In 2002, we  reported that eliminating the program would increase State’s resource  requirements. Specifically, if the program were eliminated, we estimated  that State’s initial costs at that time to process the additional workload  would likely range between $739 million and $1.28 billion and that annual  recurring costs would likely range between $522 million and $810 million.  For example, millions of visa waiver travelers who have benefited from  visa-free travel would need to obtain a visa to travel to the United States if  the program did not exist. Furthermore, we reported that U.S. officials,  including those from State as well as from some law enforcement  agencies, said that eliminating the Visa Waiver Program could have  negative implications for U.S. relations with governments of participating  countries and could impair their cooperation in efforts to combat  terrorism.
section_title: Visa Waiver Program Can Pose Risks to U.S. Security, Law Enforcement, and Immigration Interests
paragraphs: The Visa Waiver Program can pose risks to U.S. security, law enforcement,  and immigration interests because some foreign citizens may exploit the  program to enter the United States. In particular, visa waiver travelers are  not subject to the same degree of screening as those travelers who must  first obtain a visa before arriving in the United States. Furthermore, lost  and stolen passports from visa waiver countries could be used by  terrorists, criminals, and immigration law violators to gain entry into the  United States.
subsections: section_title: Visa Waiver Travelers and Visa Applicants Face Different Levels of Screening
paragraphs: Since September 11, 2001, the visa issuance process has taken on greater  significance as an antiterrorism tool, as we have previously reported.  Those travelers who must apply for visas before traveling to the United  States receive two levels of screening before entering the country (see fig.  3). However, visa waiver travelers are first screened in person by a CBP  inspector once they arrive at the U.S. port of entry, perhaps after having  already boarded an international flight bound for the United States with a  fraudulent travel document. For visa waiver travelers, CBP primary  inspectors observe the applicant, examine his or her passport, collect the  applicant’s fingerprints as part of the U.S. Visitor and Immigrant Status  Indicator Technology program (US-VISIT), and check his or her name  against automated databases and watch lists, which contain information  regarding the admissibility of aliens, including known terrorists, criminals,  and immigration law violators. However, according to the DHS OIG,  primary border inspectors are disadvantaged when screening Visa Waiver  Program travelers because they may not know the alien’s language or local  fraud trends in the alien’s home country, nor have the time to conduct an  extensive interview. In contrast, non-visa-waiver travelers, who must  obtain a visa from a U.S. embassy or consulate, undergo an interview by  consular officials overseas, who conduct a rigorous screening process  when deciding to approve or deny a visa. As we have previously reported,  State has taken a number of actions since 2002 to strengthen the visa  issuance process as a border security tool. Moreover, consular officers  have more time to interview applicants and examine the authenticity of  their passports, and may also speak the visa applicant’s native language,  according to consular officials. Inadmissible travelers who need visas to  enter the United States may attempt to acquire a passport from a Visa  Waiver Program country to avoid the visa screening process.
section_title: Lost and Stolen Passports from Visa Waiver Program Countries Are Highly Valued
paragraphs: One of the Visa Waiver Program Oversight Unit’s primary concerns is the  potential exploitation by terrorists, immigration law violators, and other  criminals of a visa waiver country’s lost or stolen passports. DHS  intelligence analysts, law enforcement officials, and forensic document  experts all acknowledge that misuse of lost and stolen passports is the  greatest security problem posed by the Visa Waiver Program. Lost and  stolen passports from visa waiver countries are highly prized travel  documents, according to the Secretary General of Interpol. Moreover, Visa  Waiver Program countries that do not consistently report the losses or  thefts of their citizens’ passports, or of blank passports, put the United  States at greater risk of allowing inadmissible travelers to enter the  country.
Fraudulent passports from Visa Waiver Program countries have been used  illegally by travelers seeking to disguise their true identities or  nationalities when attempting to enter the United States. For example,  from January through June 2005, DHS reported that it confiscated, at U.S.  ports of entry, 298 fraudulent or altered passports issued by Visa Waiver  Program countries that travelers were attempting to use for admission into  the United States (see table 1). Two more recent cases demonstrate  continued attempts to enter the United States with fraudulent passports  issued by visa waiver countries:  In December 2005, a Pakistani citizen attempted to enter the United States  under the program with a counterfeit United Kingdom passport that she  had purchased. During secondary inspection, the CBP officer detected  flaws in the passport.
In March 2006, an Albanian citizen attempted to enter the United States  using a Belgian passport that he had purchased. The traveler confessed to  this upon questioning by CBP officers during secondary inspection.
In 2004, the DHS OIG reported that aliens applying for admission to the  United States using lost or stolen passports have little reason to fear being  caught. DHS’s OIG reported that a lack of training hampered border  inspectors’ ability to detect passport fraud among Visa Waiver Program  travelers, and recommended that CBP inspectors receive additional  training in fraudulent document detection. At that time, the 12-week  training course for new inspectors at the Federal Law Enforcement  Training Center devoted 1 day to passport fraud, according to the OIG.   Currently, CBP dedicates 16 hours out of the 16-week basic training  program to fraudulent document detection training for new border  inspectors, and provides additional courses for inspectors throughout  their assignments at ports of entry.  Nevertheless, training officials said  that fraudulent and counterfeit passports are extremely difficult to detect,  even for the most experienced border inspectors—which makes it  imperative that lost and stolen passports are reported on a timely basis.
Although DHS has intercepted some travelers with fraudulent passports at  U.S. ports of entry, DHS officials acknowledged that an undetermined  number of inadmissible aliens may have entered the United States using a  lost or stolen passport from a visa waiver country. According to State,  these aliens may have been inadmissible because they were immigration  law violators, criminals, or terrorists. Following are several examples:  In July 2005, two aliens successfully entered the United States using lost or  stolen Austrian passports. DHS was not notified that these passports had  been lost or stolen prior to this date; the aliens were admitted, and there is  no record of their departure, according to CBP. In October 2005, CBP  referred this case to DHS Immigration and Customs Enforcement for  further action.
In June 2005, CBP inspectors admitted into the United States two aliens  using Italian passports that were from a batch of stolen passports. CBP  was notified that this batch was stolen; however, the aliens altered the  passport numbers to avoid detection by CBP officers. DHS has no record  that these individuals departed the United States.
Also in June 2005, three aliens traveling together—all using fraudulent  Italian passports—were interviewed at primary inspection. CBP referred  one alien, an Albanian citizen, to secondary inspection because she was  reluctant to answer the inspector’s questions. In secondary inspection,  CBP determined that her passport had been altered. CBP admitted the  other two aliens, but subsequently determined that their passports were  part of the batch of stolen Italian passports cited in the previous example.
section_title: Process for Assessing Program Risks Has Weaknesses
paragraphs: In July 2004, DHS created the Visa Waiver Program Oversight Unit within  OIE to monitor the Visa Waiver Program. Its mission is to oversee Visa  Waiver Program activities and monitor countries’ adherence to the  program’s statutory requirements, ensuring that the United States is  protected from those who wish to do it harm or violate its laws, including  immigration laws. In 2004, DHS reviewed the law enforcement and  security risks posed by the continued participation of 25 of the 27  countries in the program. However, we identified problems with the  country review process by which DHS assesses these risks. For example,  DHS did not involve key interagency stakeholders in certain portions of  the review process, and did not establish transparent protocols for the  country assessments—including internal milestones or deadlines for  completing the final country assessments, the goals of the site visits, and  an explanation of the clearance process. Furthermore, OIE is unable to  effectively monitor the immigration, law enforcement, and security risks  posed by visa waiver countries on a continuing basis because of  insufficient resources.
subsections: section_title: Initial Steps Taken to Assess Risk of Visa Waiver Program
paragraphs: In April 2004, the DHS OIG identified significant areas where DHS needed  to strengthen and improve its management of the Visa Waiver Program.  For example, the OIG found that it was unclear who was managing the  program following the dissolution of the Immigration and Naturalization  Service. In addition, the OIG found that a lack of funding, trained  personnel, and other issues left DHS unable to comply with the mandated  biennial country assessments. In response to these findings, DHS  established OIE’s Visa Waiver Program Oversight Unit in July 2004, and  named a director to manage the office. Since its establishment, DHS, and  particularly OIE, has made strides to address concerns raised by the 2004  OIG review. Specifically, DHS has:    conducted site visits in all 27 participating countries;    completed comprehensive assessments of 25 participating countries,  examining the effect of continued participation in the Visa Waiver  Program on U.S. security and law enforcement interests, including the  enforcement of immigration laws; identified risks in some of the countries and brought the concerns to the  attention of host-country governments in five visa waiver countries;   submitted a six-page report to Congress in November 2005 that  summarized the findings from the 2004 assessments; and  initiated assessments for the remaining two countries in August and  September 2005.
In addition, in September 2005, DHS and State organized a technical  conference in Washington, D.C., with representatives from Visa Waiver  Program countries, to discuss the passport requirements for visa waiver  travelers, and the October 2005 and 2006 deadlines for digital photographs  and e-passports, respectively. Together, these actions demonstrate  significant improvements since the April 2004 OIG report.
section_title: DHS Lacks a Clearly- Defined, Consistent, and Timely Process to Assess Risks of Visa Waiver Program
paragraphs: Despite these steps to strengthen and improve the management of the  program, we identified several problems with the process DHS uses to  assess the risks posed by each of the visa waiver countries’ continued  participation in the program—namely the mandated biennial country  assessment process. For the 2004 assessments, we found the following:    some key stakeholders were excluded from the decision-making process;  the reviews lacked clear criteria to make key judgments; there was inconsistent preparation for the in-country site visits for the  reviews; and   DHS and its interagency partners neither completed the 25 country  assessments nor issued the summary report to Congress in a timely  manner.
OIE has acknowledged such weaknesses and has begun to make  adjustments; however, concerns remain.
subsections: section_title: Review Process Did Not Involve Key Stakeholders
paragraphs: We found that the review process lacked clear protocols, as key  stakeholders were left out of the report development process. Specifically,  after conducting the site visits and contributing to the reports on the site  visits, DHS and the interagency working group did not seek input from all  site visit team members while drafting and clearing the final country  assessments and subsequent report to Congress. For example, DHS’s  forensic document analysts, who participated in the site visits in 2004, told  us that they did not see, clear, or comment on the draft country  assessments, despite repeated attempts to obtain copies of them. Thus,  these analysts questioned the integrity of the process because they had not  seen how their analyses were incorporated into the final assessments.  Additionally, State’s headquarters officers who cover diplomatic relations  in Visa Waiver Program countries, as well as embassy officials in all of the  posts we visited, stated that they were not asked to review or provide  comments on the draft assessments, nor had they seen the final  assessments. CBP officials also stated that they repeatedly requested  copies of the country assessments and subsequent report to Congress, but  did not receive them. According to State’s Bureau of Consular Affairs, DHS  did not seek feedback from U.S. embassies and State’s regional bureaus on  the draft site visit or individual country assessments. Because these  assessments contained classified information, OIE officials told us that  they were not broadly distributed in draft or final form. Nevertheless,  without this information, key stakeholders could not be effective  advocates for U.S. concerns.
section_title: Review Process Lacked Clear Criteria to Make Key Judgments
paragraphs: We found that DHS did not have clear criteria when assessing each  country’s participation in the program to determine at what point security  concerns would trigger discussions with foreign governments about these  concerns and an attempt to resolve them. As previously mentioned, the  DHS-led interagency working group identified five countries from its 2004  assessment with significant security concerns, and DHS, in coordination  with State, discussed these concerns with government officials.  Furthermore, U.S. embassies issued a formal diplomatic demarche to the  five governments regarding the concerns in March 2005. However, while  the working group also had concerns with a sixth country, it decided not  to issue a demarche to this government. According to State, the working  group determined that the concerns identified in this country were not  directly related to the Visa Waiver Program and the country’s participation  in the program. However, OIE officials and other working group members  stated that they did not use any standard criteria in making this  determination. State officials agreed that qualitative and/or quantitative  criteria would be useful when making these determinations, although DHS  stated that the criteria should be flexible. During our visit to the U.S.  embassy in the sixth country, which was not issued a demarche, U.S.  officials told us they were unaware that the working group had discussed  security concerns in the context of the country assessment. While  embassy officials had already been addressing these issues as part of their  mission, they said that they would have likely seen greater progress made  in discussions with foreign government officials if all parties had known  that there was a potential link between these security concerns and visa  waiver requirements.
section_title: Inconsistent Preparation for Site Visits
paragraphs: The site visits associated with each country review were not always well- prepared and lacked a consistent approach, according to the site visit  team members. Several team members representing different agencies  stated that they did not receive adequate information and guidance prior  to conducting the site visits and, thus, were not well-prepared to conduct  the visits. DHS did not brief or train the site visit team members prior to  conducting the 2004 reviews, and many said that the goals of the in- country visits were not clear. One team member stated that the site visits  were largely “fact-finding trips,” as opposed to a targeted analysis of law  enforcement and security concerns. Moreover, prior to conducting the site  visits, DHS sent each country a background questionnaire; however, OIE  and team members stated that some countries did not provide responses  to the questionnaire prior to the site visit, which would have been useful  for preparation. Furthermore, senior U.S. officials in each of the embassies  we visited stated that the goals and priorities of the 2004 DHS-led site visit  teams were not clear to them. Consular officials at half of the posts we  visited also said that the site visit teams arrived on short notice and did not  give them adequate time to prepare. As a result, the teams may not have  made the most efficient use of their time in-country, and may not have  gathered their information on a consistent basis.
section_title: Reporting Untimely
paragraphs: DHS did not issue, in a timely manner, the summary report to Congress  that generally described the overall findings from the 25 country  assessments. Although DHS is mandated to conduct the country  assessments every 2 years, Congress did not establish a deadline by which  the assessments must be completed or the summary report issued. OIE,  State, and Justice officials acknowledged that the assessments took too  long to complete. The interagency teams conducted site visits as part of  the country assessments from May through September 2004, and  transmitted the final summary report to Congress more than 1 year later,  in November 2005. The report to Congress was a six-page summary that  did not include detailed descriptions of the law enforcement and security  risks identified during the review process, which were discussed at length  in the individual country assessments. According to interagency working  group members, DHS did not establish internal milestones or deadlines for  completing the final country assessments. OIE officials attributed the  lengthiness of the assessment process to the multiple rounds of clearances  for each of the 25 assessments and the summary report.
While the country assessments were awaiting clearance, there were  missed opportunities to capture more recent developments, and the final  assessments contained dated information or were incomplete. For  example, in May 2005, a post in one visa waiver country was notified there  had been a large-scale, high-profile theft of blank passports. While the U.S.  government was aware of this theft, this information was not captured in  that country’s assessment as it was being cleared. Moreover, the teams  collecting information about the visa waiver countries’ risks in 2004 used,  in some cases, information from 2 years prior; by the time the summary  report was issued in November 2005, some of the data was over 3 years  old. As a result of this lengthy process, the final report presented to  Congress did not necessarily reflect the current law enforcement and  security risks posed by each country, or the positive steps that countries  had made to address these risks (see fig. 4).
OIE officials acknowledged weaknesses in the 2004 reviews, and made  some adjustments for the 2005 country assessments for Italy and Portugal,  the two remaining countries. For the 2005 reviews, DHS conducted a 1-day  training seminar to explain the objectives of the visit and share  information about the countries to the site visit teams, including findings  from prior country assessments. Additionally, the team members met prior  to conducting the site visits, and reconvened upon returning to  Washington, D.C., to ensure consensus on their report on the site visit.  However, the 2005 country review process still lacked consistency and  transparency. In particular, DHS has not finalized its operating procedures  for site visits. The site visit teams traveled to the remaining two countries  in August and September 2005; however, as of June 2006, DHS had neither  updated the interagency working group team members on the status of the  reviews of Italy and Portugal, nor provided them with a timeline for  proceeding with the review. Furthermore, stakeholders continued to  express concern about DHS’s lack of communication about the process  and the findings, and no changes have been made to the review process  that would make the final report to Congress timely. Therefore, there are  no assurances that the next biennial assessment round will proceed more  quickly than the previous round.
section_title: DHS Cannot Effectively Monitor Ongoing Concerns in Visa Waiver Countries
paragraphs: DHS cannot effectively monitor the law enforcement and security risks  posed by visa waiver countries on a consistent, ongoing basis because it  has not provided OIE with adequate staffing and resources. Furthermore,  we found weaknesses in communication between DHS and overseas posts  and other agencies.
subsections: section_title: Lack of Staffing and Funding Impedes Ability to Assess Risks
paragraphs: OIE is limited in its ability to achieve its mission because of insufficient  staffing and funding. The office has numerous responsibilities, including    conducting the mandated biennial country reviews;    monitoring law enforcement, security, and immigration concerns in visa  waiver countries on an ongoing basis;   working with countries seeking to become members of the Visa Waiver    briefing foreign government representatives from participating visa waiver  countries, as well as those countries that are seeking admission into the  program, on issues related to program membership.
In 2004, the DHS OIG found that OIE’s lack of resources directly undercut  its ability to assess a security problem inherent in the program—lost and  stolen passports. The office received funding to conduct the country  reviews in 2004 and 2005; however, OIE officials indicated that a lack of  funding and full-time staff has made it extremely difficult to conduct  additional overseas fieldwork, as well as track ongoing issues of concern  in the 27 visa waiver countries—a key limitation in DHS’s ability to assess  and mitigate the program’s risks. According to OIE officials, the unit  developed a strategic plan to monitor the program, but has been unable to  implement its plan with its current staffing. As of June 2006, the office was  staffed with two full-time employees, as well as one temporary employee  from another DHS component. Moreover, OIE does not have a separate  budget, but must request funds (for example, to conduct travel related to  the Visa Waiver Program) from the Office of Policy Development. In  addition, program officials stated that they have paid for their own office  supplies using their personal savings due to funding constraints. Without  adequate resources, OIE is unable to monitor and assess participating  countries’ compliance with the Visa Waiver Program’s statutory  requirements.
section_title: Gaps in DHS’s Communications with its Overseas Posts and Other Agencies
paragraphs: DHS has not clearly communicated its mission to stakeholders at overseas  posts, nor identified points of contact within U.S. embassies, so it can  communicate directly with field officials positioned to monitor countries’  compliance with Visa Waiver Program requirements and report on current  events and issues of potential concern. In particular, within DHS’s various  components, we found that OIE is largely an unknown entity and,  therefore, is unable to leverage the expertise of DHS officials overseas.  Specifically, only 3 of the 15 DHS field officials with whom we spoke in the  six visa waiver countries we visited were aware of the Visa Waiver  Program Oversight Unit and its mission. A senior DHS representative at  one post showed us that her organizational directory did not contain  contact information for OIE. In addition, an official from the Immigration  and Customs Enforcement’s Office of International Affairs acknowledged  that DHS needs a better communication plan for the Visa Waiver Program.  He stated that DHS had not prioritized the workload for all its officials  overseas, including their role in overseeing the Visa Waiver Program; he  also told us that OIE had not yet articulated what information it needed,  designated a mechanism to share that information, or gained agency-wide  acceptance of procedures for monitoring the compliance of visa waiver  countries. In fact, a senior DHS official in Washington, D.C., told us that he  may find out about developments—either routine or emergent—in visa  waiver countries by “happenstance.” Without an outreach strategy, DHS is  not able to leverage its existing resources at U.S. embassies in all visa  waiver countries.
Furthermore, key stakeholders, who are in a position to influence and  monitor visa waiver countries’ compliance with the program’s  requirements, were not informed of the major findings of the country  assessments. In fact, at the time of our visits, ambassadors or deputy  chiefs of mission in each of the six posts told us that they were not fully  aware of the extent to which the country assessments discussed law  enforcement and security concerns posed by the continued participation  of the country in the program. The Deputy Chief of Mission at one post  stated that without the appropriate information, such as was contained in  the assessments, embassy officials could not be effective agents for the  U.S. government with regard to these issues. Bureau of Consular Affairs  officials in Washington, D.C., agreed that any concerns identified in the  assessments should be brought to the attention of the embassy, so that the  posts can address the concerns accordingly. Due to the lack of outreach  and clear communication about its mission, OIE is limited in its ability to  monitor the day-to-day law enforcement and security concerns posed by  the Visa Waiver Program, and the U.S. government is limited in its ability  to influence visa waiver countries’ progress in meeting requirements.
We also found gaps in interagency communication. According to OIE,  State plays a significant role in conveying information relevant to the Visa  Waiver Program to U.S. embassy officials and their host government  counterparts. Therefore, it is important that State and DHS have clear lines  of communication. For example, in October 2005, one government  expressed willingness to share data on lost and stolen issued passports  with the United States, and asked for technical specifications on how to do  so. However, at the time of our February 2006 visit, the post in that  country had not received direction from headquarters on how this  passport information should be shared. Moreover, OIE officials told us  that they were unaware that this country was willing to share this data  until we brought it to their attention in early March 2006. As a result, the  United States missed opportunities to potentially deter the fraudulent use  of passports from this country, which in fact has the highest rate of misuse  among all visa waiver countries, according to DHS. Additionally, a senior  consular official in another participating country expressed frustration  that DHS had not fully explained to embassy officials why visa waiver  countries needed to report lost and stolen passport information directly to  the United States and Interpol, which maintains a global database of lost  and stolen travel documents. Several other senior consular officials also  expressed the need for more information about OIE’s mission and goals,  as well as the desired role for overseas posts.
section_title: DHS Faces Difficulties in Mitigating Program Risks
paragraphs: DHS has taken some actions to mitigate the risks of the Visa Waiver  Program, such as terminating the use of the German temporary passport  for travel under the program. Since 2002, the law has required the timely  reporting of passport thefts for continued participating in the Visa Waiver  Program, but DHS has not established and communicated time frames and  operating procedures to participating countries. In addition, DHS has  sought to expand this requirement to include the reporting of data, to the  United States and Interpol, on lost and stolen issued passports; however,  participating countries are resisting these requirements, and DHS has not  yet issued guidance on what information must be shared, with whom, and  within what time frame. Furthermore, U.S. border inspectors are unable to  automatically access Interpol’s data on reported lost and stolen passports,  which makes it more difficult to detect reported lost or stolen passports at  U.S. ports of entry.
subsections: section_title: DHS Has Taken Some Actions to Mitigate Risks of the Visa Waiver Program
paragraphs: As previously mentioned, during the 2004 assessment process, the working  group identified security concerns in several participating countries, and  DHS took actions to mitigate some of these risks. For example, DHS  determined that several thousand blank German temporary passports had  been lost or stolen, and that Germany had not reported some of this  information to the United States. In March 2005, at the working group’s  request, the U.S. embassy in Berlin conveyed these concerns to the  German government to seek a solution. In March 2006, DHS determined  that sufficient progress had not been made to address the concern over  German temporary passports, and, as of May 1, 2006, German temporary  passport holders are not allowed to travel to the United States under the  Visa Waiver Program without a visa.
DHS has also made some progress in enforcing new passport security  measures. For example, DHS has enforced an October 26, 2005, deadline  requiring travelers under the Visa Waiver Program to have digital  photographs in their passports. Specifically, Italian and French citizens  with noncompliant passports issued after October 26, 2005, must first  obtain a visa before traveling to the United States because these countries  did not meet the deadline. Furthermore, as previously mentioned, by  October 26, 2006, visa waiver travelers must have e-passports for travel  under the program. E-passports aim to enhance the security of travel  documents, making it more difficult for imposters or inadmissible aliens to  misuse the passport to gain entry into the United States. DHS and State  officials told us that nearly all 27 participating countries report that they  are on schedule to meet this deadline. According to US-VISIT, DHS will  deploy machines to read the e-passports at 33 airports by the October 2006  deadline, covering about 98 percent of all visa waiver travelers. While US- VISIT intends to deploy e-passport readers to all ports of entry in the  future, it has not articulated clear timeframes to do so. Therefore, until  this is achieved, it will not be possible for DHS to read the information on  the chips embedded in the passports for the remaining ports of entry.
section_title: DHS Lacks Standard Procedures for Obtaining Stolen Blank Passport Data
paragraphs: A key risk in the Visa Waiver Program is stolen blank passports from visa  waiver countries, because detecting these passports at U.S. ports of entry  is extremely difficult, according to DHS. Some thefts of blank passports  have not been reported to the United States until years after the fact,  according to DHS intelligence reports. For example, in 2004, a visa waiver  country reported the theft of nearly 300 stolen blank passports to the  United States—more than 9 years after the theft occurred. In addition, in  2004, a visa waiver country reported the theft of 270 blank passports more  than 8 months after the theft occurred. The 2002 Enhanced Security and  Visa Entry Reform Act provides that the Secretary of Homeland Security  must terminate a country from the Visa Waiver Program if he and the  Secretary of State jointly determine that the country is not reporting the  theft of its blank passports to the United States on a timely basis. DHS and  State have chosen not to terminate from the program countries that have  failed to report these incidents.
DHS officials told us that the inherent political, economic, and diplomatic  implications associated with removing a country from the Visa Waiver  Program make it difficult to enforce the statutory requirement in the  broadest terms. Moreover, DHS has not established time frames or  operating procedures to enforce this requirement. In April 2004, the DHS  OIG recommended that the then-Under Secretary for Border and  Transportation Security, in coordination with State, develop standard  operating procedures for the routine and proactive collection of stolen  passport information from host governments for dissemination to U.S.  agencies. While the statute requires visa waiver countries to certify that  they report information on the theft of their blank passports to the United  States on a timely basis, as of June 2006, DHS has not defined what  constitutes “timely.” Moreover, the United States lacks a centralized  mechanism for foreign governments to report all stolen passports. In  particular, DHS has not defined to whom in the U.S. government  participating countries should report this information.
section_title: Some Participating Visa Waiver Program Countries Are Resisting Additional Reporting to United States and Interpol
paragraphs: In addition to blank passports, lost or stolen issued passports also pose a  risk because they can be altered. In June 2005, DHS issued guidance to  participating Visa Waiver Program countries requiring that they certify  their intent to report lost and stolen passport data on issued passports by  August 2005. However, DHS has not yet issued guidance on what  information must be shared, with whom, and within what time frame.  Some visa waiver countries have not yet agreed to provide this  information to the United States, due in part to concerns over the privacy  of their citizens’ biographical information. In addition, several consular  officials expressed confusion about the current and impending  requirements about sharing this data, and felt they were unable to  adequately explain the requirements to their foreign counterparts.
In June 2005, the U.S. government also announced its intention to require  visa waiver countries to certify their intent to report information on both  lost and stolen blank and issued passports to Interpol. In 2002, Interpol  developed a database of lost and stolen travel documents to which its  member countries may contribute on a voluntary basis. The United States  has endorsed Interpol’s database, and, since May 2004, State has been  contributing U.S. data from lost and stolen blank passports to it. In 2005,  State reported to Congress that it also instructed all U.S. embassies and  consulates to take every opportunity to persuade host governments to  share this data with Interpol. While most visa waiver countries use and  contribute to Interpol’s database, four do not. Moreover, some countries  that do contribute do not do so on a regular basis, according to Interpol  officials. Interpol stated that it continues to encourage countries to send  this information more systematically. In addition, participating countries  have expressed concerns about reporting this information, citing privacy  issues; however, Interpol’s database on lost and stolen travel documents  does not include the passport bearers’ biographical information, such as  name and date of birth. According to the Secretary General of Interpol, in  light of the high value associated with passports from visa waiver  countries, it is a priority for his agency to encourage these countries to  contribute to the database.
section_title: Inefficient Access to Interpol’s Database on Lost and Stolen Passports
paragraphs: Though information from Interpol’s database could potentially stop  inadmissible travelers from entering the United States, CBP’s border  inspectors do not have automatic access to the database at primary  inspection at U.S. ports of entry—the first line of defense against those  who might exploit the Visa Waiver Program to enter the United States. The  inspection process at U.S. ports of entry can include two stages—a  primary and secondary inspection. If, during the primary inspection, the  inspector suspects that the traveler is inadmissible either because of a  fraudulent passport or other reason, the inspector refers the traveler to  secondary inspection. At secondary inspection, border inspectors can  contact officials at the National Targeting Center, who can query Interpol’s  stolen-travel-document database to determine if the traveler is attempting  to enter the United States with a passport that had been previously  reported lost or stolen, but is not yet on CBP’s watch list (see fig. 5).  However, Interpol’s data on lost and stolen travel documents is not  automatically accessible to border inspectors at primary inspection—one  reason why it is not currently an effective border screening tool, according  to DHS, State, and Justice officials. According to the Secretary General of  Interpol, until DHS can automatically query Interpol’s data, the United  States will not have an effective screening tool for checking passports.
According to Interpol officials, the United States is working actively with  Interpol on a potential pilot project that would allow for an automatic  query of aliens’ passport data against Interpol’s database at primary  inspection at U.S. ports of entry. However, DHS has not yet finalized a plan  to do so. In December 2005, Interpol began a similar program at all border  stations in Switzerland. Through this program, Swiss border agents query  Interpol’s database as soon as travelers appear at a border station.  According to the Secretary General of Interpol, in a 2-month period,  Switzerland encountered 282 potential instances of travelers attempting to  enter the country with a previously reported lost or stolen passport. In  addition, during this time frame, Swiss border agents queried Interpol’s  database more than all other member countries combined because it was  the only country accessing the database automatically.
In commenting on a draft of this report, Justice’s Interpol-U.S. National  Central Bureau stated that from April through June 2006, Justice, CBP’s  National Targeting Center, and Interpol compared records from certain  passengers arriving in the United States against Interpol’s lost and stolen  travel document database. According to the National Central Bureau, the  test’s objectives were to simulate an automatic query of passenger records  against Interpol’s database and analyze discrepancies between that  database and U.S. watch lists. The National Central Bureau stated that, by  early August 2006, it and the National Targeting Center will finalize a  report on this test to help facilitate a pilot program for real-time,  systematic queries of passenger records against Interpol’s data at U.S.  ports of entry.
section_title: Conclusions
paragraphs: The Visa Waiver Program aims to facilitate international travel for millions  of people each year and promote the effective use of government  resources. Effective oversight of the program entails balancing these  benefits against the program’s potential risks. To find this balance, the U.S.  government needs to fully identify the vulnerabilities posed by visa waiver  travelers, and be in a position to mitigate them. However, we found  weaknesses in the process by which the U.S. government assesses these  risks, and DHS’s Visa Waiver Program Oversight Unit is not able to manage  the program with its current resource levels. Moreover, DHS has not  communicated clear reporting requirements for lost and stolen  passports—a key risk—nor can it automatically access all stolen passport  information when it is most needed—namely, at the primary inspection  point at U.S. points of entry. It is imperative that DHS commit to  strengthen its ability to promptly identify and mitigate risks to ensure that  the Visa Waiver Program does not jeopardize U.S. security interests.
section_title: Recommendations
paragraphs: To improve the U.S. government’s process for assessing risks in the Visa  Waiver Program, we recommend that the Secretary of Homeland Security,  in coordination with State and other appropriate agencies, take the  following five actions:    Provide additional resources to strengthen OIE’s visa waiver monitoring  unit.
Finalize clear, consistent, and transparent protocols for the biennial  country assessments and provide these protocols to stakeholders at  relevant agencies at headquarters and overseas. These protocols should  provide timelines for the entire assessment process, including the role of a  site visit, an explanation of the clearance process, and deadlines for  completion.
Create real-time monitoring arrangements, including the identification of  visa-waiver points of contact at U.S. embassies, for all 27 participating  countries; and establish protocols, in coordination with appropriate  headquarters offices, for direct communication between points of contact  at overseas posts and OIE’s Visa Waiver Program Oversight Unit.
Require periodic updates from points of contact at posts in countries  where there are law enforcement or security concerns relevant to the Visa  Waiver Program.
Provide complete copies of the most recent country assessments to  relevant stakeholders in headquarters and overseas posts.
To improve the U.S. government’s process for mitigating the risks in the  Visa Waiver Program, we recommend that the Secretary of Homeland  Security, in coordination with State and other appropriate agencies, take  the following three actions:    Require that all visa waiver countries provide the United States and  Interpol with non-biographical data from lost or stolen issued passports,  as well as from blank passports.
Develop and communicate clear standard operating procedures for the  reporting of lost and stolen blank and issued passport data, including a  definition of timely reporting and to whom in the U.S. government  countries should report.
Develop and implement a plan to make Interpol’s stolen travel document  database automatically available during primary inspection at U.S. ports of  entry.
section_title: Matter for Congressional Consideration
paragraphs: The May 2002 Enhanced Border Security and Visa Entry Reform Act  mandated DHS to conduct country assessments of the effect on U.S. law  enforcement and security interests of each country’s continued  participation in the Visa Waiver Program at least every 2 years. Given the  lengthy time it took for DHS to issue the November 2005 summary report  to Congress, and to ensure future reports contain timely information when  issued, Congress should consider establishing a biennial deadline by  which DHS must complete the country assessments and report to  Congress.
section_title: Agency Comments and Our Evaluation
paragraphs: DHS, State, and Interpol provided written comments on a draft of this  report (see apps. IV, V, and VI). DHS, State, Interpol, and Justice’s Interpol- U.S. National Central Bureau provided technical comments, which we  incorporated into the report, as appropriate.
DHS either agreed with, or stated that it is considering, all of our  recommendations. Regarding our matter for congressional consideration,  DHS did not appear to support the establishment of a deadline for the  biennial report to Congress. Instead, DHS suggested that Congress should  require continuous and ongoing evaluation. With continuous review, DHS  stated that it would be able to constantly evaluate U.S. interests and report  to Congress on the current 2-year reporting cycle on targeted issues of  concern, rather than providing a historical evaluation. We agree that  continuous and ongoing evaluation is necessary, and that is why we  recommended that DHS create real-time monitoring arrangements and  provide additional resources to the Visa Waiver Program Oversight Unit to  achieve this goal. Regarding the mandated biennial country assessments,  we believe that they can serve a useful purpose if they are completed in a  timely fashion. In addition, DHS provided information on actions that it  has taken to improve the management of the biennial country assessment  process.
State agreed that efforts by U.S. embassies and consulates to monitor and  assess the Visa Waiver Program would benefit from enhanced  communication to and from DHS, and endorsed our recommendation that  DHS provide more information to these stakeholders on Visa Waiver  Program issues. In addition, State acknowledged the risk of misuse of  previously lost or stolen passports, particularly by persons who are not  eligible for a visa. With regard to timely reporting on lost and stolen  passports, State welcomed our recommendation calling for clear  guidelines and reporting mechanisms to achieve this goal.
Interpol provided information about its lost and stolen travel document  database and tools that it has developed to allow law enforcement officers  to instantly check this database at airports and other border entry points.   In addition, Interpol noted that many developing countries lack the  resources necessary to implement these tools.  Therefore, Interpol urged  the United States and other countries to provide funding to facilitate  access for all countries to its lost and stolen travel document database. It  also provided its views on the risks associated with lost and stolen  passports.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will provide copies of this report to the  Secretaries of State and Homeland Security, as well as the Attorney  General and the Secretary General of Interpol. We will also make copies  available to others upon request.
In addition, this report will be available at no charge on the GAO Web site  at http://www.gao.gov. If you or your staff have any questions about this  report, please contact me at (202) 512-4128 or fordj@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. GAO staff who made major  contributions to this report are listed in appendix VII.
section_title: Appendix I: Scope and Methodology
paragraphs: To describe the benefits of the Visa Waiver Program, we reviewed relevant  documentation, including Office of Inspector General (OIG) reports and  our 2002 report on the implications of eliminating the program. We also  interviewed political, economic, consular, commercial, and law  enforcement officials at U.S. embassies overseas to discuss the advantages  of the program for U.S. business and tourism. To describe the risks in the  Visa Waiver Program, we examined documentation on the screening  process at U.S. ports of entry for travelers from Visa Waiver Program  countries. In addition, we analyzed data from Customs and Border  Protection (CBP) on interceptions of fraudulent, lost, or stolen passports  from participating countries. We also observed fraudulent document  detection training of CBP agents at the Federal Law Enforcement Training  Center and spoke with training officials regarding the difficulty in  detecting fraudulent passports. We also interviewed officials from the  Department of Homeland Security’s (DHS) National Targeting Center,  Intelligence and Analysis Directorate, and Forensic Document Laboratory  on the risks posed by Visa Waiver Program travelers.
In particular, we analyzed data on the number of nonimmigrants that  entered the United States under the Visa Waiver Program from fiscal years  2002 though 2004. While we did not fully assess the reliability of these  statistics because we used them for background purposes, we conducted  interviews and obtained other corroborating evidence that confirmed the  importance of the Visa Waiver Program in terms of the broad numbers of  admissions to the United States in recent years.
Regarding DHS’s data on fraudulent passports, DHS reported that these  data are limited to those cases in which the fraudulent document from the  Visa Waiver Program country was intercepted at a port of entry, and do  not include instances when fraudulent passports were used to enter the  United States but were not detected. While we could not fully assess the  reliability of the data, we found them sufficiently reliable to establish that  hundreds of fraudulent documents from a broad range of Visa Waiver  Program countries were intercepted in 2005. In addition, the number of  documents that DHS reports by country is not necessarily indicative of the  extent of the problem in that country, as these data only cover instances  when fraudulent documents were intercepted.
To evaluate the U.S. government’s efforts to assess and mitigate these  risks, we analyzed the laws governing the program, relevant agency  operating procedures, and DHS OIG reports. We also examined 15 of the  25 completed reports assessing the participation of Visa Waiver Program  countries. As of June 2006, the remaining 10 assessments were pending  classification review by DHS’s Office of International Enforcement. These  assessments contained, among other things, detailed analyses of an  individual country’s    political, social, and economic conditions;    security over its passport and national identity documents;  immigration and nationality laws, law enforcement policies and practices,  and other matters relevant to law enforcement, immigration, and national  security;   patterns of passport fraud, visa fraud, and visa abuse;    assessments of terrorism, by the country’s nationals, within or outside the    evaluations of the impact of the country’s participation in the Visa Waiver  Program on U.S. national security and law enforcement.
To discuss these assessments and actions taken in response to their  findings, we met with officials from several DHS component agencies and  offices, the Department of State’s Bureau of Consular Affairs and its  Europe and Eurasia Bureau, and the International Criminal Police  Organization (Interpol) in Lyon, France. In addition, we met with officials  from the Department of Justice’s U.S. National Central Bureau in  Washington, D.C., which facilitates international law enforcement  cooperation among the United States and Interpol and its other member  countries. We also spoke with U.S. Embassy officials in six Visa Waiver  Program countries, as well as foreign government officials in three of  these countries. During these visits, we observed visa operations and  interviewed embassy management, consular staff, and representatives  from law enforcement agencies regarding their roles and responsibilities  in overseeing the Visa Waiver Program.
We conducted our evaluation from September 2005 through June 2006 in  accordance with generally accepted government auditing standards.
section_title: Appendix II: Map of Visa Waiver Program Countries
subsections: section_title: The Netherlands
section_title: Appendix III: Foreign Nationals Admitted under the Visa Waiver Program, Fiscal Years 2002 through 2004
section_title: Appendix IV: Comments from the Department of Homeland Security
subsections: section_title: GAO Comments
paragraphs: 1.  We understand that DHS’s organizational structure changed during the  2004 review process. To avoid confusion regarding the DHS units that  had some involvement in this process, we have replaced references to  the Office of International Enforcement (OIE) with DHS, as  appropriate.   2.  Our review focused on the 2004 biennial review process for 25 of the  27 Visa Waiver Program countries. We agree that DHS has taken some  steps to improve the 2005 process for Italy and Portugal, whose  reviews are still in process, and we discuss these improvements in our  report. However, we disagree that DHS has corrected most of the  problems associated with the 2004 review process. As we note in our  report, as of June 2006, DHS had neither updated the interagency  working group team members on the status of the reviews of Italy and  Portugal, nor provided them with a timeline for proceeding with the  review. Furthermore, stakeholders continued to express concern  about DHS’s lack of communication about the process and the  findings. Therefore, we recommended that DHS finalize clear,  consistent, and transparent protocols for biennial country assessments  and provide these protocols to stakeholders at relevant agencies at  headquarters and overseas.    3.  We did not intend to suggest that the evaluation of U.S. security and  law enforcement interests needed to be conducted or finalized during  the in-country site visits. Our point is that important events may take  place while the country assessments are in the clearance process. We  believe that DHS should update the country assessments to reflect  these events, such as large scale thefts of blank passports like the May  2005 theft that we noted in our report, to ensure that Congress has a  comprehensive analysis of the current law enforcement and security  risks posed by each country.  4.  We agree that DHS cannot continue to incorporate data indefinitely  into the country assessments. However, as we reported, the teams  collecting information about the visa waiver countries’ risks in 2004  used, in some cases, information from 2 years prior; by the time the  summary report was issued in November 2005, some of the data was  more than 3 years old. Indeed, as DHS noted elsewhere, the 2004  country assessments provided a “rearview mirror” and “backward- looking” evaluation. Thus, the assessments may not necessarily have  contained the best information available at the time the assessments  were finalized. Given the lengthy time it took for DHS to issue the  November 2005 summary report to Congress, and to ensure future  reports contain timely information when issued, we believe that  Congress should consider establishing a biennial deadline by which  DHS must complete the country assessments and report to Congress.    5.  We agree that continuous and ongoing evaluations of Visa Waiver  Program countries are needed and recommended that DHS create real- time monitoring arrangements and provide additional resources to the  Visa Waiver Program Oversight Unit to achieve this goal. However, as  long as DHS is required to report biennially to Congress, DHS should  ensure that future reviews are conducted in a timely fashion. Based on  our review of the 2004 country assessment process, the assessments  may not necessarily have contained the best information available at  the time the assessments were finalized given the lengthy time it took  for DHS to finalize its reviews.  6.  We agree that it is in the U.S. government’s best interest to engage with  countries on global concerns identified during the course of the  country assessment process. It is not our intention to inhibit this kind  of consultation. Furthermore, we acknowledge that a consultative  process may involve tradeoffs between timely reporting and complete  information gathering and analysis. Our concern is that key  stakeholders in headquarters and at overseas posts, as well as  members of the in-country site visit teams, expressed concerns about  their roles in the 2004 country assessment process, and stated that  they had not received enough detail from DHS about the process and  the findings. Thus, we recommended that DHS provide transparent  protocols to all stakeholders that provide timelines for the entire  assessment process, including the role of a site visit, an explanation of  the clearance process, and deadlines for completion. We believe it is  important that DHS finalize its standard operating procedures, and  share these procedures with relevant stakeholders at headquarters and  overseas. As we noted in our report, due to the lack of outreach and  clear communication about its mission, OIE is limited in its ability to  monitor the day-to-day law enforcement and security concerns posed  by the Visa Waiver Program, and the U.S. government is limited in its  ability to influence visa waiver countries’ progress in meeting  requirements.  7.  We strongly agree that classified and sensitive information should be  protected. However, we also believe that cleared U.S. officials at  overseas posts in Visa Waiver Program countries, including  ambassadors and deputy chiefs of mission, have a need to know the  extent to which law enforcement and security concerns were  identified during the mandated biennial reviews, and should receive  copies of the final country assessments. Without the appropriate  information, such as was contained in the assessments, embassy  officials can not be effective agents for the U.S. government with  regard to these issues. We believe that the establishment of a classified  sharing system that allows U.S. government agencies to access the  country assessments is a positive step.
section_title: Appendix V: Comments from the Department of State
section_title: Appendix VI: Comments from the International Criminal Police Organization
section_title: Appendix VII: GAO Contact and Staff Acknowledgments
paragraphs: Jess T. Ford, (202) 512-4128 or fordj@gao.gov.
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, John Brummet, Assistant  Director; Kathryn H. Bernet, Joseph C. Brown, Joseph Carney, Richard  Hung, Jane S. Kim, Mary Moutsos, and Jena Sinkfield made key  contributions to this report.