The VWP was established as a pilot program, with two participating countries, in November 1986 and became a permanent program in October 2000. The program allows eligible nationals from the 38 VWP countries to travel to the United States for 90 days or less for business or pleasure without a visa and requires that VWP countries extend reciprocal privileges to U.S. citizens. Additionally, the VWP makes it possible for State to allocate more resources to visa-issuing posts in countries with higher-risk applicant pools. In fiscal year 2013, there were nearly 20 million traveler admissions to the United States under the VWP, with admissions from each of the 38 countries ranging from about 700 to more than 4 million (see fig. 1). In August 2008, responding to a requirement in the Implementing Recommendations of the 9/11 Commission Act of 2007, DHS’s U.S. Customs and Border Protection (CBP) introduced the Electronic System for Travel Authorization (ESTA). In 2009, CBP began requiring all travelers arriving by air or sea under the VWP to, among other things, submit an application through ESTA before departure. VWP travelers are also required to possess a passport containing an electronic chip (e- passport) issued by the VWP country. Before a traveler can depart for the United States under the VWP, CBP vets the traveler’s ESTA application against several databases. These databases include, among others, the Federal Bureau of Investigation’s (FBI) Terrorist Screening Database—the U.S. government’s consolidated watch list of known or suspected terrorists—and the International Criminal Police Organization’s (INTERPOL) Stolen and Lost Travel Documents database. If CBP approves an ESTA application, the VWP traveler is authorized to depart for the United States. If CBP denies an ESTA application, CBP refers the traveler to the U.S. embassy or consulate to complete the standard visa application process. This process includes submitting an application and being interviewed, fingerprinted, and vetted against the FBI’s Terrorist Screening Database and INTERPOL’s Stolen and Lost Travel Documents database, among others, before travel to the United States. At U.S. ports of entry, CBP interviews, fingerprints, and photographs VWP travelers arriving by air or sea with an approved ESTA as well as travelers with a U.S. visa and vets the fingerprints against biometrics databases. In November 2014, DHS revised the ESTA application to address concerns that foreign terrorist fighters might exploit the VWP to enter the United States. The revised application requires additional passport data, contact information, information about connections to U.S. persons, and any other names or aliases. According to DHS documents, DHS determined that these revisions would improve its ability to vet prospective VWP travelers and to more accurately and effectively identify those who pose a security risk to U.S. interests. DHS also rephrased questions in the ESTA application to make them easier for the general public to understand. In response to the Implementing Recommendations of the 9/11 Commission Act of 2007, DHS worked with interagency partners to develop several requirements to help prevent terrorists from using the VWP to travel to the United States, according to DHS officials. To continue participating in the program, each VWP country must, among other things, accept repatriation of any citizens, former citizens, and nationals ordered removed from the United States within 3 weeks of the final order of removal. In addition, since before the 2007 act, VWP countries have been required to extend reciprocal visa-free travel to U.S. citizens and issue machine-readable passports. Further, the U.S. government requires each country to enter into a 1. Lost and Stolen Passport (LASP) agreement to report information about the theft or loss of passports, 2. Homeland Security Presidential Directive 6 (HSPD-6) arrangement to share watch list information about known or suspected terrorists, and 3. Preventing and Combating Serious Crime (PCSC) agreement to establish frameworks for enhanced law enforcement cooperation, including sharing of criminal history information. As of December 2015, all VWP countries are also required by law to, among other things, fully implement their agreements to share information on whether their citizens and nationals traveling to the United States represent a threat to the security or welfare of the United States or its citizens. Under existing law, a number of factors can result in a VWP country’s termination or suspension from the program. DHS is required to terminate a country’s VWP designation if the country (1) experiences an emergency that the DHS Secretary, in consultation with the Secretary of State, determines to be a threat to the law enforcement or security interests of the United States, including interests in enforcing U.S. immigration laws; (2) does not report the theft or loss of passports, as jointly determined by DHS and State; or (3) does not share required passenger information. In addition, DHS may place on probationary status or, in certain circumstances, terminate the designation of any VWP country if, following certain criteria, more than 2 percent of the country’s nationals who applied for admission as nonimmigrant visitors to the United States during the previous fiscal year were denied admission, withdrew their application for admission, or were admitted as nonimmigrant visitors and violated the terms of admission. In consultation with State, DHS also may for any reason—including national security—rescind any waiver or designation previously granted at any time or may refrain from waiving the visa requirement for nationals of any country that may otherwise qualify for designation. In addition, DHS may terminate a VWP country’s designation if, in consultation with State, DHS determines through its biennial evaluation that a country’s participation is inconsistent with the law enforcement and security interests of the United States, including U.S. interests in enforcing immigration laws and securing criminal extraditions. Further, in consultation with State, DHS may suspend a VWP country’s designation if the Director of National Intelligence informs the Secretary of Homeland Security of any current and credible threat of an imminent danger to the United States or its citizens that originates from a VWP country. Under U.S. law, DHS is required to periodically evaluate VWP countries and report its findings to Congress. In particular, DHS, in consultation with State, must perform the following at least once every 2 years: Evaluate the effect of each VWP country’s continued participation in the program on U.S. law enforcement and national security interests (including immigration enforcement interests). Determine, based on the evaluation conducted, whether each VWP country’s participation in the program should be continued or terminated. Submit a written report to appropriate congressional committees, including the Secretary’s determination with an explanation of any effects of each VWP country’s continued participation in the program on U.S. law enforcement and security interests. Submit a written report to Congress regarding the implementation of the electronic system for travel authorization. Within DHS, the Visa Waiver Program Office (VWPO) is responsible for overseeing and monitoring VWP countries’ adherence to the program’s statutory and policy requirements. VWPO’s responsibilities include evaluating the effects of VWP countries’ participation in the program, preparing the Secretary of Homeland Security’s determinations to continue or terminate VWP countries’ participation, and submitting the written reports to Congress. According to VWPO officials, the office also monitors VWP country security, law enforcement, and immigration enforcement issues outside the formal review periods to identify issues that could negatively affect U.S. interests. In addition, the DHS Office of Intelligence and Analysis produces an independent intelligence review of each VWP country, examining threats associated with the country’s participation in the VWP, the country’s counterterrorism capabilities, and the country’s information sharing with the United States about terrorist threats, according to officials from that office. All 38 countries participating in the VWP have entered into the three types of required information-sharing agreements, or their equivalents, with the United States, but not all countries are sharing information through two of the agreements. According to DHS, all VWP countries are reporting losses or thefts of passports through LASP agreements, although DHS previously placed two countries on provisional status partly because of a lack of timely reporting. However, as of December 2015, about a third of VWP countries were not sharing identity information about known or suspected terrorists through HSPD-6 arrangements. Also, about a third of VWP countries had not yet shared criminal history information through PCSC agreements. Although U.S. agencies receive law enforcement and national security information from VWP countries through other means, such as multilateral entities, the U.S. government identified the information-sharing agreements as critical for protecting the United States from nationals of VWP countries who might present a threat. While U.S. law before December 2015 required VWP countries to enter into, but not to implement, the agreements, DHS announced in August 2015 that it had developed a new requirement that countries implement them by sharing information. However, contrary to standard program management practices, DHS has not specified time frames for working with VWP countries to institute this and other new VWP security requirements. All 38 VWP countries have entered into LASP agreements with the United States and, according to DHS officials, are reporting lost or stolen passports through the agreements. Before December 2015, U.S. law required that VWP countries enter into an agreement with the United States to report, or to make available to the U.S. government through INTERPOL or other means designated by the Secretary of Homeland Security, information about the theft or loss of passports within a strict time limit and in a manner specified in the agreement. Since December 2015, U.S. law has required that countries agree to report on lost and stolen passports not later than 24 hours after becoming aware of the theft or loss. Of the 38 countries, 35 agreed to report lost or stolen travel documents exclusively through INTERPOL and in accordance with INTERPOL standards. According to DHS officials, 2 of the remaining countries agreed to report through the Regional Movement Alert System, an alternative mechanism for reporting LASP information that provides a direct query capability between national document-issuing authorities and border control systems; the third country agreed to report through another means. According to VWPO officials, VWPO considers all VWP countries to be in compliance with the requirement to report lost and stolen passports. VWPO officials noted that VWPO bases its compliance determinations in part on data from INTERPOL’s Stolen and Lost Travel Documents database that are available to VWPO and other U.S. agencies. DHS and State use information about lost and stolen passports to vet travelers to the United States. DHS’s CBP uses information obtained through the LASP agreements to vet foreign travelers attempting to enter the United States, which, according to CBP and DOJ documents, may help counter the threat of foreign terrorist fighters. CBP and State use this information to vet travelers’ ESTA applications and visa applications before travel, and CBP uses it to vet foreign passports of all travelers before boarding and at U.S. ports of entry. According to testimony by the DHS Deputy Assistant Secretary for International Affairs, CBP has denied over 165,000 ESTA applications since 2008 on the basis of LASP information, potentially preventing criminals or terrorists from using stolen passports to illegally enter the United States. In 2013, U.S. agencies— primarily DHS—queried INTERPOL’s Stolen and Lost Travel Documents database over 238 million times. All VWP countries have entered into HSPD-6 or equivalent arrangements to exchange information with the United States about known or suspected terrorists, but not all countries are sharing information through these arrangements. U.S. law requires that each VWP country enter into an agreement with the United States to share information regarding whether the country’s citizens and nationals traveling to the United States represent a threat to the security or welfare of the United States or its citizens. Since December 2015, U.S. law has also required that VWP countries fully implement these agreements. State’s Bureau of Counterterrorism and the FBI’s Terrorist Screening Center (TSC) negotiate HSPD-6 arrangements between the U.S. government and VWP countries. Under the arrangements, VWP countries share information directly with the TSC, which then integrates the information into the U.S. terrorist watch list. As of December 2015, most VWP countries were exchanging information about known or suspected terrorists with the TSC through HSPD-6 arrangements, but about a third of VWP countries were not exchanging information directly with the TSC. The TSC reported in December 2015 that the number of known or suspected terrorist identities that each VWP country had shared with the TSC through HSPD-6 arrangements ranged from zero to over 1,000. For example, one country that entered into a HSPD-6 arrangement in 2012 had not shared information through the arrangement as of December 2015. According to DHS officials, some countries share information about known or suspected terrorists with U.S. agencies through alternative arrangements rather than sharing directly with the TSC. Information provided through the HSPD-6 arrangements has enhanced U.S. traveler-screening capabilities and improved U.S. agencies’ ability to prevent known and suspected terrorists from traveling to the United States. According to FBI documents, from 2008 through 2015, the TSC received information about approximately 9,000 known or suspected terrorists, including approximately 3,500 who were previously unidentified, through HSPD-6 arrangements with VWP countries. The FBI integrates into the Terrorist Screening Database the information that VWP countries provide to the TSC, and U.S. agencies reported using the database to vet travelers attempting to enter the United States. CBP vets ESTA applications against the Terrorist Screening Database to identify any potential known or suspected terrorists attempting to use the VWP to travel to the United States. According to the DHS Deputy Assistant Secretary for International Affairs, since 2008, CBP has denied over 4,300 ESTA applications for national security concerns as a result of vetting against the Terrorist Screening Database and other terrorism- related databases. In addition, at ports-of-entry, CBP vets every international traveler attempting to enter the United States against the database, according to DHS documents. State also uses the Terrorist Screening Database to vet visa applicants. As of February 2014, all 38 VWP countries had entered into PCSC agreements, or their equivalents, with the United States regarding the exchange of information about criminals who pose a risk to U.S. interests, but not all VWP countries had shared information through the agreements. U.S. law requires that VWP countries enter into an agreement with the United States to share information regarding whether citizens and nationals of that country traveling to the United States represent a threat to the security or welfare of the United States or its citizens. Since December 2015, U.S. law has also required that VWP countries fully implement these agreements. In some cases, countries entered into the agreements several years after the requirement to enter into agreements was established in 2008. According to DHS officials, the existing domestic political environments of individual VWP countries may have delayed some countries’ entry into the agreements. As of September 2015, about two-thirds of VWP countries had shared information about criminals with U.S. agencies through PCSC or equivalent agreements, using interim, manual query mechanisms—either electronic file transfer systems or compact disc exchanges. The remaining VWP countries had not shared such information through the agreements. For example, one country that entered into a PCSC agreement in 2008 had not shared information through the agreement as of September 2015. PCSC agreements are intended to automate and expedite the sharing of information about individuals suspected or convicted of committing serious crimes, according to DHS officials. PCSC agreements allow for the exchange of biometric data, such as fingerprints, and biographic data of suspected criminals while protecting individual privacy. According to DHS, by authorizing both the United States and a VWP country to conduct automated queries of the other’s criminal fingerprint databases, PCSC agreements establish a framework for enhanced law enforcement cooperation. Both DOJ and DHS reported using interim exchange mechanisms established through PCSC agreements to aid in law enforcement investigations. Likewise, many VWP countries had used interim exchange mechanisms to query U.S. law enforcement databases. As of January 2016, U.S. agencies and VWP countries had not fully established virtual private networks to allow for automated querying of criminal databases as authorized by PCSC agreements. However, the FBI reported working with several VWP countries to establish these networks. In addition to receiving information through the three agreements required for participation in VWP, U.S. agencies may receive information related to national security and law enforcement through other means, such as multilateral entities. For example, since 2013, INTERPOL has issued 670 notices seeking arrest and extradition of suspected foreign terrorist fighters to all 190 of its members, and individual members had issued an additional 2,100 alerts. The United States also works with an international coalition—which includes at least 30 VWP countries—to counter threats posed by ISIS, such as the threat of foreign terrorist fighters’ entering this country. The coalition has a working group focused on disrupting the recruitment, travel, and sustainment of foreign terrorist fighters. While VWP countries may use other means to share information that is useful to U.S. agencies responsible for law enforcement and national security, the U.S. government identified the three information-sharing agreements as critical for protecting the United States from nationals of VWP countries who might present a threat. As we reported in 2011, DHS officials told us that formal agreements—in contrast to the sharing of information on an informal, case-by-case basis—expand the pool of information to which the United States has systematic access and generally expedite information sharing by laying out specific terms that can be referenced easily in requests for data. DHS officials observed that timely access to information is especially important for CBP officials at ports of entry. In August 2015, the Secretary of Homeland Security announced that DHS and other agencies were developing additional requirements for VWP participation, including a requirement to implement HSPD-6 and PCSC agreements by sharing information. Previously, in accordance with U.S. law, DHS required VWP countries to enter into the arrangements and agreements but did not require the countries to implement them in order to participate in the program. According to testimony by the Secretary, DHS developed the new VWP requirements in order to detect and prevent travel by foreign terrorist fighters. However, contrary to standard program management practices, DHS did not establish time frames for instituting the new requirements. In October 2015, DHS officials confirmed that the department had not established time frames for DHS’s consultations with each country or for instituting the new requirements. Standard practices in program and project management call for, among other things, developing a plan to execute specific projects needed to obtain defined results within a specified time frame. Time frames for working with VWP countries to institute the requirement to implement the HSPD-6 arrangements and PCSC agreements could help DHS ensure that countries meet all legal criteria for participating in the VWP—including the December 2015 law requiring them to fully implement their agreements—and could help DHS protect against threats to the United States or its citizens. Our analysis of a nongeneralizable sample of 12 internal VWPO evaluation reports on VWP countries found that VWPO assessed the effect of the countries’ participation in the program on U.S. law enforcement and security interests, including immigration enforcement, as required by federal law. However, almost one-quarter of DHS’s most recent reports to Congress regarding whether VWP countries should continue to participate in the program were submitted, or remained outstanding, 5 or more months after the dates when DHS had determined that, under U.S. law, they were due. As a result, Congress may lack timely information that it needs to conduct oversight of the VWP. The internal VWPO evaluation reports for 12 countries that we reviewed showed that, for each of these countries, VWPO assessed the effect of the country’s participation in the program on U.S. law enforcement and security interests, including immigration enforcement, as required by U.S. law. The law states, among other things, that DHS, in consultation with State, must periodically evaluate the effect of each VWP country’s continued participation in the program on U.S. law enforcement and security interests, including immigration enforcement interests. VWPO standard operating procedures lay out steps for conducting, and for reporting internally on, VWPO’s evaluations of VWP countries, which it uses to prepare the required DHS reports to Congress. For the 12 countries, VWPO completed 10 internal evaluation reports after a site visit to the relevant VWP country and completed 2 reports on the basis of desk-based, administrative reviews. In the 12 reports, the required sections on law enforcement interests and security interests, including immigration enforcement interests, had been updated from previous evaluations of the VWP country. The reports showed that VWPO consulted broadly with relevant U.S. agency officials, both in Washington, D.C., and at overseas posts and also consulted with relevant foreign VWP country officials to gather information about law enforcement interests, security interests, and immigration enforcement interests. Moreover, according to U.S. officials and VWP country officials whom we spoke with overseas, VWPO’s site visits, including questionnaires sent to countries beforehand, were generally thorough and complete and addressed the topic of foreign terrorist fighters. Our review showed that almost a quarter of DHS’s most recent reports to Congress about VWP countries were submitted 5 or more months after the dates when, according to DHS, they were due under U.S. law. U.S. law requires DHS to submit a written report to Congress for each VWP country not less than once every 2 years. Each report must provide DHS’s determination of whether the country’s participation in the program should be continued or terminated as well as an explanation of any effects of the country’s continued participation on U.S. law enforcement and security interests, including immigration enforcement interests. Because of DHS’s inconsistency in submitting the reports within the required statutory time frame, Congress may lack access to timely information needed for its oversight of the VWP. DHS’s timeliness in reporting to Congress about VWP countries has improved since 2011, when we found that the department had not completed half of its recent VWP congressional reports in a timely manner and that many of the reports were more than a year past due. Nonetheless, our current analysis shows that as of October 31, 2015, 28 of DHS’s 38 most recent congressional reports on VWP countries had been submitted, or remained outstanding, 1 or more months after the due dates. Nine of those reports were 5 or more months past due, including 2 that were past due by more than a year (see fig. 2). Since its establishment in 1986, the VWP has evolved to address U.S. national security and law enforcement interests while allowing travelers from VWP countries to contribute significantly to the U.S. economy. Most recently, the Visa Waiver Program Improvement and Terrorist Travel Prevention Act of 2015 included changes to the program—including requiring VWP countries to fully implement their agreements—that may help prevent foreign terrorist fighters from attempting to exploit it to travel to this country. U.S. agencies have used information that some VWP countries have shared under the required agreements or their equivalents to mitigate this and other threats to U.S. interests. However, because many VWP countries have not yet provided information through the agreements—possibly including information about known or suspected terrorists—agencies’ access to this critical information may be limited. Time frames for instituting the new requirement that VWP countries fully implement the information-sharing agreements could help strengthen DHS’s ability to protect against threats to the security of the United States and its citizens. The VWPO internal reports that we reviewed showed that DHS has evaluated the effect of VWP countries’ participation in the program on U.S. security and law enforcement interests, as required by law. DHS has also improved the timeliness of its required reports to Congress about the effects of VWP countries’ participation in the program on U.S. interests and its determinations of countries’ eligibility to continue in the program. Nonetheless, DHS’s inconsistency in submitting its congressional reports by the statutory deadlines may have limited Congress’s access to information needed for conducting oversight of the VWP and identifying any modifications to the program necessary to protect U.S. law enforcement and national security interests. To strengthen DHS’s ability to fulfill legislative requirements for the VWP and protect the security of the United States and its citizens, we are making the following two recommendations to the Secretary of Homeland Security: Specify time frames for working with VWP countries to institute the additional VWP security requirements, including the requirement that the countries fully implement agreements to share information about known or suspected terrorists through the countries’ HSPD-6 arrangements and PCSC agreements with the United States. Take steps to improve DHS’s timeliness in reporting to Congress, within the statutory time frame, the department’s determination of whether each VWP country should continue participating in the program and any effects of the country’s participation on U.S. law enforcement and security interests. We provided a draft of the classified report to DHS, DOJ, and State for their review and comment. DHS and DOJ provided technical comments, which we incorporated as appropriate. DHS also provided written comments, which are reproduced in appendix II. In its written comments, DHS concurred with both of our recommendations. In addition, DHS noted that it had begun taking steps to address our first recommendation and was planning actions to address our second recommendation. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees, the Secretary of Homeland Security, the Secretary of State, and the Attorney General of the United States. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact Michael J. Courts at (202) 512-8980 or courtsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. To determine whether Visa Waiver Program (VWP) countries have entered into the required Lost and Stolen Passport (LASP) agreements, Homeland Security Presidential Directive 6 (HSPD-6) arrangements, and Preventing and Combating Serious Crime (PCSC) agreements, we analyzed data provided by the Department of Homeland Security (DHS) and interviewed officials from DHS and the Department of State (State) in Washington, D.C. We also reviewed supporting documentation from DHS and State, such as diplomatic notes, letters of intent, and memorandums of understanding, that indicate whether countries entered into the agreements. To identify the information-sharing requirements, we reviewed relevant U.S. law and DHS policy. In addition, to better understand what each agreement entailed and to learn of any associated challenges, we interviewed officials from the agencies that are responsible for negotiating each agreement. We determined that the information we obtained was sufficiently reliable for our purposes. To determine the extent to which VWP countries have implemented LASP agreements, HSPD-6 arrangements, and PCSC agreements, or their equivalents, we analyzed data from DHS and the Department of Justice (DOJ) showing the status of, and information sharing through, the signed agreements and arrangements. We also visited four VWP countries: Belgium, Greece, France, and Spain. We selected these countries from among the 38 VWP countries on the basis of numerous factors—in particular, high estimated total and per capita numbers of foreign fighters and concerns about border security and counterterrorism capacity. In these four countries, we interviewed U.S. and VWP country officials responsible for implementing the agreements and arrangements to understand challenges associated with the countries’ sharing information with the United States. LASP agreements. To examine VWP countries’ sharing of information about lost and stolen passports, we reviewed data provided by DHS and INTERPOL for calendar years 2014 and 2015. We also discussed with DHS officials their level of engagement with VWP countries regarding the timeliness of their information sharing under the LASP agreement. Although we discussed the DHS and INTERPOL data with DHS and DOJ officials, we did not interview officials of all VWP countries that report through INTERPOL. DOJ officials described their uses and checks of the data they received. We determined that the DHS and INTERPOL data were sufficiently reliable for placing the reporting countries in broad categories that indicate the relative frequency with which they report to INTERPOL but were not sufficiently reliable for determining the countries’ compliance with the VWP requirement to report lost and stolen passports. We did not independently verify the legal status of each VWP country’s LASP agreement. HSPD-6 arrangements. To examine VWP countries’ information sharing through HSPD-6 arrangements, we reviewed information that we received from the Federal Bureau of Investigation (FBI) about VWP countries’ provision of information through these arrangements or their equivalents. When we encountered anomalies in the information we received, we discussed and resolved them with agency officials. We discussed the data with DOJ officials but did not interview officials of all VWP countries that report to the Terrorist Screening Center. DOJ officials described their uses and checks of the data they received but stated that they did not formally study the accuracy of the underlying data. We determined that the FBI data we received were sufficiently reliable for placing the reporting countries in broad categories that indicate the relative volume and frequency of their reporting of information to the Terrorist Screening Center through HSPD-6 arrangements or their equivalents. We did not independently verify the legal status of each VWP country’s HSPD-6 arrangement. PCSC agreements. To examine VWP countries’ information sharing through PCSC agreements, as well as the mechanisms that VWP countries have established for sharing information through the agreements, we reviewed information and data that DHS and DOJ provided. We discussed the data with DOJ officials but did not interview VWP country officials regarding the data. DOJ officials described their uses and checks of the data they received but stated that they did not formally study the data’s accuracy. We determined that the data were sufficiently reliable to place countries into broad categories that indicate the relative frequency with which they shared information. We did not independently verify the legal status of each VWP country’s PCSC agreement. In addition, to determine the extent to which U.S. agencies have been able to use the shared information to address U.S. law enforcement and security interests, we reviewed U.S. agency data and documents reporting the agencies’ use of information shared through the agreements. We also discussed the value and utility of information obtained through the agreements with U.S. law enforcement and counterterrorism officials in the United States and in the countries where we conducted our fieldwork. We determined that the information and data provided were sufficiently reliable for the purposes of this report. To determine the extent to which DHS has evaluated VWP countries’ effect on U.S. security and law enforcement interests, including immigration enforcement, we selected and analyzed a nongeneralizable sample of 12 internal DHS reports evaluating VWP countries. We selected these reports on the basis of a number of factors chosen to identify countries where concerns might exist regarding foreign terrorist fighters traveling to the United States—for example, high estimated numbers of foreign terrorist fighters; border security and counterterrorism capacity concerns; a high number of ESTA denials; number of travelers to the United States, including the percentage that traveled under the VWP; relative population size (e.g., large or small); date of entry into the VWP (i.e., pre-2000, 2001-2010, 2010-the present); geographic variation (e.g., Western Europe, Eastern Europe, the Asia Pacific region); and status of VWP information-sharing agreements as characterized by U.S. agencies (i.e., whether agreements had been signed, were ratified, and were in force and whether sharing had occurred). We used a data collection instrument developed in consultation with a methodological expert to analyze the nongeneralizable sample of 12 internal DHS reports. We also reviewed relevant U.S. agency documents and guidance, such as VWPO’s January 2015 “Visa Waiver Program Continuing Designation Country Reviews Standard Operating Procedures.” In addition, we interviewed U.S. agency and VWP country officials regarding the processes for conducting the evaluations and communicating results of the evaluations to VWP countries. To determine the extent to which DHS has submitted required reports about VWP countries to Congress, we collected and analyzed information from DHS that documented the due dates and actual delivery dates to Congress for DHS’s most recent VWP congressional reports. To assess DHS’s timeliness in submitting the required reports to Congress since 2011, when we last reviewed the VWP, we compared the results of our current analysis with our 2011 findings on DHS’s timeliness in submitting the reports. In addition, we interviewed VWPO officials regarding the process they use to prepare the reports and submit them to Congress. We determined that the information we obtained was sufficiently reliable for our purposes. We conducted this performance audit from October 2014 to January 2016 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. . Michael J. Courts, (202) 512-8980 or courtsm@gao.gov. In addition to the contact named above, Hynek Kalkus (Assistant Director), Ian Ferguson, Brandon Hunt, Reid Lowe, and Christal Ann Simanski made key contributions to this report. Ashley Alley, Kathryn Bernet, Jose Cardenas, Martin De Alteriis, and Ozzy Trevino also provided assistance.

Summary: The Visa Waiver Program allows nationals from the 38 VWP countries to travel to the United States for tourism or business for up to 90 days without a visa. To help prevent terrorists and others who present a threat from travelling to the United States, DHS requires VWP countries to, among other things, enter into information-sharing agreements with the United States. In addition, U.S. law requires DHS to evaluate, at least once every 2 years, the effect of each VWP country's participation on U.S. law enforcement, security, and immigration enforcement interests; determine whether the country should continue in the program; and report on its determination to Congress. GAO was asked to review the VWP. In this report, GAO examines the extent to which VWP countries have implemented the required agreements. GAO also examines the extent to which DHS evaluated VWP countries and reported to Congress as required. GAO reviewed documents related to the VWP, including a sample of DHS reports. In addition, GAO interviewed U.S. officials in Washington, D.C., and U.S. and foreign officials in four VWP countries selected on the basis of factors such as high estimated numbers of foreign terrorist fighters. This is a public version of a classified report GAO issued in January 2016. All 38 countries participating in the Visa Waiver Program (VWP) have entered into required agreements, or their equivalents, to (1) report lost and stolen passports, (2) share identity information about known or suspected terrorists, and (3) share criminal history information. However, not all countries have shared information through the agreements. The Department of Homeland Security (DHS) reported that all VWP countries have reported passport information through the first agreement, but more than a third of VWP countries are not sharing terrorist identity information through the second agreement and more than a third of the countries have not yet shared criminal history information through the third agreement. While VWP countries may share information through other means, U.S. agency officials told GAO that information sharing through the agreements is essential for national security. In August 2015, DHS decided to require VWP countries to implement agreements to share terrorist identity and criminal history information; previously, VWP countries were required to enter into, but not to implement, these agreements. However, contrary to standard program management practices, DHS did not establish time frames for instituting the amended requirements. In December 2015, Congress passed a law requiring that VWP countries fully implement information-sharing agreements in order to participate in the program. Time frames for working with VWP countries to implement their agreements could help DHS enforce U.S. legal requirements and could strengthen DHS's ability to protect the United States and its citizens. GAO's analysis of a nongeneralizeable sample of 12 internal DHS reports, each evaluating one VWP country, found the reports assessed the effects of the countries' participation on U.S. law enforcement, security, and immigration enforcement interests, as required by U.S. law. Since 2011, when GAO last reviewed the VWP, DHS has improved its timeliness in reporting to Congress at least once every 2 years its determinations of whether countries should continue in the program. Nonetheless, as of October 31, 2015, GAO found that about a quarter of DHS's most recent VWP congressional reports were submitted, or remained outstanding, 5 or more months past the statutory deadlines (see figure). As a result, Congress may lack timely information needed to conduct oversight of the VWP and assess whether further modifications are necessary to prevent terrorists from exploiting the program. DHS should (1) specify time frames for working with VWP countries on the requirement to implement information-sharing agreements and (2) take steps to improve its timeliness in reporting to Congress on whether VWP countries should continue in the program. DHS concurred with the recommendations.