Each year, millions of visitors, foreign students, and immigrants come to the United States. A visitor may enter on a legal temporary basis—that is, with an authorized period of admission that expires on a specific date— either with a temporary visa (generally for tourism, business, or work) that the Department of State issues or, in some cases, as a tourist or business visitor who is allowed to enter without a visa. The latter category includes Canadians and qualified visitors from 27 countries who enter under the Visa Waiver Permanent program. A large majority of these visitors depart on time, but others overstay. The term “overstay” is defined as follows: An overstay is an illegal alien who was legally admitted to the United States for a specific authorized period but remained here after that period expired, without obtaining an extension or a change of status or meeting other specific conditions. Overstays who settle here are part of the illegal immigrant population. Although overstays are sometimes referred to as visa overstays, we do not use that term in this report for two reasons. First, many visitors are allowed to enter the United States without visas and to remain for specific periods of time, which they may overstay. Second, a visitor can overstay an authorized period of admission set by a U.S. Department of Homeland Security (DHS) inspector at the border—even though that authorized period may be shorter than the period of the visitor’s visa. (For example, a visitor with a 6-month multiple-entry visa from the Department of State might be issued a 6-week period of admission by the DHS inspector and remain here for 7 weeks, thus overstaying.) Viewed in terms of individuals, the overstay process can be summarized as aliens’ (1) legally visiting the United States, which for citizens of most nations is preceded by obtaining a passport and a visa and filling out Form I-94 at the U.S. border; (2) overstaying for a period that may range from a single day to weeks, months, or years; and, in some cases, (3) terminating their overstay status by exiting the United States or adjusting to legal permanent resident status (that is, obtaining a green card). Most long- term overstays appear to have economic motivations. However, the overstay process can also be viewed in the context of a layered defense for domestic security, supported by agencies such as DHS, the U.S. Department of Justice (DOJ), and the Department of State, among others. Figure 1 illustrates the layered-defense concept and the many interrelated issues that we have analyzed in numerous reports—ranging from the overseas tracking of terrorists to stateside security for critical infrastructure locations. Intelligence, investigation, and information sharing are the key ingredients supporting such a defense. A variety of immigration issues are potentially relevant. Progress in deploying and effectively using watch lists is ongoing. In 2003, we reported that (1) the State Department, “with the help of other agencies, almost doubled the number of names and the amount of information” in its Consular Lookout and Support System but that (2) “the federal watch list environment has been characterized by a proliferation of systems, among which information sharing is occurring in some cases but not in others.” Visitor biographical and biometric data are now being checked against selected watch list data, to verify visitors’ identity, as part of the new U.S. Visitor and Immigrant Status Indicator Technology program (US-VISIT). Keeping all dangerous persons and potential terrorist suspects from legally entering the United States is difficult because some do not match the expected characteristics of terrorists or suspicious persons. In addition, some—such as citizens of Canada or one of the 27 visa waiver countries— are not required to apply for visas and are not screened by the visa process. Terrorists may continue to slip through border defenses, and watch lists have therefore also been used for tracking foreign terrorists within the United States. Overstay tracking—that is, recording visitors’ entries and exits as well as their address information—also logically plays a role. Overstay issues have gained heightened attention because some of the hijackers of September 11, 2001, had overstayed their periods of admission. Form I-94 (shown in appendix I) is the basis of DHS’s long-standing system for tracking overstays. For visitors from most countries, the period of admission is authorized (or set) by a DHS inspector when they enter the United States legally and fill out this form. Each visitor is to give the top half of the form to the inspector and to retain the bottom half, which should be collected when the visitor departs the country. However, two major groups are exempt from filling out Form I-94 when they visit the United States for business or pleasure: Canadian citizens admitted for up to 6 months and Mexican citizens entering the United States with a border crossing card (BCC, illustrated in fig. 2) at the southwestern border who intend to limit their stay to less than 72 hours and intend not to travel beyond a set perimeter, generally 25 miles from the border (see app. II, fig. 6). During fiscal years 1999 to 2003, the Department of State issued 6.4 million Mexican BCCs. Because the majority of Canadian and Mexican BCC visits do not require Form I-94, the system based on this form cannot follow them—that is, cannot track them. No data indicate how many overstay. Overstay tracking should be possible for almost all other legal temporary visitors, including visitors from visa waiver countries, because they are required to fill out the form. describe available data on the extent to which overstaying occurs, identify any weaknesses that might limit the utility of DHS’s long-standing overstay tracking system, and provide some observations about the potential effect of overstays—as well as limitations of the overstay tracking system—on domestic security. In examining these issues, our main information sources included (1) relevant GAO and other reports, (2) interviews we conducted with officials and staff at DHS and DOJ, and (3) a variety of data, including printouts from DHS’s long-standing overstay tracking system (based on Form I-94), data that DHS developed, at our request, from Operation Tarmac (the sweep that identified overstays and other illegal immigrants working at U.S. airports) and other similar operations, and facts about the arrivals, departures, and overstay status of the September 11 hijackers and others involved in terrorist-related activities. We assessed the reliability of these data sources by reviewing existing information about the data, interviewing agency officials knowledgeable about the data and the process by which they were collected, and reviewing the data for reasonableness and corroboration with other independent data sources. While we found and reported on weaknesses in the data, we determined that the data were sufficiently reliable for the purposes of this report. Our scope did not include (1) aspects of illegal immigration or domestic security unrelated to overstaying or (2) elements of overstay enforcement additional to a system for tracking legal visitors’ entries and exits (for example, resource allocation). Our work was conducted in accordance with generally accepted government auditing standards between January 2003 and May 2004, primarily at DHS and DOJ headquarters in Washington, D.C. One visit to the southwest border was made to observe departure procedures. Significant numbers of visitors overstay their authorized periods of admission. A January 2003 DHS estimate put the January 2000 resident overstay population at one-third of 7 million illegal immigrants, or 2.3 million. While the method DHS used to obtain this figure is complex, indirect, and marked by potential weaknesses, we identified three small-sample alternative data points that, taken together, provide some evidence that, in all likelihood, a substantial proportion of illegal immigrants are overstays. These three alternative data sources on illegal immigrants indicate varying—but uniformly substantial—percentages of overstays: 31 percent, 27 percent, and 57 percent. At the same time, we found that DHS’s estimate excludes some overstay groups and may thus understate the extent of the total overstay problem. The main overstay groups omitted from the DHS overstay estimate of 2.3 million are long-term Mexican and Canadian overstays who were not required to fill out Form I-94 at entry and short-term overstays, whether from Mexico, Canada, or other countries. Short-term overstays cannot be ignored because, as we explain in a later section, some terrorists or terrorist supporters are in this group. DHS’s overstay estimate for January 2000 (that is, that overstays represent one-third of the illegal immigrant population, or 2.3 million residents) was based, in part, on a projection forward of overstay rates for 1992. Earlier, we identified challenges and potential weaknesses in Immigration and Naturalization Service (INS) procedures used in estimating these overstays (including an incorrect INS formula). Therefore, we sought alternative, and more current, data sources. The first alternative data source we identified is a survey that DHS and the National Institute of Child Health and Human Development sponsored, in partnership with other federal agencies. As reported in 2002, the survey (1) sampled more than 1,000 adult green-card holders, (2) asked them about their prior immigration status, and (3) found that more than 300 self- reported earlier illegal status. The computer run we requested showed that 31 percent of these former illegals said they had been overstays. (Most others reported prior illegal border crossing.) A second alternative source was a set of data we obtained from Operation Tarmac and other recent sweeps of employees who, in the course of their work, had access to sensitive areas in airports, other critical infrastructures, or special events (for example, the Super Bowl). Although investigators conducting these operations collected information on overstaying, they had not systematically recorded data for overstays versus illegal border crossers or other categories of illegal immigrants. We requested that DHS manually review case files for those arrested and identify the number who were overstays. DHS reported to us on a total of 917 arrests, taken from operations at a sample of Operation Tarmac airports and at all other critical infrastructure and special-event locations investigated. As we detail later in this report, 246 of the 917 cases—or 27 percent—were categorized as overstays. Another source we obtained from DHS was similar information on an operation identifying illegal alien employees at a retail chain (unrelated to terrorist concerns). In this operation, 138 of 243 cases—that is, 57 percent—were identified as overstays. The percentages above do not represent the illegal population but, as indicated above, do provide some evidence that in all likelihood, a substantial proportion of illegal immigrants are overstays. The DHS overstay estimate appears to be an understatement for two main reasons. The first is that it is based on data from I-94 forms—and many Mexican and Canadian visitors are not required to complete this form. The second is that, by definition, the population of illegal immigrants does not include many short-term overstays. Thus, DHS’s 2.3 million estimate excludes the following overstay groups: 1. Mexican and Canadian visitors who did not fill out Form I-94 and who overstayed and settled here. (Although these long-term overstay settlers are included in DHS’s estimate of 7 million illegal immigrants, they are, erroneously, categorized as illegal immigrants other than overstays. This is because DHS used I-94 data to estimate overstays.) 2. Visitors filling out Form I-94 who overstay for short periods of time. 3. Mexicans and Canadian visitors who do not fill out Form I-94 and who overstay for short periods of time. The excluded groups are illustrated in figure 3, together with the overstay group that is covered. As a result, an overstay settler group is omitted from DHS’s overstay estimate (that is, from DHS’s estimate that one-third of the illegal immigrant population, or 2.3 million, are overstays). The Mexican– Canadian overstay group at issue was apparently included in the 7 million—but not the 2.3 million—estimate. It is not clear whether this issue may affect some of the three “rough-check” comparison figures cited above. DHS’s procedures for arriving at the estimate of 7 million are heavily based on the 2000 census and include those who settled here, were residing here at the time of the 2000 census, and were included either in the actual census count or in corrections for possible undercounts. The census is not likely to include aliens illegally present for relatively short periods of time, in part because such persons may not identify the United States as their principal place of residence. Consistent with this, when using I-94 data to estimate overstays, DHS specifically excluded short-term overstays. This is important because overstaying is not limited to those who illegally immigrate here and intend to remain for years. Many others overstay for only a few days, weeks, or months, including those discussed above who are—and are not—required to fill out Form I-94. Finally, we note two possible further limitations: DHS overstay estimates do not address either the issue of “prior overstays” or possible trends in overstaying: As indicated by the survey cited above (our first alternative data source), a portion of overstays who settle here eventually obtain legal status. Many prior overstays appear to be residing legally in the United States now, and thus the “flow” of overstays who settle here may be larger than a net estimate of the overstay population at a single point in time implies. DHS estimated overstays using I-94 data from the early 1990s, and it projected those estimates forward to January 2000. Without independent overstay estimates for two points in time, a reliable assessment of change is not possible. DHS has not published estimates for more recent dates— that is, since January 2000. Overstay trend estimates would be of interest but are not available. Visits to the United States decreased somewhat in 2002. Data from the Bureau of the Census indicate that the overall trend of the foreign-born population (of whom the majority are legal) was to steadily increase in size from 1990 through 2003. (See fig. 4.) We recognize that an overstay tracking system is only one ingredient in effective overstay control and enforcement. However, we believe it is a crucial ingredient. Without an adequate overstay tracking system, an accurate list of overstays cannot be generated for control purposes. In earlier reports, we identified a variety of weaknesses in the I-94 overstay tracking system. DHS has begun to phase in US-VISIT—a new program for collecting, maintaining, and sharing information on foreign nationals. We discussed above one weakness in DHS’s Form I-94 overstay tracking system—its limited coverage of Mexican and Canadian visitors. In our previous work, we have pointed to at least three other weaknesses: Failure to update the visitor’s authorized period of admission or immigration status. Last year, we reported that DHS does not “consistently enter change of status data . . . integrate these data with those for entry and departure.” DHS told us that linkage to obtain updated information may occur for an individual, as when a consular official updates information on an earlier period of admission for someone seeking a new visa, but DHS acknowledged that linkage cannot be achieved broadly to yield an accurate list of visitors who overstayed. Lack of reliable address information and inability to locate visitors. Some visitors do not fill in destination address information on Form I-94 or they do so inadequately. A related issue that we reported in 2002 is DHS’s inability to obtain updated address information during each visitor’s stay. Such information could be a valuable addition to the arrival, departure, and destination address information that is collected. Missing departure forms. We reported in 1995 that “airlines are responsible for collecting . . . departure forms when visitors leave . . . . But for some visitors who may have actually left the United States record of the departures.” DHS acknowledges that this is still a concern, the situation is analogous for cruise lines, and noncollection is a larger problem for land exits. Our recent work has also drawn attention to identity fraud, demonstrating how persons presenting fraudulent documents (bearing a name other than their own) to DHS inspectors could enter the United States. Visitors whose fraudulent documents pass inspection could record a name other than their own on Form I-94. In our current work, we have identified two further weaknesses in the overstay tracking system. One weakness is the inability to match some departure forms back to corresponding arrival forms. DHS has suggested that when a visitor loses the original departure form, matching is less certain because it can no longer be based on identical numbers printed on the top and bottom halves of the original form. The other weakness is that at land ports (and possibly airports and seaports), the collection of departure forms is vulnerable to manipulation—in other words, visitors could make it appear that they had left when they had not. To illustrate, on bridges where toll collectors accept Form I-94 at the southwestern border, a person departing the United States by land could hand in someone else’s form. Because of these weaknesses, DHS has no accurate list of overstays to send to consular officials or DHS inspectors. This limits DHS’s ability to consider past overstaying when issuing new visas or allowing visitors to reenter. More generally, the lack of an accurate list limits prevention and enforcement. For example, accurate data on overstays and other visitors might help define patterns for better differentiating visa applicants with higher overstay risk. And without an accurate list and updated addresses, it is not possible to identify and locate new overstays to remind them of penalties for not departing. Such efforts fall under the category of interior enforcement. As we previously reported, “historically . . . over five times more resources in terms of staff and budget border enforcement than . . . interior enforcement.” Despite large numbers of overstays, current efforts to deport them are generally limited to (1) criminals and smugglers, (2) employees identified as illegal workers at airports and other critical infrastructure locations, and (3) persons included in special control efforts such as the 2003 domestic registration (or “call in” component) of the NSEERS program (the National Security Entry and Exit Registration System). DHS statisticians told us that for fiscal year 2002, the risk of arrest for all overstays was less than 2 percent. For most other overstays (that is, for persons not in targeted groups), the risk of deportation is considerably lower. DHS told us that because of limited resources, it has focused enforcement on high-priority illegal alien groups. The effect that weaknesses in the overstay tracking system has on overstay data is illustrated by the inaccurate—and, according to DHS, inflated—lists of what it has termed “apparent overstays.” For fiscal year 2001 arrivals, the system yielded a list of 6.5 million “apparent overstays” for which DHS had no departure record that matched the arrivals and an additional list of a half million other visits that ended after the visitors’ initial periods of admission expired. (For data on specific countries or country groups, see app. V, table 5.) However, DHS has no way of knowing which of these are real cases of overstaying and which are false, because in all likelihood, some of these visitors departed or legally changed their status—or legally extended their periods of admission. In the past, we made a number of recommendations that directly or indirectly addressed some of these system weaknesses, but these recommendations have not been implemented or have been only partially implemented. (Of these, four key recommendations are reproduced in app. VI.) Two recent DHS programs are aimed at remedying some of the weaknesses we have discussed. First, as part of NSEERS, an effort is being made to register certain visitors at points of entry (POE) to the United States and to have government inspectors register departures. But that POE effort does not cover most visitors and does not involve inspectors’ actually observing departures. Second, US-VISIT is DHS’s new program for collecting, maintaining, and sharing information on foreign nationals who enter the United States. Among other things, the first phase of US-VISIT is designed to collect electronic entry-exit passenger and crew manifest data and to match entry and exit data to each other (based on passengers’ biographic information) and to other information, thus identifying overstays, and use biometrics to verify foreign visitors’ identities, upon entry, at 115 airports and 14 seaports of entry. We have reported elsewhere that this first phase is operational but that improvements are needed. Three additional phases are planned that would extend US-VISIT’s identity-verification capabilities—initially, to high- traffic land borders and, eventually, to all remaining ports of entry—as well as adding capabilities, such as that of processing machine-readable documents that use biometric identifiers. DHS told us that a current goal is to incorporate NSEERS POE into the US-VISIT program. Successfully designing—and implementing—US-VISIT involves a number of challenges. For example, DHS concurred with recommendations in our 2003 report, including, among other things, that DHS develop key acquisition management controls. As we have reported elsewhere, US-VISIT has not yet developed a strategy for defining and implementing these controls or a time period for doing so. Other crucial issues are whether US-VISIT can avoid weaknesses associated with the Form I-94 system. Some challenges—such as implementing an appropriate system at land borders, obtaining accurate addresses, verifying the identity of all entering visitors, and otherwise insuring the integrity of the inspections process—may be very difficult to overcome. While the design and implementation of US-VISIT face a number of challenges, we believe that it might be useful to determine whether the new program successfully avoids specific weaknesses associated with the long-standing I-94 system. Together with other efforts, this might help identify some difficult challenges in advance and enhance US-VISIT’s chances for eventual success as an overstay tracking system. Weaknesses in overstay tracking may encourage visitors and potential terrorists who legally enter the United States to overstay. Once here, terrorists may overstay or use other stratagems to extend their stay—such as exiting and reentering (to obtain a new authorized period of admission) or applying for a change of status. As shown in table 1, of the six hijackers who actually flew the planes on September 11 or were apparent leaders, three were out of status on or before September 11—two because of prior short-term overstaying. Additionally, a number of current or prior overstays were arrested after September 11 on charges related to terrorism. For example: Two overstays pled guilty to separate instances of identity document fraud and were connected to different hijackers in the September 11 group. They were current, short-term overstays when the identity document fraud occurred. Four others with a history of overstaying (and variously connected to the September 11 hijackers, the Taliban, and Hezbollah terrorists) pled guilty to document fraud or weapons charges or were convicted of money laundering. One of these was also convicted of providing Hezbollah material support, including night vision devices and other weapons-related technology. Last, the gunman who fired on several people at the El Al ticket counter of Los Angeles International Airport was identified (by DHS) as a prior overstay. Terrorists who enter as legal visitors are hidden within the much larger populations of all legal visitors, overstays, and other illegals such as border crossers. Improved overstay tracking could help counterterrorism investigators and prosecutors locate suspicious individuals placed on watch lists after they entered the country. The director of the Foreign Terrorist Tracking Task Force told us that he considered overstay tracking data helpful. For example, these data—together with additional analysis— can be important in quickly and efficiently determining whether suspected terrorists were in the United States at specific times. As we reported in 2003, between “September 11 and November 9, 2001 , . . . INS compiled a list of aliens whose characteristics were similar to those of the hijackers” in types of visas, countries issuing their passports, and dates of entry into the United States. While the list of aliens was part of an effort to identify and locate specific persons for interviews, it contained duplicate names and data entry errors. In other words, poor data hampered the government’s efforts to obtain information in the wake of a national emergency, and it was necessary to turn to private sector information. Reporting earlier that INS data “could not be fully relied on to locate many aliens who were of interest to the United States,” we had indicated that the Form I-94 system is relevant, stressing the need for improved change-of-address notification requirements. INS generally concurred with our recommendations. DHS has declared that combating fraudulent employment at critical infrastructures, such as airports, is a priority for domestic security. DHS has ongoing efforts to identify illegal workers in jobs at various infrastructures (for example, airport workers with security badges). These sweeps are thought to reduce the nation’s vulnerability to terrorism, because, as experts have told us, (1) security badges issued on the basis of fraudulent IDs constitute security breaches, and (2) overstays and other illegal aliens working in such facilities might be hesitant to report suspicious activities for fear of drawing authorities’ attention to themselves or they might be vulnerable to compromise. Operation Tarmac is a national multiagency initiative focused on screening employees working in secure areas of U.S. airports. Post–September 11 investigations of passenger-screening companies and other secure-area employers revealed substantial numbers of unauthorized foreign national employees. As a result, further sweeps began in 2001 with Washington, D.C., and Salt Lake City (in preparation for the Winter Olympics); these eventually became known as Operation Tarmac and are still ongoing. As of April 2004, DHS reported that 195 airports had been investigated and 5,877 businesses had been audited. Operation Tarmac investigators had checked the I-9 Employment Eligibility Verification forms or badging office records (or both) for about 385,000 employees and had found 4,918 unauthorized workers. As we discussed earlier in this report, when we obtained data on the specific immigration status of workers who were arrested or scheduled for deportation at 26 Operation Tarmac airports, we found that a substantial number were overstays (see table 2). Overstays had fraudulently gained access to the secure areas of all but one of the 26 airports reviewed. Of 607 unauthorized workers arrested at these airports, 182, or 30 percent, were overstays. Of these overstays, 19 percent were Mexican nationals and 38 percent were from other Latin American countries. A total of 10 unauthorized airport workers were arrested from special interest (NSEERS) countries, 5 of whom were overstays. (See app. VII for more complete Operation Tarmac nationality data.) The illegal immigrant workers with access to secure airport areas were employed by airlines (for example, at Washington Dulles International Airport and Washington Reagan National Airport, these included American, Atlantic Coast, Delta, Northwest, and United Airlines, as well as SwissAir and British Airways) and by a variety of other companies (for example, Federal Express and Ogden Services). Job descriptions included, among others, aircraft maintenance technician, airline agent, airline cabin service attendant, airplane fueler, baggage handler, cargo operations manager, electrician, janitorial supervisor, member of a cleaning crew, predeparture screener, ramp agent, and skycap. One overstay was employed in an airport badging office. Without fraud or counterfeit documents, illegal workers would not have been able to obtain these jobs and badges, allowing them access to secure areas. In the large majority of these cases, illegal immigrants had misused Social Security numbers and identity documents to illegally obtain airport jobs and security badges. A much smaller number of airport employees had misrepresented their criminal histories in order to obtain their jobs and badges. One DHS official emphasized that these were all serious security breaches because there was no way to know who these people actually were. Moreover, another DHS official told us that Operation Tarmac is likely not to have identified all illegal aliens working in secure areas of airports. Of the 4,918 unauthorized workers identified, 1,054 have been arrested, and the 3,864 others have left their airport jobs and eluded arrest. Sweeps similar to Operation Tarmac were subsequently initiated for a broad range of critical infrastructure components and special events, such as the Super Bowl (see table 3). The employees checked in these sweeps ranged from workers at nuclear power plants, military bases, pipelines, and special national events such as the Super Bowl to security officers for the Federal Protective Services, which guards federal buildings, and workers at sensitive national landmarks. Illegal immigrants committing identity fraud were found to be working at every one of these locations. Overstays were found to be working at two-thirds of these facilities and represented 20.7 percent of the unauthorized workers found by investigators of critical infrastructure sites. We asked DHS Immigration and Customs Enforcement (ICE) officials why there were more than 4,900 security breaches at airports, most of which involved illegal aliens. They stated that airport badging authorities did not routinely make rigorous checks. They stated that while badging authorities were able to check the FBI databases for criminal histories and terrorists on watch lists, they had no protocol for checking Social Security numbers and only a limited ability to verify immigration status. In contrast, Operation Tarmac and related critical infrastructure sweeps were joint federal operations that were able to do more rigorous, but still limited, checks because they had full access to DHS and Social Security Administration (SSA) data. We asked if this problem had been corrected as a result of Operation Tarmac. DHS officials stated that it had not. They stated that airport badging authorities still could not make these positive identification checks. They stated that, in effect, the airports knew who was not working there (that is, airports had checked for known terrorists and criminals) but not who was. Officials we interviewed from the Department of Transportation’s (DOT) Inspector General’s office and the U.S. Attorney’s office have also expressed their concern about this problem. With respect to the other security breaches at critical infrastructure sites, DHS officials told us that in many cases, the situation was similar to that described for airport badging authorities. Last, officials from the Transportation Security Administration (TSA) recently testified before the House Aviation subcommittee that persons employed at airports will not be subject to the CAPPS II screening that airline passengers will undergo—and are not now subject to physical screening—because TSA relies on employees’ rigorous background checks instead. It differs by airport, but the legislative requirement is that workers must be screened, and TSA policy is that screening can consist of background checks and credentialing procedures rather than physical screening. Operation Tarmac found airport background checks to have failed more than 4,900 times. Not all were overstays, but overstays do represent a substantial portion of the cases in which badged, unauthorized employees were identified. In the area of illegal immigration, reliable information remains elusive. Yet it is clear that the level of overstaying is significant and that the Form I-94 overstay tracking system contains important weaknesses. While we cannot quantify the risk to domestic security, we believe that efforts to ensure domestic security are affected to some degree by the level of overstaying that apparently occurs and by limitations in overstay tracking. This is illustrated by the employment of overstays at critical infrastructure locations. DHS recently initiated two efforts to develop improved systems, but challenges remain. Designing and implementing a viable and effective overstay tracking system is an important priority, not only because of its potential consequences for policy effectiveness but also because it could contribute to broader overstay control and enforcement efforts—and because it could enhance a layered defense. We provided a draft of this report to the Department of Homeland Security and the Department of Justice. Both agencies informed us that they had no comments. As agreed with your office, we plan no distribution of this report until 21 days after its issue date, unless you publicly announce its contents earlier. We will then send copies to the Secretary of the Department of Homeland Security, the Attorney General, appropriate congressional committees, and others who are interested. The report is also available at no charge on GAO’s Web site at http://www.gao.gov. If you or your staff would like to discuss any of the issues we present here, please call me at 202-512-2700 or Judith Droitcour, who served as project director on this study, at 202-512-9145. Other individuals who made key contributions to this report are Daniel Rodriguez, Eric M. Larson, Andrea Miller, and Mona Sehgal. Mexicans entering the United States with a border crossing card at the southwestern border who intend to limit their stay to 72 hours or less are not required to obtain a visa or to complete Form I-94 if they limit their travel to within a perimeter that is generally 25 miles from the border but that may extend up to 75 miles in Arizona (illustrated in fig. 6). DHS’s estimate of 7 million illegal U.S. residents as of January 2000 is based on the separate calculation of two estimates: (1) about 5.5 million illegal residents who arrived in the United States between 1990 and 2000 and were residing here, in illegal status, as of January 2000 and (2) about 1.5 million other illegal residents who arrived before 1990 and were here in illegal status as of January 2000. Because this estimate focuses on resident aliens, many aliens here for short periods (for example, 3 to 9 months) were likely to be excluded. The first component estimate—the estimate of 5.5 million here illegally as of January 2000 who arrived between 1990 and 2000—was derived through a “residual,” or subtraction, method. Using data from the decennial census (long form), DHS estimated the number of total foreign-born noncitizens residing here as of January 2000 who had arrived in each year from 1990 up to 2000. From this, DHS subtracted an estimate of legally resident foreign-born noncitizens, based on annual DHS administrative data—for example, the number of green cards issued each year, adjusted downward to account for deaths and return migration. Also subtracted were an estimate of the number of (1) residents who had applied for and would eventually receive legal status (estimated at 200,000) and (2) asylees, parolees, and persons with temporary protected status (TPS) who had received work authorization but not permanent resident status (377,000). These subtraction procedures yielded a “residual” estimate of illegal residents. The actual subtraction was conducted separately for each year. In this estimation process, DHS adjusted for various factors, such as census undercounts. According to the INS paper presenting the estimate of 7 million, the second component in this estimate—the estimate of 1.5 million illegal residents who had arrived before 1990—was derived from an estimate of 3.5 million illegal residents here in January 1990 and DHS’s estimate that, of the 3.5 million, 1.5 million had survived and remained here until 2000—without adjusting to legal status. To derive estimates for various countries or regions of origin (for example, Mexico or Asia), these procedures were carried out separately for 75 countries and for each region of origin. The component estimate of 5.5 million illegal residents who arrived in the past decade is based on residual estimation, which is a generally accepted demographic procedure; DHS also attempts to compensate for potential weaknesses in the source data—for example, compensating for some illegal immigrants’ avoidance of the decennial census. The other (second) component estimate—1.5 million illegal residents who had arrived before 1990—is based, in part, on the estimate of 3.5 million illegal residents (as of 1990). The methods and procedures used to make the 3.5 million estimate have not been described in any DHS publication. However, the 3.5 million estimate can be compared with another published estimate of the illegal immigrant population, derived from residual-based estimates, calculated with data from the 1990 census: 3.5 million for 1990. We have not evaluated this other published estimate; however, it is based on the generally accepted residual approach and was prepared by an expert in immigration statistics. DHS estimates that overstays constituted one-third of 7 million illegal immigrants residing in the United States as of January 2000. DHS’s one- third estimate is the result of a series of estimation procedures, described in this appendix. In 1994, INS published estimates of overstays for October 1992, using data from the Form I-94 overstay tracking system we describe in this report. The overstay tracking system generally does not include Mexican visitors entering the United States with a BCC at the Southwest land border who state that their intention is to limit their stay to 72 hours and not to travel beyond a set perimeter, generally 25 miles from the border. (See fig. 6.) The overstay tracking system also does not monitor Canadians admitted for up to 6 months, and there is no perimeter restriction for them. Such visitors who overstayed would not be included in an overstay estimate based on the I-94 data. Thus, from the very start, INS excluded some Mexican and Canadian overstays from its estimate. In using the I-94 data, INS recognized that many departure forms were missing (even when visitors had actually departed). Therefore, INS devised a way to estimate this missing-data factor, which was termed “system error.” As we explained in an earlier report. INS first identified as “index” countries those whose citizens were very unlikely to immigrate illegally to the United States—Sweden and Switzerland, among others. Then, using I-94 index-country data for a specific time period (that is, all index-country arrivals in a specific year, checked about 9 months after their initially required departure date), INS calculated the percentage of visitors from each index country who were “apparent overstays”—visitors for whom no matching record of departure could be found. Averaging this percentage across 12 index countries yielded a percentage figure (for example, 8 percent). Assuming that virtually no visitors from those 12 countries actually overstayed, INS took its calculated percentage (for example, 8 percent), plus a small margin of error, to represent a global level of “system error.” INS then calculated the percentage of apparent overstays for each nonindex country—Korea, Mexico, Poland, and so on—as of October 1992. From a particular country’s percentage of apparent overstays (for example, 12 percent), INS subtracted its global system error estimate (10 percent), yielding an estimated overstay rate for that country (for example, 2 percent). Any overstaying above the global “system error” was taken as an overstay flow estimate. Multiplied by the number of arrivals from a specific country in the designated year, this yielded the number of new overstays from that country. Estimation was limited to overstays remaining here for about a year or more. These data and procedures are the basis for all subsequent DHS overstay estimates. In our earlier report, we indicated a number of reasons why these overstay estimation procedures needed improvement. INS combined these estimates with estimates for total illegal residents—to address the question of what percentage of total illegal alien residents overstays represented as of October 1992. Importantly, this step was carried out separately for 99 countries, with the remaining countries grouped together in their respective continents of origin—for example, the rest of Asia. INS then applied the country-by-country October 1992 overstay percentages to project a later, October 1996 overstay estimate. Assuming no change between 1992 and 1996 in percentages of illegals estimated to be overstays in each country, INS multiplied the 1992 overstay percentages by newly estimated (1996) per-country estimates of numbers of total illegal immigrants. The same procedures (based on 1992 data) were carried out to yield country-by-country overstay estimates for January 2000. Summing the results across all country categories yielded an estimate of overstays— 2.3 million, or one-third of all illegal aliens residing here as of January 2000. Although we believe that the DHS estimation procedures contain several weak points, we were able to identify or develop three small-sample comparisons of illegal immigrants, as detailed in this report. These three “rough checks” indicated varying results—that 27 percent, 31 percent, and 57 percent of the illegal immigrants “sampled” were overstays. But taken together, they clearly suggest that some substantial percentage of illegal residents are overstays. With respect to possible trends, we do not believe that a reliable estimate of change in the overstay population can be based on DHS estimates. The estimate of overstays for 2000 is not based on any new overstay data; rather, it is based on (1) new data on the “total illegal population” as of January 2000 and (2) old data on what percentage of immigrants from each country or continent of origin are overstays. This means that we cannot identify two independent overstay estimates for the early 1990s and 2000. The weaknesses of DHS’s I-94 data system—that is, the reasons why false cases of overstaying are mixed with real cases—are discussed in the report. Tables 4 and 5 illustrate the resulting data. The following four prior recommendations to DHS concern overstay tracking, data, or estimates. 1. We recommended that to improve the collection of departure forms, the Commissioner of the Immigration and Naturalization Service should ensure that INS examine the quality control of the Nonimmigrant Information System database and determine why departure forms are not being recorded. This could involve, for example, examining a sample of the passenger manifest lists of flights with foreign destinations to determine the extent of airline compliance and, possibly, developing penalties to be levied on airlines for noncompliance. Discovery of the incidence of various causes of departure loss could allow a more precise estimation of their occurrence and the development of possible remedies. (U.S. General Accounting Office, Illegal Aliens: Despite Data Limitations, Current Methods Provide Better Population Estimates, GAO/PEMD-93-25 (Washington, D.C.: Aug. 5, 1993).) INS agreed in principle with our recommendation and fielded a pilot project to study why departure forms were not being collected. In 2002, INS discontinued the pilot because it was not yielding results INS had hoped for and because INS was in the process of designing an automated entry-exit system, which is now part of DHS’s US-VISIT program. If successfully implemented, US-VISIT could help identify overstays. We are monitoring the design and implementation of the US-VISIT program. 2. We recommended that the Commissioner of INS have new overstay estimates prepared for air arrivals from all countries, using improved estimation procedures such as those discussed in the report, including, as appropriate, the potential improvements suggested by INS or by reviewers of the report. (U.S. General Accounting Office, Illegal Immigration: INS Overstay Estimation Methods Need Improvement, GAO/PEMD-95-20 (Washington, D.C.: Sept. 26, 1995).) INS initially concurred and produced revised estimates as part of its comments on our report. However, in our response to INS’s comments, we described the new estimates as a “first step” and identified concerns about INS’s methodological procedures that we said needed further study. Recently, DHS told us that it has not further studied making overstay estimates for air arrivals. Valid estimation of overstays is extremely difficult, given current tracking system weaknesses. 3. We recommended that to promote compliance with the change of address notification requirements through publicity and enforcement and to improve the reliability of its alien address data, the Attorney General should direct the INS Commissioner to identify and implement an effective means of publicizing the change of address notification requirement nationwide. INS should make sure, in its publicity effort, that aliens are given information on how to comply with this requirement, including information on where change of address forms and other information may be available. (U.S. General Accounting Office, Homeland Security: INS Cannot Locate Many Aliens Because It Lacks Reliable Address Information, GAO-03-188 (Washington, D.C.: Nov. 21, 2002).) DHS concurred with this recommendation and has identified it as a long- term strategy that will require 2 years to fully implement. Since we made this recommendation less than 2 years ago, DHS has not had sufficient time to implement it fully. 4. We recommended that to provide better information on H-1B workers and their status changes, the Secretary of DHS take action to ensure that information on prior visa status and occupations for permanent residents and other employment-related visa holders is consistently entered into current tracking systems and that such information become integrated with entry and departure information when planned tracking systems are complete. (U.S. General Accounting Office, H-1B Foreign Workers: Better Tracking Needed to Help Determine H-1B Program’s Effects on U.S. Workforce, GAO-03-883 (Washington, D.C.: Sept. 10, 2003).) DHS concurred with this recommendation. Sufficient time has not elapsed for DHS to implement this recommendation. Appendix VII: Data from Operation Tarmac and Other Operations Nationality data are not available. Refers to multiple locations; landmark names are not specified for security reasons. The references in this appendix are full bibliographic citations keyed to the GAO report numbers listed in figure 1. Border Security: New Policies and Increased Interagency Coordination Needed to Improve Visa Process. GAO-03-1013T. Washington, D.C.: July 15, 2003. Border Security: New Policies and Procedures Are Needed to Fill Gaps in the Visa Revocation Process. GAO-03-798. Washington, D.C.: June 18, 2003. Information Technology: Terrorist Watch Lists Should Be Consolidated to Promote Better Integration and Sharing. GAO-03-322. Washington, D.C.: April 15, 2003. Weaknesses in Screening Entrants into the United States. GAO-03-438T. Washington, D.C.: January 30, 2003. Major Management Challenges and Program Risks: Department of State. GAO-03-107. Washington, D.C.: January 1, 2003. Border Security: Implications of Eliminating the Visa Waiver Program. GAO-03-38. Washington, D.C.: November 22, 2002. Border Security: Visa Process Should Be Strengthened as an Antiterrorism Tool. GAO-03-132NI. October 21, 2002. National Preparedness: Integrating New and Existing Technology and Information Sharing into an Effective Homeland Security Strategy. GAO-02-811T. Washington, D.C.: June 7, 2002. Embassy Security: Background Investigations of Foreign Employees. GAO/NSIAD-89-76. January 5, 1989. Security: Counterfeit Identification Raises Homeland Security Concerns. GAO-04-133T. October 1, 2003. Homeland Security: Risks Facing Key Border and Transportation Security Program Need to Be Addressed. GAO-03-1083. September 19, 2003. Land Border Ports of Entry: Vulnerabilities and Inefficiencies in the Inspections Process. GAO-03-1084R. August 18, 2003. Border Security: New Policies and Increased Interagency Coordination Needed to Improve Visa Process. GAO-03-1013T. July 15, 2003. Counterfeit Documents Used to Enter the United States from Certain Western Hemisphere Countries Not Detected. GAO-03-713T. May 13, 2003. Border Security: Challenges in Implementing Border Technology. GAO-03-546T. March 12, 2003. Technology Assessment: Using Biometrics for Border Security, GAO-03-174. November 15, 2002. H-1B Foreign Workers: Better Tracking Needed to Help Determine H-1B Programs Effects on U.S. Workforce. GAO-03-883. September 10, 2003. Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning. GAO-03-563. June 9, 2003. Homeland Security: Justice Department’s Project to Interview Aliens after September 11, 2001. GAO-03-459. April 11, 2003. Homeland Security: Challenges to Implementation of the Immigration Interior Enforcement Strategy. GAO-03-660T. April 10, 2003. Homeland Security: INS Cannot Locate Many Aliens Because It Lacks Reliable Address Information. GAO-03-188. November 21, 2002. Immigration Benefits: Several Factors Impede Timeliness of Application Processing. GAO-01-488. May 4, 2001. Illegal Immigration: INS Overstay Estimation Methods Need Improvement. GAO/PEMD-95-20. September 26, 1995. Illegal Aliens: Despite Data Limitations, Current Methods Provide Better Population Estimates. GAO/PEMD-93-25. August 5, 1993. Social Security Administration: Actions Taken to Strengthen Procedures for Issuing Social Security Numbers to Noncitizens but Some Weaknesses Remain. GAO-04-12. October 15, 2003. Social Security Administration: Disclosure Policy for Law Enforcement Allows Information Sharing, but SSA Needs to Ensure Consistent Application. GAO-03-919. September 30, 2003. Social Security Numbers: Improved SSN Verification and Exchange of States’ Driver Records Would Enhance Identity Verification. GAO-03-920. September 15, 2003. Security: Counterfeit Identification and Identification Fraud Raise Security Concerns. GAO-03-1147T. September 9, 2003. Supplemental Security Income: SSA Could Enhance Its Ability to Detect Residency Violations. GAO-03-724. July 29, 2003. Social Security Numbers: Ensuring the Integrity of the SSN. GAO-03-941T. July 10, 2003. Identity Fraud: Prevalence and Links to Alien Illegal Activities. GAO-02-830T. June 25, 2002. Customs and INS: Information on Inspection, Infrastructure, Traffic Flow, and Security Matters at the Detroit Port of Entry. GAO-02-595R. April 22, 2002. INS Forensic Document Laboratory: Several Factors Impeded Timeliness of Case Processing. GAO-02-410. March 13, 2002. Identity Theft: Prevalence and Cost Appear to Be Growing. GAO-02-363. March 1, 2002. Identity Theft: Available Data Indicate Growth in Prevalence and Cost. GAO-02-424T. February 14, 2002. Illegal Aliens: Fraudulent Documents Undermining the Effectiveness of the Employment Verification System. GAO/T-GGD/HEHS-99-175. July 22, 1999. Illegal Aliens: Significant Obstacles to Reducing Unauthorized Alien Employment Exist. GAO/GGD-99-33. April 2, 1999. Homeland Security: Information Sharing Responsibilities, Challenges, and Key Management Issues. GAO-03-1165T. September 17, 2003. Transportation Security: Federal Action Needed to Help Address Security Challenges. GAO-03-843. June 30, 2003. Transportation Security Research: Coordination Needed in Selecting and Implementing Infrastructure Vulnerability Assessments. GAO-03-502. May 1, 2003. Transportation Security: Post-September 11th Initiatives and Long- Term Challenges. GAO-03-616T. April 1, 2003. Responses of Federal Agencies and Airports We Surveyed about Access Security Improvements. GAO-01-1069R. August 31, 2001. Aviation Security: Challenges Exist in Stabilizing and Enhancing Passenger and Baggage Screening Operations. GAO-04-440T. February 12, 2004. Aviation Security: Computer-Assisted Passenger Prescreening System Faces Significant Implementation Challenges. GAO-04-385. February 13, 2004. Aviation Security: Transportation Security Administration Faces Immediate and Long-Term Challenges. GAO-02-971T. July 25, 2002. Aviation Security: Information Concerning the Arming of Commercial Pilots. GAO-02-822R. June 28, 2002. Aviation Security: Long-Standing Problems Impair Airport Screeners’ Performance. GAO/RCED-00-75. June 28, 2000. Aviation Security: Vulnerabilities Still Exist in the Aviation Security System. GAO/T-RCED/AIMD-00-142. April 6, 2000. Aviation Security: FAA’s Actions to Study Responsibilities and Funding for Airport Security and to Certify Screening Companies. GAO/RCED-99-53. February 25, 1999. Aviation Security: Implementation of Recommendations Is Under Way, but Completion Will Take Several Years. GAO/RCED-98-102. April 24, 1998. Aviation Security: Posting Notices at Domestic Airports. GAO/RCED-97-88R. March 25, 1997. Aviation Safety and Security: Challenges to Implementing the Recommendations of the White House Commission on Aviation Safety and Security. GAO/T-RCED-97-90. March 5, 1997.

Summary: Each year, millions of visitors, foreign students, and immigrants come to the United States. Foreign visitors may enter on a legal temporary basis--that is, with an authorized period of admission that expires on a specific date--either (1) with temporary visas (generally for tourism, business, or work) or, in some cases, (2) as tourists or business visitors who are allowed to enter without visas. (The latter include Canadians and qualified visitors from 27 countries who enter under the visa waiver program.) The majority of visitors who are tracked depart on time, but others overstay--and since September 11, 2001, the question has arisen as to whether overstay issues might have an impact on domestic security. In this report, we (1) describe available data on the extent of overstaying, (2) report on weaknesses in the Department of Homeland Security's long-standing overstay tracking system, and (3) provide some observations on the impact that tracking system weaknesses and significant levels of overstaying may have on domestic security. Significant numbers of foreign visitors overstay their authorized periods of admission. Based in part on its long-standing I-94 system for tracking arrivals and departures, the Department of Homeland Security (DHS) estimated the overstay population for January 2000 at 2.3 million. But this estimate (1) excludes an unknown number of long-term overstays from Mexico and Canada, and by definition (2) excludes short-term overstays from these and other countries. Because of unresolved weaknesses in DHS's long-standing tracking system (e.g., noncollection of some departure forms), there is no accurate list of overstays. Tracking system weaknesses make it difficult to monitor potentially suspicious aliens who enter the country legally--and limit immigration control options. Post-September 11 operations identified thousands of overstays and other illegal immigrant workers who (despite limited background checks) had obtained critical infrastructure jobs and security badges with access to, for example, airport tarmacs and U.S. military bases. As of April 2004, federal investigators had arrested more than 1,360 illegal workers, while the majority had eluded apprehension. Together with other improvements, better information on overstays might contribute to a layered national defense that is better able to counter threats from foreign terrorists. A more comprehensive system, US-VISIT, the U.S. Visitor and Immigrant Status Indicator Technology, is being phased in. The design and implementation of US-VISIT, however, face a number of challenges. It is important that this new program avoid specific weaknesses associated with the long-standing system. Checking for these weaknesses might help identify difficult challenges in advance and--together with other efforts--enhance USVISIT's chances for eventual success as a tracking system.