Foreign citizens wishing to temporarily enter the United States generally fill out a visa application; make an appointment; pay a fee; submit photographs and other documents; provide 2-digit fingerprints; and appear for a document review, name check against government watch lists, and interview with a State consular officer at an American Embassy or Consulate. Consular officers review applications, interview applicants, execute name checks through the Consular Lookout and Support System, make notations, and assess whether the applicant may be an intending immigrant, a potential threat to national security, or otherwise ineligible. Following these steps, the applicant is granted or refused a visa, or subjected to additional security checks. (See fig. 1.) Consular officers are assisted by locally hired staff who are generally not U.S. citizens. These staff perform support tasks but do not adjudicate visas. The Bureau of Consular Affairs considers the visa process to be a major element of national security. In addition to guidance on visa processing, State provides visa adjudicators, who are typically entry-level officers, with specific guidance and training on examining applicants’ documentation, interviewing, and screening out applicants who may pose security concerns. This guidance is provided in the Foreign Affairs Manual and the Consular Management Handbook, as well as through periodic policy updates of standard operating procedures transmitted to overseas posts and placed on an intranet site. While the Office of the Inspector General and Diplomatic Security share authority for investigating visa malfeasance, Diplomatic Security conducts most of the investigations. In particular, Diplomatic Security’s Visa Fraud Branch investigates visa malfeasance cases and carries out related enforcement functions for State. These cases are typically pursued by a regional security officer and consular management and involve observation of the suspected employee and collection of evidence to document the malfeasance. In cases where Justice determines sufficient evidence exits, it will prosecute employees who are accused of malfeasance. The Bureau of Consular Affairs has established a number of key internal controls designed to mitigate the risk of employee malfeasance, some of which are new or have been reinforced since September 11, 2001. Among the controls State has emphasized are: limiting employee access to visa issuing systems and applicants, periodic reconciliations of visa stocks, specific criteria for post employees to follow when referring foreign individuals seeking visas for favorable treatment by consular officials, and mechanisms to provide oversight of key consular activities by post and Consular Affairs headquarters management. While Consular Affairs’ controls are consistent with accepted control standards, we found that some of the controls were not always being followed at the posts we visited. To prevent the issuances of nonimmigrant visas to unqualified applicants, Consular Affairs has strengthened its efforts to limit employee access to automated systems that issue visas and has taken steps to ensure that visa applicants cannot predict which officers will interview them. Additionally, Consular Affairs has a series of controls over accountable items. It has also strengthened its criteria for applicants referred by post employees for favorable consideration in obtaining a visa and expedited processing by consular officers. Further, Consular Affairs has increased its emphasis on both headquarters and post supervisory oversight. It also requires posts to certify in writing annually their compliance with key internal controls. Consular Affairs has issued guidelines on reporting suspicious behavior that may involve malfeasance. It has also enhanced its malfeasance prevention efforts. The increased dependence of consular officers on automated systems requires Consular Affairs to have effective management controls over these systems. Consular Affairs has strengthened its existing controls over visa issuing systems by restricting employee access to key systems and safeguarding passwords, thereby emphasizing consular officers’ accountability for visa issuance and providing an audit trail to document which officer issued each visa. For example: The Consular System Administrator controls employees’ access to the automated consular systems by assigning user identifiers and roles. Designated consular officers ensure appropriate access to consular automated functions; an administrator specifically assigns each consular employee a specific role; and the computer system only allows consular staff to perform functions associated with that role. For example, only officers that adjudicate visas are assigned a system role that permits them to authorize visa issuance. In February 2004, Consular Affairs strengthened controls over access to employee computers by requiring that passwords be known only to the users and that they be changed semi-annually. In the past, employee passwords were assigned by the system administrator, but are now chosen by the employee. As an additional safeguard, employees are now reminded to lock their computers when not at their desks, and the system is set to automatically lock after an interval of idleness. Consular Affairs controls access of applicants to visa adjudicators and consular staff. To prevent applicants targeting a particular consular officer, Consular Affairs requires that consular officers interview applicants in a random manner, with no single person controlling the process. When translators are used, they are to be rotated among the adjudicators. Controls over Accountable Items To reduce the risk that blank visas will be stolen or that visas will be issued without being properly recorded in the consular systems, it is Consular Affairs’ standard practice to safeguard blank visas and other accountable items, closely monitor usage, conduct frequent inventories, and reconcile discrepancies quickly. Each post must designate a primary and backup accountable consular officer to be responsible for controlled items. Further, Consular Affairs procedures require controlled items to be reconciled daily, verified quarterly, and certified annually by senior consular or post officials. At least quarterly, the accountability officer must physically count the stock of each accountable item and reconcile the inventory ledger, ensuring that the number of the item on hand in fact matches the number that the ledger indicates should be on hand. Discrepancies between inventory records and stocks of blank visas on hand that can not be resolved must be reported within 24 hours to Consular Affairs management. U.S. officers from any U.S. government agency posted at embassies and consulates may refer to the consular section for favorable consideration and expedited processing foreign applicants where visa issuance would support U.S. interests or those of the mission. This so-called visa referral is a means for other embassy officials to provide additional information on a visa case and to document a perceived U. S. national interest served in facilitating the travel of the applicant. According to a 2005 State Inspector General’s report, embassy staff or prominent local figures often appeal to ambassadors or other mission managers for favorable consideration in obtaining visas, and consular officers have felt pressure to provide such assistance. To ensure that post staff refer visas only for qualified applicants, Consular Affairs has strengthened and formalized its criteria for issuing referred visas. Prior to 2002, posts individually interpreted the guidelines on making referrals and many posts did not have formal referral policies. In 2002, Consular Affairs required posts to establish a formal postwide referral system. Under this system, referral procedures are to be reissued annually, and supervisory consular officers are to periodically review referral activities, specifically noting frequency of referrals by officer as well as applicant return-to-country rates. Consistent with the new congressionally mandated biometric and interview requirements, the new referral criteria require fingerprinting and photos of all applicants and personal interviews of nearly all referred visa applicants, mandatory use of revised referral forms, certification that the applicant is personally known to the sponsor and presents no threat to national security, supervisory approval of the referral request by the sponsor’s supervisor, scanning of applicant forms and referral requests into the nonimmigrant visa system to provide a record and an audit trail, and post management reviews of aggregate visa trends by referrer. Since 2002, Consular Affairs has repeatedly reiterated referral criteria in policy updates and clarifications to overseas posts. Moreover, during our review, in June 2005, Consular Affairs again revised the referral policy reiterating the need for senior consular officers to adjudicate Class A referrals and requiring posts to provide the Bureau of Consular Affairs copies of their referral policies. In addition, Consular Affairs said that it gives briefings to every ambassador, deputy chief of mission, and principal officer emphasizing the importance of strict compliance with the visa referral policy, that visa referrals are tracked, and that mission leaders bear responsibility and liability for their own referrals. Citing cases of consular malfeasance resulting from lax supervision over consular functions, Consular Affairs has continually emphasized the need for supervisory oversight of the visa function, particularly by ambassadors, deputy chiefs of mission, or principal officers. Depending on the size of the post, daily oversight is exercised by senior consular officers over nonimmigrant visa section chiefs (who supervise adjudicating officers and other consular staff) or by the most senior available post officer. Senior consular section chiefs, who generally adjudicate referrals or other visas at smaller posts, are supervised by senior post managers. Consular Affairs requires that supervisors review all visa refusals daily and perform spot- checks of issuances, as well as undertake periodic reviews of post referrals. Supervisors have tools to assist with this responsibility. For example, the Nonimmigrant Visa application allows on-line oversight through reports of consular activities, such as daily visa refusals and issuances, including the time of visa issuance; the applicants interviewed and their nationalities; and the types of visas issued, including those for visitors, students, businesspersons, professionals, and performing artists, as well as the reasons for denials. Additionally, reports providing aggregate information on the number and types of referrals made by each post officer and their disposition are available. A recent enhancement to the system permits supervisors to view applications and referral forms showing applicant’s purpose of travel and whether the referral was signed appropriately and reviewed as required. Consular Affairs also has emphasized in cables and training the importance of ambassadors, deputy chiefs of mission, and principal officers’ supervisory role in reviewing the visa function. According to State officials, training courses for these offices have included information on the consular function, oversight responsibilities, and employee malfeasance. According to State training records, the senior managers at six posts we visited had received this training. To ensure that the internal controls over the visa process are being implemented, State requires that chiefs of mission certify annually that the controls are adequate. In addition, since September 2002, State has required that consular managers certify their compliance with key controls over the visa process to chiefs of mission and to Consular Affairs. Each year, posts are required to issue a report certifying their compliance with internal controls, including routine inventory counts of controlled items, established referral policies and procedures, and supervisory reviews of visa refusals and issuances. In October 2004, Consular Affairs required the review of 19 controls by each post. To safeguard the visa process, consular sections are required to assess post vulnerability to employee malfeasance. Posts are to identify internal visa malfeasance risks, such as inadequate oversight procedures, and to assess post vulnerability to external fraud, such as bribery. To assess this vulnerability, Consular Affairs has established Fraud Prevention Units at posts and designated Fraud Prevention Manager positions. The units are responsible for detecting suspected fraud by visa applicants as well as possible employee malfeasance, and coordinating with the regional security officer and local law enforcement authorities as necessary. The positions are often filled on a part-time basis by consular officers who are responsible for making vulnerability assessments along with their other duties. Consular Affairs also has guidance on reporting suspicious behavior. Employees are required to report suspicions of employee malfeasance to the senior consular manager at post and the regional security officer, unless one of them is believed to be involved in the malfeasant activity. Further, State’s guidance on reporting malfeasance emphasizes the need to protect the integrity of an investigation and the commitment of confidentiality to the source of an allegation. As such, State’s standard operating procedures call for potential malfeasance information to be closely held at post and in the department. With 211 visa issuing posts, State requires adequate and continuous oversight to reduce the risks of visa malfeasance. Headquarters management is an essential part of that oversight. To assist headquarters in monitoring post operations, State established the Vulnerability Assessment Unit (VAU) jointly staffed by Consular Affairs and Diplomatic Security. In addition, Consular Affairs established Consular Management Assistance Teams (CMAT). VAU, established in 2003, attempts to detect and prevent possible employee malfeasance by analyzing consular data from State’s Consular Consolidated Database. VAU reviews several different reports for variations that could indicate malfeasance. Among other things, these reports and other information can (1) identify whether senior officers with responsibility for reviewing adjudications have access to automated systems to do required reviews of visa adjudications, as well as whether they are actually doing so; (2) determine whether post employees follow procedures and use appropriate forms to make referrals for applicants; (3) review issuance and refusal rates of adjudicators; and (4) review rates of visa refusals overturned by senior officers. In 2003, State instituted CMATs to perform informal reviews of consular functions. The teams, which are provided VAU reports on consular activities, examine access controls, inventory reconciliations, training and knowledge of consular applications, appropriate use of referral procedures, supervisory reviews of daily adjudications, and other visa issues. Posts are selected for CMAT examination if there is knowledge of a management problem and a review can help to identify a systemic problem, if posts request a review, or if there has been a previous case of malfeasance at the post. CMAT reports, which may include recommendations to improve post management, are sent to State’s Bureau of Consular Affairs and to the posts. State has conducted 81 CMAT reviews, including reviews of several posts twice, since program inception. Consular Affairs has established and reinforced a system of internal controls, described above, designed to reduce visa malfeasance risks; however, we found that the controls were not being fully and consistently implemented. All the posts we visited had limited employee access to systems and applicant access to consular staff. However, we found that inventory counts of accountable items were performed inconsistently. Further, the referral policy was not followed. Also, supervisory adjudication reviews were not performed consistently. Moreover, we found that some posts had certified compliance with these controls when we, and in some cases, CMAT teams, indicated that they were not in compliance. In addition, staff were unclear on employee malfeasance reporting policies. Finally, headquarters oversight has been hindered by the lack of enhanced technical tools to identify potential malfeasance. Table 1 summarizes the results of our review of internal controls over the visa process at the 11 posts we visited. To reduce the risks of visa malfeasance, all the posts we visited had complied with department directives to limit employee access to visa issuing systems. This compliance ensured that employees only had appropriate level access to accomplish their responsibilities. We also observed at all posts that consular staff did not have exposed passwords at their workspace, and they logged off systems each time they left their desks. Moreover, most posts ensured that applicants did not have access to consular sections and that consular staff and applicants were interviewed in a random manner. To prevent malfeasant issuance of visas, Consular Affairs requires that blank visas (visa foils) be counted and safeguarded along with other controlled equipment. We found that not all posts reconciled visa inventories as required. Seven posts had not conducted quarterly reconciliations as required, although posts did routinely perform daily reconciliations. Moreover, some posts had certified that they had complied with inventory controls when they had not, and other posts did not accurately characterize their compliance. For example: At one post, the accountable consular officer was absent and the back up officer did not have the combination to the controlled area. Therefore, we could not review inventory logs nor could the backup perform the required daily reconciliation. Two posts had discrepancies in their monthly reconciliations due to miscounting. At one post, this discrepancy was discovered later when the post prepared for a CMAT review. A referral is also a useful foreign policy tool. However, if it is not implemented properly, it could create risks in the visa process by allowing expedited visa processing for potentially unqualified applicants to enter the United States. We found problems with the implementation and monitoring of referrals at seven posts. Moreover, in 2002, an Inspector General Report cited several instances where malfeasant employees sold referrals and recommended strengthening the nonimmigrant visa referral policy. The cases cited by the Inspector General involved Drug Enforcement Administration and Department of Commerce employees, but sales of referrals by State employees have also occurred. Consular Affairs has issued and reinforced guidance on referrals to posts three times since 2002. However, the Inspector General noted in March 2005 that the Bureau of Consular Affairs needed to be better informed of referral procedures in place at overseas posts. The report cited concerns that not all posts were following State guidance and recommended that posts verify that applicants had returned at the end of their authorized stay in the United States. State subsequently required posts to conduct periodic studies on whether referred applicants left the United States before their visa expired. State requires that all posts have a referral policy that defines specific criteria referred applicants must meet. The post policies are intended as a supplement to overall Consular Affairs guidance on referrals. As a further safeguard, referrals must be (1) adjudicated by senior consular officers, (2) reviewed by supervisors, and (3) monitored by post management. Class A referents, generally high-level foreign government, business, or cultural officials, are fingerprinted and undergo a document review but do not have to be interviewed by the consular section. We found that four posts did not have a current post-specific referral policy. Furthermore, based on our spot-checks of visa referral records, there was no evidence at six posts that some supervisors had performed the required reviews. In fact, at three of these posts, the supervisors, principal officers, or deputy chiefs of mission were not enabled to access the systems designed to permit and document supervisory review. Consular Affairs indicated that it encourages supervisors to document their review within the consular computer system. Our review of referral forms and applications revealed that not all referred applicants met State’s referral criteria. For example, A senior consular officer at one post issued referrals that did not meet Class A criteria, including approving referrals for the secretary of a foreign official and the adult children of foreign officials on personal travel, when only minor children accompanying the official qualify. One post could not identify the individual who had made a referral. The recent referral was approved by the consular section in February 2005. The individual making the referral did not appear on the post roster, and the post agency where the referrer was assigned could not identify the individual at the time of our visit. U.S. personnel not under the authority of the Chief of Mission cannot use the referral system, according to Consular Affairs. As a result, the post was unable to verify that the referral was legitimate. To monitor the referral process, State requires consular managers to review referral adjudications daily (as they do other issuances) and to annually examine 12 months of referrals for anomalies. To comply, all posts had prepared, as required, executive management aggregate reports of referrals by employee. Our review of these aggregate reports indicated no abnormalities; however, when we reviewed individual referral and applicant forms available online, we found that referrals had not been submitted or adjudicated appropriately. For example: One referral was made by a local employee, when only U.S. officers at the post are allowed to make referrals. At one post, a referral was made and adjudicated by the same officer. Consular officers may not refer and approve the same applicants for visas. This referral was for a cousin of a consular section employee, and consular officers are not allowed to adjudicate matters involving friends. Three posts had incorrectly used the Class A referral for local employees on personal travel. State permits Class A referrals for locally employed staff only for official travel. Nonimmigrant Visa chiefs are to review daily all refusals and a sample of issuances. When visa section chiefs adjudicate, senior consular officers are to perform the reviews, while at small posts with one or two consular officers, the deputy chief of mission, principle officer, or other senior post staff are to do so. State policy recommends on-line reviews, but permits paper reviews as well. Reviewers have an automated system that provides management reports that would reveal anomalies in consular officer visa issuances. However, we found little evidence that reviews were being undertaken consistently at the posts we visited. For example: Six posts did not consistently perform State required daily reviews of visa issuances and refusals. For example, at one post a review of the Nonimmigrant Visa system showed that required daily reviews had not been done for a month. At one post, with the consular section located in a different building from the embassy, we saw several months of visa adjudications on the floor awaiting review by the deputy chief of mission. A review of Nonimmigrant Visa adjudication reports at the posts we visited showed that some posts consistently reviewed daily visa applicant refusals, but did not follow Consular Affairs’ policy to spot- check daily visa issuances. Due to inaccurate or incomplete submissions, the certifications of consular management controls may not provide the level of assurance desired that internal controls are being followed. For example: Seven of the posts we visited had not conducted quarterly reconciliations, as required, although five had certified compliance with inventory controls. The October 2004 CMAT reviews of two of these posts had found similar problems, noting that required inventory controls had not been reconciled on a quarterly basis, although all had routinely performed daily reconciliations. Some posts submitted the required certifications but did not indicate whether they were in compliance. Two posts, for example, reported reviewing controlled items, but did not note whether they were reconciled. Many consular staff at most posts were aware that they should report suspected visa malfeasance but did not know the appropriate reporting procedures. Internal control standards require agencies to clearly establish areas of authority and appropriate lines for reporting. State policy requires that suspicions of malfeasance at posts be reported to Consular Affairs’ consular section chiefs and Diplomatic Security’s regional security officers, unless they are the subject of the allegations. In practice, most consular staff we spoke with said they report suspicions of consular malfeasance up their chain of command. If suspected malfeasance is not promptly reported to the regional security officer, subsequent investigations could be affected. In August 2005, Consular Affairs and Diplomatic Security provided more explicit guidance to the field on the actions that posts, in particular consular and security officers, must take in the event they suspect or uncover malfeasance. Consular Affairs’ headquarters oversight unit, the VAU, does not have adequate tools to assist their review of the visa process to identify fraud trends. The Consular Consolidated Database contains various reports that provide information on daily visa issuances, denials, and referrals by consular staff. Currently, the VAU can only recall this information on an ad- hoc basis, which is time consuming for the two staff assigned to the unit. For example, it took several hours for us and a VAU staff to review two categories of data—assigned roles allowing post staff to use consular databases and whether daily reviews of visa refusals and issuances were being conducted at five posts. Moreover, the unit has no automated means to sort data and generate reports that flag unusual variances in visa issuances or to track trends. As a result, the unit is currently reactive, focusing its research on supporting allegations and investigations of malfeasance and generating reports on individual post consular activities in preparation for CMAT team visits to posts. Unit officials indicated that they are working toward developing a more proactive approach to malfeasance analysis that will allow automated searches of anomalies, fraudulent or not, through a more efficient data mining and search capability. The new capability will include identification of consular activity outside of normal operating patterns, unusual timing of issuances, adjudications made by someone unauthorized to do so by controlled systems, and overrides of visa refusals, and would also result in further inquiry into the anomalies. Consular Affairs indicated that the software enhancements’ usefulness would be tested beginning in late September 2005. Between 2001 and 2004, Diplomatic Security substantiated through investigation 28 cases of U.S. employee visa malfeasance that resulted in various actions. In examining these case files, we could not discern why the malfeasance occurred in part because the data were not contained in Diplomatic Security case files or because in some instances the case was ongoing. However, in examining case data on several prosecuted cases, we found that a breakdown in post adherence to internal controls could have been a contributing factor. Several factors impede visa malfeasance investigations, including differences in U.S. and foreign laws, investigative techniques, and other issues. Malfeasance prosecutions also face several impediments. Cases are opened only for those allegations found to be supported by some evidence, even if that evidence is eventually determined to be unreliable. Allegations of visa malfeasance, initiated from tips or reporting of suspicious activity, are vetted through post security officers and investigated when warranted. According to Diplomatic Security Investigators, the investigative process can result in several outcomes: unfounded, with no reliable evidence found to support the allegation; unsubstantiated, with some evidence found that might indicate wrongdoing, but not sufficient to establish culpability and build a criminal case; or substantiated, with sufficient evidence found to support the allegation of malfeasance. Substantiated cases lead to further investigation and typically result in resignation, termination, arrest, or referral to Justice for criminal prosecution. The 28 substantiated cases of visa malfeasance between 2001 and 2004 resulted in various dispositions, according to Diplomatic Security records. Thirteen investigations resulted in arrests, 13 resulted in termination of the employee, and 2 resulted in employee resignations. Generally, the officers involved in these cases were arrested and the majority of Foreign Service Nationals were terminated. Most of the 28 cases we reviewed involved the alleged sale of visas by both consular and other post officers and Foreign Service nationals. However, possibly because the information provided was not complete, we could not identify any particular trend in the cases we reviewed covering 2001 to 2004 or in the 28 cases that were substantiated. Diplomatic Security does not have the capability to automatically pinpoint specific types of visa malfeasance or perform trend analyses. As a law enforcement entity, Diplomatic Security and its regional security officers overseas focus on gathering sufficient evidence to substantiate the allegation and do not focus on what allowed the alleged activity to occur. Consequently, in reviewing the information provided, we could not consistently determine across cases, for example, how the alleged malfeasance was discovered, the exact nature of the malfeasance, the rank of the individual allegedly involved in the malfeasance, and whether similar allegations were made when the individual was at other posts. This type of information would benefit investigations and could be a tool for consular management’s monitoring and training efforts. Diplomatic Security officials acknowledged this capability would be useful but noted that progress in developing this capability has been slow because Diplomatic Security has other priorities. Of the 28 cases substantiated, at least 10 individuals have been prosecuted. The individuals prosecuted received prison terms ranging from 18 to 63 months, and two individuals were given probation. In some of these cases, it appeared that the lack of adherence to internal controls could have played a role in allowing employee malfeasance to go undetected for a considerable period of time. Consular officials indicated that strict compliance to internal controls could not prevent malfeasance. However, they acknowledged that lack of strict compliance could create an environment that would make it easier to commit malfeasance. The following are examples of visa malfeasance or alleged visa malfeasance and how lack of strict compliance with internal controls may have been a contributing factor in creating an environment where the malfeasance could take place. Consular Affairs requires supervisors to review reports on visa refusals and issuances to detect anomalous activity. Between 2000 and 2003, two consular employees at one post sold visas to unqualified applicants. Diplomatic Security said it did not know how many visas were sold. However, 181 visas were revoked after the malfeasance was discovered. Diplomatic Security believes that many of the persons with revoked visas had already entered the country. We believe that strict compliance with internal controls could have identified this malfeasance earlier. Applicants for nonimmigrant visas generally apply at an embassy or consulate with jurisdiction over their place of normal residence, although they are not required to do so. However, in this case, there were a large number of third country nationals receiving visas from the same officer. Supervisory review of the issuances to the third country nationals or review of a standard report on visa issuances could have alerted management to this unusual activity. The consular officer ceased the illegal activity following a supervisory reprimand but soon was able to resume selling visas. The convicted employees received a 63-month sentence and forfeited $750,000 in illicit gains. Consular managers are required to continually oversee visa functions and suspicions of malfeasance must be examined carefully. Between 2000 and 2002 a senior consular officer at a small post accepted fraudulent applications and documents from a visa broker, issued them outside the normal process, and returned visas to the broker. After a supervisory reprimand, the officer revised the fraud scheme and conspired with the broker to approve visas for applicants with false passports. The officer received money for processing 85 visas, was convicted, and received a 24-month sentence. During the course of our work, State reported another case of visa malfeasance where we believe that lack of strict compliance with internal controls could have been a contributing factor. State requires consular and post management to periodically review referral activities and check on the return rates of applicants receiving a visa. Between 1999 and 2001, a State political officer at a small post allegedly referred unqualified applicants for visas, according to a State press release issued in April 2005. In the absence of the senior consular officer, the political officer was also responsible for visa adjudications and allegedly provided blank visa applications to an individual, assisted in filling them out, and then issued them to unqualified applicants. In return for these services the officer allegedly received a vintage BMW motorcycle. The officer was arrested in 2005. Consular Affairs emphasized that although some of its officers have engaged in visa malfeasance, other U.S. government employees and Foreign Service nationals have as well. Between 2000 and 2001, a U.S.- based Foreign Agricultural Service officer recommended 99 unqualified applicants and was able to influence the visa process through his recommendations and the submission of fraudulent documents, according to court documents. In exchange, the officer received bribes totaling $77,400. The officer, who was given the names of ineligible applicants by visa brokers, provided the applicants, on U.S. Department of Agriculture letterhead, letters stating that the individuals were agricultural specialists invited to the United States for official meetings. The officer then sent follow-up faxes to posts confirming the invitations. The individuals, who all listed the same destination address, presented the letters at embassy visa offices and unlawfully obtained visas. The officer was sentenced to 21 months in prison for participating in the visa malfeasance scheme. Visa malfeasance investigations are impeded by several factors, according to Diplomatic Security officials, including untimely reporting of alleged visa malfeasance. The ability to gather evidence is adversely affected, for example, when allegations are made several years after the alleged malfeasance occurred and witnesses have been reassigned, or are unavailable. In particular, entry-level officers, fearing reprisal, may delay reporting malfeasance until after they have been reassigned to a new post, according to State officials. In such cases, reconstructing the actions constituting any malfeasance is difficult because years may have passed since the incident occurred. When visa malfeasance occurs overseas, differences in legal systems can pose obstacles to investigators. Local laws may not permit the use of U.S. investigative techniques such as recorded conversations, undercover operations, or interrogation of suspects, according to Diplomatic Security officials. Additionally, according to Diplomatic Security investigators, investigations of local employees may be complicated due to differences in U.S. and foreign laws. According to Diplomatic Security officials, bribery is not a criminal offense in some countries and therefore it is difficult and sometimes impossible to obtain local warrants for searches in these countries. Conflicting priorities may also impede evidence gathering. For example, at one post, the Diplomatic Security investigator noted that he had to concentrate on ensuring the security of the post and was not able to devote adequate attention to investigating a recent allegation of visa malfeasance. Diplomatic Security officials confirmed that protecting personnel and infrastructure is the first priority of post security officers. Additionally, when malfeasance is suspected, Consular Affairs’ and Diplomatic Security’s differing objectives may affect evidence gathering. Diplomatic Security officials abroad and in headquarters, as well as Justice officials, all noted that documenting the illegal activity and gathering a sufficient amount of evidence to make a criminal case often requires allowing the suspect to continue working, unaware of the investigation. Consular Affairs noted that when this occurs, consular management closely reviews the suspect’s adjudications and monitors his or her activities to prevent issuances to ineligible applicants. However, Consular Affairs management interviewed on this issue expressed a preference for removing suspected individuals from their positions as quickly as possible. At one post, the ambassador, at the recommendation of the senior consular officer, took action to remove an employee under investigation in order to stop even the possibility that a visa could be issued to an ineligible applicant, thereby ending the covert investigation. As a result, a criminal case could not be developed, and the employee was dealt with administratively and was fired. Justice’s efforts to prosecute malfeasance are limited by a range of factors, including the inability to use U.S. warrants to search U.S. employees’ offices and residences overseas, according to Justice. U.S. magistrates generally cannot issue warrants for overseas searches. Further, Justice officials noted that they only accept for prosecution cases with sufficient evidence to warrant convictions. Under Rule 41 of the Federal Rules of Criminal Procedures, U.S. magistrates do not have the authority to issue search warrants for locations outside their districts, such as an embassy or residence overseas. According to Diplomatic Security officials, the ability to obtain U.S. search warrants, rather than relying on local warrants issued and executed by the host government, is important since investigations of visa malfeasance generally focus on embassy property or diplomatic residences. The U.S. mission and the residences of certain U.S. diplomats in country are inviolable, which means that agents of the host government may not enter the premises without the consent of the head of the mission, according to State officials. State officials also told us that the United States will never waive inviolability for the U.S. mission, and, therefore, investigators could not rely on a host country’s warrant to search an employee’s office at the U.S. mission. However, in certain instances, State officials said that they would waive inviolability for the personal residences of U.S. diplomats, located outside the U.S. mission. In instances where inviolability is waived, the United States can use current tools, such as letter rogatories and Mutual Legal Assistance Treaties, to request that a host government issue and execute a search warrant under the host government’s laws. Nonetheless, Diplomatic Security officials cited many difficulties they say can arise when using these tools. For example, according to these officials, differences between the United States’ and some host government’s techniques in gathering evidence can affect the admissibility of that evidence in U.S. courts. As a result of these and other difficulties, diplomatic security officials told us that they do not often utilize these tools to obtain local search warrants. In discussing with State and Diplomatic Security officials the possibility of obtaining additional search authorities under U.S. law, these officials raised issues regarding the magnitude of the need, as well as concerns over sovereignty and reciprocity. For example, Diplomatic Security officials indicated that in approximately six cases in the past year they would have wanted to conduct searches of employee residences and offices in connection with suspected visa malfeasance. State officials raised concerns that should the United States execute U.S. search warrants overseas, host governments could view this as a challenge to their sovereignty. Further, if the United States were to execute U.S. warrants overseas, the question arises whether the United States would have to extend the same privilege to foreign governments to execute their own warrants here in the United States. A visa system that is beyond reproach, with strong internal controls to protect against consular malfeasance, is critical to ensuring the integrity of visa decisions, national security, and U.S. immigration objectives. There is no way to prevent applicants from offering bribes; therefore, State recognizes that along with the integrity of its employees, an effective internal control program is needed to guard against employee malfeasance. Established internal controls make it more difficult for an employee to commit visa malfeasance. State has established a system of internal controls. However, at the posts we visited, we found that compliance with some of these internal controls was inconsistent. This increases the risk of visa malfeasance. Furthermore, most consular staff we spoke with did not know the appropriate way to report suspicions of employee visa malfeasance, which could hinder investigations. A further weakness to investigations is the lack of data on allegations and investigations to identify vulnerable points in the visa process. Finally, U.S. investigators cannot obtain a U.S. search warrant to search the offices or residences overseas of employees, which, according to Justice and Diplomatic Security officials, affects their ability to gather evidence in malfeasance cases. However, there are numerous factors that would need to be considered in pursuing additional search authorities. To emphasize the importance of internal controls to consular officers, section heads, and post managers, we recommend that the Secretary of State take the following two actions: Develop a strategy to achieve strict compliance with internal controls. The strategy should include a system to spot check compliance. The strategy should also include formalized procedures in Fraud Prevention Units to document how the post will address the risk of employee malfeasance and emphasize the importance of reporting suspected internal malfeasance to consular managers and post security officers. Improve State’s existing mechanisms to combat visa malfeasance. This could be accomplished by (1) improving the software available to the Vulnerability Assessment Unit to automatically sort data to identify and analyze abnormalities in post visa issuance statistics that could be an indication of malfeasance and (2) enhancing the investigative case tracking systems used by the Bureau of Diplomatic Security in order to better identify trends and vulnerabilities in the visa process for use by investigators and consular managers. We also recommend that the Secretary of State and the Attorney General determine whether seeking additional overseas search authorities is warranted to facilitate investigations of visa malfeasance. If they determine that such authorities are warranted, the Secretary of State and the Attorney General should develop an implementation plan and notify the Congress of any required legislative changes. We provided a draft of this report to the Departments of State and Justice. The Department of State provided written comments, which are included in appendix II. State concurred with our conclusions and recommendations and has begun taking actions to improve and monitor posts’ adherence to internal controls. Specifically, the department said it will review and approve post referral policies, and it has established an ombudsman to ensure that there is no undue influence on consular officers to issue visas. To monitor compliance with internal controls, the department plans to establish an automated control system for controlled items, field test an automated data mining system of consular activities, and launch a worldwide fraud case tracking system in 2006. Lastly, the department said it will work with the Attorney General to determine if additional authority for overseas searches of employees’ residences and offices is warranted and, if so, how it could best be achieved. Justice did not comment on our recommendations, but provided technical comments, which we incorporated in the report as appropriate. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its issue date. At that time, we will send copies of the report to relevant congressional committees and subcommittees, the Secretary of State, the Attorney General, and other interested parties. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-4128. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. The scope of our work covered the visa application and adjudication process at selected U.S. Consulates and Embassies overseas. To assess the policies and procedures governing visa operations, we obtained copies of written procedures and interviewed officials from the Bureau of Consular Affairs. At the embassies and consulates we visited, we interviewed foreign service nationals, foreign service officers, adjudicating officers, the Nonimmigrant Visa section chiefs, the consular section chiefs, and the deputy chiefs of mission or principal officers. When available, we also interviewed consuls general and ambassadors. To assess the internal controls designed to prevent the illegal provision of visas, we asked State to identify the policies, procedures, and key internal controls governing visa operations. State identified a number of key internal controls, and, in particular, identified the Consular Management Handbook (Chapter 600), their Standard Operating Procedures, and the relevant sections of the Foreign Affairs Manual as sources for these controls. We obtained and examined the Department of State’s Consular Management Handbook, Standard Operating Procedures, key sections of the Foreign Affairs Manual, and documents related to how the department develops and enforces standards of conduct for visa adjudication officers from the department’s Bureau of Consular Affairs. To determine if supervisors were reviewing records of visa issuances, we reviewed on line reports at posts and at the Vulnerability Assessment Unit (VAU). To assess whether the key internal controls were being followed, we examined post records for the year preceding our visit, except in the case of referral policies, where we examined judgmental samples of four months of referrals at each post. We visited 11 consular posts in six countries to observe and verify the implementation of the key internal controls. These posts are Nogales, Guadalajara, and Mexico City, Mexico; Quito and Guayaquil, Ecuador; Lima, Peru; Ho Chi Minh City and Hanoi, Vietnam; Bangkok and Chiang Mai, Thailand; and Mumbai, India. To select the posts to visit, we reviewed overall post staffing data and issuance rates and selected posts that had both large and small staffing levels with varied experience. Selected posts performed a varying amount of adjudications, and some had regional responsibilities for fraud detection and investigations. Some posts had also undergone internal reviews and permitted examination of external oversight functions. Lastly, some posts selected had been the subject of fraud allegations, enabling the review of investigative procedures. Our reported results apply to the posts we visited, and we cannot generalize the results to posts not visited. To assess the nature and extent of malfeasance, we examined records provided by State’s Bureau of Diplomatic Security on investigations of visa malfeasance involving employees between 2001 and 2004. We reviewed 140 cases collected by Diplomatic Security covering alleged visa malfeasance involving employees over the last 4 years. The cases reviewed represented 2004, 2003, and 2002, as well as prominent, but not all cases from 2001. The reports included information on the types of employees being investigated for visa malfeasance, such as U.S. Foreign Service officers, and employees of other U.S. government agencies overseas and locally hired staff. Diplomatic Security does not maintain automated data on employee malfeasance, and it obtained these reports for us by reviewing its files on all types of visa fraud and identifying those where employee malfeasance was involved. While Diplomatic Security reported that it made its best efforts to obtain complete data from 2002 through 2004, it could not assure us that it had identified every case that had been opened and involved employee malfeasance. These data covered 2001 to 2004 because this was the most recent information available. However, there were a number of limitations in these data. For example, the information available did not include a comprehensive set of allegations, nor completely describe the nature of the fraudulent activity under investigation. We determined that these data were sufficiently reliable to provide details on approximate figures of the employee malfeasance cases that were opened, as well as details about the types of cases. We also obtained information from the Department of Justice on visa fraud prosecutions by the Public Integrity Section conducted between January 2001 and March 2005. These data allowed us to determine how many cases this office in Justice has pursued in the last 4 years, as well as the status or outcome of those cases. Additionally, we interviewed officials from State’s Office of the Inspector General, Consular Affairs’ Office of Fraud Prevention, and its VAU. We observed VAU officials as they conducted their analysis and queries. We interviewed the fraud prevention staff and management at all the embassies and consulates visited, and also interviewed the Regional Security Officers and Assistant Regional Security Officers/Investigators at all posts where such officers were posted and available. To determine how State and Justice interact to investigate suspicious activity and allegations of employee malfeasance, we interviewed officials from State’s Bureaus of Consular Affairs and Diplomatic Security, and Justice’s Criminal Division, Public Integrity Section, and the Executive Office for United States Attorneys. We conducted our work from August 2004 through July 2005 in accordance with generally accepted government auditing standards. In addition to the person named above, John Brummet, Assistant Director; Claude Adrien; Joseph Carney; Martin de Alteriis; Etana Finkler; Patricia Martin; and Mary Moutsos made key contributions to this report.

Summary: Issuing a U.S. visa to a foreign citizen in exchange for money or something of value is a crime that can facilitate entry into the United States of unqualified persons, including those who may wish to do our country harm. Internal controls make it difficult for an employee to commit visa malfeasance without being detected, but, despite these safeguards, visa malfeasance does occur. GAO examined (1) State's internal controls to prevent nonimmigrant visa malfeasance and if they are being implemented and (2) visa malfeasance cases from 2001-2004 and factors cited by State and the Department of Justice (Justice) that contributed to visa malfeasance and affected investigations and prosecutions. State has a set of internal controls to prevent visa malfeasance and has taken actions to improve them; however, these internal controls are not being fully and consistently implemented by the posts we visited. While State's controls are consistent with accepted control standards, we found noncompliance with required supervisory oversight at 6 of the 11 posts we visited. This included failure to inventory items used to issue visas, review visa decisions, and follow State's procedures when issuing visas for applicants referred by officers within the post. Lack of full compliance with internal controls increases vulnerability to visa malfeasance. State recently established two headquarters entities to monitor post visa operations. While stronger oversight should help strengthen compliance with internal controls, State has not developed automated software to sort and analyze abnormalities in visa issuances that could indicate potential malfeasance. The Bureau of Diplomatic Security substantiated 28 visa malfeasance cases between 2001 and 2004 involving U.S. employees. The suspects were fired, chose to resign, or were arrested. State investigators could not tell us how many opened cases were referred to Justice for possible prosecution because they had not been routinely collecting that information. In fact, their case records did not permit investigators to identify malfeasance trends or consular managers to identify internal control weaknesses needing attention. Justice's Public Integrity Section successfully prosecuted 10 U.S. government employees. State Diplomatic Security and Justice officials noted that their investigations and prosecutions were impeded by constraints on evidence gathering. Additionally, investigators can not obtain U.S. search warrants to search consular officer's offices or residences overseas. Justice and State are discussing the possibility of pursuing legal changes and other means to address these constraints.