The US-VISIT expenditure plan partially satisfies 8 of the 11 legislative conditions required of DHS. For example, the plan partially satisfies the legislative conditions that it contain a listing of all open GAO and DHS Office of Inspector General recommendations. Specifically, while the plan did include a listing and status of our recommendations, it did not provide milestones for addressing any of the recommendations, as required by the act. include a certification by the DHS Chief Procurement Officer that the program was reviewed and approved in accordance with the department’s investment management process and that this process fulfilled all capital planning and investment control requirements and reviews established by the Office of Management and Budget (OMB). While the plan did include such a certification, it was based on information that pertains to the fiscal year 2007 expenditure plan and the fiscal year 2009 budget submission, rather than on the fiscal year 2008 expenditure plan, as required by the act. include an architectural compliance certification by the Chief Information Officer that the system architecture of the program is sufficiently aligned with the information system enterprise architecture of DHS. Specifically, while the plan did include such a certification, the basis for the certification was an assessment against the 2007 DHS enterprise architecture, which is a version that we recently reported to be missing important US-VISIT architectural content. provide a detailed accounting of operations and maintenance, contractor services, and program management costs. While the plan did provide an accounting of operations and maintenance, and program management costs, it did not separately identify the program’s contractor costs, as required by the act. The plan does not satisfy the remaining three conditions that apply to DHS. Specifically: The expenditure plan did not explicitly define how funds are to be obligated to meet future program commitments, including linking the planned expenditure of funds to milestone-based delivery of specific capabilities and services. While the plan linked funding to four broad core capability areas and associated projects, it did not link this planned use of funds to milestones, and it did not consistently decompose projects into specific mission capabilities, services, performance levels, benefits and outcomes, or program management capabilities. The expenditure plan did not include a certification by the DHS Chief Human Capital Officer that the program’s human capital needs are being strategically and proactively managed and that the program has sufficient human capital capacity to execute the expenditure plan. While the plan contained a certification, it only addressed that the human capital plan reviewed by the Chief Human Capital Officer contained specific initiatives to address the hiring, development, and retention of program employees and that a strategy existed to develop indicators to measure the progress and results of these initiatives. It did not address the implementation of this plan or whether the current human capital capabilities were sufficient to execute the expenditure plan. The expenditure plan did not include a complete schedule for the full implementation of a biometric exit program or certification that a biometric exit program is not possible within 5 years. While the plan contains a very high-level schedule that identifies five broadly defined tasks and high-level milestones, the schedule did not include, among other things, decomposition of the program into a work breakdown structure or sequencing, integrating, or resourcing each work element in the work breakdown structure. We are making five observations about US-VISIT relative to its proposed exit solution, its management of program risks, and its use of earned value management. These observations are summarized here. Reliability of cost estimates for air and sea exit alternatives is not clear. In developing its air and sea exit Notice of Proposed Rule Making (NPRM), DHS is required to prepare a written assessment of the costs, benefits, and other effects of its proposal and a reasonable number of alternatives and to adopt the least costly, most cost-effective, or least burdensome among them. To accomplish this, it is important that DHS have reliable cost estimates for its proposed and alternative solutions. However, the reliability of the estimates that DHS developed is not clear because (1) DHS documents characterize the estimates as being, by definition, rough and imprecise, but DHS officials responsible for developing the estimates stated that this characterization is not accurate; (2) our analysis of the estimates’ satisfaction of cost estimating best practices shows that while DHS satisfied some key practices, it did not fully satisfy others or the documentation provided was not sufficient for us to determine whether still other practices were met; and (3) data on certain variables pertaining to airline costs were not available for inclusion in the estimates, and airlines report that these costs were understated in the estimates. DHS reports that the proposed air and sea exit solution provides less security and privacy than other alternatives. Adequate security and privacy controls are needed to assure that personally identifiable information is secured against unauthorized access, use, disclosure, or retention. Such controls are especially needed for government agencies, where maintaining public trust is essential. In the case of US-VISIT, one of its stated goals is to protect the security and privacy of U.S. citizens and visitors. DHS’s proposed air and sea exit solution would require air and vessel carriers to implement and manage the collection of biometric data at the location(s) of their choice. However, the NPRM states that having carriers collect the biometric information is less secure than alternatives where DHS collects the information, regardless of the information collection point. Similarly, the NPRM states that the degree of confidence in compliance with privacy requirements is lower when DHS does not maintain full custody of personally identifiable information. Public comments on the proposed air and sea exit solution raise a range of additional concerns. Ninety-one entities—including the airline, trade, and travel industries, as well as federal, state, and foreign governments—commented on the air and sea exit proposal. The comments that were provided raised a number of concerns and questions about the proposed solution. For example, comments stated that (1) technical requirements the carriers must meet in delivering their respective parts of the proposed solution had yet to be provided; (2) the proposed solution conflicts with air and vessel carrier passenger processing improvements; (3) the proposed solution is not fully integrated with other border screening programs involving air carriers; and (4) stakeholders were not involved in this rulemaking process as they had been in previous rulemaking efforts. Risk management database shows that some program risks have not been effectively managed. Proactively managing program risks is a key acquisition management control and, if defined and implemented properly, it can increase the chances of programs delivering promised capabilities and benefits on time and within budget. To its credit, the US-VISIT program office has defined a risk management plan and related process that is consistent with relevant guidance. However, its own risk database shows that all risks have not been proactively mitigated. As we have previously reported, not proactively mitigating risks increases the chances that risks become actual cost, schedule, and performance problems. Significance of a task order’s schedule variances have been minimized by frequent rebaselining. According to the GAO Cost Assessment Guide, rebaselining should occur rarely, as infrequently as once in the life of a program or project. Schedule rebaselining should occur only when a schedule variance is significant enough to limit its utility as a predictor of future schedule performance. For task order 7, the prime contractor’s largest task order, the program office has rebaselined its schedule twice in the last 2 years—first in October 2006 and again in October 2007. This rebaselining has resulted in the task order showing a $3.5 million variance, rather than a $7.2 million variance that would exist without either of the rebaselinings. DHS has not adequately met the conditions associated with its legislatively mandated fiscal year 2008 US-VISIT expenditure plan. The plan does not fully satisfy any of the conditions that apply to DHS, either because it does not address key aspects of the condition or because what it does address is not adequately supported or is otherwise not reflective of known program weaknesses. Given that the legislative conditions are intended to promote the delivery of promised system capabilities and value, on time and within budget, and to provide Congress with an oversight and accountability tool, these expenditure plan limitations are significant. Beyond the expenditure plan, other program planning and execution limitations and weaknesses also confront DHS in its quest to deliver US- VISIT capabilities and value in a timely and cost-effective manner. Most notably, DHS has proposed a solution for a long-awaited exit capability, but it is not clear if the cost estimates used to justify it are sufficiently reliable to do so. Also, DHS has reported that the proposed solution provides less security and privacy than other alternatives analyzed, and the proposed solution is being challenged by those who would be responsible for implementing it. Further, DHS’s ability to measure program performance and progress, and thus be positioned to address cost and schedule shortfalls in a timely manner, is hampered by weaknesses in the prime contractor’s implementation of earned value management. Each of these program planning and execution limitations and weaknesses introduce risk to the program. In addition, DHS is not effectively managing the program’s risks, as evidenced by the program office’s risk database showing that known risks are being allowed to go years without risk mitigation and contingency plans. Overall, while DHS has taken steps to implement a significant percentage of our prior recommendations aimed at improving management of US-VISIT, additional management improvements are needed to effectively define, justify, and deliver a system solution that meets program goals, reflects stakeholder input, minimizes exposure to risk, and provides Congress with the means by which to oversee program execution. Until these steps are taken, US-VISIT program performance, transparency, and accountability will suffer. To assist DHS in planning and executing US-VISIT, we recommend that the Secretary of Homeland Security direct the department’s Investment Review Board to review the reasons for the plan’s limitations and address the challenges and weaknesses raised by our observations about the proposed air and sea exit solution, risk management, and the implementation of earned value management, and to report the results to Congress. In written comments on a draft of this report, signed by the Director, Departmental Audit Liaison Office, and reprinted in appendix II, DHS concurred with our recommendations and stated that the department’s Investment Review Board would meet for the purpose of reviewing US- VISIT and addressing our findings and recommendations. Moreover, DHS commented that our report has prompted the department to modify the fiscal year 2009 US-VISIT expenditure plan to provide greater visibility into operations and maintenance and program management expenditures, and to include milestones and performance targets for planned accomplishments, mitigation plans, milestones for closing open recommendations, and results relative to prior year commitments. DHS also commented that after it received our report for comment, it issued an interim policy for managing investments, such as US-VISIT, and thus it disagreed with one of our findings relative to one of the legislative conditions—namely that DHS’s investment management process is not sufficiently mature. However, DHS did not provide the policy itself, thus we were not able to determine whether it addressed our concerns. Further, the memo states that the policy is draft and that implementation of the policy, including training, still needs to occur. Thus, while we have modified our briefing document to reflect the policy’s issuance, we have not modified our conclusion that DHS’s investment management process is not sufficiently mature. We are sending copies of this report to the Chairmen and Ranking Minority Members of other Senate and House committees and subcommittees that have authorization and oversight responsibilities for homeland security. We are also sending copies to the Secretary of Homeland Security, Secretary of State, and the Director of OMB. Copies of this report will also be available at no charge on our Web site at http://www.gao.gov. If you or your staffs have any questions on matters discussed in this report, please contact me at (202) 512-3439 or at hiter@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who have made significant contributions to this report are listed in appendix III. Briefing for staff members of the Subcommittees on Homeland Security Senate and House Committees on Appropriations *This briefing has been amended on page 44 to address DHS comments. U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) is a Department of Homeland Security (DHS) program for collecting, maintaining, and sharing information on foreign nationals who enter and exit the United States. The goals of US-VISIT are to: enhance the security of U.S. citizens and visitors, facilitate legitimate travel and trade, ensure the integrity of the U.S. immigration system, and protect the privacy of our visitors. Pub. L. No. 110-161 (Dec. 26, 2007). Since fil yer 2002, $2.22 illion has een pproprited for US-VISIT. Thi the eventh legitively-mndted US-VISIT expenditre pln. 4 control requirements and reviews established by the Office of Management and Budget (OMB), including Circular A-11, part 7; a certification by the DHS Chief Information Officer (CIO) that an independent verification and validation agent is currently under contract for the project; a certification by the DHS CIO that the system architecture of the program is sufficiently aligned with the department’s information systems enterprise architecture to minimize future rework, including a description of all aspects of the architectures that were and were not assessed in making the alignment determination, the date of the alignment determination, and any known areas of misalignment, along with the associated risks and corrective actions to address any such areas; a certification by the DHS CPO that the plans for the program comply with federal acquisition rules, requirements, guidelines, and practices, and a description of the actions being taken to address any areas of noncompliance, the risks associated with them, along with any plans for addressing these risks and the status of their implementation; a certification by the DHS CIO that the program has a risk management process that regularly identifies, evaluates, mitigates, and monitors risks throughout the system life cycle, and communicates high-risk conditions to agency and DHS investment decision makers, as well as a listing of all the program’s high risks, and a status of efforts to address them; 5 a certification by the DHS Chief Human Capital Officer (CHCO) that the human capital needs of the program are being strategically and proactively managed, and that current human capital capabilities are sufficient to execute the plans discussed in the report; a complete schedule for the full implementation of a biometric exit program or a certification that such a program is not possible within 5 years; a detailed accounting of operations and maintenance, contractor services, and program management costs associated with the program. The act also requires that we review this plan. DHS submitted its fiscal year 2008 US- VISIT expenditure plan to the House and Senate Appropriations Subcommittees on Homeland Security on June 12, 2008. As agreed, our objectives were to (1) determine whether the plan satisfies the legislative conditions and (2) provide observations about the plan and management of the program. A diussed in the cope nd methodology ection of thi riefing (ttchment 1), we ght clrifiction from ff with the Housnd Sente Approprition Committee, Subcommittee on Homelnd Secrity, on thi condition. A result, the wording of thi condition has een modified lightly from tht in the ct. 6 To accomplish the first objective, we compared the information provided in the plan with each aspect of the eleven conditions. Further, for those conditions requiring a DHS certification, we analyzed documentation, interviewed cognizant officials, and leveraged our recent work to determine the basis for each certification. We then determined whether the plan satisfies, partially satisfies, or does not satisfy the conditions based on the extent to which (1) the plan addresses all aspects of the applicable condition, as specified in the act or (2) the applicable certification letter contained in the plan (a) addresses all aspects of each condition, as specified in the act, (b) is sufficiently supported by documented and verifiable analysis, (c) contains significant qualifications, and (d) is otherwise consistent with our related findings. To accomplish the second objective, we analyzed DHS’s Notice of Proposed Rule Making (NPRM) for Air/Sea Exit, the Regulatory Impact Analysis, Privacy Impact Assessment, and US-VISIT’s Exit Pilot Report. We also compared available information on the US- VISIT prime contractor’s implementation of earned value management and the program office’s implementation of risk management to relevant guidance. (See attachment 1 for more detailed information on our scope and methodology.) 9 The reliability of DHS Air and Sea Exit cost estimates is not clear for various reasons, including program officials’ statements that contradict how the department characterized the estimates in the public documents and supporting documentation about the estimates’ derivation that we have yet to receive. The proposed Air and Sea Exit solution, according to DHS, would provide less security and privacy than other alternatives, because it relies on private carriers to collect, store, and transmit passenger data. Comments on the Proposed Air and Sea Exit solution, provided by airlines and others, raised a number of additional stakeholder concerns, such as conflicts with air carrier business models and impact on trade and travel. The program office’s risk database shows that risk mitigation and contingency plans have not been developed and implemented in a timely fashion for a number of risks, which increases the chances that known risks will become actual problems. Significant schedule variances are being minimized by frequent redefinition of baselines, thus limiting the use of earned value management as a performance management tool. We provided a draft of this briefing to DHS officials, including the Director of US-VISIT. While these officials did not state whether they agreed or not with our findings, conclusions, or recommendations, they did provide a range of technical comments, which we have incorporated into the briefing, as appropriate. They also sought clarification on our scope and methodology, which we have also incorporated into the briefing. The strategic goals of US-VISIT are to enhance the security of U.S. citizens and visitors, facilitate legitimate travel and trade, ensure the integrity of the U.S. immigration system, and protect the privacy of our visitors. It is to accomplish these things by: collecting, maintaining, and sharing biometric and other information on certain foreign nationals who enter and exit the United States; identifying foreign nationals who (1) have overstayed or violated the terms of their admission; (2) can receive, extend, or adjust their immigration status; or (3) should be apprehended or detained by law enforcement officials; detecting fraudulent travel documents, verifying traveler identity, and determining traveler admissibility through the use of biometrics; and facilitating information sharing and coordination within the immigration and border management community. As defined in expenditure plans prior to fiscal year 2006, US-VISIT biometric entry and exit capabilities were to be delivered in four increments. Increments 1 through 3 were to be interim, or temporary, solutions that would focus on building interfaces among existing (legacy) systems; enhancing the capabilities of these systems; and deploying these systems to air, sea, and land ports of entry (POEs). Increment 4 was to be a series of yet-to-be-defined releases, or mission capability enhancements, that were to deliver long-term strategic capabilities for meeting program goals. Increments 1 through 3 have produced an entry capability that began operating at over 300 POEs by 2006. (See the system diagram on the next slide for an overview of this entry capability; attachment 3 provides further details on each of the systems.) For detil on the process nderlying ech increment nd tem supplying informtion on US-VISIT, ee ttchment 3. Increment 4 has continued to evolve. The fiscal year 2006 expenditure plan described increment 4 as the combination of two projects: (1) Transition to 10 fingerprints in the Automated Biometric Identification System (IDENT) and (2) interoperability between IDENT and the Federal Bureau of Investigation’s (FBI) Integrated Automated Fingerprint Identification System (IAFIS). The fiscal year 2007 expenditure plan combines these two projects with a third project called Enumeration (developing a single identifier for each individual) into a larger project referred to as Unique Identity. During fiscal year 2007, the following Unique Identity efforts were completed. The Interim Data Sharing Model (iDSM) was deployed. It allows sharing of certain biometric information between US-VISIT and the FBI, as well as with the Office of Personnel Management and police departments in Houston, Dallas, and Boston. The next phase of IDENT/IAFIS interoperability (referred to as Initial Operating Capability) is to be deployed in October 2008. The 10-print scanners were deployed to 10 air locations for pilot testing. Deployment of the scanners to 292 POEs is to begin during fiscal year 2008 and is to be completed by December 2008. Also in fiscal year 2007, steps were taken relative to a biometric exit solution. Exit pilot projects were halted at 12 airports and 2 seaports in May 2007. Exit radio frequency identification proof-of-concept projects were discontinued at selected land ports in November 2006. Planning for an air and sea exit solution based on lessons learned from the pilot projects was begun, to include studying the costs, impacts, and privacy concerns of alternative solutions. The fiscal year 2008 expenditure plan provides additional information on these and other projects in the context of the program’s four core mission capabilities: (1) providing identity management and screening services, (2) developing and enhancing biometric identity collection and data sharing, (3) providing information technology support for mission services, and (4) enhancing program management. For example, under developing and enhancing biometric capabilities, the plan allocates $228 million for further development and deployment of Unique Identity and $13 million for development of an Air and Sea Exit solution. (See table on next slide). Rdio freqency technology relie on proximity crd nd crd reder. Rdio freqency device red the informtion contined on the crd when the crd iassed ner the device. The informtion cn contin peronl informtion of the crdholder. (dollars in millions) US-VISIT projects are subject to the program’s Enterprise Life Cycle Methodology (ELCM). Within ELCM is a component methodology for managing software-based system projects, such as Unique Identity and Air/Sea Exit, known as the US-VISIT Delivery Methodology (UDM). According to version 4.3 of UDM (April 2007), it applies to both new development and operational projects; specifies the documentation and reviews that should take place within each of the methodology’s six phases: plan, analyze, design, build, test, and deploy; and allows for tailoring to meet the needs and requirements of individual projects, in which specific activities, deliverables, and milestone reviews that are appropriate for the scope, risk, and context of the project can be set for each phase of the project. The chart on the following page shows the status of each US-VISIT project within the life cycle methodology as of August 2008. 20 task orders have been issued against this contract, and their total value is about $501 million. 11 of these task orders are ongoing, and their total value is about $331 million. The table on the following slides provides additional information about the ongoing task orders organized by the four core mission capabilities and projects. An indefinite delivery/indefinite quantity contrct provide for n indefinite quantity, within ted limit, of supplie or ervicering fixed period of time. The government chedle deliverie or performnce y plcing order with the contrctor. Accentre’rtner in thi contrct inclde, mong other, Rytheon Compny, the Titn Corportion, nd SRA Interntionl, Inc. Totl ve i the reported budget t completion as of My 2008. Approximate Value (dollars in millions) Develop and enhance biometric identity collection and data sharing capabilities Biometric oltion delivery Uniqe Identity 82.5 Plnning, development, nd implementtion of Uniqe Identity (IDENT/IAFIS integrtion nd IDENT 10-print) Approximate value (dollars in millions) Opertion nd mintennce IT ervice 27.7 Mgement of opertion nd mintennce ctivitie for deployed cabilitie Informtion technology ervice for implemented fnctionlity, inclding ecrity pgrde, tem chnge, etc. DHS issued a draft Investment Review Process guide in March 2006 that includes milestone decision points (MDP) linking five life cycle phases: project initiation (MDP1), concept and technology development (MDP2), capability development and demonstration (MDP3), production and deployment (MDP4), and operations and support (MDP5). Under the draft guide, a program sends an investment review request prior to the initial milestone date. The program is then to be reviewed by the DHS Enterprise Architecture Board (EAB), Joint Requirements Council and/or Investment Review Board, depending on such factors as the program’s cost and significance. According to the official from DHS’s Program Analysis and Evaluation Directorate who is responsible for overseeing program adherence to the investment control process, the draft guide is being used for all DHS programs, including US-VISIT. This official also stated that milestone reviews can be performed concurrently with an expenditure plan review. In December 2006, the DHS Investment Review Board held an MDP1 review of US- VISIT. Since then, the EAB held an MDP2 review in April 2007, and the EAB is currently performing an MDP3 review. Neither the Joint Requirements Council nor the Investment Review Board have reviewed US-VISIT since MDP1. On April 24, 2008, DHS published its NPRM for establishing a biometric exit capability at commercial air and sea ports. At the same time, it published an Air/Sea Biometric Exit Regulatory Impact Analysis providing information on the projected costs and benefits of several alternatives discussed in the proposed rule. Key aspects of the NPRM are summarized here. The proposed rule would require aliens who are subject to US-VISIT biometric requirements on entry at POEs to provide biometric information to commercial carriers before departing air and sea POEs. The rule also proposed that the biometric information collected be submitted to DHS within 24 hours of securing the airplane doors for air travel or departing the seaport. According to the NPRM, these requirements would not apply to persons departing on certain private or small carriers. The proposed rule discussed nine exit alternatives for collecting biometrics: (1) at the check-in counter by air and vessel carriers, (2) at the check-in counter by DHS, (3) at the security checkpoint by DHS, (4) at the departure gate by air and vessel carriers, (5) at the departure gate by DHS, (6) at the check-in counter by air and vessel carriers with verification at the departure gate, (7) at the check-in counter by DHS with verification at the departure gate, (8) at the security checkpoint by DHS with 24 verification at the departure gate, and (9) within the sterile area (after passing through the Transportation Security Administration checkpoint) by DHS. The following five alternatives were subject to further analysis of costs and benefits. Proposed Alternative: Air and vessel carriers implement and manage the collection of biometric data at location(s) of their choice. Alternative 1: Air and vessel carriers implement and manage the collection of biometric data at their check-in counter. Alternative 2: DHS implements and manages the collection of biometric data at the TSA Security checkpoint. Alternative 3: DHS implements and manages the collection of biometric data at location(s) of the air or vessel carrier’s choice. Alternative 4: DHS implements and manages the collection of biometric data at kiosks placed in various locations. Thi oltion wold not pplicable to vessel crrier ecause there re no TSA checkpoint port. 26 Objective 1: Legislative Conditions Of the 12 legislative conditions pertaining to DHS’s fiscal year 2008 expenditure plan for US-VISIT, the plan partially satisfies 8 and does not satisfy 3 of them. Our review has satisfied the remaining condition. Given that the act’s conditions are designed to help ensure that the program is effectively managed and that congressional oversight of program can occur, a partially or a not satisfied condition should be viewed as introducing risk to the program. Each of the conditions is addressed in detail on the following slides. 27 Objective 1: Legislative Conditions Condition 1 Condition 1. The plan partially satisfies the legislative condition to include a detailed accounting of the program’s progress to date relative to system capabilities or services, system performance levels, mission benefits and outcomes, milestones, cost targets, and program management capabilities. As we previously reported, describing how well DHS is progressing relative to US-VISIT program commitments (e.g., cost, schedule, capabilities, and benefits commitments) that it has made in previous expenditure plans is essential to permitting meaningful program oversight and promoting accountability for results. GAO, Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning, GAO-03-563 (Washington, D.C.: Jne 9, 2003) nd Homeland Security: Some Progress Made, but Many Challenges Remain on U.S. Visitor and Immigrant Status Indicator Technology Program, GAO-05-202 (Washington, D.C.: Fe. 23, 2005). 28 Objective 1: Legislative Conditions Condition 1 for an enhanced Candidate Verification Tool. However, the information presented is not always sufficient to measure progress. For example, The fiscal year 2007 plan stated that US-VISIT would begin 10-print pilot deployment in late 2007 to ten air locations, but the fiscal year 2008 plan only states that DHS selected a number of pilot locations and evaluated the performance and operational impacts at those locations. According to program officials, although the plan does not state the number of locations for the pilot, it was in fact deployed to ten locations, and this information has been previously provided to the Congress. The fiscal year 2008 plan describes progress in achieving some, but not all, system performance levels. For example, the fiscal year 2007 plan cited a target of 1,850 biometric watch list hits for travelers processed at POEs, and the latest plan reports that the number of these hits was 11,838. However, many of the target measures included in the fiscal year 2007 plan are not described in the current plan. For example, The fiscal year 2007 plan cited a target of having biometric information on file for 49 percent of foreign nationals prior to their entering the United States (also referred to as the “Unique Identity baseline”). However, this measure is not discussed in the fiscal year 2008 plan. 29 Objective 1: Legislative Conditions Condition 1 The fiscal year 2007 plan cited a target of 26 days for resolving requests by visitors to correct their baseline data. However, this measure is not discussed in the fiscal year 2008 plan. The fiscal year 2007 plan stated that US-VISIT would establish a baseline of the number of individuals who were biometrically verified based on 10-print enrollment. However, this baseline measure is not discussed in the fiscal year 2008 plan. According to program officials, although these measures are not mentioned in the expenditure plan, performance data relative to each is in fact collected and monitored. The fiscal year 2008 plan identifies estimated costs (i.e., funding levels) for each of the four broad capability areas. In some cases, the broad areas are decomposed and meaningful detail is provided to understand how the funds will be used. However, in many cases, capabilities and costs are not decomposed to a level that permits such understanding and oversight. For example, The fiscal year 2008 plan states that $7.9 million will be used for the Biometric Support Center. However, allocations for specific support center capabilities and services are not provided. 30 Objective 1: Legislative Conditions Condition 1 The fiscal year 2008 plan states that $72.6 million will be used to update DHS border and process technology in support of 10-print and IDENT/IAFIS interoperability. However, the funds are not allocated between the two activities or to major tasks, products, and services under each activity, such as the completion of initial operating capability for IDENT/IAFIS integration. The fiscal year 2008 plan states that $6.4 million will be used for data integrity efforts. However, the funds are not allocated among specific data integrity activities described in the plan, such as upgrading the integrity of the system and data to meet stakeholder needs. Furthermore, the fiscal year 2007 and 2008 plans use different terminology to describe categories of spending under the broad capability areas. For example, The fiscal year 2008 plan shows $5.0 million in fiscal year 2007 funds allocated to “Information Technology” under the “Comprehensive Biometric Exit Solution—Air and Sea” project, but the 2007 plan does not identify an “Information Technology” component to this project, but rather shows $5.0 million being allocated to “Planning and Design.” 31 Objective 1: Legislative Conditions Condition 1 The fiscal year 2008 plan shows $1.4 million in fiscal year 2007 funds allocated to “Law Enforcement and Intelligence” under Biometric Support Services, but the fiscal year 2007 plan does not identify a Law Enforcement and Intelligence component, but instead shows $1.4 million being allocated to “Management.” Objective 1: Legislative Conditions The plan cites the following benefits relative to the Comprehensive Biometric Exit Solution – Air and Sea project: “Provides greater accuracy in recording identity of persons leaving the country, enables improved assessment by DHS of travelers’ compliance with immigration laws, and enables DHS to more easily match records across multiple identities or travel documents.” However, since these benefits/outcomes are not linked to a baseline measure, and the amount of the expected improvement is not specified, the proposed benefits are not meaningful. The plan cites benefits from sharing biometric data globally, including enabling countries to redirect the course of an immigration claims or enforcement activity, improving the accuracy of records through vetting and validation, identifying patterns of legal and illegal migration, achieving efficiency savings, establishing the identities of individuals who sought benefits among partner agencies and governments, and helping to prevent fraud through identity verification of individuals seeking benefits. However, it does not link any of these benefits to specific baseline measures. 33 Objective 1: Legislative Conditions Condition 1 The fiscal year 2008 plan cites high-level milestones that are traceable to the prior plan. However, neither of the plans provides enough specificity to measure progress. For example: The fiscal year 2007 plan stated that the first phase of IDENT/IAFIS interoperability was implemented via the iDSM prototype in 2006. It also identified high-level activities to design, build, and deploy the initial operating capability for IDENT/IAFIS interoperability, such as advancing the data sharing architecture and enabling the assignment of a unique number to each individual. While the fiscal year 2008 plan states that some of these efforts were completed, neither plan provided specific milestones to measure progress. The fiscal year 2007 plan stated that efforts to deploy a biometric exit solution for air and sea environments would be launched. While the fiscal year 2008 plan states that US-VISIT developed a Comprehensive Biometric Exit strategy and began planning to address the air and sea environments, neither plan provided specific milestones to measure progress. 34 Objective 1: Legislative Conditions Condition 1 The fiscal year 2008 plan discusses several initiatives to enhance and leverage key program management capabilities, such as continuing efforts to improve the program’s use of earned value management, the maturity of software acquisition/ development processes, and the quality of internal governance. In some cases, the plan cites program management efforts that can be traced to the fiscal year 2007 plan. For example, the fiscal year 2007 plan stated that an assessment of the prime contractor’s earned value management system was to be conducted during fiscal year 2007. According to the fiscal year 2008 plan, an assessment was completed in June 2007 that identified a number of weaknesses, a plan of action and milestones was developed to address the weaknesses, and this plan is to be executed in 2008. (These weaknesses are discussed in detail later in this briefing.) However, the fiscal year 2008 plan also identifies program management capability improvements that are not traceable to prior plan commitments. For example, the fiscal year 2008 plan states that a Planning, Programming, Budgeting, and Execution process was developed during fiscal year 2007. However, this effort was not mentioned in the prior plan as a commitment and thus as a basis for measuring progress. 35 Objective 1: Legislative Conditions Condition 2 Condition 2. The plan does not satisfy the condition that it include an explicit plan of action defining how all funds are to be obligated to meet future program commitments, with the planned expenditure of funds linked to the milestone-based delivery of specific capabilities, services, performance levels, mission benefits and outcomes, and program management capabilities. As we have previously reported, the purpose of the expenditure plan is to provide Congress with sufficient information to exercise effective oversight of US-VISIT and to hold DHS accountable for results. As such, the plan should specify planned system capabilities, schedules, costs, and expected benefits for each of its projects and for its program management activities. While the fiscal year 2008 plan links funding to four broad core capability areas and associated projects, it does not link this planned use of funds to milestones and it does not consistently decompose projects into specific mission capabilities, services, performance levels, benefits and outcomes, or program management capabilities. GAO, Homeland Security: U.S. Visitor and Immigrant Status Program’s Long-standing Lack of Strategic Direction and Management Controls Needs to Be Addressed, GAO-07-1065 (Washington, D.C.: Ag. 31, 2007). 36 Objective 1: Legislative Conditions Condition 2 To illustrate, the expenditure plan allocates funding among the program’s four broad core capability areas. For one of these capability areas, the plan identifies major projects, such as Unique Identity and Comprehensive Biometric Exit Solution—Air and Sea. These projects are then decomposed into general functional activities (e.g., project integration and analysis, and acquisition and procurement), which are then associated with fiscal year 2007 and 2008 funding. However, these functional activities do not constitute specific capabilities, services, performance levels, or benefits. Rather, they represent functions to be performed that presumably will produce such capabilities, services, performance levels, or benefits. Similarly, the remaining three core capability areas are also divided into general functional activities (e.g., biometric support, data integrity, program staffing, data center operations) that do not constitute capabilities, services, performance levels, or benefits. Moreover, the funding associated with the broad core capability areas, projects, or functional activities is not linked to any milestones. For example, the plan states that $72.6 million of fiscal year 2008 funds will be used to update DHS border and process technology for 10-print transition and IDENT/IAFIS, but does not state what updates will be accomplished or by when. The plan also states that $45.1 million will be used to operate and maintain applications, but does not state what maintenance activities will be performed and when they will be performed. 37 Objective 1: Legislative Conditions Condition 3 Condition 3. The plan, including related program documentation and program officials’ statements, partially satisfies the condition that it include a listing of all open GAO and OIG recommendations related to the program and the status of DHS actions to address them, including milestones. We reported in August 2007 that US-VISIT’s progress in implementing our prior recommendations had been slow, as indicated by the 4-year-old recommendations that were less than fully implemented. Given that our recommendations focus on fundamental limitations in the management of US-VISIT, they are integral to DHS’s ability to execute its expenditure plans, and thus should be addressed in the plans. Since 2003, GAO has made 44 recommendations to the US-VISIT program. The fiscal year 2008 plan provides a listing and status of our recommendations. However, the plan does not provide milestones for addressing these recommendations. The table on the next slide summarizes our analysis of the status of our recommendations. GAO-07-1065. 39 Objective 1: Legislative Conditions Condition 4 Condition 4. The plan partially satisfies the condition that it include a certification by the DHS CPO that (1) the program has been reviewed and approved in accordance with the department’s investment management process and (2) the process fulfills all capital planning and investment control requirements and reviews established by the Office of Management and Budget (OMB), including Circular A-11, part 7. As we have previously reported, it is important for organizations such as DHS, which rely heavily on IT to support strategic outcomes and meet mission needs, to adopt and employ an effective institutional approach to IT investment management. Such an approach provides agency management with the information needed to ensure that IT investments cost-effectively meet strategic mission needs and that projects are meeting cost, schedule, and performance expectations. We have also reported that the capital investment control requirements and reviews outlined in the OMB Circular A-11, part 7, are important because they are intended to minimize a program’s exposure to risk, permit performance measurement and oversight, and promote accountability. Office of Mgement nd Bdget Circr A-11, Prt 7 eablihe policy for plnning, budgeting, cqition, nd mgement of federl cpitasset. GAO, Information Technology: DHS Needs to Fully Define and Implement Policies and Procedures for Effectively Managing Investments, GAO-07-424 (Washington, D.C.: April 27, 2007). GAO-07-1065. 40 Objective 1: Legislative Conditions Condition 4 On March 14, 2008, the DHS CPO certified that (1) US-VISIT was reviewed and approved in accordance with the department’s investment management process and (2) this process fulfills all capital planning and investment control requirements and reviews established by OMB, including Circular A-11, part 7. In support of certifying the first aspect of the condition, the CPO stated that OMB scored US-VISIT’s fiscal year 2009 budget submission (i.e., budget exhibit 300) a 35 out of a possible 50 in November 2007. According to OMB, this score means that the submission has “very few points . . . but still needs strengthening.” In addition, the CPO stated that the program had been reviewed by the DHS Investment Review Board in December 2006, and that the board had issued a decision memorandum in April 2007 stating that the fiscal year 2007 expenditure plan met, among other things, OMB capital planning and investment review requirements and satisfied that aspect of the DHS investment management process that requires investments to comply with DHS’s enterprise architecture. However, this support is not sufficient to fully satisfy the first aspect of the legislative condition because this condition applies to the fiscal year 2008 expenditure plan, and the support that the CPO cites does not relate to either the fiscal year 2008 budget submission or to the fiscal year 2008 expenditure plan. Rather, it pertains to the following year’s budget submission and the prior year’s plan. 41 Objective 1: Legislative Conditions Condition 4 In support of certifying the second aspect of the condition, the CPO again cites the fiscal year 2009 budget submission, which DHS documents show underwent a series of reviews and revisions before being sent to OMB that raised the department’s scoring of the submission from a 29 to a 37. According to OMB, a score of 29 means, among other things, that “much work remains to solidify and quantify” the submission. In certifying to this aspect, the CPO also stated that his office will continue to oversee US-VISIT through the department’s emerging investment management process. However, the cited support is not sufficient to satisfy the legislative condition for two reasons. As previously noted, the cited budget submission is for fiscal year 2009 rather than fiscal year 2008. GAO-07-424. GAO, Information Technology Investment: A Framework for Assessing and Improving Process Maturity, GAO-04-394G (Washington, D.C.: Mrch 2004). 42 Objective 1: Legislative Conditions Condition 4 and investment control requirements. In particular, we reported that: DHS’s process (policies and procedures) for project-level management do not include all key elements, such as specific criteria or steps for prioritizing and selecting new investments. DHS has not fully implemented the practices needed to control investments—at the project level or at the portfolio level, including regular project-level reviews by the DHS Investment Review Board. DHS’s process does not identify a methodology with explicit decision-making criteria to determine an investment’s alignment with the DHS enterprise architecture. 43 Objective 1: Legislative Conditions Condition 4 In its comments on a draft of this report, DHS disagreed that its investment management process is not sufficiently mature, stating that on November 7, 2008 it issued an interim operational policy for investment control that addresses the limitations that we reported in April 2007. However, because DHS’s comments only provided the memo that issued the interim policy, and not the policy itself, we have yet to review it to determine whether it addresses the above limitations. Also, the memo describes the interim policy as a “resulting draft” that is the product of an “informal staffing process” and that changes will be made to “the policy prior to completing this process.” Moreover, implementation of the policy, including training on its implementation, still needs to occur. Therefore, we continue to view DHS’s investment management process as not sufficiently mature. 44 Objective 1: Legislative Conditions Condition 5 Condition 5. The plan partially satisfies the condition that it include a certification by the DHS CIO that an independent verification and validation (IV&V) agent is currently under contract. As we have previously reported, IV&V is a recognized best practice for large and complex system development and acquisition programs, like US-VISIT, as it provides management with objective insight into the program’s processes and associated work products. On February 25, 2008, the former DHS Acting CIO conditionally certified that the program has an IV&V agent under contract. However, this certification was qualified to recognize that the contract only provided for IV&V services relative to testing system applications (i.e., it did not extend to other key program activities). Accordingly, the certification was made conditional on the program office providing an update on its efforts to award a contract for program-level IV&V by April 15, 2008. According to program officials, they are in the process of evaluating a program-wide IV&V contract proposal and plan to award a contract in September 2008. GAO, Homeland Security: First Phase of Visitor and Immigration Status Program Operating, but Improvements Needed, GAO-04- 586 (Washington, D.C.: My 11, 2004). 45 Objective 1: Legislative Conditions Condition 6 Condition 6. The plan partially satisfies the condition that it include a certification by the DHS CIO that the program’s system architecture is sufficiently aligned with the department’s enterprise architecture (EA), including a description of all aspects of the architectures that were and were not assessed in making the alignment determination, the date of the alignment determination, and any known areas of misalignment, along with the associated risks and corrective actions to address any such areas. According to federal guidelines and best practices, investment compliance with an EA is essential for ensuring that new and existing systems are defined, designed, and implemented in a way that promotes integration and interoperability and minimizes overlap and redundancy, thus optimizing enterprisewide efficiency and effectiveness. A compliance determination is not a one-time event that occurs when an investment begins, but rather occurs throughout an investment’s life cycle as changes to both the EA and the investment’s architecture are made. Within DHS, the EAB, supported by the Enterprise Architecture Center of Excellence, is responsible for ensuring that system investments demonstrate adequate technical and strategic compliance with the department’s EA. Chief Informtion Officer Concil, A Practical Guide to Federal Enterprise Architecture, Verion 1.0, Feuary 2001. GAO, Information Technology: A Framework for Assessing and Improving Enterprise Architecture Management (verion 1.1), GAO- 03-584G (Washington, D.C.: April 2003). 46 Objective 1: Legislative Conditions Condition 6 In early 2008, the DHS Acting CIO certified that the US-VISIT system architecture was aligned with the DHS EA based on an assessment of the program’s alignment to the 2007 version of DHS’s EA, which was conducted by the EAB in support of the program’s MDP2 review. Consistent with the legislative condition, the fiscal year 2008 expenditure plan includes the former Acting CIO’s certification, the date of the board’s conditional approval of architectural alignment for MDP2 (September 27, 2007) and the date of the certification (February 25, 2008). It also includes areas of misalignment and corrective actions to address the identified areas. Specifically, it identifies such areas of misalignment as US-VISIT requirements and products to support 10-print solution not having been defined and included in the 2007 EA technical reference model, and US-VISIT data standards not having been vetted with the DHS Enterprise Data Management Office for compliance. It states that corrective actions to address these areas were completed in September 2007, and that no outstanding MDP2 conditions remain. However, the certification does not fully satisfy the legislative conditions for three reasons. 47 Objective 1: Legislative Conditions Condition 6 First, the basis for the certification is an assessment against the 2007 EA, which is a version that we recently reported to be missing important US-VISIT architectural content.Further, while DHS recently issued a 2008 version of its EA, it does not address these content shortfalls. The following are examples of the missing architecture content: US-VISIT’s representation in this version’s business model—which associates the department’s business functions with the organizations that support and/or implement them—does not align US-VISIT with certain business functions (e.g., verify identity and establish identity) that the program office has identified as a critical part of its mission. US-VISIT business rules and requirements are not included in this version’s business model. Business rules are important because they explicitly translate business policies and procedures into specific, unambiguous rules that govern what can and cannot be done. As such, they facilitate the consistent implementation of policies and procedures. US-VISIT’s baseline and target performance goals (e.g., for transaction volume) are not reflected in this version. GAO, Homeland Security: Strategic Solution for US-VISIT Program Needs to Be Better Defined, Justified, and Coordinated, GAO- 08-361 (Washington, D.C.: Fe. 29, 2008). 48 Objective 1: Legislative Conditions Condition 6 in the 2007 EA. For example, it erroneously identifies two US-VISIT component systems as being owned by two other DHS entities. All US-VISIT system interfaces are not included in the 2007 EA’s system reference model. For example, it does not identify key interfaces between the IDENT, Advance Passenger Information System (APIS), Arrival and Departure Information System (ADIS), and Treasury Enforcement Communications System. Additionally, it does not identify the interface between IDENT and the Global Enrollment System, even though US-VISIT officials confirmed that the interface exists and is operating. Second, the department lacks a defined methodology for determining an investment’s compliance with its EA, including explicit steps and criteria. According to federal guidance, such a methodology is important because the benefits of using an EA cannot be fully realized unless individual investments are defined, designed, and developed in a way that avoids duplication and promotes interoperability. However, we reported in April 2007 that DHS does not have such a methodology. Without this methodology and verifiable documentation demonstrating its use in making compliance determinations, the basis for concluding that a program sufficiently complies with any version of the 2007 EA will be limited. GAO-07-424. 49 Objective 1: Legislative Conditions Condition 6 Third, the certification attachment includes a description of what was assessed to provide the basis for the compliance certification. For example, the attachment states that the board “evaluated the program’s ability to support the Department’s line of business and strategic goals; their alignment to a DHS Office of the CIO portfolio; the data, data objects, and data entity that encompass the investment; the technology leveraged to deliver capabilities and functions by the program; and compliance with information security, Section 508, and screening coordination.” However, the descriptions do not link directly to key 2007 EA artifacts. For example, it aligns US-VISIT’s data entities (e.g., Watch List and Warrants) to the data object “Record”. The 2007 EA, however, does not define that data object. Moreover, those aspects of the architectures that were not assessed are not identified, such as the business rules and enterprise security architecture. 50 Objective 1: Legislative Conditions Condition 7 Condition 7. The plan partially satisfies the condition that it include a certification by the DHS CPO that the plans for the program comply with federal acquisition rules, requirements, guidelines and practices, and a description of the actions being taken to address any areas of noncompliance, the risks associated with them, along with any plans for addressing these risks, and the status of their implementation. As we have previously reported, federal IT acquisition requirements, guidelines, and management practices provide an acquisition management framework that is based on the use of rigorous and disciplined processes for planning, managing, and controlling the acquisition of IT resources. If implemented effectively, these processes can greatly increase the chances of acquiring software-intensive systems that provide promised capabilities on time and within budget. GAO-07-1065. 51 Objective 1: Legislative Conditions Condition 7 practices. In addition, the CPO stated that DHS's Office of Procurement Operations had conducted self-assessments of US-VISIT-related contracts in fiscal years 2006 and 2007, and that these assessments had not identified any areas of non-compliance that required risk mitigation. However, the cited support is not sufficient to fully satisfy the legislative condition because the condition applies to the fiscal year 2008 expenditure plan, while the support that is cited pertains to the fiscal year 2007 expenditure plan and assessments that were completed in fiscal years 2006 and 2007. 52 Objective 1: Legislative Conditions Condition 8 Condition 8. The plan partially satisfies the condition that it include (1) a certification by the DHS CIO that the program has a risk management process that regularly identifies, evaluates, mitigates, and monitors risks throughout the system life cycle and communicates high-risk conditions to department investment decision makers, as well as (2) a listing of all the program’s high risks and the status of efforts to address them. As we have previously reported, proactively managing program risks is a key acquisition management control, and if defined and implemented properly, it can increase the chances of programs delivering promised capabilities and benefits on time and within budget. On February 25, 2008, the former DHS Acting CIO certified that US-VISIT had a sufficient risk management process in place, adding that this process satisfied all process-related aspects of the legislative condition. In doing so, the then Acting CIO relied on an assessment of a range of US-VISIT risk management documents, including a policy, plan, periodic listings of high risks and related status reports, and communications with department decision makers. GAO, DOD Business Systems Modernization: Key Marine Corps System Acquisition Needs to Be Better Justified, Defined, and Managed, GAO-08-22 (Washington, D.C.: Jly. 28, 2008). 53 Objective 1: Legislative Conditions Condition 8 However, the certification does not fully satisfy the legislative condition. Our analysis of the same risk management documents that the certification is based on revealed key weaknesses: The US-VISIT risk management plan is not being effectively implemented, which is also a weakness that we reported in February 2006. For example, of the 33 high risks identified as being in or past the handling phase of the risk management process in the February 6, 2008 risk inventory, 8 (about 24 percent) did not have a mitigation plan, and 19 (about 58 percent) did not have a contingency plan. Moreover, considerable time has passed without such plans being developed, in some cases more than 3 years. According to the risk management plan, mitigation and contingency plans should be developed for all high and medium risks once they have reached the handling phase of the risk management process. (This weakness is discussed in greater detail later in this briefing.) GAO, Homeland Security: Recommendations to Improve Management of Key Border Security Program Needs to Be Implemented, GAO-06-296 (Washington, D.C.: Fe. 14, 2006). The US-VISIT Rik Mgement Plepte the rik mgement process into five tep. The forth tep—rik hndling—i the process of electing nd implementing repon to identified nd prioritized ri. 54 Objective 1: Legislative Conditions Condition 8 The US-VISIT process for managing risk does not contain thresholds for elevating risks beyond the program office. Moreover, program officials told us that an update to this process that is currently in draft does not include such thresholds. Without thresholds, it is unlikely that senior DHS officials will become aware of those risks requiring their attention. In this regard, we reported in February 2006 that the thresholds for elevating risks to department executives that were in place were not being applied. In August 2007, we reported that these thresholds had been eliminated and that no risks had been elevated to department executives since December 2005. During the following 32 months, only one risk was elevated beyond the program office. GAO-06-296. GAO-07-1065. 55 Objective 1: Legislative Conditions Condition 9 Condition 9. The plan does not satisfy the condition that it include a certification by the DHS Chief Human Capital Officer that the human capital needs of the program are being strategically and proactively managed, and that current human capital capabilities are sufficient to execute the plans discussed in the report. As we have previously reported, strategic management of human capital is both a best practice and a provision in federal guidance. Among other things, it involves proactive efforts to understand an entity’s future workforce needs, existing workforce capabilities, and the gap between the two and charting a course of action to define how this gap will be continuously addressed. By doing so, agencies and programs can better ensure that they have the requisite human capital capacity to execute agency and program plans. On March 6, 2008, the DHS Chief Human Capital Officer certified that the US-VISIT human capital strategic plan provides specific initiatives to address the hiring, development, and retention of program employees, and that a strategy exists to develop indicators to measure the progress and results of these initiatives. However, this certification does not satisfy the legislative condition for two reasons. GAO-07-1065. 56 Objective 1: Legislative Conditions Condition 9 The certification does not address the strategic plan’s implementation, which is important because just having a human capital strategic plan does not constitute strategic and proactive management of the program’s human capital. The certification does not address whether the current human capital capabilities are sufficient to execute the expenditure plan. For example, it does not recognize that US-VISIT is under staffed. We reported in August 2007 that the program office had 21 vacancies and had taken the interim step to address this shortfall by temporarily assigning other staff to cover the vacant positions, and planned to fill all the positions through aggressive recruitment. As of July 2008, the program office reported having 23 vacancies, including vacancies in leadership positions, such as the program’s deputy director. Since then, the program office reports that it has filled nine of these vacancies. GAO-07-1065. 57 Objective 1: Legislative Conditions Condition 10 Condition 10. The plan does not satisfy the condition that it include a complete schedule for the full implementation of a biometric exit program or a certification that such a program is not possible within 5 years. As we stated in our June 2007 testimony, a complete schedule for the full deployment of an exit capability would specify, at a minimum, what work will be done, by what entities, and at what cost to define, acquire, deliver, deploy, and operate expected system capabilities. A complete schedule is essential to ensuring that the solution is developed and implemented effectively and efficiently. The fiscal year 2008 plan does not contain either a complete schedule for fully implementing biometric exit capabilities at air, sea, and land POEs, or a statement that this cannot be completed within a 5-year time frame. Rather, the plan contains a very high-level schedule that only identifies five broadly-defined tasks, and a date by which each is to be completed, as shown in the table on the following slide. GAO, Homeland Security: Prospects for Biometric US-VISIT Exit Capability Remains Unclear, GAO-07-1044T (Washington, D.C.: Jne 28, 2007). 59 Objective 1: Legislative Conditions Condition 11 Condition 11. The plan partially satisfies the condition that it include a detailed accounting of operation and maintenance, contractor services, and program management costs associated with the program. As we have previously reported, the purpose of the expenditure plan is to provide Congress with sufficient information to exercise effective oversight of US-VISIT and to hold DHS accountable for results. To accomplish this, the act sought specific information relative to planned US-VISIT spending for operations and maintenance, contractor services, and program management. A diussed in the cope nd methodology ection of thi riefing (ttchment 1), we ght clrifiction from ff with the Housnd Sente Approprition Committee, Subcommittee on Homelnd Secrity, on thi condition. A result, the wording of thi condition has een modified lightly from tht in the ct. 60 Objective 1: Legislative Conditions Condition 11 The fiscal year 2008 plan provides a decomposition of program operations and maintenance costs according to functional areas of activity, such as operations and maintenance of system applications, data center operations, network/data communications, and IT services. While this decomposition does satisfy the condition, it nevertheless could be more informative if the costs were associated with specific capabilities, systems, and services, such as the cost to operate and maintain ADIS, IDENT, and iDSM. The fiscal year 2008 plan does not separately identify the program’s costs for contractor services. According to program officials, such services are embedded in other cost categories, such as Program Staffing (which is a combination of government and contractor staff), Prime Integrator, and Project Integration and Analysis. The one exception is for the Provide Identity Management and Screening Services broad core capability area, which identifies $15.8 million in contractor services. 61 Objective 1: Legislative Conditions Condition 11 The fiscal year 2008 plan states that program management costs will total $115.2 million, and allocates them to items such as program staffing ($46.2 million), planning and logistics ($14.3 million), prime integrator ($33.5 million), and working capital and management reserve ($ 21.2 million). It also describes a number of program management related initiatives, such as maturing program monitoring and control processes, developing strategic plans and related policies, conducting public information dissemination and outreach, and strengthening human capital management and stakeholder training. However, it does not allocate the $115.2 million to these initiatives. For example, the plan does not describe what portion of the $115.2 million will be used to develop criteria for estimating life cycle costs, which is one effort within the maturing program processes initiative, or to properly align program management staffing to tasks and rewrite position descriptions, which are efforts within strengthening human capital management. In addition, the $115.2 million does not include $11.6 million in contractor program management support provided to specific projects, such as Air and Sea Exit. As a result, total cost allocated to program management in fiscal year 2008 is $126.8 million, which is similar to the program management costs we reported in the fiscal year 2006 and 2007 62 Objective 1: Legislative Conditions Condition 11 expenditure plans. As we previously reported, these levels of program management costs represented a sizeable portion of the US-VISIT planned spending, but were not adequately justified. GAO, Homeland Security: Planned Expenditures for U.S. Visitor and Immigrant Status Program Need to be Adequately Defined and Justified, GAO-07-278 (Washington, D.C.: Fe. 14, 2007). 63 Objective 1: Legislative Conditions Condition 12 Condition 12. We have reviewed the plan, thus satisfying the condition. Our review was completed on September 15, 2008. In developing its Air and Sea Exit NPRM, DHS is required to prepare a written assessment of the costs, benefits, and other effects of its proposal and a reasonable number of alternatives, and to adopt the least costly, most cost-effective, or least burdensome among them. To accomplish this, it is important that DHS have reliable cost estimates for its proposed and alternative solutions. As noted earlier in this briefing, the NPRM and regulatory impact analysis cite the estimated costs of each of the five alternatives that were analyzed. For example, the impact analysis states that the estimated cost of the proposed solution is $3.6 billion. Moreover, this analysis states that each of the cost estimates are “rough order of magnitude” estimates, meaning that they are by definition rough and imprecise, to the point of being potentially understated by as much as 100 percent, and overstated by as much as 50 percent. Restated, this means that the estimated cost of the proposed solution could be anywhere from $1.8 billion to $7.2 billion. According to DHS’s analysis, these broad cost risk ranges were used to reflect the degree to which Air and Sea Exit has been defined, including the assumptions that had to be made about airline solution configurations in the absence of airline data. According to GAO’s Cost Estimating Guide, rough order of magnitude estimates are used when few details are available about the alternatives, and they should not be considered budget-quality cost estimates. Accordingly, they should not be viewed as sufficiently credible, accurate, or comprehensive to be considered reliable for making informed choices among competing investment options. Available Documentation Shows Some Estimating Best Practices Were Met, While Others Were Not GAO’s Cost Estimating Guide identifies four characteristics of reliable cost estimates and associates a number of estimating best practices with each characteristic. The four characteristics of reliable cost estimates are that they are well-documented, credible, comprehensive, and accurate. The cost estimates for the Air and Sea Exit alternatives satisfied a number of the best practices in GAO’s Cost Estimating Guide. For example, the estimate’s purpose and scope are clearly defined, the cost team included experienced cost analysts, and the cost estimate included a description of the cost estimation process, data sources, and methods. Moreover, we have yet to receive documentation from DHS relative to other best practices cited in the guide. For example, the guide recognizes the importance of performing risk analyses that allow for risks to be examined across the work breakdown structure so that the uncertainties associated with individual work elements can be determined, and risk levels can be assigned to each. According to the regulatory impact analysis, a standard level 5 risk range (50 percent below to 100 percent above) was used with the cost estimates because a comprehensive risk analysis had not been done. Program officials told us, however, that a risk analysis was performed, but we have yet to receive it. Further, we have yet to receive evidence showing that all relevant costs were addressed, such as the cost of spare, refreshed, and updated equipment and technology. The regulatory impact analysis states that data on several variables were not available for inclusion in the analysis, including estimates for burden to carriers and travelers. Of the 56 airlines and airline associations that provided comments on the NPRM, 21 commented that DHS’s cost estimate for its proposed solution was understated because it did not adequately reflect the burden to carriers. In particular, the International Air Transport Association commented that the proposed solution could cost the air carriers as much as $12.3 billion over 10 years. According to this association, its estimate was developed in collaboration with airlines, network service providers, and hardware manufacturers. The association attributed the understatement of DHS’s estimate to its omission of relevant costs for data transmission, secure networks, and secure data warehouses. Specifically, it stated that transmission requirements for biometric data would be between 350 and 800 times greater that what the airlines currently use for the transmission of biographic and manifest text data (between 31 and 128 megabytes of information for each international flight versus about 100 kilobytes currently transferred); 69 Objective 2: Observations 1: Reliability of Air nd S Exit Cot Etimte Not Cle secure networks required for transmission of biometric data would need to be installed between the airports and the airlines’ departure control systems because they currently do not exist (estimated to cost about $150 million over 10 years); and secure data warehouses for biometric data storage would need to be installed to store the data prior to transmission to DHS (estimated to cost about $1 billion to operate over 10 years). In addition, United Airlines commented that its start-up costs would be about $21.8 million. It also commented that DHS’s cost estimate does not include the cost of additional traveler burden, which they estimated to be about $30 per hour. According to United Airlines, passenger time is potentially the highest cost element with as many as 50 million persons being affected by queuing, congested space, and flight delays. DHS’s regulatory impact analysis acknowledges the omission of the cost of additional travel burden and the impact on the cost to each carrier’s business processes. Further, Air Canada Jazz, a regional airline, commented that because the requirement for airline personnel to collect biometric data is beyond the scope of duties outlined in current collective agreements, it would have to renegotiate its agreements to add these duties. Adequate security and privacy controls are needed to assure that personally identifiable information is secured against unauthorized access, use, disclosure, or retention. Such controls are especially needed for government agencies, where maintaining public trust is essential. In the case of US-VISIT, one of its stated goals is to protect the security and privacy of U.S. citizens and visitors. However, DHS's proposed solution would have more privacy and security risks than alternative solutions. According to the NPRM, having carriers collect the biometric information is less secure than alternatives where DHS collects the information, regardless of the information collection point. Moreover, it states that information that is in the sole custody of one entity (e.g., DHS) is less likely to be compromised than information passed from private carriers to DHS. Similarly, the NPRM states that the degree of confidence in compliance with privacy requirements is lower when DHS does not maintain full custody of personally identifiable information. According to the NPRM, these privacy and security risks will be addressed in two ways. First, DHS will require carriers to ensure that their systems and transmission methods of biometric data meet DHS technical, security and privacy requirements to be established in guidance and issued in conjunction with the final rule. However, it is unclear how DHS will ensure that the guidance is effectively implemented. Second, when the data are received by DHS, the NPRM states that it will be protected in accordance with a robust privacy and security program. However, we recently reported that the systems supporting US-VISIT have significant information security weaknesses that place sensitive and personally identifiable information at increased risk of unauthorized and possibly undetected disclosure and modification, misuse, and destruction. GAO, Information Security: Homeland Security Needs to Immediately Address Significant Weaknesses in Systems Supporting the US-VISIT Program, GAO-07-870 (Washington, D.C.: Jly 13, 2007). As noted earlier, 91 entities, including the airline, trade, and travel industries, and federal, state, and foreign governments, commented on the Air and Sea Exit proposal. In addition to the comments discussed earlier relative to the reliability of the cost estimates and the security and privacy implications of a carrier-implemented solution, a number of other comments were provided that raise further concerns and questions about the proposed solution. Specifically, the entities provided the following comments: According to some carriers, DHS has yet to provide technical requirements for the carriers to meet in delivering their respective parts of the proposed solution. In particular, the NPRM stated that carriers will be required to comply with the DHS Consolidated User’s Guide. However, they stated that this guide does not define, for example, how biometric images are to be incorporated into the existing message format used for APIS transmissions. Similarly, the NPRM states that all biometric data transmissions would be bound by existing regulations, including the FBI’s Criminal Justice Information Services Electronic Transmission Specifications. However, carriers stated that these specifications had not been made available. vessel carrier passenger processing improvements. Requiring passenger-agent contact goes against recent simplifications to carriers’ business models in which new technologies are being introduced to eliminate time-consuming passenger-agent interactions. For example, most airlines and cruise ships allow passengers to confirm arrival and check-in online prior to entering the airport or sea terminal, or to check in and print a boarding pass at a kiosk. These carriers commented that the passenger- agent contact required under the NPRM is at odds with this evolution in business processes and will slow down the travel process, delay flights, and make air and sea ports more crowded. According to one carrier’s estimates, the proposed solution will add 1 to 2 minutes processing time per passenger, which will collectively add an estimated 3 to 5 hours per flight. While the regulatory impact analysis projected flight delays to be less lengthy, it nevertheless acknowledged that most travelers would be delayed by about 50 minutes. A number of entities said that such significant delays will cause foreign travelers to vacation elsewhere. fully integrated with other border screening programs involving air carriers. DHS has recently issued proposed or final rules for four DHS programs, and each of these require or propose requiring carriers to collect and transmit additional data in 2008 and 2009. As such, these organizations viewed the four as duplicative (require very similar data) and inefficient (use different transmission methods), and claimed that DHS’ sequential introduction of these programs will require carriers to undertake separate and repeated system development and employee training efforts that will impact their operations. According to several carriers, DHS did not involve the stakeholders in this rulemaking process as it had in previous rulemaking efforts. Carriers stated that for US-VISIT entry and the Advance Passenger Information System-Quick Query, which is about to be deployed, they were involved in developing a solution, but for US-VISIT exit, they were not. There the Air/S Exit, Secre Flight, the Electronic Trvel Athoriztion Stem, nd the Advnce Passenger Informtion Stem-Qick Qery. Proactively managing program risks is a key acquisition management control and, if defined and implemented properly, it can increase the chances of programs delivering promised capabilities and benefits on time and within budget. To its credit, the program office has defined a risk management plan and related process that is consistent with relevant guidance. However, its own risk database shows that not all risks have been proactively mitigated. As we have previously reported, not proactively mitigating risks increases the chances that risks become actual cost, schedule, and performance problems. GAO-06-296 OMB, Circular No. A-11, Part 7 Supplement - Capital Programming Guide, 2006, http://www.whitehouse.gov/om/circ/11/ crrent_yer/_11_2006.pdf (ccessed Jne 16, 2008) nd Softwre Engineering Intitte, CMMI for Acquisition, Verion 1.2, CMU/SEI-2007-TR-017 (Pittsburgh, PA; Novemer 2007). Within each of these steps, the plan defines a number of activities that are consistent with federal guidance and related best practices. For example, In the preparation phase, each project office is to develop a strategy for managing risk that includes, among other things, the scope of the project risks to be addressed and the risk management tools to be used. In the risk identification phase, risks are to be identified in as much detail as possible and a risk owner is to be designated. In the risk analysis phase, the estimated probability of occurrence and impact on the program or project of each risk is to be determined and used to assign a priority (high, medium, or low). prepared for all medium-and-high priority risks as early as possible. In the risk monitoring phase, the status of risk mitigation and contingency plans is to be tracked, and decisions are to be reached as to whether to close a risk or to designate it as a realized issue (i.e., actual problem). Days the risk has been open (as of February 6, 2008) Management step Hndle (6 ri) Monitor (6 ri) Relized (11 ri) Days the risk has been open (as of July 3, 2008) Management step Hndle (7 ri) Monitor (6 ri) Relized (11 ri) According to the GAO Cost Assessment Guide, rebaselining should occur very rarely, as infrequently as once in the life of a program or project and only when a schedule variance is significant enough to limit its utility as a predictor of future schedule performance. For task order 7, the largest task order, which provides for development and deployment of new capabilities (e.g., Unique Identity and Biometric Solutions Delivery) the program office has rebaselined its schedule twice in the last 2 years—first in October 2006, when the task order had a negative schedule variance of $958,216, and then in October 2007, when the negative schedule variance for Unique Identity and Biometric Solutions was $4.1 million. Since this last rebaselining, the program office reports a negative variance through May 2008 of $3.5 million. Without the rebaselinings, this would have amounted to a $7.2 million schedule variance. The graphic on the next slide shows the cumulative schedule variance with and without the rebaselining. GAO, Cost Assessment Guide: Best Practices for Estimating and Managing Program Costs, Exposure Draft, GAO-07-1134SP. (Washington, D.C.:Jly 2007). Task order 7 has pproximte ve of $141 million. Cumulative Schedule Variance, TO7 (Biometric Solutions + Unique ID) 84 DHS has not adequately met the conditions associated with its legislatively mandated fiscal year 2008 US-VISIT expenditure plan. The plan does not fully satisfy any of the conditions that apply to DHS, either because it does not address key aspects of the condition or because what it does address is not adequately supported or is otherwise not reflective of known program weaknesses. Given that the legislative conditions are intended to promote the delivery of promised system capabilities and value, on time and within budget, and to provide Congress with an oversight and accountability tool, these expenditure plan limitations are significant. Beyond the expenditure plan, other program planning and execution limitations and weaknesses also confront DHS in its quest to deliver US-VISIT capabilities and value in a timely and cost-effective manner. Most notably, DHS has proposed a solution for a long- awaited exit capability, but it is not clear if the cost estimates used to justify it are sufficiently reliable to do so. DHS has reported itself that the proposed solution provides less security and privacy than other alternatives analyzed, and the proposed solution is being challenged by those responsible for implementing it. Further, DHS’s ability to measure program performance and progress, and thus be positioned to address cost and schedule shortfalls in a timely manner, is hampered by weaknesses in the prime contractor’s implementation of EVM. Each of these program planning and execution limitations and weaknesses introduce risk to the program. In addition, DHS is not effectively managing the program’s risks, as evidenced by the program office’s risk database showing that known risks are being allowed to go years without risk mitigation and contingency plans. Overall, while DHS has taken steps to implement a significant percentage of our prior recommendations aimed at improving management of US-VISIT, additional management improvements are needed to effectively define, justify, and deliver a system solution that meets program goals, reflects stakeholder input, minimizes exposure to risk, and provides Congress with the means by which to oversee program execution. Until these steps are taken, US-VISIT program performance, transparency, and accountability will suffer. To assist DHS in planning and executing US-VISIT, we recommend that the Secretary of Homeland Security direct the department’s Investment Review Board to immediately hold a review of the US-VISIT program that, at a minimum, addresses The reasons for the fiscal year 2008 expenditure plan not fully addressing each of the legislative conditions and corrective action to ensure that this does not occur for future expenditure plans; The adequacy of the basis for any future Air and Sea Exit solution, including the reliability of cost estimates, implication of privacy and security issues, and addressing key concerns raised in comments to the proposed rule; The weaknesses in the program’s implementation of risk management, and The weaknesses in the prime contractor’s implementation of earned value management, including the limitations in the quality of the schedule baselines and the schedule variance measurements. We further recommend that the Secretary of Homeland Security report the results of this Investment Review Board review to Congress. 87 Agency Comments and Our Evaluation We provided a draft of this briefing to DHS officials, including the Director of US-VISIT. In their oral comments on the draft, these officials did not state whether they agreed or not with our findings, conclusions, or recommendations. They did, however, provide a range of technical comments, which we have incorporated in the briefing, as appropriate. They also sought clarification on our scope and methodology, which we have also incorporated in the briefing. A greed, ocope of work focused on the pln delivered to the Housnd Sente Approprition Committee. For condition 4, we reviewed the DHS certification and supporting documentation for US-VISIT’s capital planning and investment controls, including US-VISIT’s most recent OMB submission and documents related to the milestone decision point 1 and 2 approvals, to determine whether a sufficient basis existed for the certification; For condition 5, we reviewed the DHS certification for the independent verification and validation agent and analyzed supporting documentation, such as DHS’s assessment of US-VISIT’s independent verification and validation efforts, to determine whether a sufficient basis existed for the certification; For condition 6, we reviewed the DHS certification that the US-VISIT architecture is sufficiently aligned with the DHS EA, and assessed supporting documentation, including US-VISIT program documents against the DHS EA 2007, and criteria in DHS’s Investment Review Process and DHS’s EA Governance Process Guide to 91 Attachment 1 Scope nd Methodology determine whether a sufficient basis existed for the certification; For condition 7, we reviewed the DHS certification that the plans for the US-VISIT program comply with federal acquisition rules, guidelines, and practices, and analyzed supporting documentation, such as DHS’s assessment of US-VISITs contracts, to determine whether there was a sufficient basis for the certification; For condition 8, we reviewed the DHS certification that US-VISIT have a risk management process that identifies, evaluates, mitigates, and monitors risks throughout the life cycle, and communicates high risks to the appropriate managers at the US-VISIT program and DHS levels. We also analyzed the most current US- VISIT risk management plan, risk lists, and risk meeting minutes, to determine whether there was a sufficient basis for the certification; and For condition 9, we reviewed the DHS certification that the human capital needs of the US-VISIT program were being strategically and proactively managed, and analyzed supporting documentation, such as US-VISIT’s Human Capital Strategic Plan, to determine whether there was a sufficient basis for the certification. We did not ttempt to vlidte the comment. For observtion 6, we used the Uniqe ID nd Biometric Soltion Delivery subas of task order 7. Thee tas covered 98 percent of the totl ve of task order 7 nd the remining 2 percent were relted to subasssued in fil yer 2008. 93 Attachment 1 Scope nd Methodology define and implement a risk management process that addresses the identification, analysis, evaluation, and monitoring of risks by reviewing the risk management policy, risk management plan, active and high risk lists, risk meeting minutes, and a risk elevation memorandum. Additionally, in February 2007, we reported that the system that US-VISIT uses to manage its finances (U.S. Immigration and Customs Enforcement’s Federal Financial Management System) has reliability issues. In light of these issues, the US-VISIT Budget Office tracks program obligations and expenditures separately using a spreadsheet and comparing this spreadsheet to the information in Federal Financial Management System. Based on a review of this spreadsheet, there is reasonable assurance that the US-VISIT budget numbers being reported by Federal Financial Management System are accurate. For DHS-provided data that our reporting commitments did not permit us to substantiate, we have made appropriate attribution indicating the data’s source. Defined, Justified, and Coordinated. GAO-08-361. Washington, D.C.: February 29, 2008. Homeland Security: U.S. Visitor and Immigrant Status Program’s Long-standing Lack of Strategic Direction and Management Controls Needs to be Addressed. GAO-07- 1065. Washington, D.C.: August 31, 2007. Homeland Security: DHS Enterprise Architecture Continues to Evolve But Improvements Needed. GAO-07-564. Washington, D.C.: May 9, 2007. Homeland Security: US-VISIT Program Faces Operational, Technological, and Management Challenges. GAO-07-632T. Washington D.C.: March 20, 2007. Homeland Security: US-VISIT Has Not Fully Met Expectations and Longstanding Program Management Challenges Need to Be Addressed. GAO-07-499T. Washington, D.C.: February 16, 2007. Homeland Security: Planned Expenditures for U.S. Visitor and Immigrant Status Program Need to Be Adequately Defined and Justified. GAO-07-278. Washington, D.C.: February 14, 2007. Border Security: US-VISIT Program Faces Strategic, Operational, and Technological Challenges at Land Ports of Entry. GAO-07-378T. Washington, D.C.: January 31, 2007. Challenges at Land Ports of Entry. GAO-07-248. Washington, D.C.: December 6, 2006. Homeland Security: Contract Management and Oversight for Visitor and Immigrant Status Program Need to Be Strengthened. GAO-06-404. Washington, D.C.: June 9, 2006. Homeland Security: Progress Continues, but Challenges Remain on Department’s Management of Information Technology. GAO-06-598T. Washington, D.C.: March 29, 2006. Homeland Security: Recommendations to Improve Management of Key Border Security Program Need to Be Implemented. GAO-06-296. Washington, D.C.: February 14, 2006. Homeland Security: Visitor and Immigrant Status Program Operating, but Management Improvements Are Still Needed. GAO-06-318T. Washington, D.C.: January 25, 2006. Information Security: Department of Homeland Security Needs to Fully Implement Its Security Program. GAO-05-700. Washington, D.C.: June 17, 2005. Information Technology: Customs Automated Commercial Environment Program Progressing, but Need for Management Improvements Continues. GAO-05-267. Washington, D.C.: March 14, 2005. Homeland Security: Some Progress Made, but Many Challenges Remain on U.S. Visitor and Immigrant Status Indicator Technology Program. GAO-05-202. Washington, D.C.: February 23, 2005. Border Security: State Department Rollout of Biometric Visas on Schedule, but Guidance Is Lagging. GAO-04-1001. Washington, D.C.: September 9, 2004. Border Security: Joint, Coordinated Actions by State and DHS Needed to Guide Biometric Visas and Related Programs. GAO-04-1080T. Washington, D.C.: September 9, 2004. Homeland Security: First Phase of Visitor and Immigration Status Program Operating, but Improvements Needed. GAO-04-586. Washington, D.C.: May 11, 2004. Homeland Security: Risks Facing Key Border and Transportation Security Program Need to Be Addressed. GAO-04-569T. Washington, D.C.: March 18, 2004. Homeland Security: Risks Facing Key Border and Transportation Security Program Need to Be Addressed. GAO-03-1083. Washington, D.C.: September 19, 2003. Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning. GAO-03-563. Washington, D.C.: June 9, 2003. Increment 1 processes—Increment 1 includes the following five processes at air and sea ports of entry (POE): pre-entry, entry, status management, exit, and analysis, which are depicted in the graphic below. US-VISIT irrently tritioning from nning only the right nd left index finger to nning ll 10 finger. 8 U.S.C. § 1221(). When the foreign national arrives at a primary POE inspection booth, the inspector, using a document reader, scans the machine-readable travel documents. APIS returns any existing records on the foreign national to the CBP primary inspection workstation screen, including manifest data matches and biographic lookout hits. When a match is found in the manifest data, the foreign national’s name is highlighted and outlined on the manifest data portion of the screen. Biographic information, such as name and date of birth, is displayed on the bottom of the computer screen, as well as the photograph from State’s Consular Consolidated Database. The inspector at the booth scans the foreign national’s fingerprints and takes a digital photograph. This information is forwarded to the IDENT database, where it is checked against stored fingerprints in the IDENT lookout database. The new 10-print process will o integrte thi informtion with mnifet d o tht it i ll repreented on one creen. While the system is checking the fingerprints, the inspector questions the foreign national about the purpose of his or her travel and length of stay. The inspector adds the class of admission and duration of stay information into the Treasury Enforcement Communications System (TECS), and stamps the “admit until” date on the Form I-94. If the foreign national is ultimately determined to be inadmissible, the person is detained, lookouts are posted in the databases, and appropriate actions are taken. Within 2 hours after a flight lands and all passengers have been processed, TECS is to send the Arrival and Departure Information System (ADIS) the records showing the class of admission and the “admit until” dates that were modified by the inspector. The status management process manages the foreign national’s temporary presence in the United States, including the adjudication of benefits applications and investigations into possible violations of immigration regulations. Commercial air and sea carriers transmit departure manifests electronically for each departing passenger. These manifests are transmitted through APIS and shared with ADIS. ADIS matches entry and exit manifest data to ensure that each record showing a foreign national entering the United States is matched with a record showing the foreign national exiting the United States. ADIS maintains a status indicator for each traveler and computes the number of overstay days a visitor remains beyond their original entry duration. ADIS also provides the ability to run queries on foreign nationals who have entry information but no corresponding exit information. ADIS receives status information from the Computer Linked Application Information Management System and the Student and Exchange Visitor Information System on foreign nationals. The exit process includes the carriers’ electronic submission of departure manifest data to APIS. This biographic information is passed to ADIS, where it is matched against entry information. An ongoing analysis capability is to provide for the continuous screening against watch lists of individuals enrolled in US-VISIT for appropriate reporting and action. As more entry and exit information becomes available, it is to be used to analyze traffic volume and patterns as well as to perform risk assessments. The analysis is to be used to support resource and staffing projections across the POEs, strategic planning for integrated border management analysis performed by the intelligence community, and determination of travel use levels and expedited traveler programs. Increments 2B and 3 deployed US-VISIT entry processing capabilities to land POEs. These two increments are similar to Increment 1 (air and sea POEs), with several noteworthy differences. No advance passenger information is available to the inspector before the traveler arrives for inspection. Travelers subject to US-VISIT are processed at secondary inspection, rather than at primary inspection. Inspectors’ workstations use a single screen, which eliminates the need to switch between the TECS and IDENT screens. Form I-94 data are captured electronically. The form is populated by data obtained when the machine-readable zone of the travel document is swiped. If visa information about the traveler exists in the Datashare database, it is used to populate the form. Fields that cannot be populated electronically are manually entered. A copy of the completed form is printed and given to the traveler for use upon exit. No electronic exit information is captured. Dasre inclde extrct from Ste’ Consur Conolidted Dabastem nd inclde the visa photogrph, iogrphicl d, nd the fingerprint identifiction ner assigned when nonimmigrnt pplie for visa. US-VISIT Increments 1 through 3 include the interfacing and integration of existing systems and, with Increment 2C, the creation of a new system. The three main existing systems are as follows: Arrival and Departure Information System (ADIS) stores non-citizen traveler arrival and departure data received from air and sea carrier arrival data captured by CBP officers at air and sea POEs, Form I-94 issuance data captured by CBP officers at Increment 2B land POEs, Form I-94 data captured at air and sea ports of entry, and status update information provided by the Student and Exchange Visitor Information System (SEVIS) and the Computer Linked Application Information Management System (CLAIMS 3) (described on the next slide). 105 Attachment 3 Detiled Decription of Increment nd Component Stem ADIS provides biographic identity record matching, query, and reporting functions. The passenger processing component of the Treasury Enforcement Communications System (TECS) includes two systems: Advance Passenger Information System (APIS) captures arrival and departure manifest information provided by air and sea carriers, and Interagency Border Inspection System (IBIS) maintains lookout data and interfaces with other agencies’ databases. CBP officers use these data as part of the admission process. The results of the admission decision are recorded in TECS and ADIS. Federal Bureau of Investigation information on all known and suspected terrorists, all active wanted persons and warrants, and previous criminal histories for visitors from high-risk countries; DHS Immigration and Customs Enforcement information on deported felons and sex DHS information on previous criminal histories and previous IDENT enrollments. Informtion from the Federl Breau of Invetigtion inclde fingerprint from the Integrted Atomted Fingerprint Identifiction Stem. 107 Attachment 3 Detiled Decription of Increment nd Component Stem US-VISIT also exchanges biographic information with other DHS systems, including SEVIS and CLAIMS 3: SEVIS is a system that contains information on foreign students and CLAIMS 3 is a system that contains information on foreign nationals who request benefits, such as change of status or extension of stay. Some of the systems involved in US-VISIT, such as IDENT and ADIS, are managed by the program office, while some systems are managed by other organizational entities within DHS. For example: TECS is managed by CBP, SEVIS is managed by Immigration and Customs Enforcement, and CLAIMS 3 is under United States Citizenship and Immigration Services. Wtch lit d rce inclde DHS’ Custom nd Border Protection nd Immigrtion nd Custom Enforcement; the Federl Breau of Invetigtion; legcy DHS tem; the U.S. Secret Service; the U.S. Coast Guard; the Internl RevenService; the Drg Enforcement Agency; the Breau of Alcohol, Tobacco, & Firerm; the U.S. M Service; the U.S. Office of Foreign Asset Control; the Ntionl Guard; the Treasury Inpector Generl; the U.S. Deprtment of Agricltre; the Deprtment of Defene Inpector Generl; the Royl Cdin Monted Police; the U.S. Ste Deprtment; Interpol; the Food nd Drg Adminitrtion; the Finncil Crime Enforcement Network; the Breau of Engrving nd Printing; nd the Deprtment of Justice Office of Specil Invetigtion. 1. Develop nd pprove complete tet pl efore teting egin. Thee pl, minimm, hold (1) pecify the tet environment, inclding tet eqipment, oftwre, mteril, nd necessary trining; (2) decrie ech tet to e performed, inclding tet control, inp, nd expected otp; (3) define the tet procedre to e followed in condcting the te; nd (4) provide trceability etween tet cas nd the reqirement to e verified y the teting.(GAO-04-586) Implement effective configtion mgement prctice, inclding eablihing US-VISIT chnge control rd to mge nd overee tem chnge. (GAO-04-586) Partially Implemented: The progrm office has developed nd pproved tet pl for vrious tem component, such as the US-VISIT/IDENT Prodct Integrtion nd the Unified IDENT Release 2 Component/Assemly. Oly of thee pl how tht they (1) pecified the tet environment, inclding tet eqipment, oftwre, mteril, nd necessary trining; (2) decried ech tet to e performed, inclding tet control, inp, nd expected otp; (3) defined tet procedre to e followed in condcting te; nd (4) provided trceability etween tet cas nd the reqirement to e verified y the teting. However, we were able to verity tht thee pl were pproved prior to teting. Implemented: The progrm office has developed configtion control rd tht i reponle for, mong other thing, to mge nd overee tem chnge. The office has o developed configtion mgement plnd egn implementing prctice pecified in the pln. For exmple, project level configtion mgement pln was developed for Uniqe Identity nd chnge control reqsubmitted nd pproved y the rd. 3. Develop pln, inclding explicit tas nd miletone, for implementing ll of or open recommendtion, inclding thoe provided in thi report. The plhold provide for periodic reporting to the Secretry nd Under Secretry on progress in implementing thi pln. The Secretry hold report thi progress, inclding reason for del, in ll fre US-VISIT expenditre pl. (GAO-04-586) Partially Implemented: US-VISIT audit coordintion nd reoltion i governed y formaudit gidnce nd coordinted throgh n Integrted Project Tem. The tem has developed pln tht incldeas nd miletone for implementing GAO recommendtion. The plo provide for the periodic reporting to the Secretry nd Under Secretry. Frther, the us of effort to ddress er of GAO recommendtionas een inclded in recent US-VISIT expenditre pl, lthogh reason for del in implementing them hve not. 4. Flly nd explicitly dicloe in ll fre expenditre pl how well DHS progressing int the commitment tht it mde in prior expenditre pl. (GAO- 05-202) 5. Reassss it pl for deploying n exit ability to ensure tht the cope of the exit pilot provide for dequate evuation of lterntive oltion nd etter ensure tht the exit oltion elected i in the t interet of the progrm. (GAO-05-202) Partially Implemented: A diussed erlier in thi riefing, while the fil yer 2008 expenditre pln provide ome informtion on how well DHS progressing int commitmentde in the fil yer 2007 expenditre pln, it doe not flly nd explicitly dicloe how well it i progressing inll previous commitment, nd it decri progress in reas not committed to in the prior yer’ pln. Implemented: The progrm office has reassssed it pl for deploying n exit cability. A result of thassssment, the progrm office dicontined the US-VISIT exit pilot in My 2007. 6. Develop nd implement process for ging the ccity of the US-VISIT tem. (GAO-05-202) 7. Follow effective prctice for etimting the co of fre increment. (GAO-05-202) 8. Mke ndernding the reltionhip nd dependencie etween the US-VISIT nd ACE progr priority mtter, nd report periodiclly to the Under Secretry on progress in doing o. (GAO-05-202) Implemented: The progrm has developed city mgement hndook tht provideidnce for mging tem ccity nd has incorported the ctivitie to e performed into it Universal Delivery Method. Frther, the progrm office has egn implementing thiidnce. For exmple, it has developed US- VISIT/IDENT business nd ervice ccity baseline. Partially Implemented: According to the progrm office, they hve (1) eablihed Cot Process Action Tem, (2) defined cot etimtion nd ly prctice nd process, (3) developed process for developing oth progrm life cycle cot etimte nd Independent Government Cot Etimte, nd (4) condcted elf- assssment of the progrm’ cot etimting prctice int gideline from the Softwre Engineering Intitte. However, the progrm office has yet to provide docmenttion demontrting tht it i implementing it defined cot etimtion prctice. Implemented: The progrm office has een working with the DHS Screening nd Coordintion Office to, mong other prioritie; develop greter ndernding etween US-VISIT nd other progr, inclding ACE. Frther, ecause the progrm i no longer orgniztionlly within the Office of the Under Secretry, reporting on progress to the Under Secretry i no longer wrrnted. Inted, the Screening nd Coordintion Office, which report directly to the Secretry nd Depty Secretry, i re of progress in thi re. 9. Explore lterntive me of oining ndernding of the fll impct of US-VISIT ll lnd POE, inclding it impct on workforce level nd fcilitie; thelterntive hold inclde surveying the ite tht were not prt of the previous assssment. (GAO-06-296) Implemented: The progrm office reassssed it pl for deploying n exit cability to lnd POE, nd as result, dicontined the demontrtion project in Novemer 2006. 10.For ech US-VISIT contrct ction tht the progrm mge directly, eablind mintin pln for performing the contrctor overight process, as pproprite. (GAO-06- 404) 11.Develop nd implement prctice for overeeing contrctor work mged y other gencie on the progrm office’ ehlf, inclding (1) clerly defining role nd reponilitie for oth the progrm office nd ll gencieging US-VISIT-relted contrct; (2) hving crrent, reliable, nd timely informtion on the fll cope of contrct ction nd ctivitie; nd (3) defining nd implementing tep to verify tht deliverable meet reqirement. (GAO-06-404) Implemented: For contrct ction tht the progrm mge directly, nd where it i pproprite for the progrm office to overee contrctor ctivitie, the progrm office hasablihed nd mintin n overight pln. For exmple, the progrm office has developed individual overight pl for 10-Print, Uniqe Identity, Interim D Sring Model, nd Independent Tend Support Evuation Service. Ech individual overight pln decri the role, reponilitie, nd authoritie involved in condcting contrct dminitrtion nd overight of the contrct ction. Implemented: The progrm office has developed nd implemented prctice for overeeing contrctor work mged y other gencie on the progrm office’ ehlf. Specificlly, it has developed contrctor dminitrtion mgement pln tht inclde (1) clerly defining role nd reponilitie for oth the progrm office nd ll gencieging US-VISIT-relted contrct; (2) hving crrent, reliable, nd timely informtion on the fll cope of contrct ction nd ctivitie; nd (3) defining nd implementing tep to verify tht deliverable meet reqirement. 12.Reqire, throgh greement, thgencie ging contrct ction on the progrm office’ ehlf implement effective contrct mgement prctice content with cqition gidnce for ll US-VISIT contrct ction, inclding minimm, (1) eablihing nd mintining pln for performing contrct mgement ctivitie; (2) assigning reponility nd authority for performing contrct overight; (3) trining the people performing contrct overight; (4) docmenting the contrct; (5) verifying tht deliverable satify reqirement; (6) monitoring contrctor-relted rik; nd (7) monitoring contrctor performnce to ensure tht the contrctor i meeting chedle, effort, cot, nd technicl performnce reqirement. (GAO-06-404) Implemented: The progrm office has mended the lnguage used in it intergency greement (IAA) to reqire gencie tht mge contrct ction on the progrm’ ehlf to implement certin prctice deigned to trengthen contrct mgement nd overight. Thee reqirement re pecified in the My 2007 US- VISIT Contrct Adminitrtion Mgement Plnd hve een inclded in ech of the IAA. Specificlly, ech IAA pecifie tht the gent gency i to (1) eablind mintin pln for performing contrct mgement ctivitie; (2) deignte contrcting officer nd contrcting officer’ technicl repreenttive to mge ll contrctuaction; (3) trin the people performing contrct overight, (4) docment the contrct; (5) verify tht deliverable satify reqirement; (6) monitor contrctor-relted rik; nd (7) monitor contrctor performnce to ensure tht the contrctor i meeting chedle, effort, cot, nd technicl performnce reqirement. 13.Reqire DHS nd non-DHS gencie thge contrct on ehlf of US-VISIT to (1) clerly define nd delinete the US-VISIT work from non-US-VISIT work as performed y contrctor; (2) record, t the contrct level, mont eing illed nd expended on US-VISIT-relted work o tht thee ce trcked nd reported eptely from mont not for US-VISIT prpo; nd (3) determine if they hve received reimbuement from the progrm for pyment not relted to US-VISIT work y contrctor, nd, if o, refnd to the progrny mont received in error. (GAO- 06-404) Partially Implemented: The progrm office report tht it has egn effort to eablih the process thre to (1) ensure thoth DHS nd non-DHS gencie tht mge contrct on ehlf of the progrm clerly define nd delinete the US-VISIT work from non-US-VISIT work performed y contrctor, (2) record, t the contrct level, mont eing illed nd expended on US-VISIT- relted work o tht thee ce trcked nd reported eptely from mont not for US-VISIT prpo; nd (3) determine if they hve received reimbuement from the progrm for pyment not relted to US-VISIT work y contrctor, nd, if o, refnd to the progrny mont received in error; however, they hve yet to demontrte tht thee process re in plce nd eing used ll DHS nd non-DHS gencie. 14.Ensure tht pyment to contrctor re timely nd in ccordnce with the Prompt Pyment Act. (GAO-06-404) 15.Improve exiting mgement control for identifying nd reporting compter processing nd other opertionl prolem as they rit lnd POE nd ensure tht thee control re contently dminitered. (GAO-07-248) Partially Implemented: The progrm office report tht it has egn effort to eablih the control needed to ensure tht pyment to contrctor re mde timely nd in ccordnce with the Prompt Pyment Act. Not Implemented: DHSas yet to implement improved mgement control for identifying nd reporting compter processing nd other opertionl prolem as they rit lnd POE or to implement method for ensuring tht thee control re contently dminitered. 16.Develop performnce measure for assssing the impct of US-VISIT opertion pecificlly t lnd POE. (GAO-07-248) Not Implemented: DHSas yet to develop performnce measure for assssing the impct of US-VISIT opertion t lnd POE. 17.A DHS finlize the torily mndted report decriing comprehenive iometric entry nd exit tem for US-VISIT, tht it inclde, mong other thing, informtion on the co, enefit, nd feasility of deploying iometric nd noniometric exit cabilitie t lnd POE. (GAO-07-248) Not Implemented: DHS report tht it has recently egn to develop the torily mndted report, nd deprtment offici said tht they expect to issue it in erly 2009. DHS offici ted tht they expect it to inclde informtion on co, enefit, nd feasility of iometric nd noniometric exit cabilitie t lnd POE. 18.A DHS finlize the torily mndted report decriing comprehenive iometric entry nd exit tem for US-VISIT, tht it inclde, mong other thing, diussion of how DHS intend to move from noniometric exit cability, such as the technology crrently eing teted, to reliable iometric exit cability tht meet tory reqirement. (GAO-07-248) Not Implemented: DHSas recently egn to develop the torily mndted report, nd deprtment offici ted tht it i to e issued in erly 2009. DHS offici ted tht they expect it to inclde diussion on how it intend to move to iometric exit cability t lnd port of entry. 19.A DHS finlize the torily mndted report decriing comprehenive iometric entry nd exit tem for US-VISIT, tht it inclde, mong other thing, decription of how DHS expect to lign emerging lnd order ecrity inititive with US-VISIT nd wht fcility or fcility modifiction wold e needed to ensure tht technology nd process work in hrmony. (GAO-07-248) Not Implemented: DHSas recently egn to develop the torily mndted report, nd deprtment offici ted tht it i to e issued in erly 2009. DHS offici ted tht they expect it to how how US-VISIT i to lign with emerging lnd order inititive as well as wht fcility modifiction wold e needed to ensure tht technology nd process work in hrmony. Not Implemented: Progrm offici ted tht they periodiclly rief authoriztion nd pproprition committee on nge of progrm ri, inclding thoassocited with not hving flly satified ll expenditre pln legitive condition, reason why they were not satified, nd tep eing tken to mitigte thee ri. However, they did not provide ny verifiable evidence tht thee mtter were diussed, nd ff with the Housnd Sente pproprition committee tht focus on US-VISIT told us tht they re not re of such riefing in which thee mtter were diussed. Implemented: The progrm office has limited plnned expenditre in exit pilot nd demontrtion project y reassssing it pl nd dicontining the exit pilot in My 2007 nd the demontrtion project in Novemer 2006. demontrtion project ntil such invetment re economiclly justified nd ntil ech invetment has well-defined evuation pln. The project hold e justified on the bas of co, enefit, nd ri, nd the evuation pl hold define wht i to chieved nd hold inclde pln of ction nd miletone nd measure for demontrting chievement of pilot nd project go nd deired otcome. (GAO- 07-278) 22.Work with the DHS Enterprie Architectre Bord to identify nd mitigte progrm ri associted with inveting in new US-VISIT cabilitie in the absence of DHS-wide opertionnd technologicl context for the progrm. Thee ri hold reflect the absence of flly defined reltionhip nd dependencie with relted order ecrity nd immigrtion enforcement progr. (GAO-07- 278) Not Implemented: The progrm office provided DHS Enterprie Architectre Bord meeting meeting. However, none of the meeting minte provided contined informtion on identifying nd mitigting progrm ri associted with inveting in new US-VISIT cabilitie in the absence of DHS-wide technologicl context for the progrm. 23.Limit plnned expenditre for progrgement-relted ctivitie ntil such invetment re economiclly justified nd hve well-defined pl detiling wht i to chieved, pln of ction nd miletone, nd measure for demontrting progress nd chievement of deired otcome. (GAO-07- 278) 24.The Secretry of DHS report to the deprtment’ authoriztion nd pproprition committee on it reason for not flly ddressing it expenditre pln legitive condition nd or prior recommendtion. (GAO-07-1065) Not Implemented: The progrm office has yet to provide either n economic justifiction or well-defined pl for it progrm mgement-relted ctivitie detiling wht i to chieved nd inclding pln of ction nd miletone nd measure for demontrting progress nd chievement of deired otcome. Moreover, the mont of fnding for progrm mgement in FY2008 remin t the level mentioned in FY2006 expenditre pln, which was the bas for thi recommendtion. Not Implemented: Progrm offici ted tht they periodiclly rief authoriztion nd pproprition committee on progrm- relted issu, inclding reason for not hving flly satified ll expenditre pln legitive condition nd GAO recommendtion. However, they did not provide ny verifiable evidence tht thee mtter were diussed, nd ff with the Housnd Sente pproprition committee tht focus on US-VISIT told us tht they re not re of such riefing in which thee mtter were diussed. 25.Develop pln for comprehenive exit ability, which inclde, minimm, decription of the cability to e deployed, the cot of developing, deploying nd operting the cability, identifiction of key keholder nd their repective role nd reponilitie, key miletone, nd measuable performnce indictor. (GAO- 08-361) 26.Develop ly of co, enefit, nd ri for propoed exit oltion efore lrge su of money re committed on thooltion, nd use the ly in electing the finoltion. (GAO-08-361) 27.Direct the pproprite DHSrtie involved in defining, mging, nd coordinting reltionhip cross the deprtment’ order nd immigrtion mgement progr to ddress the progrm collabortion hortcoming identified in thi report, such aslly defining the reltionhip etween US- VISIT nd other immigrtion nd order mgement progr nd, in doing o, to employ the collabortion prctice diussed in thi report. (GAO-08-361) Partially Implemented: DHS recently issued notice of propoed rlemking for implementing n exit cability ir nd POE. Thi notice provide high-level decription of propoed Air nd S Exit oltion, nd n etimte of the cot to develop, deploy, nd operte the oltion. Frther, it decri the role nd reponilitie of key keholder, such as ir nd rrier, nd et ome performnce indictor, such as when passenger iometric re to e trmitted to DHS. However, as diussed in thi riefing, thi propoed oltion r er of qtion tht need to e reolved. Partially Implemented: A noted erlier in thi riefing, DHS’ Air nd S Exit regtory impct ly lyzed the co nd enefit of the propoed oltion nd folterntive, nd DHS used thi ly in propoing it exit oltion. However, the cot etimte tht were used in thi ly were not sufficiently reliable to justify the propoed oltion. Partially Implemented: DHSas yet to direct ll of the pproprite prtie involved in defining, mging, nd coordinting reltionhip cross the deprtment’ order nd immigrtion mgement progr to ddress the progrm collabortion hortcoming identified in thi report nd, in doing o, to employ the collabortion prctice diussed in thi report. Specificlly, while US-VISIT has egn to coordinte with pecific order nd immigrtion mgement progr such as the Secre Border Inititive nd Wetern Hemiphere Trvel Inititive. In addition to the individual named above, Tonia Johnson (Assistant Director), Bradley Becker, Season Dietrich, Neil Doherty, Jennifer Echard, Elena Epps, Nancy Glover, Rebecca LaPaze, Anjalique Lawrence, Anh Le, Emily Longcore, Lee McCracken, Freda Paintsil, Karl Seifert, and Jeanne Sung made key contributions to this report.

Summary: The Department of Homeland Security (DHS) has established a program known as U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) to collect, maintain, and share information, including biometric identifiers, on certain foreign nationals who travel to and from the United States. By congressional mandate, DHS is to develop and submit an expenditure plan for US-VISIT that satisfies certain conditions, including being reviewed by GAO. GAO's objectives were to (1) determine if the plan satisfies the twelve legislative conditions and (2) provide observations about the plan and management of the program. To accomplish this, GAO assessed the plan and related DHS certification letters against each aspect of each legislative condition and assessed program documentation against federal guidelines and industry standards. The fiscal year 2008 US-VISIT expenditure plan does not fully satisfy any of the eleven conditions required of DHS by the Consolidated Appropriations Act, 2008, either because the plan does not address key aspects of the condition or because what it does address is not adequately supported or is otherwise not reflective of known program weaknesses. More specifically, of the eleven conditions, the plan partially satisfies eight. For example, while the plan includes a listing of GAO recommendations, it does not provide milestones for addressing these recommendations, as required by the act. Further, although the plan includes a certification by the DHS Chief Procurement Officer that the program has been reviewed and approved in accordance with the department's investment management process, and that this process fulfills all capital planning and investment control requirements and reviews established by the Office of Management and Budget, the certification is based on information that pertains to the fiscal year 2007 expenditure plan and fiscal year 2009 budget submission, rather than to the fiscal year 2008 expenditure plan. Moreover, even though the plan provides an accounting of operations and maintenance and program management costs, the plan does not separately identify the program's contractor services costs, as required by the act. With regard to the remaining three legislative conditions, the plan does not satisfy any of them. For example, the plan does not include a certification by the DHS Chief Human Capital Officer that the program's human capital needs are being strategically and proactively managed and that the program has sufficient human capital capacity to execute the expenditure plan. Further, the plan does not include a detailed schedule for implementing an exit capability or a certification that a biometric exit capability is not possible within 5 years. The twelfth legislative condition was satisfied by our review of the expenditure plan. Beyond the expenditure plan, GAO observed that other program planning and execution limitations and weaknesses also confront DHS in its quest to deliver US-VISIT capabilities and value in a timely and cost-effective manner. Concerning DHS's proposed biometric air and sea exit solution, for example, the reliability of the cost estimates used to justify the proposed solution is not clear, the proposed solution would provide less security and privacy than other alternatives, and public comments on the proposed solution raise additional concerns, including the impact the solution would have on the industry's efforts to improve passenger processing and travel. Moreover, the program's risk management database shows that key risks are not being managed. Finally, frequent rebaselining of one of the program's task orders has minimized the significance of schedule variances. Collectively, this means that additional management improvements are needed to effectively define, justify, and deliver a US-VISIT system solution that meets program goals, reflects stakeholder input, minimizes exposure to risk, and provides Congress with the means by which to oversee program execution. Until these steps are taken, US-VISIT program performance, transparency, and accountability will suffer.