As we reported in January 2017, CBP electronically vets all travelers before they board U.S.-bound flights and continues to do so until they land at a U.S. port of entry. Through these vetting efforts, CBP seeks to identify high-risk travelers from the millions of individuals who travel to the United States each year. As we reported in January 2017, CBP’s vetting and targeting efforts are primarily conducted by its National Targeting Center (NTC) and entail (1) traveler data matching and analysis, (2) rules- based targeting, and (3) recurrent vetting. Specifically: CBP’s primary method of identifying high-risk individuals is through the comparison of travelers’ information (such as name, date of birth, and gender) against records extracted from U.S. government databases, including the Terrorist Screening Database (TSDB)—the U.S. government’s consolidated terrorist watch list. Traveler data matching focuses on identifying known high-risk individuals—that is, individuals who may be inadmissible to the United States under U.S. immigration law or who may otherwise pose a threat to homeland or national security. CBP’s primary tool for vetting and targeting travelers is the Automated Targeting System (ATS), which is a computer-based enforcement and support system that compares traveler information against intelligence and law enforcement data to identify high-risk travelers. Traveler data matching occurs throughout the travel process and, upon a positive or possible match, CBP officers can select these individuals for further vetting, interviewing, and inspection. CBP’s rules-based targeting efforts seek to identify unknown high-risk travelers—that is, travelers for whom U.S. government entities do not have available derogatory information directly linking them to terrorist activities or any other actions that would make them potentially inadmissible to the United States but who may present a threat and thus warrant additional scrutiny. CBP identifies unknown high-risk individuals by comparing their information against a set of targeting rules based on intelligence, law enforcement, and other information. NTC officials stated that these rules have identified potential high-risk travelers, including potential foreign fighters. Rules-based targeting evaluates travelers during the travel process and, in some cases, in advance of the travel process. If a traveler is a rule “hit,” this individual can be selected for further vetting, interviewing, and inspection. CBP supports its traveler data matching and rules-based targeting efforts through the use of recurrent vetting. NTC’s vetting, targeting, and traveler data matching activities in ATS run 24 hours a day and seven days a week and automatically scan updated traveler information, when available. This process is to ensure that new information that affects a traveler’s admissibility is identified in near real time. Recurrent vetting occurs throughout the travel process and continues until a traveler arrives at a domestic port of entry. For example, after checking into a foreign airport, a traveler may have his or her visa revoked for a security or immigration-related violation. Due to recurrent vetting, CBP would be alerted to this through ATS and could take action, as appropriate. As we reported in January 2017, throughout the travel process, CBP’s predeparture programs use the results of NTC’s efforts to identify and interdict high-risk individuals destined for the United States while they are still overseas; however, we found that CBP had not evaluated the effectiveness of its predeparture programs as a whole, including implementing a system of performance measures and baselines to assess whether the programs are achieving their stated goals. CBP operates three air predeparture programs that are responsible for all U.S.-bound air travelers—Preclearance; the Immigration Advisory Program (IAP) and Joint Security Program (JSP); and the regional carrier liaison groups (RCLG). As we reported in January 2017, CBP data indicated that these programs identified and ultimately interdicted approximately 22,000 high-risk air travelers in fiscal year 2015, the most recent data available at the time of our review. Information on individuals who the NTC identifies through traveler data matching or rules-based targeting, including recurrent vetting, is compiled automatically through ATS into a daily high-priority list, or traveler referral list. CBP officers at the NTC review the traveler referral list for accuracy and to remove, if possible, any automatically generated matches determined to not be potential high-risk individuals. After this review, CBP officers at the NTC use ATS to send the traveler referral list to officers at each Preclearance, IAP, JSP, and RCLG location, as shown in figure 2. Preclearance. Preclearance locations operate at foreign airports and serve as U.S. ports of entry. Preclearance operations began in 1952 in Toronto to facilitate trade and travel between the United States and Canada. As of January 2017, CBP operated 15 air Preclearance locations in six countries. Through the Preclearance program, uniformed CBP officers at a foreign airport exercise U.S. legal authorities to inspect travelers and luggage and make admissibility determinations prior to an individual boarding a plane to the United States. According to CBP officials, an inspection at a Preclearance location is the same inspection an individual would undergo at a domestic port of entry, and officers conducting Preclearance inspections exercise the same authority as officers at domestic ports of entry to approve or deny admission into the United States. As a result, travelers arriving at domestic air ports of entry from Preclearance locations do not have to be re-inspected upon entry. According to CBP data, in fiscal year 2015, CBP officers at Preclearance locations determined that 10,648 air travelers were inadmissible out of the approximately 16 million air travelers seeking admission to the United States through a Preclearance location. In addition to requiring that all travelers undergo a primary inspection, CBP officers in these locations also referred almost 290,000 individuals for secondary inspection. Immigration Advisory Program (IAP) and Joint Security Program (JSP). IAP and JSP operate at 9 and 2 foreign airports, respectively, as of January 2017. According to CBP officials, under this program, unarmed, plainclothes CBP officers posted at foreign airports partner with air carriers and host country government officials to help prevent terrorists and other high-risk individuals from boarding U.S.-bound flights by vetting and interviewing them before travel. According to CBP program documentation, CBP established IAP in 2004 to prevent terrorists, high- risk travelers, and improperly documented travelers from boarding airlines destined to the United States. Building on the IAP concept, CBP established JSP in 2009 to partner with host country law enforcement officials to identify high-risk travelers. CBP officers at IAP and JSP locations have the ability to question travelers and review their travel documents. They are to act in an advisory manner to the air carriers and host governments and do not have authority to deny boarding to individuals on U.S.-bound flights or fully inspect travelers or their belongings. IAP and JSP officers are authorized by CBP to make recommendations to airlines as to whether to board or deny boarding (known as a no-board recommendation) to selected travelers based on their likely admissibility status upon arrival to the United States. The final decision to board travelers, however, lies with the carriers. According to CBP data, CBP officers at IAP and JSP locations made 3,925 no-board recommendations in fiscal year 2015 for the approximately 29 million air travelers bound for the United States from such locations. During this same time period, CBP data indicated 1,154 confirmed encounters with individuals on the TSDB, including 106 on the No Fly List. Regional Carrier Liaison Groups (RCLG). RCLGs are located and operate at three domestic airports—Miami International Airport, John F. Kennedy International Airport, and Honolulu International Airport. CBP established RCLGs in 2006 to assist air carriers with questions regarding U.S. admissibility requirements and travel document authenticity. According to CBP officials, RCLGs are responsible for coordinating with air carriers on all actionable referrals from NTC on U.S.-bound travelers departing from an airport without an IAP, JSP, or Preclearance presence. Each RCLG is assigned responsibility for travelers departing out of a specific geographic location. Similar to IAP and JSP, CBP officers in RCLGs also make no-board recommendations, as appropriate, to air carriers. CBP officers at RCLGs do not have authority to make admissibility determinations about U.S.-bound air travelers, and the final decision to board or not board a traveler lies with the carrier. CBP officers working at the three RCLGs made 7,664 no-board recommendations in fiscal year 2015 for the approximately 59 million travelers bound for the United States from locations within the RCLGs’ spheres of responsibility. During this time period, CBP data indicated that RCLGs also reported 1,634 confirmed encounters with individuals in the TSDB, including 119 on the No Fly List. In January 2017, we reported that CBP had not evaluated the effectiveness of its predeparture programs as a whole, including implementing a system of performance measures and baselines to assess whether the programs were achieving their stated goals. We reported that CBP had taken some initial steps to measure the performance of these programs. Specifically, CBP officials told us that they had collected a large quantity of data and statistics regarding the actions of their predeparture programs and had done so since program inception for all programs. However, due to changes in operational focus, technology updates, and the use of separate data systems at program locations, CBP had not collected consistent data across all of its predeparture programs. As a result, CBP did not have baseline data on which to measure program performance. However, CBP officials stated at the time that they had updated and uniform data collection systems that were consistent across all predeparture programs, which would enable CBP to identify performance baselines from fiscal year 2015 onward. According to senior CBP officials, some of the results of these programs were not easily measured. Officials also noted that relying on data alone may not always present the most accurate picture of the true impact of predeparture programs because changes to the travel process or other factors may impact the programs in ways that are not fully captured by the data. However, on the basis of our analysis of CBP’s documentation, including official hearing statements, and interviews with program officials, we found that CBP used these data as indicators of the programs’ success. According to GAO’s Program Evaluation Guide, which articulates best practices for program evaluation, a program evaluation is a systematic study using research methods to collect and analyze data to assess how well a program is working and why. Moreover, consistent with requirements outlined in the Government Performance and Results Act of 1993 (GPRA), as updated by the GPRA Modernization Act of 2010, performance measurement is the ongoing monitoring and reporting of program accomplishments, particularly towards pre-established goals, and agencies are to establish performance measures to assess progress towards goals. Agencies can use performance measurement to make various types of management decisions to improve programs and results, such as developing strategies and allocating resources, and identify problems and take corrective action. Therefore, we recommended that CBP develop and implement a system of performance measures and baselines for each program to help ensure that these programs are achieving their intended goals. By using data from fiscal year 2015, for example, to develop initial baselines, CBP could better measure program performance towards meeting stated goals. In response, CBP established a working group to develop and implement a system of performance measures and baselines to evaluate the effectiveness of CBP’s predeparture programs. As of December 2016, the working group was gathering baseline data from fiscal year 2015 to compare with fiscal year 2016 data. In February 2017, CBP officials stated that the working group had identified potential performance measures but needs to further refine them. CBP officials stated that they expect to complete this work by the end of June 2017. The Homeland Security Act of 2002 authorized DHS to assign officers to each diplomatic and consular post at which visas are issued, and also authorized DHS to immediately assign personnel to Saudi Arabia to review all visa applications prior to final adjudication. In response, DHS implemented the Visa Security Program (VSP) in 2003, and as of March 2016, ICE had established 26 visa security units in 20 countries. VSP aims to prevent terrorists and otherwise inadmissible travelers from attempting to enter the United States by screening visa applicants before the travel process begins. When reviewing applications for visas under VSP, ICE screens applicant information to identify applicants that potentially match records of individuals who are known or suspected threats to the United States or have immigration violations or derogatory information related to their criminal histories. In accordance with the Homeland Security Act of 2002, DHS officers assigned overseas are authorized to perform the following functions: provide expert advice and training to consular officers regarding specific security threats relating to the adjudication of individual visa applications or classes of applications, review any such visa applications either on the initiative of the employee of the department or at the request of a consular officer, or other persons charged with adjudicating such applications, and conduct investigations with respect to consular matters under the jurisdiction of the Secretary of Homeland Security. In March 2011, we reported, among other things, on DHS’s efforts to expand VSP and challenges to VSP operations overseas. For example, we found that training of consular officers by VSP agents varied from post to post, with some consular officers at some posts receiving no training. Therefore, we recommended that DHS issue guidance requiring ICE to provide training for consular officers. DHS concurred and issued guidance to enhance the training of consular officers by VSP offices abroad. We also found that ICE did not gather comprehensive data on all the performance measures needed to evaluate the VSP mission objectives and that the data that ICE collected on VSP activities were limited by inconsistencies. Therefore, we recommended that ICE collect reliable data to allow it to accurately evaluate VSP performance. DHS did not concur with this recommendation and stated that VSP captured all the required performance metrics. However, as we reported, we determined that ICE was collecting some data on the required performance measures, but that the data were not sufficient to accurately demonstrate the progress made toward the program’s stated objectives. We continue to believe that without collecting comprehensive data on performance measures, DHS cannot accurately demonstrate progress of VSP in enhancing national security. In addition, we found that VSP agents performed various investigative and administrative functions beyond their visa security responsibilities, which limited their time spent on visa security activities, and ICE did not track this information in its tracking system, making it unable to identify the time spent on investigative and administrative functions. Therefore, we recommended that ICE develop a mechanism to track the amount of time its agents spent on visa security activities and other investigations to determine appropriate staffing levels and resource needs for VSP operations. DHS did not concur with our recommendation and stated that ICE tracked case investigation hours through its case management system, and that adding the metric to the VSP tracking system would be redundant. However, we found at the time, according to ICE documentation, that ICE could not accurately determine the amount of time that VSP agents spent on investigative and visa security activities because ICE did not distinguish between the hours logged by VSP agents and hours logged by other ICE officials at posts abroad and that ICE did not maintain accurate data on the time VSP agents spent on visa security activities at posts. ICE did not take action to implement these recommendations and we continue to believe that it needs to take steps to address issues we identified. We have ongoing work assessing DHS, State, and other U.S. agency efforts to strengthen the security of the visa process, including oversight of VSP, in which we plan to follow up on the findings and recommendations from our March 2011 report related to ICE’s efforts to enhance VSP performance measurement, among other things. We plan to report later this year on the results of this work. In May 2016, among other things, we reported that all 38 countries participating in the VWP had entered into the three types of required information-sharing agreements, or their equivalents, to (1) report lost and stolen passports, (2) share identity information about known or suspected terrorists, and (3) share criminal history information. However, we reported that not all countries had shared information through two of the agreements. Specifically, we reported that all VWP countries reported passport information through the first agreement, but about one-third of VWP countries were not sharing terrorist identity information through the second agreement and about one-third of the countries had not yet shared criminal history information through the third agreement. Although U.S. agencies receive law enforcement and national security information from VWP countries through other means, such as multilateral entities, the U.S. government identified the information-sharing agreements as critical for protecting the United States from nationals of VWP countries who might present a threat. For example, as we reported, information provided through HSPD-6 arrangements has enhanced U.S. traveler- screening capabilities and improved U.S. agencies’ ability to prevent known and suspected terrorists from traveling to the United States. Prior to the December 2015 enactment of the Visa Waiver Program Improvement and Terrorist Travel Prevention Act of 2015, U.S. law required VWP countries to enter into, but did not specifically require that countries implement, the information sharing agreements. DHS announced in August 2015 that it had developed a new requirement that countries implement the agreements by sharing information. However, as we reported, DHS had not specified time frames for working with VWP countries to institute this and other new VWP security requirements. In May 2016, we recommended that DHS specify time frames for working with VWP countries to institute the additional VWP security requirements, including the requirement that the countries fully implement agreements to share information about known or suspected terrorists through the countries’ HSPD-6 arrangements and PCSC agreements with the United States. DHS concurred with the recommendation and, as of April 2017, reported that officials are continuing to work with VWP countries on time frames for implementing program requirements. Chairman Gallagher, Ranking Member Watson Coleman, and Members of the Task Force, this concludes my prepared statement. I would be pleased to respond to any questions that you may have. For further information regarding this testimony, please contact Rebecca Gambler at (202) 512-8777 or gamblerr@gao.gov. In addition, contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals who made key contributions to this testimony are Kathryn H. Bernet, Assistant Director; Eric Hauswirth; Paul Hobart; Brandon Hunt; Hynek Kalkus; Thomas Lombardi; Sasan J. “Jon” Najmi; Erin O’Brien; Mary Pitts; and Garrett Riba. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: DHS seeks to identify and interdict travelers who are potential security threats to the United States, such as foreign fighters and potential terrorists, human traffickers, drug smugglers and otherwise inadmissible persons, at the earliest possible point in time. DHS also adjudicates petitions for certain visa categories and has certain responsibilities for strengthening the security of the visa process, including oversight of VSP and VWP. State manages the visa adjudication process for foreign nationals seeking admission to the United States. This statement addresses (1) CBP programs aimed at preventing high-risk travelers from boarding U.S.-bound flights; (2) ICE's management of VSP; and (3) DHS's oversight of VWP. This statement is based on prior products GAO issued from March 2011 through January 2017, along with selected updates conducted in April 2017 to obtain information from DHS on actions it has taken to address prior GAO recommendations. In January 2017, GAO reported that the Department of Homeland Security's (DHS) U.S. Customs and Border Protection (CBP) operates predeparture programs to help identify and interdict high-risk travelers before they board U.S.-bound flights. CBP officers inspect all U.S.-bound travelers on precleared flights at the 15 Preclearance locations and, if deemed inadmissible, a traveler will not be permitted to board the aircraft. CBP also operates nine Immigration Advisory Program and two Joint Security Program locations, as well as three Regional Carrier Liaison Groups, through which CBP may recommend that air carriers not permit identified high-risk travelers to board U.S.-bound flights. CBP data showed that it identified and interdicted over 22,000 high-risk air travelers through these programs in fiscal year 2015 (the most recent data available at the time of GAO's report). However, CBP had not fully evaluated the overall effectiveness of these programs using performance measures and baselines. CBP tracked some data, such as the number of travelers deemed inadmissible, but had not set baselines to determine if predeparture programs are achieving goals, consistent with best practices for performance measurement. GAO recommended that CBP develop and implement a system of performance measures and baselines to better position CBP to assess if the programs are achieving their goals. CBP concurred and has established a working group to develop such measures and baselines. In March 2011, GAO reported on the Visa Security Program (VSP) through which DHS's U.S. Immigration and Customs Enforcement (ICE) deploys personnel to certain U.S. overseas posts to review visa applications. Among other things, GAO found that ICE did not collect comprehensive data on all VSP performance measures or track the time officials spent on visa security activities. DHS did not concur with GAO's recommendations to address these limitations, stating that ICE collected data on all the required performance measures and tracked VSP case investigation hours. However, GAO continues to believe DHS needs to address these limitations. GAO has ongoing work assessing U.S. agencies' efforts to strengthen the security of the visa process, including oversight of VSP, in which GAO plans to follow up on the findings and recommendations from its March 2011 report related to ICE's efforts to enhance VSP performance measurement. In May 2016, GAO reported on DHS's oversight of the Visa Waiver Program (VWP), which allows nationals from 38 countries to travel visa-free to the United States for business or pleasure for 90 days or less. GAO reported, among other things, that all 38 countries entered into required agreements, or their equivalents, to (1) report lost and stolen passports, (2) share identity information about known or suspected terrorists, and (3) share criminal history information. However, not all countries shared such information. In August 2015, DHS established a new requirement for VWP countries to implement the latter two agreements; however, DHS did not establish time frames for instituting the amended requirements. GAO recommended that DHS work with VWP countries to implement these agreements and DHS concurred. As of April 2017, DHS reported that officials are continuing to work with VWP countries on time frames for implementing program requirements. GAO previously made recommendations to improve evaluation of CBP's predeparture programs' performance and strengthen DHS's oversight of VSP and VWP. DHS agreed with GAO's recommendations related to CBP's predeparture programs and VWP. DHS did not agree with some of GAO's recommendations related to VSP. GAO has ongoing work related to, among other things, DHS's management and oversight of VSP and plans to report later this year on the results of this work.