US-VISIT is a governmentwide program intended to enhance the security of U.S. citizens and visitors, facilitate legitimate travel and trade, ensure the integrity of the U.S. immigration system, and protect the privacy of our visitors. To achieve its goals, US-VISIT is to collect, maintain, and share information on certain foreign nationals who enter and exit the United States; detect fraudulent travel documents, verify traveler identity, and determine traveler admissibility through the use of biometrics; facilitate information sharing and coordination within the immigration and border management community; and identify foreign nationals who (1) have overstayed or violated the terms of their admission; (2) may be eligible to receive, extend, or adjust their immigration status; or (3) should be apprehended or detained by law enforcement officials. The scope of the program includes the pre-entry, entry, status, and exit of hundreds of millions of foreign national travelers who enter and leave the United States at over 300 air, sea, and land POEs. The US-VISIT program office is responsible for managing the acquisition, deployment, operation, and sustainment of US-VISIT systems in support of such DHS agencies as Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE). As of March 31, 2007, the program director reports to the Under Secretary for the National Protection and Programs Directorate. In 2003, DHS planned to deliver US-VISIT capability in 4 increments: Increment 1 (air and sea entry and exit), Increment 2 (land entry and exit), Increment 3 (land entry and exit), and Increment 4, which was to define, design, build, and implement a more strategic program capability. Since then the scope of the first three increments has changed. The current scope is Increment 1 (air and sea entry), Increment 2 (air, sea, and land entry), and Increment 3 (land entry). Increment 4 is still intended to define, design, build, and implement a more strategic program capability, which program officials stated will consist of a series of incremental releases or mission capability enhancements that will support business outcomes. In Increments 1 through 3, the program has built interfaces among existing (“legacy”) systems, enhanced the capabilities of these systems, and deployed these capabilities to air, sea, and land POEs. These first three increments have been largely pursued through existing system contracts and task orders. Increment 4 strategic system enhancements are being pursued through a systems integration contract awarded to Accenture and its partners in May 2004. Through fiscal year 2007, about $1.7 billion has been appropriated for US-VISIT. According to the Department of Homeland Security Appropriations Act, 2007, DHS may not obligate $200 million of the $362.494 million appropriated for US-VISIT in fiscal year 2007 until DHS provides the Senate and House Committees with a plan for expenditure that meets several criteria. The department has requested $462 million in fiscal year 2008 for the program. As of January 31, 2007, program officials stated that about $1.3 billion has been obligated for US-VISIT activities. A biometrically enabled US-VISIT entry capability is operating at most POEs. On January 5, 2004, the program office deployed and began operating most aspects of its planned biometric entry capability at 115 airports and 14 seaports for certain foreign nationals, including those from visa waiver countries. As of December 2006, the program office also deployed and began operating this entry capability in the secondary inspection areas of 154 of 170 land POEs. According to program officials, 14 of the remaining 16 POEs have no operational need to deploy US-VISIT because visitors subject to US-VISIT are, by regulation, not authorized to enter into the United States at these locations. The other two POEs do not have the necessary transmission lines to operate US-VISIT, and thus they process visitors manually. According to DHS, these entry capabilities have produced results. For example, as of June 15, 2007, it had more than 7,600 biometric hits in primary entry resulting in more than 1,500 people having adverse actions, such as denial of entry, taken against them. Further, about 14,000 leads were referred to ICE’s immigration enforcement unit, resulting in 315 arrests. Another potential consequence is the deterrent effect of having an operational entry capability. Although deterrence is difficult to demonstrate, officials have cited it as a byproduct of having a publicized capability at the border to screen entry on the basis of identity verification and matching against watch lists of known and suspected terrorists. Over the last few years, DHS has devoted considerable time and resources towards establishing an operational exit capability at air, sea, and land POEs. For example, between 2003 and 2006, DHS reports allocating about $250 million for exit-related efforts. Notwithstanding this considerable investment of time and resources, DHS still does not have an operational exit capability. Our prior reports have raised a number of concerns about DHS’s management of US-VISIT’s exit efforts. As we and others have reported, the absence of a biometric exit capability raises questions about what meaningful US-VISIT data are available to DHS components, such as ICE. Without this exit capability, DHS cannot ensure the integrity of the immigration system by identifying and removing those people who have overstayed their original period of admission—a stated goal of US-VISIT. Further, ICE’s efforts to ensure the integrity of the immigration system could be degraded if it continues to spend its limited resources on investigating potential visa violators who have already left the country. Between January 2004 and May 2007, the program office conducted various exit pilots at one air and one sea POE without fully deploying a biometric exit capability. Throughout this period, we have reported on the limitations in how these pilot activities were planned, defined, and justified. For example, we reported in September 2003, prior to the pilots being deployed, that DHS had not economically justified the initial US-VISIT increment (which was to include an exit capability at air and sea POEs) on the basis of benefits, costs, and risks. As a result, we recommended that DHS determine whether proposed incremental capabilities would produce value commensurate with program costs and risks. We later reported in May 2004 that DHS had not deployed a biometric exit capability to the 80 air and 14 sea POEs as part of Increment 1 deployment in December 2003, as it had originally intended. Instead, as we mention above, the pilot exit capability was deployed to only one air and one sea POE on January 5, 2004. In February 2005, we reported that the program office had not adequately planned for evaluating its exit pilot at air and sea POEs because the pilot’s evaluation scope and time line were compressed, and thus would not provide the program office with sufficient information to adequately assess the pilots and permit the selection of the best exit solution for deployment. Accordingly, we recommended that the program office reassess its plans for deploying an exit capability to ensure that the scope of the pilot provided an adequate evaluation of alternatives. A year later in February 2006, we reported that the program office had extended the pilot from 5 to 11 POEs (nine airports and two seaports) and the time frame by an additional 7 months. Notwithstanding the expanded scope and time frame, the exit pilots were not sufficiently evaluated. In particular, on average only about 24 percent of those travelers subject to US-VISIT actually complied with the exit processing steps. The evaluation report attributed this, in part, to the fact that compliance during the pilot was voluntary, and that to achieve the desired compliance rate, the exit solution would need an enforcement mechanism, such as not allowing persons to reenter the United States if they do not comply with the exit process. Despite this limitation, as of February 2006, program officials had not conducted any formal evaluation of enforcement mechanisms or their possible effect on compliance or cost, and according to the then Acting Program Director, no such evaluation would be done. Nonetheless, DHS continued to operate the exit pilots. In February 2006, we also reported that while DHS had analyzed the cost, benefits, and risks for its air and sea exit capability, the analyses did not demonstrate that the program was producing or would produce mission value commensurate with expected costs and benefits, and the costs upon which the analyses were based were not reliable. A year later, we reported that DHS had not adequately defined and justified its past investment in its air and sea exit pilots and its land exit demonstration projects, and still did not have either an operational exit capability or a viable exit solution to deploy. We further noted that exit-related program documentation did not adequately define what work was to be done or what these efforts would accomplish, did not describe measurable outcomes from the pilot or demonstration efforts, and did not indicate the related cost, schedule, and capability commitments that would be met. We recommended that planned expenditures be limited for exit pilots and demonstration projects until such investments were economically justified and until each investment had a well-defined evaluation plan. In its comments on our report, DHS agreed with our recommendation. In January 2004, DHS committed to delivering a biometric exit capability by December 2005; however, we reported that program officials concluded in January 2005 that a biometric land exit capability could not be implemented without having a major impact on land POE facilities. According to these officials, the only proven technology available to biometrically verify individuals upon exit at land POEs would necessitate mirroring the entry processes, which the program reported was “an infeasible alternative for numerous reasons, including but not limited to, the additional staffing demands, new infrastructure requirements, and potential trade and commerce impacts.” In light of these constraints, the program office tested radio frequency identification (RFID) technology as a means of recording visitors as they exit at land POEs. However, this technology was not biometrics-based. Moreover, testing and analysis at five land POEs at the northern and southern borders identified numerous performance and reliability problems, such as the failure of RFID readers to detect a majority of travelers’ tags during testing. According to program officials, no technology or device currently exists to biometrically verify persons exiting the country that would not have a major impact on land POE facilities. They added that technological advances over the next 5 to 10 years will make it possible to biometrically verify persons exiting the country without major changes to facility infrastructure and without requiring those exiting to stop and/or exit their vehicles. In November 2006, during the course of our work on, among other things, the justification for ongoing land exit demonstration projects, DHS terminated these projects. In our view, the decision was warranted because DHS had not adequately defined and justified its investment in its pilots and demonstration projects. As noted earlier, we recommended in February 2007, that planned expenditures be limited for exit pilots and demonstration projects until such investments are economically justified and until each investment has a well-defined evaluation plan. DHS agreed with our recommendation. According to relevant federal guidance, the decision to invest in a system or system component should be based on a clear definition of what capabilities, involving what stakeholders, will be delivered according to what schedule and at what cost. Moreover, such investment decisions should be based on reasonable assurance that a proposed program will produce mission value commensurate with expected costs and risks. As noted earlier, DHS funding plans have collectively allocated about $250 million to a number of exit efforts through 2006, but without having adequately defined or economically justified them. Now, in 2007, it risks repeating these same mistakes as it embarks on yet another attempt to implement a means by which to biometrically track certain foreign nationals exiting the United States, first at airports, and then at seaports, with land exit capabilities being deferred to an unspecified future time. Based on the department’s latest available documentation, it intends to spend $27.3 million ($7.3 million in fiscal year 2007 funding and $20 million in fiscal year 2006 carryover funding) on air and sea exit capabilities. However, it has not produced either the plans or the analyses that adequately define and justify how it intends to invest these funds. Rather, it has only generally described near-term deployment plans for biometric exit capabilities at air and sea POEs, and acknowledged that a near-term biometric solution for land POEs is not possible. More specifically, the US-VISIT fiscal year 2007 expenditure plan states that DHS will begin the process of planning and designing an air and sea exit solution during fiscal year 2007, focusing initially on air exit and then emulating these technology and operational experiences in completing the sea exit solution. According to this plan, air exit efforts will begin during the third quarter of fiscal year 2007, which ends in 2 days. However, US-VISIT program officials told us as recently as three weeks ago that this deadline will not be met. Moreover, no exit program plans are available that define what will be done, by what entities, and at what cost to define, acquire, deliver, deploy, and operate this capability, including plans describing expected system capabilities, defining measurable outcomes (benefits and results), identifying key stakeholder (e.g., airlines) roles/responsibilities and buy-in, and coordinating and aligning with related programs. Further, there is no analysis available comparing the life cycle costs of the air exit solution to its expected benefits and risks. The only additional information available to date is what the department characterized as a high-level schedule for air exit that we obtained on June 11, 2007. This schedule shows that business requirements and a concept of operations are to be completed by September 3, 2007; a cost-benefit analysis is to be completed by October 1, 2007; testing is to be completed by October 1, 2008; and the exit solution is to be fully deployed in 2 years (June 2009). However, the schedule does not include the underlying details supporting the timelines for such areas of activity as system design, system development, and system testing. According to program officials, more detailed schedules exist but were not provided to us because the schedules had not yet been approved by DHS. Further, while the expenditure plan states that DHS plans to integrate the air exit solution with the commercial airlines’ existing check-in processes and to integrate US-VISIT’s efforts with CBP’s pre-departure Advance Passenger Information System and the Transportation Security Administration’s (TSA’s) Secure Flight, the program office did not provide any documentation that describes what has been done with regard to these plans or what is planned relative to engaging with and obtaining buy-in from the airlines. Nevertheless, DHS plans to issue a proposed regulation requiring airlines to participate in this effort by December 17, 2007. With regard to land exit, the future is even more unclear. According to the fiscal year 2007 expenditure plan, the department has concluded that a biometric land exit capability is not practical in the short term because of the costly expansion of existing exit capacity, including physical infrastructure, land acquisition, and staffing. As a result, DHS states an intention to begin matching entry and exit records using biographic information in instances where no current collection exists today, such as in the case of individuals who do not submit their Form I-94 upon departure. According to DHS, it has also initiated discussions with its Canadian counterparts about the potential for them to collect biographical exit data at entry into Canada. Such a solution could include data sharing between the two countries and would require significant discussions on specific data elements and the means of collection and sharing, including technical, policy, and legal issues associated with this approach. However, DHS has yet to provide us with any documentation that specifies what data elements would be collected or what technical, policy, and legal issues would need to be addressed. Further, according to DHS, it has not yet determined a time frame or any cost estimates for the initiation of such a non-biometric land exit solution. --------------------------------------------------------------- In closing, we would like to emphasize the mission importance of a cost effective, biometrically enabled exit capability, and that delivering such a capability requires effective planning and justification, and rigorous and disciplined system acquisition management. To date, these activities have not occurred for DHS’s exit efforts. If this does not change, there is no reason to expect that DHS’s newly launched efforts to deliver an air and sea exit solution will produce results different from its past efforts—namely, no operational exit solution despite many years and hundreds of millions of dollars of investment. More importantly, the continued absence of an exit capability will hinder DHS’s ability to effectively and efficiently perform its border security and immigration enforcement mission. Hence, it is important that DHS approach its latest attempt to deploy its exit capabilities in the kind of rigorous and disciplined fashion that we have previously recommended. Madam Chairwoman, this concludes our statement. We would be happy to answer any questions that you or members of the subcommittee may have at this time. If you should have any questions about this testimony, please contact Randolph C. Hite at (202) 512-3439 or hiter@gao.gov, or Richard M. Stana at (202) 512-8777 or stanar@gao.gov. Other major contributors include Deborah Davis, Kory Godfrey, Daniel Gordon, David Hinchman, Kaelin Kuhn, John Mortin, and Amos Tevelow. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The Department of Homeland Security (DHS) has spent and continues to invest hundreds of millions of dollars each year in its U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) program to collect, maintain, and share information on selected foreign nationals who enter and exit the United States at over 300 air, sea, and land ports of entry (POEs). The program uses biometric identifiers (digital finger scans and photographs) to screen people against watch lists and to verify that a visitor is the person who was issued a visa or other travel document. GAO's testimony addresses the status of US-VISIT entry and exit capabilities and DHS's management of past and future exit efforts. In developing its testimony, GAO drew from eight prior reports on US-VISIT as well as ongoing work for the committee. After investing about $1.3 billion over 4 years, DHS has delivered essentially one-half of US-VISIT, meaning that biometrically enabled entry capabilities are operating at almost 300 air, sea, and land POEs but comparable exit capabilities are not. To the department's credit, operational entry capabilities have reportedly produced results, including more than 1,500 people having adverse actions, such as denial of entry, taken against them. However, DHS still does not have the other half of US-VISIT (an operational exit capability) despite the fact that its funding plans have allocated about one-quarter of a billion dollars since 2003 to exit-related efforts. During this time, GAO has continued to cite weaknesses in how DHS is managing US-VISIT in general, and the exit side of US-VISIT in particular, and has made numerous recommendations aimed at better ensuring that the program delivers clearly defined and adequately justified capabilities and benefits on time and within budget. The prospects for successfully delivering an operational exit solution are as uncertain today as they were 4 years ago. The department's latest available documentation indicates that little has changed in how DHS is approaching its definition and justification of future US-VISIT exit efforts. Specifically, DHS has indicated that it intends to spend $27.3 million ($7.3 million in fiscal year 2007 funding and $20 million in fiscal year 2006 carryover funding) on air and sea exit capabilities. However, it has not produced either plans or analyses that adequately define and justify how it intends to invest these funds. Rather, it has only described in general terms near-term deployment plans for biometric exit capabilities at air and sea POEs, and acknowledged that a near-term biometric solution for land POEs is not possible. Beyond this high-level schedule, no other exit program plans are available that define what will be done by what entities and at what cost. In the absence of more detailed plans and justification governing its exit intentions, it is unlikely that the department's latest efforts to deliver near-term air and sea exit capabilities will produce results different from the past. Therefore, the prospects for having operational exit capabilities continue to be unclear. Moreover, the longer the department goes without exit capabilities, the more its ability to effectively and efficiently perform its border security and immigration enforcement missions will suffer. Among other things, this means that DHS cannot ensure the integrity of the immigration system by identifying and removing those people who have overstayed their original period of admission, which is a stated goal of US-VISIT. Further, DHS immigration and customs enforcement entities will continue to spend limited resources on investigating potential visa violators who have already left the country.