As we reported in April 2011, ICE CTCEU investigates and arrests a small portion of the estimated in-country overstay population due to, among other things, ICE’s competing priorities; however, these efforts could be enhanced by improved planning and performance management. CTCEU, the primary federal entity responsible for taking enforcement action to address in-country overstays, identifies leads for overstay cases; takes steps to verify the accuracy of the leads it identifies by, for example, checking leads against multiple databases; and prioritizes leads to focus on those the unit identifies as being most likely to pose a threat to national security or public safety. CTCEU then requires field offices to initiate investigations on all priority, high-risk leads it identifies. According to CTCEU data, as of October 2010, ICE field offices had closed about 34,700 overstay investigations that CTCEU headquarters assigned to them from fiscal year 2004 through 2010. These cases resulted in approximately 8,100 arrests (about 23 percent of the 34,700 investigations), relative to a total estimated overstay population of 4 million to 5.5 million. About 26,700 of those investigations (or 77 percent) resulted in one of these three outcomes: (1) evidence is uncovered indicating that the suspected overstay has departed the United States; (2) evidence is uncovered indicating that the subject of the investigation is in-status (e.g., the subject filed a timely application with the United States Citizenship and Immigration Services (USCIS) to change his or her status and/or extend his or her authorized period of admission in the United States); or (3) CTCEU investigators exhaust all investigative leads and cannot locate the suspected overstay. Of the approximately 34,700 overstay investigations assigned by CTCEU headquarters that ICE field offices closed from fiscal year 2004 through 2010, ICE officials attributed the significant portion of overstay cases that resulted in a departure finding, in-status finding, or with all leads being exhausted generally to difficulties associated with locating suspected overstays and the timeliness and completeness of data in DHS’s systems used to identify overstays. Further, ICE reported allocating a small percentage of its resources in terms of investigative work hours to overstay investigations since fiscal year 2006, but the agency expressed an intention to augment the resources it dedicates to overstay enforcement efforts moving forward. Specifically, from fiscal years 2006 through 2010, ICE reported devoting from 3.1 to 3.4 percent of its total field office investigative hours to CTCEU overstay investigations. ICE attributed the small percentage of investigative resources it reported allocating to overstay enforcement efforts primarily to competing enforcement priorities. According to the ICE Assistant Secretary, ICE has resources to remove 400,000 aliens per year, or less than 4 percent of the estimated removable alien population in the United States. In June 2010, the Assistant Secretary stated that ICE must prioritize the use of its resources to ensure that its efforts to remove aliens reflect the agency’s highest priorities, namely nonimmigrants, including suspected overstays, who are identified as high risk in terms of being most likely to pose a risk to national security or public safety. As a result, ICE dedicated its limited resources to addressing overstays it identified as most likely to pose a potential threat to national security or public safety and did not generally allocate resources to address suspected overstays that it assessed as noncriminal and low risk. ICE indicated that it may allocate more resources to overstay enforcement efforts moving forward and that it planned to focus primarily on suspected overstays whom ICE has identified as high risk or who recently overstayed their authorized periods of admission. ICE was considering assigning some responsibility for noncriminal overstay enforcement to its Enforcement and Removal Operations (ERO) directorate, which has responsibility for apprehending and removing aliens who do not have lawful immigration status from the United States. However, ERO did not plan to assume this responsibility until ICE assessed the funding and resources doing so would require. ICE had not established a time frame for completing this assessment. We reported in April 2011 that by developing such a time frame and utilizing the assessment findings, as appropriate, ICE could strengthen its planning efforts and be better positioned to hold staff accountable for completing the assessment. We recommended that ICE establish a target time frame for assessing the funding and resources ERO would require in order to assume responsibility for civil overstay enforcement and use the results of that assessment. DHS officials agreed with our recommendation and stated that ICE planned to identify resources needed to transition this responsibility to ERO as part of its fiscal year 2013 resource-planning process. Moreover, although CTCEU established an output program goal and target, and tracked various performance measures, it did not have a mechanism in place to assess the outcomes of its efforts, particularly the extent to which the program was meeting its mission as it relates to overstays—to prevent terrorists and other criminals from exploiting the nation’s immigration system. CTCEU’s program goal is to prevent criminals and terrorists from exploiting the immigration system by proactively developing cases for investigation, and its performance target is to send 100 percent of verified priority leads to field offices as cases. CTCEU also tracks a variety of output measures, such as the number of cases completed their associated results (i.e., arrested, departed, in- status, or all leads exhausted) and average hours spent to complete an investigation. While CTCEU’s performance target permits it to assess an output internal to the program—the percentage of verified priority leads it sends to field offices for investigation—it does not provide program officials with a means to assess the impact of the program in terms of preventing terrorists and other criminals from exploiting the immigration system. We reported that by establishing such mechanisms, CTCEU could better ensure that managers have information to assist in making decisions for strengthening overstay enforcement efforts and assessing performance against CTCEU’s goals. In our April 2011 report, we recommended that ICE develop outcome-based performance measures—or proxy measures if program outcomes cannot be captured—and associated targets on CTCEU’s progress in preventing terrorists and other criminals from exploiting the nation’s immigration system. DHS officials agreed with our recommendation and stated that ICE planned to work with DHS’s national security partners to determine if measures could be implemented. In addition to ICE’s overstay enforcement activities, in April 2011 we reported that the Department of State and CBP are responsible for, respectively, preventing ineligible violators from obtaining a new visa or being admitted to the country at a port of entry. According to Department of State data, the department denied about 52,800 nonimmigrant visa applications and about 114,200 immigrant visa applications from fiscal year 2005 through fiscal year 2010 due, at least in part, to applicants having previously been unlawfully present in the United States for more than 180 days, according to statute. Similarly, CBP reported that it refused admission to about 5,000 foreign nationals applying for admission to the United States from fiscal year 2005 through 2010 (an average of about 830 per year) specifically because of the applicants’ previous status as unlawfully present in the United States for more than 180 days. DHS has not yet implemented a comprehensive biometric system to match available information provided by foreign nationals upon their arrival and departure from the United States. In August 2007, we reported that while US-VISIT biometric entry capabilities were operating at air, sea, and land ports of entry, exit capabilities were not, and that DHS did not have a comprehensive plan or a complete schedule for biometric exit implementation. In addition, we reported that DHS continued to propose spending tens of millions of dollars on US-VISIT exit projects that were not well-defined, planned, or justified on the basis of costs, benefits, and risks. Moreover, in November 2009, we reported that DHS had not adopted an integrated approach to scheduling, executing, and tracking the work that needed to be accomplished to deliver a comprehensive exit solution as part of the US-VISIT program. We concluded that, without a master schedule that was integrated and derived in accordance with relevant guidance, DHS could not reliably commit to when and how it would deliver a comprehensive exit solution or adequately monitor and manage its progress toward this end. We recommended that DHS ensure that an integrated master schedule be developed and maintained. DHS concurred and reported, as of July 2011, that the documentation of schedule practices and procedures is ongoing, and that an updated schedule standard, management plan, and management process that are compliant with schedule guidelines are under review. More specifically, with regard to a biometric exit capability at land ports of entry, we reported in December 2006 that US-VISIT officials concluded that, for various reasons, a biometric US-VISIT exit capability could not be implemented without incurring a major impact on land facilities. In December 2009, DHS initiated a land exit pilot to collect departure information from temporary workers traveling through two Arizona land ports of entry. Under this pilot, temporary workers who entered the United States at these ports of entry were required to register their final departure by providing biometric and biographic information at exit kiosks located at the ports of entry. DHS planned to use the results of this pilot to help inform future decisions on the pedestrian component of the long- term land exit component of a comprehensive exit system. With regard to air and sea ports of entry, in April 2008, DHS announced its intention to implement biometric exit verification at air and sea ports of entry in a Notice of Proposed Rule Making. Under this notice, commercial air and sea carriers would be responsible for developing and deploying the capability to collect biometric information from departing travelers and transmit it to DHS. DHS received comments on the notice and has not yet published a final rule. Subsequent to the rule making notice, on September 30, 2008, the Consolidated Security, Disaster Assistance, and Continuing Appropriations Act, 2009, was enacted, which directed DHS to test two scenarios for an air exit solution: (1) airline collection and transmission of biometric exit data, as proposed in the rule making notice and (2) CBP collection of such information at the departure gate. DHS conducted two pilots in 2009, and we reported on them in August 2010. Specifically, we reported that the pilots addressed one statutory requirement for a CBP scenario to collect information on exiting foreign nationals. However, DHS was unable to address the statutory requirement for an airline scenario because no airline was willing to participate. We reported on limitations with the pilots, such as the reported scope and approach of the pilots including limitations not defined in the pilot evaluation plan like suspending exit screening at departure gates to avoid flight delays, that curtailed their ability to inform a decision for a long-term air exit solution and pointed to the need for additional sources of information on air exit’s operational impacts. We recommended that the Secretary of Homeland Security identify additional sources of information beyond the pilots, such as comments from the Notice of Proposed Rule Making, to inform an air exit solution decision. DHS agreed with the recommendation and stated that the pilots it conducted would not serve as the sole source of information to inform an air exit solution decision. In July 2011, DHS stated that it continues to examine all options in connection with a final biometric air exit solution and has recently given consideration to using its authority to establish an advisory committee to study and provide recommendations to DHS and Congress on implementing an air exit program. In the absence of a comprehensive biometric entry and exit system for identifying and tracking overstays, US-VISIT and CTCEU primarily analyze biographic entry and exit data collected at land, air, and sea ports of entry to identify overstays. In April 2011, we reported that DHS’s efforts to identify and report on visa overstays were hindered by unreliable data. Specifically, CBP does not inspect travelers exiting the United States through land ports of entry, including collecting their biometric information, and CBP did not provide a standard mechanism for nonimmigrants departing the United States through land ports of entry to remit their arrival and departure forms. Nonimmigrants departing the United States through land ports of entry turn in their forms on their own initiative. According to CBP officials, at some ports of entry, CBP provides a box for nonimmigrants to drop off their forms, while at other ports of entry departing nonimmigrants may park their cars, enter the port of entry facility, and provide their forms to a CBP officer. These forms contain information, such as arrival and departure dates, used by DHS to identify overstays. If the benefits outweigh the costs, a mechanism to provide nonimmigrants with a way to turn in their arrival and departure forms could help DHS obtain more complete and reliable departure data for identifying overstays. We recommended that the Commissioner of CBP analyze the costs and benefits of developing a standard mechanism for collecting these forms at land ports of entry, and develop a standard mechanism to collect them, to the extent that benefits outweigh the costs. CBP agreed with our recommendation and stated it planned to complete a cost-effective independent evaluation. Further, we previously reported on weaknesses in DHS processes for collecting departure data, and how these weaknesses impact the determination of overstay rates. The Implementing Recommendations of the 9/11 Commission Act required that DHS certify that a system is in place that can verify the departure of not less than 97 percent of foreign nationals who depart through U.S. airports in order for DHS to expand the Visa Waiver Program. In September 2008, we reported that DHS’s methodology for comparing arrivals and departures for the purpose of departure verification would not inform overall or country-specific overstay rates because DHS’s methodology did not begin with arrival records to determine if those foreign nationals departed or remained in the United States beyond their authorized periods of admission. Rather, DHS’s methodology started with departure records and matched them to arrival records. As a result, DHS’s methodology counted overstays who left the country, but did not identify overstays who have not departed the United States and appear to have no intention of leaving. We recommended that DHS explore cost-effective actions necessary to further improve the reliability of overstay data. DHS reported that it is taking steps to improve the accuracy and reliability of the overstay data, by efforts such as continuing to audit carrier performance and work with airlines to improve the accuracy and completeness of data collection. Moreover, by statute, DHS is required to submit an annual report to Congress providing numerical estimates of the number of aliens from each country in each nonimmigrant classification who overstayed an authorized period of admission that expired during the fiscal year prior to the year for which the report is made. DHS officials stated that the department has not provided Congress annual overstay estimates regularly since 1994 because officials do not have sufficient confidence in the quality of the department’s overstay data—which is maintained and generated by US- VISIT. As a result, DHS officials stated that the department cannot reliably report overstay rates in accordance with the statute. In addition, in April 2011 we reported that DHS took several steps to provide its component entities and other federal agencies with information to identify and take enforcement action on overstays, including creating biometric and biographic lookouts—or electronic alerts—on the records of overstay subjects that are recorded in databases. However, DHS did not create lookouts for the following two categories of overstays: (1) temporary visitors who were admitted to the United States using nonimmigrant business and pleasure visas and subsequently overstayed by 90 days or less; and (2) suspected in-country overstays who CTCEU deemed not to be a priority for investigation in terms of being most likely to pose a threat to national security or public safety. Broadening the scope of electronic lookouts in federal information systems could enhance overstay information sharing. In April 2011, we recommended that the Secretary of Homeland Security direct the Commissioner of Customs and Border Protection, the Under Secretary of the National Protection and Programs Directorate, and the Assistant Secretary of Immigration and Customs Enforcement to assess the costs and benefits of creating biometric and biographic lookouts for these two categories of overstays. Agency officials agreed with our recommendation and have actions under way to address it. For example, agency officials stated that they have met to assess the costs and benefits of creating lookouts for those categories of overstays. As we reported in March 2011, the Visa Security Program faces several key challenges in implementing operations at overseas posts. For example, we reported that Visa Security Program agents’ advising and training of consular officers, as mandated by section 428 of the Homeland Security Act, varied from post to post, and some posts provided no training to consular officers. We contacted consular sections at 13 overseas posts, and officials from 5 of the 13 consular sections we interviewed stated that they had received no training from the Visa Security Program agents in the last year, and none of the agents we interviewed reported providing training on specific security threats. At posts where Visa Security Program agents provided training for consular officers, topics covered included fraudulent documents, immigration law, human smuggling, and interviewing techniques. In March 2011, we recommended that DHS issue guidance requiring Visa Security Program agents to provide training for consular officers as mandated by section 428 of the Homeland Security Act. DHS concurred with our recommendation and has actions under way to address it. Further, in March 2011 we reported that Visa Security Program agents performed a variety of investigative and administrative functions beyond their visa security responsibilities, including criminal investigations, attaché functions, and regional responsibilities. According to ICE officials, Visa Security Program agents perform non-program functions only after completing their visa security screening and vetting workload. However, both agents and Department of State officials at some posts told us that these other investigative and administrative functions sometimes slowed or limited Visa Security Program agents’ visa security-related activities. We recommended that DHS develop a mechanism to track the amount of time spent by Visa Security Program agents on visa security activities and other investigations, in order to determine appropriate staffing levels and resource needs for Visa Security Program operations at posts overseas to ensure visa security operations are not limited. DHS did not concur with our recommendation, stating that ICE currently tracks case investigation hours through its data system, and that adding the metric to the Visa Security Program tracking system would be redundant. However, DHS’s response did not address our finding that ICE does not have a mechanism that allows the agency to track the amount of time agents spend on both investigation hours and hours spent on visa security activities. Therefore, we continue to believe the recommendation has merit and should be implemented. Moreover, we found that ICE’s use of 30-day temporary duty assignments to fill Visa Waiver Program positions at posts created challenges and affected continuity of operations at some posts. Consular officers we interviewed at 3 of 13 posts discussed challenges caused by this use of temporary duty agents. The Visa Security Program’s 5-year plan also identified recruitment of qualified personnel as a challenge and recommended incentives for Visa Security Program agents as critical to the program’s mission, stating, “These assignments present significant attendant lifestyle difficulties. If the mission is to be accomplished, ICE, like State, needs a way to provide incentives for qualified personnel to accept these hardship assignments.” However, according to ICE officials, ICE had not provided incentives to facilitate recruitment for hardship posts. ICE officials stated that they have had difficulty attracting agents to Saudi Arabia, and ICE agents at post told us they have little incentive to volunteer for Visa Security Program assignments. Thus, we recommended that DHS develop a plan to provide Visa Security Program coverage at high-risk posts where the possibility of deploying agents may be limited. DHS agreed with our recommendation and is taking steps to implement it. In addition, ICE developed a plan to expand the Visa Security Program to additional high-risk visa-issuing posts, but ICE had not fully adhered to the plan or kept it up to date. The program’s 5-year expansion plan, developed in 2007, identified 14 posts for expansion between 2009 and 2010, but 9 of these locations had not been established at the time of our March 2011 report, and ICE had not updated the plan to reflect the current situation. Furthermore, ICE had not fully addressed remaining visa risk in high-risk posts that did not have a Visa Security Program presence. ICE, with input from the Department of State, developed a list of worldwide visa-issuing posts that are ranked according to visa risk. Although the expansion plan stated that risk analysis is the primary input to Visa Security Program site selection and that the expansion plan represented an effort to address visa risk, ICE had not expanded the Visa Security Program to some high-risk posts. For example, 11 of the top 20 high-risk posts identified by ICE and Department of State were not covered by Visa Security Program at the time of our review. The expansion of the Visa Security Program may be limited by a number of factors—including budget limitations and objections from Department of State officials at some posts—and ICE had not identified possible alternatives that would provide the additional security of Visa Security Program review at those posts that do not have a program presence. In May 2011, we recommended that DHS develop a plan to provide Visa Security Program coverage at high-risk posts where the possibility of deploying agents may be limited. DHS concurred with our recommendation and noted actions under way to address it, such as enhancing information technology systems to allow for screening and reviewing of visa applicants at posts worldwide. As we reported in May 2011, DHS implemented the Electronic System for Travel Authorization (ESTA) to meet a statutory requirement intended to enhance Visa Waiver Program security and took steps to minimize the burden on travelers to the United States added by the new requirement. However, DHS had not fully evaluated security risks related to the small percentage of Visa Waiver Program travelers without verified ESTA approval. DHS developed ESTA to collect passenger data and complete security checks on the data before passengers board a U.S. bound carrier. DHS requires applicants for Visa Waiver Program travel to submit biographical information and answers to eligibility questions through ESTA prior to travel. Travelers whose ESTA applications are denied can apply for a U.S. visa. In developing and implementing ESTA, DHS took several steps to minimize the burden associated with ESTA use. For example, ESTA reduced the requirement that passengers provide biographical information to DHS officials from every trip to once every 2 years. In addition, because of ESTA, DHS has informed passengers who do not qualify for Visa Waiver Program travel that they need to apply for a visa before they travel to the United States. Moreover, most travel industry officials we interviewed in six Visa Waiver Program countries praised DHS’s widespread ESTA outreach efforts, reasonable implementation time frames, and responsiveness to feedback but expressed dissatisfaction over ESTA fees paid by ESTA applicants. In 2010, airlines complied with the requirement to verify ESTA approval for almost 98 percent of the Visa Waiver Program passengers prior to boarding, but the remaining 2 percent— about 364,000 travelers— traveled under the Visa Waiver Program without verified ESTA approval. In addition, about 650 of these passengers traveled to the United States with a denied ESTA. As we reported in May 2011, DHS had not yet completed a review of these cases to know to what extent they pose a risk to the program. DHS officials told us that, although there was no official agency plan for monitoring and oversight of ESTA, the ESTA office was undertaking a review of each case of a carrier’s boarding a Visa Waiver Program traveler without an approved ESTA application; however, DHS had not established a target date for completing this review. DHS tracked some data on passengers that travel under the Visa Waiver Program without verified ESTA approval but did not track other data that would help officials know the extent to which noncompliance poses a risk to the program. Without a completed analysis of noncompliance with ESTA requirements, DHS was unable to determine the level of risk that noncompliance poses to Visa Waiver Program security and to identify improvements needed to minimize noncompliance. In addition, without analysis of data on travelers who were admitted to the United States without a visa after being denied by ESTA, DHS cannot determine the extent to which ESTA is accurately identifying individuals who should be denied travel under the program. In May 2011, we recommended that DHS establish time frames for the regular review and documentation of cases of Visa Waiver Program passengers traveling to a U.S. port of entry without verified ESTA approval. DHS concurred with our recommendation and committed to establish procedures to review quarterly a representative sample of noncompliant passengers to evaluate, identify, and mitigate potential security risks associated with the ESTA program. Further, in May 2011 we reported that to meet certain statutory requirements, DHS requires that Visa Waiver Program countries enter into three information-sharing agreements with the United States; however, only half of the countries had fully complied with this requirement and many of the signed agreements have not been implemented. Half of the countries entered into agreements to share watchlist information about known or suspected terrorists and to provide access to biographical, biometric, and criminal history data. By contrast, almost all of the 36 Visa Waiver Program countries entered into an agreement to report lost and stolen passports. DHS, with the support of interagency partners, established a compliance schedule requiring the last of the Visa Waiver Program countries to finalize these agreements by June 2012. Although termination from the Visa Waiver Program is one potential consequence for countries not complying with the information- sharing agreement requirement, U.S. officials have described it as undesirable. DHS, in coordination with the Departments of State and Justice, developed measures short of termination that could be applied to countries not meeting their compliance date. In addition, as of May 2011, DHS had not completed half of the most recent biennial reports on Visa Waiver Program countries’ security risks in a timely manner. In 2002, Congress mandated that, at least once every 2 years, DHS evaluate the effect of each country’s continued participation in the program on the security, law enforcement, and immigration interests of the United States. The mandate also directed DHS to determine based on the evaluation whether each Visa Waiver Program country’s designation should continue or be terminated and to submit a written report on that determination to select congressional committees. According to officials, DHS assesses, among other things, counterterrorism capabilities and immigration programs. However, DHS had not completed the latest biennial reports for 18 of the 36 Visa Waiver Program countries in a timely manner, and over half of these reports are more than 1 year overdue. Further, in the case of 2 countries, DHS was unable to demonstrate that it had completed reports in the last 4 years. DHS cited a number of reasons for the reporting delays. For example, DHS officials said that they intentionally delayed report completion because they frequently did not receive mandated intelligence assessments in a timely manner and needed to review these before completing Visa Waiver Program country biennial reports. We recommended that DHS take steps to address delays in the biennial country review process so that the mandated country reports can be completed on time. DHS concurred with our recommendation and reported that it would consider process changes to address our concerns with the timeliness of continuing Visa Waiver Program reports. This concludes my prepared testimony statement. I would be pleased to respond to any questions that members of the Subcommittee may have. For further information regarding this testimony, please contact Richard M. Stana at (202) 512-8777 or stanar@gao.gov. In addition, contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals who made key contributions to this testimony are Rebecca Gambler, Assistant Director; Jeffrey Baldwin-Bott; Frances Cook; David Hinchman; Jeremy Manion; Taylor Matheson; Jeff Miller; Anthony Moran; Jessica Orr; Zane Seals; and Joshua Wiener. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The attempted bombing of an airline on December 25, 2009, by a Nigerian citizen with a valid U.S. visa renewed concerns about the security of the visa process. Further, unauthorized immigrants who entered the country legally on a temporary basis but then overstayed their authorized periods of admission--overstays--could pose homeland security risks. The Department of Homeland Security (DHS) has certain responsibilities for security in the visa process and for addressing overstays. DHS staff review visa applications at certain Department of State overseas posts under the Visa Security Program. DHS also manages the Visa Waiver Program through which eligible nationals from certain countries can travel to the United States without a visa. This testimony is based on GAO products issued in November 2009, August 2010, and from March to May 2011. As requested, this testimony addresses the following issues: (1) overstay enforcement efforts, (2) efforts to implement a biometric exit system and challenges with the reliability of overstay data, and (3) challenges in the Visa Security and Visa Waiver programs. Federal agencies take actions against a small portion of the estimated overstay population, but strengthening planning and assessment of overstay efforts could improve enforcement. Within DHS, U.S. Immigration and Customs Enforcement's (ICE) Counterterrorism and Criminal Exploitation Unit (CTCEU) is the lead agency responsible for overstay enforcement. CTCEU arrests a small portion of the estimated overstay population in the United States because of, among other things, ICE's competing priorities, but ICE expressed an intention to augment its overstay enforcement resources. From fiscal years 2006 through 2010, ICE reported devoting about 3 percent of its total field office investigative hours to CTCEU overstay investigations. ICE was considering assigning some responsibility for noncriminal overstay enforcement to its Enforcement and Removal Operations directorate, which apprehends and removes aliens subject to removal from the United States. In April 2011, GAO reported that by developing a time frame for assessing needed resources and using the assessment findings, as appropriate, ICE could strengthen its planning efforts. Moreover, in April 2011, GAO reported that CTCEU tracked various performance measures, but did not have a mechanism to assess the outcomes of its efforts. GAO reported that by establishing such a mechanism, CTCEU could better ensure that managers have information to assist in making decisions. DHS has not yet implemented a comprehensive biometric system to match available information (e.g., fingerprints) provided by foreign nationals upon their arrival and departure from the United States and faces reliability issues with data used to identify overstays. GAO reported that while the United States Visitor and Immigrant Status Indicator Technology Program's biometric entry capabilities were operating at ports of entry, exit capabilities were not, and DHS did not have a comprehensive plan for biometric exit implementation. DHS conducted pilots to test two scenarios for an air exit solution in 2009, and in August 2010, GAO concluded that the pilots' limitations, such as limitations not defined in the pilot evaluation plan like suspending exit screening at departure gates to avoid flight delays, curtailed DHS's ability to inform a decision for a long-term exit solution. Further, in April 2011, GAO reported that there is not a standard mechanism for nonimmigrants departing the United States through land ports of entry to remit their arrival and departure forms. Such a mechanism could help DHS obtain more complete departure data for identifying overstays. GAO identified various challenges in the Visa Security and Visa Waiver programs related to planning and assessment efforts. For example, in March 2011, GAO found that ICE developed a plan to expand the Visa Security Program to additional high-risk posts, but ICE had not fully adhered to the plan or kept it up to date. Further, ICE had not identified possible alternatives that would provide the additional security of Visa Security Program review at those high-risk posts that do not have a program presence. In addition, DHS implemented the Electronic System for Travel Authorization (ESTA) to meet a statutory requirement intended to enhance Visa Waiver Program security and took steps to minimize the burden on travelers to the United States added by the new requirement. However, DHS had not fully evaluated security risks related to the small percentage of Visa Waiver Program travelers without verified ESTA approval. GAO has made recommendations in prior reports that, among other things, call for DHS to strengthen management of overstay enforcement efforts, mechanisms for collecting data from foreign nationals departing the United States, and planning for addressing certain Visa Security and Visa Waiver programs' risks. DHS generally concurred with these recommendations and has actions planned or underway to address them.