In 2007, almost 13 million citizens from 27 countries entered the United States under the Visa Waiver Program. The program was created to promote the effective use of government resources and to facilitate international travel without jeopardizing U.S. national security. The United States last expanded the Visa Waiver Program’s membership in 1999 with the addition of Portugal, Singapore, and Uruguay; since then, other countries have expressed a desire to become members. In recent years, Members of Congress have introduced bills calling for the expansion of the program. In February 2005, President Bush announced that DHS and State would develop a strategy, or “Road Map Initiative,” to clarify the statutory requirements for designation as a participating country. According to DHS, some of the countries seeking admission to the program are U.S. partners in the war in Iraq and have high expectations that they will join the program due to their close economic, political, and military ties to the United States. In July 2006, we reported that DHS and State were consulting with 13 “Road Map” countries seeking admission into the Visa Waiver Program— Bulgaria, Cyprus, Czech Republic, Estonia, Greece, Hungary, Latvia, Lithuania, Malta, Poland, Romania, Slovakia, and South Korea. In September 2007, State nominated Greece for admission into the program, and DHS is currently reviewing this nomination to assess the impact of Greece’s participation on U.S. security, law enforcement, and illegal immigration interests. In fiscal year 2006, Greece was one of three countries (along with Cyprus and Malta) with a refusal rate below 3 percent. Three other “Road Map” countries have refusal rates between 3 and 10 percent, while seven others have rates above 10 percent (see table 1). We plan to report later this year on the other aspects of our ongoing work for the subcommittee, including the status of DHS’s plans to expand the Visa Waiver Program to other “Road Map” countries and the extent to which DHS has implemented other provisions in the August 2007 legislation, including an electronic travel authorization system. In addition, we plan to report this year on the cost and resource implications for State’s consular operations of changes in the countries that participate in the Visa Waiver Program. In response to our inquiries, on December 12, 2007, DHS reported to us that it will match records of foreign nationals’ departures that airlines reported to the department to records of any prior arrival, change of status action, or prior departure from the United States to certify the air exit system requirement (see fig. 1). Using this methodology, DHS stated that it can achieve a 97.10 percent match rate, based on data from August 2007. Although DHS acknowledged there are weaknesses with this methodology, the department told us that it had no intention of altering its plans for certifying the air exit system requirement. On January 23, 2008, the assistant secretary for policy development noted that DHS may use more current departure manifest data prior to certification. On February 21, 2008, in commenting on a draft of this testimony, DHS indicated that it had not finalized its decision on which methodology the department would use to certify compliance; however, the department confirmed that all methodologies under consideration would match foreign nationals’ departure records against prior records “to determine that the person is a foreign national, and that the person did depart the country through a U.S. airport.” There are several weaknesses with this approach. First, DHS’s methodology does not begin with arrival records to determine if those foreign nationals departed or remained in the United States beyond their authorized periods of admission—more useful data for oversight of the Visa Waiver Program and consideration of its expansion. Furthermore, DHS’s methodology will not inform overall or country-specific overstay rates, which are key factors in determining illegal immigration risks in the Visa Waiver Program. An alternate approach would be to track air arrivals from a given point in time and determine whether those foreign nationals have potentially overstayed. Figure 2 compares DHS’s plan to match visitor records using departure data as a starting point to a methodology that would track foreign nationals using arrival data as a starting point. Second, for the purposes of this provision, we do not see the value in verifying that a foreign national leaving the United States had also departed at a prior point in time—in other words, matching a new departure record back to a previous departure record from the country. If, however, DHS attempted to match records of air departures in August 2007 back to records of prior entries alone, US-VISIT data for that month show that DHS would only achieve a 92.8 percent match rate. DHS’s assistant secretary for policy development told us in January 2008 that the department chose to include previous departure and change of immigration status records in its methodology because this method allowed the department to achieve a match rate of 97 percent or greater. Third, DHS’s methodology does not address the accuracy of airlines’ transmissions of departure records, and DHS acknowledges that there are weaknesses in the departure data. Foreign nationals who enter the United States by air are inspected by DHS officers—a process that provides information that can be used to verify arrival manifest data—and, since 2004, DHS has implemented the US-VISIT program to collect biometric information on foreign nationals arriving in the United States. However, the department has not completed the exit portion of this tracking system; thus, there is no corresponding check on the accuracy and completeness of the departure manifest information supplied by the airlines. As a result, according to DHS, it cannot be certain that visitors listed on airlines’ manifest data as departing the country did in fact physically depart. Furthermore, there may be some visitors who did leave the country by air, but were not recorded on airlines’ manifest data as having departed. According to DHS, the department works with air carriers to try to improve both the timeliness and comprehensiveness of manifest records, and fines carriers that provide incomplete or inaccurate information. If DHS could evaluate these data, and validate the extent to which they are accurate and complete, the department would be able to identify problems and work with the airlines to further improve the data. DHS reported to us that it had used its methodology for meeting the “97 percent” requirement to match records in the past; however, we were unable to identify an instance when DHS had used this particular methodology. We noted that DHS has used a similar methodology since 2004 in its annual report to the Committees on the Judiciary in the U.S. Senate and House of Representatives on the matching of visitor arrival and departure records using biographic and biometric data gathered through US-VISIT. However, the methodology used in these annual reports is different from what DHS told us it intends to use to certify the “97 percent” provision. In these prior annual reports, DHS matched departure records to records of prior arrivals into the United States. For example, for the period of January 5, 2004, through September 30, 2004, DHS was able to match 71 percent of recorded departures from air and sea ports of entry to records of prior arrivals. In its May 2007 report on its integrated entry and exit data system, DHS was able to match 88.1 percent of recorded departures from air and sea ports of entry to records of prior arrivals. While these reports have shown that DHS’s ability to match departure records has improved since US-VISIT was established in 2004, this methodology does not account for foreign nationals who have not left the United States. Moreover, DHS’s plans to certify the “97 percent” requirement will not further its efforts in responding to Congress’s longstanding calls for the development of an automated entry and exit control system to track visitors to the United States and identify those visitors who have remained in the country illegally. We testified in June 2007 that the prospects for successfully delivering a biometric exit system were as uncertain then as they were when US-VISIT was first implemented in 2004. Without the capability to verify departures, DHS cannot ensure the integrity of the immigration system by identifying visitors who have overstayed their original period of admission. In October 2007, DHS officials told us that data on overstay rates would be very useful for oversight of the Visa Waiver Program. As we have reported, overstays are a significant part of the larger problem of illegal immigration. For example, overstay rates would inform decision makers of illegal immigration risks associated with adding new countries to the program. However, according to the department, it cannot generate accurate overstay rates for visitors from visa waiver countries due to weaknesses in the data that indicate who has departed the United States, as previously mentioned. Moreover, the department has not designated an office with the responsibility of developing such data for the purposes of this program. Nevertheless, we identified an office within US-VISIT, the Data Integrity Group, which develops limited data on overstay rates that may be useful information for oversight of the Visa Waiver Program. This office provides information to DHS’s Immigration and Customs Enforcement on visitors who have potentially overstayed the terms of their admission into the country. Immigration enforcement officials told us they use these data regularly during investigations of potential illegal immigrants. The Data Integrity Group also provides similar information to the department’s Office of Immigration Statistics, as well as the Visa Waiver Program Office. While these are positive actions, DHS acknowledges that there are significant limitations in these data because of weaknesses in the multiple systems that the Data Integrity Group uses. For example, an unknown portion of reported overstays may be false because DHS could not match an arrival record to a departure or change of status record (for example, a visitor may have departed via a land border and not generated a departure record). An air exit system that facilitates the development of overstay rate data is important to managing potential risks in expanding the Visa Waiver Program. DHS’s planned methodology for meeting the “97 percent provision” so it can move forward with program expansion will not demonstrate improvements in the air exit system or help the department identify overstays or develop overstay rates. Chairman Feinstein, this completes my prepared statement. I would be happy to respond to any questions you or other Members of the Subcommittee may have at this time. For further information about this statement, please contact Jess Ford at (202) 512-4128 or fordj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. In addition, John Brummet, Assistant Director; Teresa Abruzzo; Kathryn Bernet; Joseph Carney; Etana Finkler; and Eric Larson made key contributions to this statement. Homeland Security: U.S. Visitor and Immigrant Status Program’s Long- standing Lack of Strategic Direction and Management Controls Needs to Be Addressed. GAO-07-1065. August 31, 2007. Homeland Security: Prospects For Biometric US-VISIT Exit Capability Remain Unclear. GAO-07-1044T. June 28, 2007. Homeland Security: US-VISIT Program Faces Operational, Technological, and Management Challenges. GAO-07-632T. March 20, 2007. Homeland Security: US-VISIT Has Not Fully Met Expectations and Longstanding Program Management Challenges Need to Be Addressed. GAO-07-499T. February 16, 2007. Homeland Security: Planned Expenditures for U.S. Visitor and Immigrant Status Program Need to Be Adequately Defined and Justified. GAO-07-278. February 14, 2007. Border Security: US-VISIT Program Faces Strategic, Operational, and Technological Challenges at Land Ports of Entry. GAO-07-248. December 6, 2006. Border Security: Continued Weaknesses in Screening Entrants into the United States. GAO-06-976T. August 2, 2006. Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa Waiver Program. GAO-06-854. July 28, 2006. Process for Admitting Additional Countries into the Visa Waiver Program. GAO-06-835R. July 28, 2006. Homeland Security: Recommendations to Improve Management of Key Border Security Program Need to Be Implemented. GAO-06-296. February 14, 2006. Homeland Security: Some Progress Made, but Many Challenges Remain on U.S. Visitor and Immigrant Status Indicator Technology Program. GAO-05-202. February 23, 2005. Overstay Tracking: A Key Component of Homeland Security and a Layered Defense. GAO-04-82. May 21, 2004. Homeland Security: Overstay Tracking Is a Key Component of a Layered Defense. GAO-04-170T. October 16, 2003. Homeland Security: Risks Facing Key Border and Transportation Security Program Need to Be Addressed. GAO-03-1083. September 19, 2003. Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning. GAO-03-563. June 9, 2003. Illegal Immigration: INS Overstay Estimation Methods Need Improvement. PEMD-95-20. September 26, 1995. Illegal Aliens: Despite Data Limitations, Current Methods Provide Better Population Estimates. PEMD-93-25. August 5, 1993. Border Security: Challenges in Implementing Border Technology. GAO 03-546T. March 12, 2003. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The Visa Waiver Program, which enables citizens of participating countries to travel to the United States without first obtaining a visa, has many benefits, yet also presents security, law enforcement, and illegal immigration risks. In August 2007, Congress passed legislation that provides the Department of Homeland Security (DHS) with the authority to expand the program to additional countries whose nationals' applications for short-term business and tourism visas were refused between 3 and 10 percent of the time in the prior fiscal year. Countries must also meet certain conditions, and DHS must first complete and certify a number of required actions aimed at enhancing the security of the program. This testimony will focus on one of these required actions--namely, that a system be in place that can verify the departure of 97 percent of foreign nationals who depart through U.S. airports (referred to as an air exit system). Our observations are based on our review of relevant legislation, regulations and agency operating procedures, and prior GAO reports on the Visa Waiver Program and immigrant and visitor entry and exit tracking systems, as well as on discussions with federal agency officials. In commenting on a draft of this statement, DHS emphasized that it had not finalized its plan for certifying the "97 percent" requirement, but that the department believes the current plan would meet the legislative requirement. The Department of State also provided technical comments, which we incorporated, as appropriate. On December 12, 2007, DHS reported to us that it will match records of foreign nationals departing the country, as reported by airlines, to the department's existing records of any prior arrivals, immigration status changes, or prior departures from the United States. Using this formula, DHS stated that it can attain a match rate above 97 percent, based on August 2007 data, to certify compliance with the legislative air exit system requirement. DHS told us that it believes this methodology would meet the statutory requirement. On February 21, 2008, DHS indicated that it had not finalized its decision on the methodology the department would use to certify compliance. Nevertheless, the department confirmed that the basic structure of its methodology would not change, and that it would use departure records as the starting point. There are several limitations with this methodology. For example, DHS's methodology does not begin with arrival records and determine if these foreign nationals stayed in the United States beyond their authorized periods of admission (referred to as overstays). Therefore, this methodology will not inform overall and country-specific overstay rates--key factors in determining illegal immigration risks of the Visa Waiver Program. Although most long-term overstays are likely motivated by economic opportunities, a few overstays have been identified as terrorists or involved in terrorist-related activity, including some of the September 11, 2001, hijackers. In addition, DHS's current methodology does not address the accuracy of airlines' transmissions of departure records, and DHS acknowledges that there are weaknesses in the departure data. For example, there may be some visitors who did not leave the country by air even though they were recorded on airlines' manifest data as having departed. The inability of the U.S. government to track the status of visitors in the country, to identify those who overstay their authorized period of visit, and to use this data to compute overstay rates have been longstanding weaknesses in the oversight of the Visa Waiver Program. DHS's plan to meet the "97 percent" requirement in the visa waiver expansion legislation will not address these weaknesses.