The Immigration Reform and Control Act of 1986 created the Visa Waiver Program as a pilot program. It was initially envisioned as an immigration control and economic promotion program, according to State. Participating countries were selected because their citizens had a demonstrated pattern of compliance with U.S. immigration laws, and the governments of these countries granted reciprocal visa-free travel to U.S. citizens. In recent years, visa waiver travelers have represented about one- half of all nonimmigrant admissions to the United States. In 2002, we reported on the legislative requirements to which countries must adhere before they are eligible for inclusion in the Visa Waiver Program. In general, to qualify for visa waiver status, a country must: maintain a nonimmigrant refusal rate of less than 3 percent for its citizens who apply for business and tourism visas. certify that it issues machine-readable passports to its citizens; and offer visa-free travel for U.S. citizens. Following the 9-11 attacks, Congress passed additional laws to strengthen border security policies and procedures, and DHS and State instituted other policy changes that have affected the qualifications for countries to participate in the Visa Waiver Program. For example, all passports issued after October 26, 2005, must contain a digital photograph printed in the document, and passports issued to visa waiver travelers after October 26, 2006, must be electronic (e-passports). In addition, the May 2002 Enhanced Border Security and Visa Reform Act required that participating countries certify that the theft of their blank passports is reported to the U.S. government in a timely manner. The Visa Waiver Program has many benefits. The program was created to facilitate international travel without jeopardizing the welfare or security of the United States, according to the program’s legislative history. According to economic and commercial officers at several of the U.S. embassies we visited, visa-free travel to the United States boosts international business travel and tourism, as well as airline revenues, and creates substantial economic benefits to the United States. Moreover, the program allows State to allocate its resources to visa-issuing posts in countries with higher-risk applicant pools. In 2002, we reported that eliminating the program would increase State’s resource requirements as millions of visa waiver travelers who have benefited from visa-free travel would need to obtain a visa to travel to the United States if the program did not exist. Specifically, if the program were eliminated, we estimated that State’s initial costs at that time to process the additional workload would likely range between $739 million and $1.28 billion and that annual recurring costs would likely range between $522 million and $810 million. In addition, visa waiver countries could begin requiring visas for U.S. citizens traveling to the 27 participating countries for temporary business or tourism purposes, which would impose a burden of additional cost and time on U.S. travelers to these countries. The Visa Waiver Program, however, can also pose risks to U.S. security, law enforcement, and immigration interests because some foreign citizens may exploit the program to enter the United States. First, visa waiver travelers are not subject to the same degree of screening as travelers who must first obtain a visa before arriving in the United States (see fig. 1). Visa waiver travelers are first screened in person by a DHS Customs and Border Protection (CBP) inspector once they arrive at the U.S. port of entry, perhaps after having already boarded an international flight bound for the United States with a fraudulent travel document. According to the DHS OIG, primary border inspectors are at a disadvantage when screening Visa Waiver Program travelers because they may not know the alien’s language or local fraud trends in the alien’s home country, nor have the time to conduct an extensive interview. In contrast, non-visa-waiver travelers, who must obtain a visa from a U.S. embassy or consulate, receive two levels of screening before entering the country—in addition to the inspection at the U.S. port of entry, these travelers undergo an interview by consular officials overseas, who conduct a rigorous screening process when deciding to approve or deny a visa. As we have previously reported, State has taken a number of actions since 2002 to strengthen the visa issuance process as a border security tool. Moreover, consular officers have more time to interview applicants and examine the authenticity of their passports, and may also speak the visa applicant’s native language, according to consular officials. Therefore, inadmissible travelers who need visas to enter the United States may attempt to acquire a passport from a Visa Waiver Program country to avoid the visa screening process. Another risk inherent in the program is the potential exploitation by terrorists, immigration law violators, and other criminals of a visa waiver country’s lost or stolen passports. DHS intelligence analysts, law enforcement officials, and forensic document experts all acknowledge that misuse of lost and stolen passports is the greatest security problem posed by the Visa Waiver Program. Lost and stolen passports from visa waiver countries are highly prized travel documents, according to the Secretary General of Interpol. Moreover, Visa Waiver Program countries that do not consistently report the losses or thefts of their citizens’ passports, or of blank passports, put the United States at greater risk of allowing inadmissible travelers to enter the country. Fraudulent passports from Visa Waiver Program countries have been used illegally by travelers seeking to disguise their true identities or nationalities when attempting to enter the United States. For example, from January through June 2005, DHS reported that it confiscated, at U.S. ports of entry, 298 fraudulent or altered passports issued by Visa Waiver Program countries that travelers were attempting to use for admission into the United States. Although DHS has intercepted some travelers with fraudulent passports at U.S. ports of entry, DHS officials acknowledged that an undetermined number of inadmissible aliens may have entered the United States using a lost or stolen passport from a visa waiver country. According to State, these aliens may have been inadmissible because they were immigration law violators, criminals, or terrorists. For example: In July 2005, two aliens successfully entered the United States using lost or stolen Austrian passports. DHS was not notified that these passports had been lost or stolen prior to this date; the aliens were admitted, and there is no record of their departure, according to CBP. In October 2005, CBP referred this case to DHS’s Immigration and Customs Enforcement for further action. In June 2005, CBP inspectors admitted into the United States two aliens using Italian passports that were from a batch of stolen passports. CBP was notified that this batch was stolen; however, the aliens altered the passport numbers to avoid detection by CBP officers. DHS has no record that these individuals departed the United States. DHS has taken several steps to assess the risks of the Visa Waiver Program. However, we identified problems with the country review process by which DHS assesses these risks, namely a lack of inclusiveness, transparency, and timeliness. Furthermore, OIE is unable to effectively monitor the immigration, law enforcement, and security risks posed by visa waiver countries on a continuing basis because of insufficient resources. In April 2004, the DHS OIG identified significant areas where DHS needed to strengthen and improve its management of the Visa Waiver Program. For example, the OIG found that a lack of funding, trained personnel, and other issues left DHS unable to comply with the mandated biennial country assessments. In response to these findings, DHS established OIE’s Visa Waiver Program Oversight Unit in July 2004, and named a director to manage the office. The unit’s mission is to oversee Visa Waiver Program activities and monitor countries’ adherence to the program’s statutory requirements, ensuring that the United States is protected from those who wish to do it harm or violate its laws, including immigration laws. Since the unit’s establishment, DHS, and particularly OIE, has made strides to address concerns raised by the 2004 OIG review. For example, DHS completed comprehensive assessments of 25 of the 27 participating countries and submitted a six-page report to Congress in November 2005 that summarized the findings from the 2004 assessments. Despite these steps to strengthen and improve the management of the program, we identified several problems with the mandated biennial country assessment process, by which DHS assesses the risks posed by each of the visa waiver countries’ continued participation in the program. For the 2004 assessments, we found the following: Some key stakeholders were excluded from the process. After conducting the site visits and contributing to the reports on the site visits, DHS and the interagency working group did not seek input from all site visit team members while drafting and clearing the final country assessments and subsequent report to Congress. For example, DHS’s forensic document analysts, who participated in the site visits in 2004, told us that they did not see, clear, or comment on the draft country assessments, despite repeated attempts to obtain copies of them. Additionally, at the time of our visits, ambassadors or deputy chiefs of mission in each of the six posts told us that they were not fully aware of the extent to which assessments for the country where they were posted discussed law enforcement and security concerns posed by the continued participation of the country in the program. Without this information, key stakeholders could not be effective advocates for U.S. concerns. The reviews lacked clear criteria to make key judgments. We found that DHS did not have clear criteria to determine at what point security concerns uncovered during their review would trigger discussions with foreign governments about these concerns and an attempt to resolve them. State officials agreed that qualitative and/or quantitative criteria would be useful when making these determinations, although DHS stated that the criteria should be flexible. DHS and its interagency partners neither completed the 25 country assessments nor issued the summary report to Congress in a timely manner. The interagency teams conducted site visits as part of the country assessments from May through September 2004, and transmitted the final summary report to Congress more than 1 year later, in November 2005. OIE, State, and Justice officials acknowledged that the assessments took too long to complete. The teams collecting information about the visa waiver countries’ risks in 2004 used, in some cases, information that was two years old; by the time the summary report was issued in November 2005, some of the data was over 3 years old. As a result of this lengthy process, the final report presented to Congress did not necessarily reflect the current law enforcement and security risks posed by each country, or the positive steps that countries had made to address these risks. OIE is limited in its ability to achieve its mission because of insufficient staffing. The office has numerous responsibilities, including conducting the mandated biennial country reviews; monitoring law enforcement, security, and immigration concerns in visa waiver countries on an ongoing basis; and working with countries seeking to become members of the Visa Waiver Program. In 2004, the DHS OIG found that OIE’s lack of resources directly undercut its ability to assess a security problem inherent in the program—lost and stolen passports. The office received funding to conduct the country reviews in 2004 and 2005; however, OIE officials indicated that a lack of funding and full-time staff has made it extremely difficult to conduct additional overseas fieldwork, as well as track ongoing issues of concern in the 27 visa waiver countries—a key limitation in DHS’s ability to assess and mitigate the program’s risks. According to OIE officials, the unit developed a strategic plan to monitor the program, but has been unable to implement its plan with its current staffing of two full- time employees, as well as one temporary employee from another DHS component. Without adequate resources, OIE is unable to monitor and assess participating countries’ compliance with the Visa Waiver Program’s statutory requirements. In addition to resource constraints, DHS has not clearly communicated its mission to stakeholders at overseas posts, nor identified points of contact within U.S. embassies, so it can communicate directly with field officials positioned to monitor countries’ compliance with Visa Waiver Program requirements and report on current events and issues of potential concern. In particular, within DHS’s various components, we found that OIE is largely an unknown entity and, therefore, is unable to leverage the expertise of DHS officials overseas. A senior DHS representative at one post showed us that her organizational directory did not contain contact information for OIE. Additionally, a senior DHS official in Washington, D.C., told us that he may find out about developments—either routine or emergent—in visa waiver countries by “happenstance.” Due to the lack of outreach and clear communication about its mission, OIE is limited in its ability to monitor the day-to-day law enforcement and security concerns posed by the Visa Waiver Program, and the U.S. government is limited in its ability to influence visa waiver countries’ progress in meeting requirements. DHS has taken some actions to mitigate the risks of the Visa Waiver Program. However, though the law has required the timely reporting of blank passport thefts for continued participation in the Visa Waiver Program since 2002, DHS has not established and communicated time frames and operating procedures to participating countries. In addition, DHS has sought to expand this requirement to include the reporting of data, to the United States and Interpol, on lost and stolen issued passports; however, participating countries are resisting these requirements, and DHS has not yet issued guidance on what information must be shared, with whom, and within what time frame. Furthermore, U.S. border inspectors are unable to automatically access Interpol’s data on reported lost and stolen passports, which makes detection of these documents at U.S. ports of entry more difficult. As previously mentioned, during the 2004 assessment process, the working group identified security concerns in several participating countries, and DHS took actions to mitigate some of these risks. Specifically, DHS determined that several thousand blank German temporary passports had been lost or stolen, and that Germany had not reported some of this information to the United States. As a result, as of May 1, 2006, German temporary passport holders are not allowed to travel to the United States under the Visa Waiver Program without a visa. In addition, DHS has enforced an October 26, 2005, deadline requiring travelers under the Visa Waiver Program to have digital photographs in their passports. A key risk in the Visa Waiver Program is stolen blank passports from visa waiver countries, because detecting these passports at U.S. ports of entry is extremely difficult, according to DHS. Some thefts of blank passports have not been reported to the United States until years after the fact, according to DHS intelligence reports. For example, in 2004, a visa waiver country reported the theft of nearly 300 stolen blank passports to the United States more than 9 years after the theft occurred. The 2002 Enhanced Security and Visa Entry Reform Act provides that the Secretary of Homeland Security must terminate a country from the Visa Waiver Program if he and the Secretary of State jointly determine that the country is not reporting the theft of its blank passports to the United States on a timely basis. However, DHS has not established time frames or operating procedures to enforce this requirement. While the statute requires visa waiver countries to certify that they report information on the theft of their blank passports to the United States on a timely basis, as of June 2006, DHS has not defined what constitutes “timely” reporting. Moreover, the United States lacks a centralized mechanism for foreign governments to report all stolen passports. In particular, DHS has not defined to whom in the U.S. government participating countries should report this information. In addition to blank passports, lost or stolen issued passports also pose a risk because they can be altered. In June 2005, DHS issued guidance to participating Visa Waiver Program countries requiring that they certify their intent to report lost and stolen passport data on issued passports by August 2005. However, DHS has not yet issued guidance on what information must be shared, with whom, and within what time frame. Moreover, some visa waiver countries have not yet agreed to provide this information to the United States, due in part to concerns over the privacy of their citizens’ biographical information. In addition, several consular officials expressed confusion about the current and impending requirements about sharing this data, and felt they were unable to adequately explain the requirements to their foreign counterparts. In June 2005, the U.S. government also announced its intention to require visa waiver countries to certify their intent to report information on both lost and stolen blank and issued passports to Interpol. In 2002, Interpol developed a database of lost and stolen travel documents to which its member countries may contribute on a voluntary basis. While most visa waiver countries use and contribute to Interpol’s database, four do not. Moreover, some countries that do contribute do not do so on a regular basis, according to Interpol officials. Participating countries have expressed concerns about reporting this information, citing privacy issues; however, Interpol’s database on lost and stolen travel documents does not include the passport bearers’ biographical information, such as name and date of birth. According to the Secretary General of Interpol, in light of the high value associated with passports from visa waiver countries, it is a priority for his agency to encourage countries to contribute regularly to the database. Though information from Interpol’s database could potentially stop inadmissible travelers from entering the United States, CBP’s border inspectors do not have automatic access to the database at the primary inspection point at U.S. ports of entry—the first line of defense against those who might exploit the Visa Waiver Program to enter the United States. The inspection process at U.S. ports of entry can include two stages—a primary and secondary inspection. If, during the primary inspection, the inspector suspects that the traveler is inadmissible either because of a fraudulent passport or other reason, the inspector refers the traveler to secondary inspection. At secondary inspection, border inspectors can contact officials at the National Targeting Center, who can query Interpol’s stolen-travel-document database to determine if the traveler’s passport had been previously reported lost or stolen, but is not yet on CBP’s watch list. However, according to DHS, State, and Justice officials, because Interpol’s data on lost and stolen travel documents is not automatically accessible to border inspectors at primary inspection, it is not currently an effective border screening tool. Moreover, according to the Secretary General of Interpol, until DHS can automatically query Interpol’s data, the United States will not have an effective screening tool for checking passports. According to Interpol officials, the United States is working actively with Interpol on a potential pilot project that would allow for an automatic query of aliens’ passport data against Interpol’s database at primary inspection at U.S. ports of entry. However, DHS has not yet finalized a plan to do so. In our report, we made a series of recommendations to improve the U.S. government’s process for assessing the risks in the Visa Waiver Program, including recommending that DHS provide additional resources to strengthen OIE’s visa waiver monitoring unit; finalize clear, consistent, and transparent protocols for the biennial country assessments and provide these protocols to stakeholders at relevant agencies at headquarters and overseas; create real-time monitoring arrangements for all 27 participating countries; and establish protocols for direct communication between overseas posts and OIE’s Visa Waiver Program Oversight Unit. In addition, we made recommendations to improve U.S. efforts to mitigate program risks, including requiring that all visa waiver countries provide the United States and Interpol with non-biographical data from lost or stolen issued passports, as well as from blank passports; developing clear standard operating procedures for the reporting of lost and stolen blank and issued passport data; and developing and implementing a plan to make Interpol’s stolen travel document database automatically available during primary inspection at U.S. ports of entry. Given the lengthy time it took for DHS to issue the November 2005 summary report to Congress, and to ensure future reports contain timely information when issued, we also proposed that Congress establish a biennial deadline by which DHS must complete the country assessments and report to Congress. DHS either agreed with, or stated that it is considering, all of our recommendations. Regarding our matter for congressional consideration, DHS did not support the establishment of a deadline for the biennial report to Congress. Instead, DHS suggested that Congress should require continuous and ongoing evaluation. With continuous review, DHS stated that it would be able to constantly evaluate U.S. interests and report to Congress on the current 2-year reporting cycle on targeted issues of concern, rather than providing a historical evaluation. We agree that continuous and ongoing evaluation is necessary, and that is why we recommended that DHS create real-time monitoring arrangements and provide additional resources to the Visa Waiver Program Oversight Unit to achieve this goal. Regarding the mandated biennial country assessments, we believe that they can serve a useful purpose if they are completed in a timely fashion. In closing, the Visa Waiver Program aims to facilitate international travel for millions of people each year and promote the effective use of government resources. Effective oversight of the program entails balancing these benefits against the program’s potential risks. To find this balance, the U.S. government needs to fully identify the vulnerabilities posed by visa waiver travelers, and be in a position to mitigate them. It is imperative that DHS commit to strengthen its ability to promptly identify and mitigate risks to ensure that the Visa Waiver Program does not jeopardize U.S. security interests. This is particularly important given that many countries are actively seeking to join the program. Mr. Chairman, this concludes my prepared statement. I will be happy to answer any questions you or Members of the Subcommittee may have. For questions regarding this testimony, please call Jess T. Ford, (202) 512- 4128 or fordj@gao.gov. Individuals making key contributions to this statement include John Brummet, Assistant Director, and Kathryn H. Bernet, Joseph Carney, and Jane S. Kim. Border Security: More Emphasis on State’s Consular Safeguards Could Mitigate Visa Malfeasance Risks. GAO-06-115. October 6, 2005 Border Security: Strengthened Visa Process Would Benefit From Improvements in Staffing and Information Sharing. GAO-05-859. September 13, 2005 Border Security: Actions Needed to Strengthen Management of Department of Homeland Security’s Visa Security Program. GAO-05-801. July 29, 2005. Border Security: Streamlined Visas Mantis Program Has Lowered Burden on Foreign Science Students and Scholars, but Further Refinements Needed. GAO-05-198. February 18, 2005. Border Security: State Department Rollout of Biometric Visas on Schedule, but Guidance Is Lagging. GAO-04-1001. September 9, 2004. Border Security: Additional Actions Needed to Eliminate Weaknesses in the Visa Revocation Process. GAO-04-795. July 13, 2004. Border Security: Improvements Needed to Reduce Time Taken to Adjudicate Visas for Science Students and Scholars. GAO-04-371. February 25, 2004. Border Security: New Policies and Procedures Are Needed to Fill Gaps in the Visa Revocation Process. GAO-03-798. June 18, 2003. Border Security: Implications of Eliminating the Visa Waiver Program. GAO-03-38. November 22, 2002. Technology Assessment: Using Biometrics for Border Security. GAO-03- 174. November 15, 2002. Border Security: Visa Process Should Be Strengthened as an Antiterrorism Tool. GAO-03-132NI. October 21, 2002. Review of International Aviation Passenger Prescreening. Requested by the Chairman and Ranking Member, Committee on the Judiciary, and the Ranking Member, Committee on Homeland Security, House of Representatives. Report expected in the fall of 1006. Review of the Department of State’s Measures to Ensure the Integrity of Travel Documents. Requested by the Chairman, Committee on the Judiciary, House of Representatives; Chairman John N. Hostettler and member Darrell E. Issa, Subcommittee on Immigration, Border Security and Claims, Committee on the Judiciary, House of Representatives; and, Chairman Lamar S. Smith, Subcommittee on Courts, the Internet, and Intellectual Property, Committee on the Judiciary, House of Representatives. Report expected in the spring of 2007. Review of the Department of State’s Effort to Address Delays in Visa Issuance. Requested by the Chairman and Ranking Member of the Committee on Government Reform, House of Representatives. Report expected in the spring of 2007. Review of Immigrant Visa Processing. Requested by the Ranking Member, Committee on Homeland Security, House of Representatives. Report expected in mid-2007. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The Visa Waiver Program enables citizens of 27 countries to travel to the United States for tourism or business for 90 days or less without obtaining a visa. In fiscal year 2005, nearly 16 million people entered the country under the program. After the 9-11 terrorist attacks, the risk that aliens would exploit the program to enter the United States became more of a concern. This testimony discusses our recent report on the Visa Waiver Program. Specifically, it (1) describes the Visa Waiver Program's benefits and risks, (2) examines the U.S. government's process for assessing potential risks, and (3) assesses the actions taken to mitigate these risks. We met with U.S. embassy officials in six program countries and reviewed relevant procedures and reports on participating countries The Visa Waiver Program has many benefits as well as some inherent risks. It facilitates travel for millions of people and eases consular workload, but poses challenges to border inspectors, who, when screening visa waiver travelers, may face language barriers or lack time to conduct in-depth interviews. Furthermore, stolen passports from visa waiver countries are prized travel documents among terrorists, criminals, and immigration law violators, creating an additional risk. While the Department of Homeland Security (DHS) has intercepted many fraudulent documents at U.S. ports of entry, DHS officials acknowledged that an undetermined number of inadmissible aliens may have entered the United States using a stolen or lost passport from a visa waiver country. DHS's process for assessing the risks of the Visa Waiver Program has weaknesses. In 2002, Congress mandated that, every 2 years, DHS review the effect that each country's continued participation in the program has on U.S. law enforcement and security interests, but did not set a reporting deadline. In 2004, DHS established a unit to oversee the program and conduct these reviews. We identified several problems with the 2004 review process, as key stakeholders were not consulted during portions of the process, the review process lacked clear criteria and guidance to make key judgments, and the final reports were untimely. Furthermore, the monitoring unit cannot effectively achieve its mission to monitor and report on ongoing law enforcement and security concerns in visa waiver countries due to insufficient resources. DHS has taken some actions to mitigate the program's risks; however, the department has faced difficulties in further mitigating these risks. In particular, the department has not established time frames and operating procedures regarding timely stolen passport reporting--a program requirement since 2002. Furthermore, DHS has sought to require the reporting of lost and stolen passport data to the United States and the International Criminal Police Organization (Interpol), but it has not issued clear reporting guidelines to participating countries. While most visa waiver countries report to Interpol's database, four do not. Further, DHS is not using Interpol's data to its full potential as a border screening tool because U.S. border inspectors do not automatically access the data at primary inspection.