Information security is a critical consideration for any organization that depends on information systems and computer networks to carry out its mission or business. It is especially important for government agencies, where maintaining the public’s trust is essential. The dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet have changed the way our government, the nation, and much of the world communicate and conduct business. However, without proper safeguards, systems are unprotected from individuals and groups with malicious intent to intrude and use the access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. This concern is well-founded for a number of reasons, including the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, the steady advance in the sophistication and effectiveness of attack technology, and the dire warnings of new and more destructive attacks to come. Recognizing the importance of securing federal agencies’ information and systems, Congress enacted the Federal Information Security Management Act of 2002 (FISMA) to strengthen the security of information and systems within federal agencies. FISMA requires each agency to use a risk-based approach to develop, document, and implement a departmentwide information security program for the information and systems that support the operations and assets of the agency. The Congress has long recognized the need for a border security system that collects information about foreign nationals entering and exiting the United States and identifies those who have overstayed their visits. Legislative efforts to create an entry exit control system to record and match arrival and departure records for foreign nationals traveling to the United States began as early as 1996 with the Illegal Immigration Reform and Immigrant Responsibility Act (IIRIRA). Among other things, Section 110 of the of IIRIRA directed the former Immigration and Naturalization Service (INS) to develop an automated entry exit control system to collect records of departure from every alien leaving the United States and match it with the alien’s record of arrival. In 2000, the Immigration and Naturalization Service Data Management Improvement Act amended section 110 of IIRIRA by replacing it in its entirety. This act, among other things, requires that the entry exit system integrate alien arrival and departure information contained in Department of Justice (including INS) and State Department databases. Since September 11, 2001, additional laws address, among other things, the use of biometric technology in an alien entry exit control system. For example, the USA PATRIOT Act mandates that this system be capable of interfacing with other law enforcement agencies, and that it uses biometric technology and tamper-resistant documents. In addition, the Aviation and Transportation Security Act requires air carriers to electronically transmit manifest information for all international flight passengers and crew members to the Commissioner of Customs before landing at a U.S. airport. Furthermore, the Enhanced Border Security and Visa Entry Reform Act further requires the use of biometrics in travel documents and expands the passenger arrival manifest requirements in the Aviation and Transportation Security Act to sea carriers and to air and sea departures. With the passage of the Homeland Security Act of 2002, 22 federal agencies and organizations merged into the Department of Homeland Security (DHS). Shortly after DHS assumed operational control, the Secretary of the Department of Homeland Security renamed the entry exit system US-VISIT. Most recently, the Intelligence Reform and Terrorism Prevention Act of 2004 calls for the Secretary of the Department of Homeland Security to accelerate the full implementation of an automated biometric entry and exit data system. Among other things, the act requires the biometric entry exit screening system to provide real-time updates on all information about entry exit history to relevant agencies. Today, the US-VISIT program is a multi-agency initiative. From fiscal year 2002 through fiscal year 2007, total funding for the US-VISIT program has been about $1.7 billion dollars. Since fiscal year 2002, Congress has directed GAO to review annual DHS plans, also called expenditure plans, describing how the agency plans to satisfy legislative conditions specified in the appropriations, including acting and complying with federal acquisition rules, requirements, guidelines, and systems acquisition management practices. These reviews have produced five reports, the latest being a review of the fiscal year 2006 US-VISIT expenditure plan. These reports and other recent reports on US-VISIT contract and financial management and US-VISIT operations at land ports of entry have identified fundamental challenges that DHS continues to face in meeting program expectations (i.e., delivering program capabilities and benefits on time and within cost). We have made many recommendations over the last 4 years to DHS to define and justify US-VISIT’s future direction, strengthen program management, and ensure the delivery of promised system capabilities on time and within budget. The goals of the US-VISIT program are to (a) enhance the security of U.S. citizens and visitors, (b) facilitate legitimate travel and trade, (c) ensure the integrity of the U.S. immigration system, and (d) protect the privacy of our visitors. Key US-VISIT functions include: collecting, maintaining, and sharing information on certain foreign nationals who enter and exit the United States; identifying foreign nationals who (1) have overstayed or violated the terms of their admission; (2) may be eligible to receive, extend, or adjust their immigration status; or (3) should be apprehended or detained by officials; detecting fraudulent travel documents, verifying traveler identity, and determining traveler admissibility through the use of biometrics; and facilitating information sharing and coordination within the immigration and border management community. The US-VISIT program is implemented via a “system-of-systems” in that the program is composed of different systems that are used to capture and store traveler information. Traveler information captured by US-VISIT includes such information as air, land, and sea port of entry admission data, commercial passenger and crew data, visa application data, and travel document (passport and visa) data. The type of data captured includes the person’s complete name, date of birth, nationality, travel document issuing country, travel document number and type, applicant photo, and finger scans. The scope of the program includes the pre-entry, entry, status management, and exit of foreign national travelers who enter and leave the United States at 285 air, land, and sea ports of entry, and the provision of new analytical capabilities across the overall process. The entry aspect of the program, and the systems that support entry, are described below. When the applicant for admission arrives at a primary inspection booth, the CBP officer, using a document reader, scans the traveler’s machine- readable travel documents or manually enters the information into a biographic system if the traveler is not in possession of machine readable documents. A biographic check is then made of the traveler to identify individuals who (1) are not known to pose a threat or is not suspected of posing a threat to the security of the United States; (2) have not violated the terms of their admission to the United States; or (3) are not wanted for commission of a criminal act in the United States or elsewhere. In addition, a photograph and summary biographical information of the individual is also displayed in cases where the individual has been issued a travel document by the Department of State or by DHS. Following the biographic check of the traveler by the CBP officer at the primary inspection booth, the officer then switches to a second biometric system to capture information pertaining to each traveler. The officer scans the individual’s fingerprints (left and right index fingers) and takes a photograph. While the system is checking the finger scan, the officer questions the foreign national about the purpose of his or her travel and length of stay. If the officer determines the traveler is admissible, the officer enters the class of admission and duration of stay information into the system and also annotates the class of admission and “admit until” date on the I-94 form. The officer in the primary inspection booth then receives either a red or green light from the system indicating the results of the query. For example, if the query from the biographic system returns derogatory information or if the document issuance information does not match the traveler, the officer gets a red light from the system and then refers the traveler to secondary inspection for further questioning or actions. If the individual is then determined to be inadmissible in secondary inspection, the person is processed for removal or other actions. This information is then entered into the system by officers at the secondary inspection area and the appropriate actions are taken. A green light indicates that the traveler’s biometrics did not match any records in the US-VISIT biometric watch list and, in cases of repeat travelers; there was no mismatch against the biometric data captured from the traveler’s prior arrival(s). The biographic system referred to above for the biographic check is performed by a system called the Treasury Enforcement Communications System/ Interagency Border Inspection Service (TECS/IBIS). The IBIS “service” serves as a centralized, shared database of textual enforcement and lookout information, containing well over 10 million subject records. It supports approximately two dozen federal and other agencies and it resides on a CBP mainframe computer. IBIS keeps track of information on suspect individuals, businesses, vehicles, aircraft, and vessels. The types of data contained on the IBIS “watch list” include information from a variety of federal, state and local sources, which contributes to effective national security and law enforcement. Personal information about these individuals includes, but is not limited to, name, alias, date of birth, address, physical description, details and circumstances of a search, arrest, or seizure, case information such as merchandise and values, and methods of theft.