The VWP was established as a pilot program, with two participating countries, in November 1986 and became a permanent program in October 2000. The program allows eligible nationals from the 38 VWP countries to travel to the United States for 90 days or less for business or pleasure without a visa and requires that VWP countries extend reciprocal privileges to U.S. citizens. Additionally, the VWP makes it possible for State to allocate more resources to visa-issuing posts in countries with higher-risk applicant pools. In fiscal year 2013, there were nearly 20 million traveler admissions to the United States under the VWP, with admissions from each of the 38 countries ranging from about 700 to more than 4 million (see fig. 1). In August 2008, responding to a requirement in the Implementing Recommendations of the 9/11 Commission Act of 2007, DHS’s U.S. Customs and Border Protection (CBP) introduced the Electronic System for Travel Authorization (ESTA). In 2009, CBP began requiring all travelers arriving by air or sea under the VWP to, among other things, submit an application through ESTA before departure. VWP travelers are also required to possess a passport containing an electronic chip (e- passport) issued by the VWP country. Before a traveler can depart for the United States under the VWP, CBP vets the traveler’s ESTA application against several databases. These databases include, among others, the Federal Bureau of Investigation’s (FBI) Terrorist Screening Database—the U.S. government’s consolidated watch list of known or suspected terrorists—and the International Criminal Police Organization’s (INTERPOL) Stolen and Lost Travel Documents database. If CBP approves an ESTA application, the VWP traveler is authorized to depart for the United States. If CBP denies an ESTA application, CBP refers the traveler to the U.S. embassy or consulate to complete the standard visa application process. This process includes submitting an application and being interviewed, fingerprinted, and vetted against the FBI’s Terrorist Screening Database and INTERPOL’s Stolen and Lost Travel Documents database, among others, before travel to the United States. At U.S. ports of entry, CBP interviews, fingerprints, and photographs VWP travelers arriving by air or sea with an approved ESTA as well as travelers with a U.S. visa and vets the fingerprints against biometrics databases. In November 2014, DHS revised the ESTA application to address concerns that foreign terrorist fighters might exploit the VWP to enter the United States. The revised application requires additional passport data, contact information, information about connections to U.S. persons, and any other names or aliases. According to DHS documents, DHS determined that these revisions would improve its ability to vet prospective VWP travelers and to more accurately and effectively identify those who pose a security risk to U.S. interests. DHS also rephrased questions in the ESTA application to make them easier for the general public to understand. In response to the Implementing Recommendations of the 9/11 Commission Act of 2007, DHS worked with interagency partners to develop several requirements to help prevent terrorists from using the VWP to travel to the United States, according to DHS officials. To continue participating in the program, each VWP country must, among other things, accept repatriation of any citizens, former citizens, and nationals ordered removed from the United States within 3 weeks of the final order of removal. In addition, since before the 2007 act, VWP countries have been required to extend reciprocal visa-free travel to U.S. citizens and issue machine-readable passports. Further, the U.S. government requires each country to enter into a 1. Lost and Stolen Passport (LASP) agreement to report information about the theft or loss of passports, 2. Homeland Security Presidential Directive 6 (HSPD-6) arrangement to share watch list information about known or suspected terrorists, and 3. Preventing and Combating Serious Crime (PCSC) agreement to establish frameworks for enhanced law enforcement cooperation, including sharing of criminal history information. As of December 2015, all VWP countries are also required by law to, among other things, fully implement their agreements to share information on whether their citizens and nationals traveling to the United States represent a threat to the security or welfare of the United States or its citizens. Under existing law, a number of factors can result in a VWP country’s termination or suspension from the program. DHS is required to terminate a country’s VWP designation if the country (1) experiences an emergency that the DHS Secretary, in consultation with the Secretary of State, determines to be a threat to the law enforcement or security interests of the United States, including interests in enforcing U.S. immigration laws; (2) does not report the theft or loss of passports, as jointly determined by DHS and State; or (3) does not share required passenger information. In addition, DHS may place on probationary status or, in certain circumstances, terminate the designation of any VWP country if, following certain criteria, more than 2 percent of the country’s nationals who applied for admission as nonimmigrant visitors to the United States during the previous fiscal year were denied admission, withdrew their application for admission, or were admitted as nonimmigrant visitors and violated the terms of admission. In consultation with State, DHS also may for any reason—including national security—rescind any waiver or designation previously granted at any time or may refrain from waiving the visa requirement for nationals of any country that may otherwise qualify for designation. In addition, DHS may terminate a VWP country’s designation if, in consultation with State, DHS determines through its biennial evaluation that a country’s participation is inconsistent with the law enforcement and security interests of the United States, including U.S. interests in enforcing immigration laws and securing criminal extraditions. Further, in consultation with State, DHS may suspend a VWP country’s designation if the Director of National Intelligence informs the Secretary of Homeland Security of any current and credible threat of an imminent danger to the United States or its citizens that originates from a VWP country. Under U.S. law, DHS is required to periodically evaluate VWP countries and report its findings to Congress. In particular, DHS, in consultation with State, must perform the following at least once every 2 years: Evaluate the effect of each VWP country’s continued participation in the program on U.S. law enforcement and national security interests (including immigration enforcement interests). Determine, based on the evaluation conducted, whether each VWP country’s participation in the program should be continued or terminated. Submit a written report to appropriate congressional committees, including the Secretary’s determination with an explanation of any effects of each VWP country’s continued participation in the program on U.S. law enforcement and security interests. Submit a written report to Congress regarding the implementation of the electronic system for travel authorization. Within DHS, the Visa Waiver Program Office (VWPO) is responsible for overseeing and monitoring VWP countries’ adherence to the program’s statutory and policy requirements. VWPO’s responsibilities include evaluating the effects of VWP countries’ participation in the program, preparing the Secretary of Homeland Security’s determinations to continue or terminate VWP countries’ participation, and submitting the written reports to Congress. According to VWPO officials, the office also monitors VWP country security, law enforcement, and immigration enforcement issues outside the formal review periods to identify issues that could negatively affect U.S. interests. In addition, the DHS Office of Intelligence and Analysis produces an independent intelligence review of each VWP country, examining threats associated with the country’s participation in the VWP, the country’s counterterrorism capabilities, and the country’s information sharing with the United States about terrorist threats, according to officials from that office. All 38 countries participating in the VWP have entered into the three types of required information-sharing agreements, or their equivalents, with the United States, but not all countries are sharing information through two of the agreements. According to DHS, all VWP countries are reporting losses or thefts of passports through LASP agreements, although DHS previously placed two countries on provisional status partly because of a lack of timely reporting. However, as of December 2015, about a third of VWP countries were not sharing identity information about known or suspected terrorists through HSPD-6 arrangements. Also, about a third of VWP countries had not yet shared criminal history information through PCSC agreements. Although U.S. agencies receive law enforcement and national security information from VWP countries through other means, such as multilateral entities, the U.S. government identified the information-sharing agreements as critical for protecting the United States from nationals of VWP countries who might present a threat. While U.S. law before December 2015 required VWP countries to enter into, but not to implement, the agreements, DHS announced in August 2015 that it had developed a new requirement that countries implement them by sharing information. However, contrary to standard program management practices, DHS has not specified time frames for working with VWP countries to institute this and other new VWP security requirements. All 38 VWP countries have entered into LASP agreements with the United States and, according to DHS officials, are reporting lost or stolen passports through the agreements. Before December 2015, U.S. law required that VWP countries enter into an agreement with the United States to report, or to make available to the U.S. government through INTERPOL or other means designated by the Secretary of Homeland Security, information about the theft or loss of passports within a strict time limit and in a manner specified in the agreement.