This is the accessible text file for GAO report number GAO-06-1090T 
entitled 'Border Security: Stronger Actions Needed to Assess and 
Mitigate Risks of the Visa Waiver Program' which was released on 
September 7, 2006. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Testimony: 

Before the Subcommittee on Terrorism, Technology, and Homeland 
Security, Committee on the Judiciary, U.S. Senate: 

United States Government Accountability Office: 

GAO: 

For Release on Delivery Expected at 2:00 p.m. EDT: 

Thursday, September 7, 2006: 

Border Security: 

Stronger Actions Needed to Assess and Mitigate Risks of the Visa Waiver 
Program: 

Statement of Jess T. Ford, Director International Affairs and Trade: 

GAO-06-1090T: 

GAO Highlights: 

Highlights of GAO-06-1090T, a testimony before the Chairman, 
Subcommittee on Terrorism, Technology, and Homeland Security, Committee 
on the Judiciary, U.S. Senate 

Why GAO Did This Study: 

The Visa Waiver Program enables citizens of 27 countries to travel to 
the United States for tourism or business for 90 days or less without 
obtaining a visa. In fiscal year 2005, nearly 16 million people entered 
the country under the program. After the 9-11 terrorist attacks, the 
risk that aliens would exploit the program to enter the United States 
became more of a concern. This testimony discusses our recent report on 
the Visa Waiver Program. Specifically, it (1) describes the Visa Waiver 
Programís benefits and risks, (2) examines the U.S. governmentís 
process for assessing potential risks, and (3) assesses the actions 
taken to mitigate these risks. We met with U.S. embassy officials in 
six program countries and reviewed relevant procedures and reports on 
participating countries. 

What GAO Found: 

The Visa Waiver Program has many benefits as well as some inherent 
risks. It facilitates travel for millions of people and eases consular 
workload, but poses challenges to border inspectors, who, when 
screening visa waiver travelers, may face language barriers or lack 
time to conduct in-depth interviews. Furthermore, stolen passports from 
visa waiver countries are prized travel documents among terrorists, 
criminals, and immigration law violators, creating an additional risk. 
While the Department of Homeland Security (DHS) has intercepted many 
fraudulent documents at U.S. ports of entry, DHS officials acknowledged 
that an undetermined number of inadmissible aliens may have entered the 
United States using a stolen or lost passport from a visa waiver 
country. 

DHSís process for assessing the risks of the Visa Waiver Program has 
weaknesses. In 2002, Congress mandated that, every 2 years, DHS review 
the effect that each countryís continued participation in the program 
has on U.S. law enforcement and security interests, but did not set a 
reporting deadline. In 2004, DHS established a unit to oversee the 
program and conduct these reviews. We identified several problems with 
the 2004 review process, as key stakeholders were not consulted during 
portions of the process, the review process lacked clear criteria and 
guidance to make key judgments, and the final reports were untimely. 
Furthermore, the monitoring unit cannot effectively achieve its mission 
to monitor and report on ongoing law enforcement and security concerns 
in visa waiver countries due to insufficient resources. 

DHS has taken some actions to mitigate the programís risks; however, 
the department has faced difficulties in further mitigating these 
risks. In particular, the department has not established time frames 
and operating procedures regarding timely stolen passport reportingóa 
program requirement since 2002. Furthermore, DHS has sought to require 
the reporting of lost and stolen passport data to the United States and 
the International Criminal Police Organization (Interpol), but it has 
not issued clear reporting guidelines to participating countries. While 
most visa waiver countries report to Interpolís database, four do not. 
Further, DHS is not using Interpolís data to its full potential as a 
border screening tool because U.S. border inspectors do not 
automatically access the data at primary inspection. 

What GAO Recommends: 

In our report, we made a series of recommendations to DHS to strengthen 
its ability to assess and mitigate the programís risks, such as 
providing more resources to the programís monitoring unit and issuing 
standards for the reporting of lost and stolen passport data. We also 
stated that Congress should consider establishing a deadline for the 
mandated biennial report to Congress. DHS generally agreed with our 
report and recommendations, but did not agree that Congress should 
establish a deadline for the biennial report. 

[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-1090T]. 

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact Jess Ford at (202) 512-
4128 or fordj@gao.gov. 

[End of Section] 

Mr. Chairman and Members of the Subcommittee: 

I am pleased to be here to discuss our observations on the Visa Waiver 
Program. In fiscal year 2005, nearly 16 million travelers entered the 
United States under this program, which facilitates international 
travel and commerce, and eases workload for consular officers at 
overseas posts, by enabling citizens of 27 participating 
countries[Footnote 1] to travel to the United States for tourism or 
business for 90 days or less without first obtaining a visa.[Footnote 
2] Participating countries were selected because their citizens had 
demonstrated a pattern of compliance with U.S. immigration laws, and 
the governments of these countries granted reciprocal visa-free travel 
to U.S. citizens. The Visa Waiver Program was created as a pilot 
program in 1986,[Footnote 3] and it became permanent in 2000,[Footnote 
4] about 1 year prior to the 9-11 terrorist attacks. After the attacks, 
the potential risks of the program became more of a concern. In 
particular, convicted terrorist Zacarias Moussaoui and "shoe-bomber" 
Richard Reid both boarded flights to the United States with passports 
issued by Visa Waiver Program countries. Moreover, the foiled alleged 
terrorist plot to board planes at London's Heathrow Airport and fly to 
the United States with explosive materials highlights the importance of 
having effective tools to ensure that only legitimate travelers enter 
the United States. In May 2002, Congress mandated that the Department 
of Homeland Security (DHS) evaluate and report to Congress at least 
every two years on the effect that each country's continued 
participation in the program has on U.S. law enforcement and security 
interests.[Footnote 5] Effective oversight of the Visa Waiver Program 
is essential to find the right balance between facilitating legitimate 
travel and preventing potential terrorists, criminals, and others that 
may pose law enforcement and immigration concerns from entering the 
United States.[Footnote 6] 

Earlier this week, we released two reports on the Visa Waiver Program: 
the first discusses the process by which the United States assesses and 
mitigates the program's risks,[Footnote 7] and the second describes the 
process by which additional countries may be admitted into the 
program.[Footnote 8] My statement will focus on the first of these 
reports. Specifically, I will discuss (1) the Visa Waiver Program's 
advantages and potential risks; (2) the U.S. government's process for 
assessing the program's risks; and (3) the actions that have been taken 
to mitigate these risks. In addition, we have ongoing work examining 
international aviation passenger prescreening, including DHS's use of 
passport and reservation data to screen travelers and the pilot 
Immigration Advisory Program at several airports overseas, and expect 
to report on our findings later this fall. 

In conducting this work, we reviewed documentation, including the laws 
governing the program, relevant regulations and agency operating 
procedures, and DHS's Office of the Inspector General (OIG) reports. We 
also examined 15 of the 25 completed reports from the 2004 review 
process that assessed the participation of Visa Waiver Program 
countries.[Footnote 9] Additionally, we interviewed political, 
economic, consular, commercial, and law enforcement officials at U.S. 
embassies in six Visa Waiver Program countries, as well as foreign 
government officials in three of these countries. We met with officials 
from several DHS component agencies and offices; the Department of 
State (State); and the International Criminal Police Organization 
(Interpol) in Lyon, France. We conducted our work in accordance with 
generally accepted government auditing standards (see app. I for a list 
of related GAO products and ongoing reviews). 

Summary: 

The Visa Waiver Program provides many benefits to the United States, 
including facilitating international travel for millions of foreign 
citizens seeking to visit the United States each year, creating 
substantial economic benefits to our country. Visa waiver travelers 
have represented about one-half of all nonimmigrant admissions to the 
United States in recent years. The program also allows State to 
allocate resources to visa-issuing posts in countries with higher-risk 
applicant pools. Moreover, participating visa waiver countries offer 
visa-free travel to U.S. citizens. However, travelers visiting the 
United States under the Visa Waiver Program can pose potential security 
risks because they are not interviewed by a consular officer prior to 
their travel. In addition, border inspectors at U.S. ports of entry may 
not know the visa waiver traveler's language or local fraudulent 
document trends in the traveler's home country, nor have the time to 
conduct an extensive interview. In contrast, visa-issuing officers at 
U.S. embassies generally have more time to interview applicants--often 
in the applicants' native language--and have more country-specific 
knowledge of passports and fraud trends. Furthermore, lost and stolen 
passports from visa waiver countries are highly prized among travelers 
seeking to conceal their true identities or nationalities, increasing 
the likelihood that terrorists and other criminals would attempt to 
obtain these documents. DHS officials have acknowledged that an 
undetermined number of inadmissible aliens may have entered the United 
States using a stolen or lost passport from a visa waiver country. In 
fact, passports from Visa Waiver Program countries have been used 
illegally by hundreds of travelers attempting to enter the United 
States. For example, from January through June 2005, at U.S. ports of 
entry, DHS confiscated 298 passports issued by Visa Waiver Program 
countries that travelers were attempting to use fraudulently for 
admission into the United States. Thus, there is a risk that the 
program could be exploited for illegal entry into the United States. 

DHS has developed a process for assessing the law enforcement and 
security risks of the Visa Waiver Program, but this process has 
weaknesses. In 2002, Congress mandated that DHS review the security 
risks posed by each visa waiver country's participation in the program 
at least every 2 years. In 2004, DHS established the Visa Waiver 
Program Oversight Unit within the Office of International Enforcement 
(OIE).[Footnote 10] DHS conducted its first mandated biennial reviews 
that same year, and subsequently determined that all of the countries 
it reviewed should remain in the program.[Footnote 11] However, we 
identified several problems with the country review process. 
Specifically, key interagency stakeholders,[Footnote 12] such as 
embassies overseas and forensic document analysts, were left out of 
portions of the 2004 country review process, and the review process 
lacked clear criteria and guidance to make key judgments. Also, the 
country assessments prepared by DHS were not completed in a timely 
fashion and contained some dated information that did not necessarily 
reflect current risks; interagency teams conducted site visits as part 
of the country assessments from May through September 2004, and 
transmitted the final report to Congress more than 1 year later, in 
November 2005. The teams collecting information about the visa waiver 
countries' risks in 2004 used, in some cases, information that was two 
years old; by the time the summary report was issued in November 2005, 
some of the data was over 3 years old. Moreover, DHS has not provided 
sufficient resources to the Office of International Enforcement to 
effectively monitor the risks posed by visa waiver countries on an 
ongoing basis. While the Visa Waiver Program Oversight Unit developed a 
strategic plan to monitor the program, it has been unable to implement 
this plan with its current staff of only two full-time employees. In 
addition, DHS has not established Visa Waiver Program points of contact 
within the U.S. embassies so it can communicate directly with foreign 
government contacts and field officials, who are best positioned to 
monitor compliance with the program's requirements and report on 
current events and issues of potential concern. Without this outreach, 
DHS is not able to leverage the existing resources at U.S. embassies in 
all visa waiver countries to obtain current information on potential 
risks, as well as countries' progress in addressing these risks. 

DHS has taken some actions to mitigate the risks of the Visa Waiver 
Program. Specifically, DHS identified security concerns in several 
participating countries during the 2004 assessment process, and, for 
example, terminated the use of the German temporary passport under the 
program. However, the department has faced difficulties in further 
mitigating program risks, particularly regarding lost and stolen 
passport reporting--a key vulnerability. For example, not all countries 
have consistently reported their data to the United States on stolen 
blank passports, even though reporting such data is vital to mitigating 
program risks. In one instance, a visa waiver country reported to the 
United States the theft of nearly 300 blank passports more than 9 years 
after the theft occurred. In 2002, timely reporting of such thefts 
became a statutory requirement for continued participation in the 
program, but DHS has not issued standard operating procedures for 
countries to report these data. DHS has also sought to expand this 
requirement to include the reporting of data, to the United States and 
Interpol,[Footnote 13] about lost and stolen issued[Footnote 14] (as 
well as blank) passports; however, the United States lacks a 
centralized mechanism for foreign governments to report all stolen 
passports, and DHS has not identified the U.S. government entity to 
which participating countries should report this information. While 
most visa waiver countries contribute to Interpol's database, four do 
not. Moreover, some countries that do contribute do not do so on a 
regular basis, according to Interpol officials. In addition, Interpol's 
data on lost and stolen travel documents is not automatically 
accessible to U.S. border inspectors at primary inspection--one reason 
why it is not an effective border screening tool, according to DHS, 
State, and Justice officials. According to the Secretary General of 
Interpol, until DHS can automatically query Interpol's data, the United 
States will not have an effective screening tool for checking 
passports. However, DHS has not yet finalized a plan to obtain this 
systematic access to Interpol's data. 

In our report, we made several recommendations to DHS to strengthen its 
ability to assess the risks of the Visa Waiver Program, including a 
recommendation to create real-time monitoring mechanisms to improve 
communication between the department and overseas posts, and to provide 
additional resources for the Visa Waiver Program Oversight Unit. We 
also made a series of recommendations to mitigate the program's risks, 
including communicating clear standard operating procedures for the 
reporting of lost and stolen, blank and issued, passport data. Finally, 
we included a matter for congressional consideration: to improve the 
timeliness of DHS's assessments of the risks of each country's 
continued participation in the program, Congress should consider 
establishing a deadline by which the department must complete its 
biennial country assessments and report to Congress. DHS either agreed 
with, or stated that it is considering, all of our recommendations. 
Regarding our matter for congressional consideration, DHS did not 
support the establishment of a deadline for the biennial report to 
Congress. Instead, DHS suggested that Congress should require 
continuous and ongoing evaluation of the risks of each country's 
continued participation in the program. 

Background: 

The Immigration Reform and Control Act of 1986 created the Visa Waiver 
Program as a pilot program.[Footnote 15] It was initially envisioned as 
an immigration control and economic promotion program, according to 
State. Participating countries were selected because their citizens had 
a demonstrated pattern of compliance with U.S. immigration laws, and 
the governments of these countries granted reciprocal visa-free travel 
to U.S. citizens. In recent years, visa waiver travelers have 
represented about one-half of all nonimmigrant admissions to the United 
States. In 2002, we reported on the legislative requirements to which 
countries must adhere before they are eligible for inclusion in the 
Visa Waiver Program.[Footnote 16] In general, to qualify for visa 
waiver status, a country must: 

* maintain a nonimmigrant refusal rate of less than 3 percent for its 
citizens who apply for business and tourism visas. 

* certify that it issues machine-readable passports to its citizens; 
and: 

* offer visa-free travel for U.S. citizens. 

Following the 9-11 attacks, Congress passed additional laws to 
strengthen border security policies and procedures, and DHS and State 
instituted other policy changes that have affected the qualifications 
for countries to participate in the Visa Waiver Program. For example, 
all passports issued after October 26, 2005, must contain a digital 
photograph printed in the document, and passports issued to visa waiver 
travelers after October 26, 2006, must be electronic (e- 
passports).[Footnote 17] In addition, the May 2002 Enhanced Border 
Security and Visa Reform Act required that participating countries 
certify that the theft of their blank passports is reported to the U.S. 
government in a timely manner. 

Visa Waiver Program Has Benefits and Risks: 

The Visa Waiver Program has many benefits. The program was created to 
facilitate international travel without jeopardizing the welfare or 
security of the United States, according to the program's legislative 
history. According to economic and commercial officers at several of 
the U.S. embassies we visited, visa-free travel to the United States 
boosts international business travel and tourism, as well as airline 
revenues, and creates substantial economic benefits to the United 
States. Moreover, the program allows State to allocate its resources to 
visa-issuing posts in countries with higher-risk applicant pools. In 
2002, we reported that eliminating the program would increase State's 
resource requirements as millions of visa waiver travelers who have 
benefited from visa-free travel would need to obtain a visa to travel 
to the United States if the program did not exist.[Footnote 18] 
Specifically, if the program were eliminated, we estimated that State's 
initial costs at that time to process the additional workload would 
likely range between $739 million and $1.28 billion and that annual 
recurring costs would likely range between $522 million and $810 
million. In addition, visa waiver countries could begin requiring visas 
for U.S. citizens traveling to the 27 participating countries for 
temporary business or tourism purposes, which would impose a burden of 
additional cost and time on U.S. travelers to these countries. 

Visa Waiver Program Can Pose Risks to U.S. Security, Law Enforcement, 
and Immigration Interests: 

The Visa Waiver Program, however, can also pose risks to U.S. security, 
law enforcement, and immigration interests because some foreign 
citizens may exploit the program to enter the United States. First, 
visa waiver travelers are not subject to the same degree of screening 
as travelers who must first obtain a visa before arriving in the United 
States (see fig. 1). Visa waiver travelers are first screened in person 
by a DHS Customs and Border Protection (CBP) inspector once they arrive 
at the U.S. port of entry, perhaps after having already boarded an 
international flight bound for the United States with a fraudulent 
travel document. According to the DHS OIG, primary border inspectors 
are at a disadvantage when screening Visa Waiver Program travelers 
because they may not know the alien's language or local fraud trends in 
the alien's home country, nor have the time to conduct an extensive 
interview. In contrast, non-visa-waiver travelers, who must obtain a 
visa from a U.S. embassy or consulate, receive two levels of screening 
before entering the country--in addition to the inspection at the U.S. 
port of entry, these travelers undergo an interview by consular 
officials overseas, who conduct a rigorous screening process when 
deciding to approve or deny a visa. As we have previously reported, 
State has taken a number of actions since 2002 to strengthen the visa 
issuance process as a border security tool.[Footnote 19] Moreover, 
consular officers have more time to interview applicants and examine 
the authenticity of their passports, and may also speak the visa 
applicant's native language, according to consular officials. 
Therefore, inadmissible travelers who need visas to enter the United 
States may attempt to acquire a passport from a Visa Waiver Program 
country to avoid the visa screening process. 

Figure 1: Comparison of Screening for U.S. Visas versus Arrival 
Inspection Screening at U.S. Air Port of Entry: 

[See PDF for image] 

Source: GAO; Nova Development (clip art). 

[End of figure] 

Another risk inherent in the program is the potential exploitation by 
terrorists, immigration law violators, and other criminals of a visa 
waiver country's lost or stolen passports. DHS intelligence analysts, 
law enforcement officials, and forensic document experts all 
acknowledge that misuse of lost and stolen passports is the greatest 
security problem posed by the Visa Waiver Program. Lost and stolen 
passports from visa waiver countries are highly prized travel 
documents, according to the Secretary General of Interpol. Moreover, 
Visa Waiver Program countries that do not consistently report the 
losses or thefts of their citizens' passports, or of blank passports, 
put the United States at greater risk of allowing inadmissible 
travelers to enter the country. 

Fraudulent passports from Visa Waiver Program countries have been used 
illegally by travelers seeking to disguise their true identities or 
nationalities when attempting to enter the United States. For example, 
from January through June 2005, DHS reported that it confiscated, at 
U.S. ports of entry, 298 fraudulent or altered passports issued by Visa 
Waiver Program countries that travelers were attempting to use for 
admission into the United States. Although DHS has intercepted some 
travelers with fraudulent passports at U.S. ports of entry, DHS 
officials acknowledged that an undetermined number of inadmissible 
aliens may have entered the United States using a lost or stolen 
passport from a visa waiver country. According to State, these aliens 
may have been inadmissible because they were immigration law violators, 
criminals, or terrorists. For example: 

* In July 2005, two aliens successfully entered the United States using 
lost or stolen Austrian passports. DHS was not notified that these 
passports had been lost or stolen prior to this date; the aliens were 
admitted, and there is no record of their departure, according to CBP. 
In October 2005, CBP referred this case to DHS's Immigration and 
Customs Enforcement for further action. 

* In June 2005, CBP inspectors admitted into the United States two 
aliens using Italian passports that were from a batch of stolen 
passports. CBP was notified that this batch was stolen; however, the 
aliens altered the passport numbers to avoid detection by CBP officers. 
DHS has no record that these individuals departed the United States. 

Process for Assessing Program Risks Has Weaknesses: 

DHS has taken several steps to assess the risks of the Visa Waiver 
Program. However, we identified problems with the country review 
process by which DHS assesses these risks, namely a lack of 
inclusiveness, transparency, and timeliness. Furthermore, OIE is unable 
to effectively monitor the immigration, law enforcement, and security 
risks posed by visa waiver countries on a continuing basis because of 
insufficient resources. 

Initial Steps Taken To Assess Risk of Visa Waiver Program: 

In April 2004, the DHS OIG identified significant areas where DHS 
needed to strengthen and improve its management of the Visa Waiver 
Program. For example, the OIG found that a lack of funding, trained 
personnel, and other issues left DHS unable to comply with the mandated 
biennial country assessments. In response to these findings, DHS 
established OIE's Visa Waiver Program Oversight Unit in July 2004, and 
named a director to manage the office. The unit's mission is to oversee 
Visa Waiver Program activities and monitor countries' adherence to the 
program's statutory requirements, ensuring that the United States is 
protected from those who wish to do it harm or violate its laws, 
including immigration laws. Since the unit's establishment, DHS, and 
particularly OIE, has made strides to address concerns raised by the 
2004 OIG review. For example, DHS completed comprehensive assessments 
of 25 of the 27 participating countries and submitted a six-page report 
to Congress in November 2005 that summarized the findings from the 2004 
assessments. 

DHS Lacks a Clearly-Defined, Consistent, and Timely Process to Assess 
Risks of Visa Waiver Program: 

Despite these steps to strengthen and improve the management of the 
program, we identified several problems with the mandated biennial 
country assessment process, by which DHS assesses the risks posed by 
each of the visa waiver countries' continued participation in the 
program. For the 2004 assessments, we found the following: 

* Some key stakeholders were excluded from the process. After 
conducting the site visits and contributing to the reports on the site 
visits, DHS and the interagency working group did not seek input from 
all site visit team members while drafting and clearing the final 
country assessments and subsequent report to Congress. For example, 
DHS's forensic document analysts, who participated in the site visits 
in 2004, told us that they did not see, clear, or comment on the draft 
country assessments, despite repeated attempts to obtain copies of 
them. Additionally, at the time of our visits, ambassadors or deputy 
chiefs of mission in each of the six posts told us that they were not 
fully aware of the extent to which assessments for the country where 
they were posted discussed law enforcement and security concerns posed 
by the continued participation of the country in the program. Without 
this information, key stakeholders could not be effective advocates for 
U.S. concerns. 

* The reviews lacked clear criteria to make key judgments. We found 
that DHS did not have clear criteria to determine at what point 
security concerns uncovered during their review would trigger 
discussions with foreign governments about these concerns and an 
attempt to resolve them. State officials agreed that qualitative and/or 
quantitative criteria would be useful when making these determinations, 
although DHS stated that the criteria should be flexible. 

* DHS and its interagency partners neither completed the 25 country 
assessments nor issued the summary report to Congress in a timely 
manner. The interagency teams conducted site visits as part of the 
country assessments from May through September 2004, and transmitted 
the final summary report to Congress more than 1 year later, in 
November 2005. OIE, State, and Justice officials acknowledged that the 
assessments took too long to complete. The teams collecting information 
about the visa waiver countries' risks in 2004 used, in some cases, 
information that was two years old; by the time the summary report was 
issued in November 2005, some of the data was over 3 years old. As a 
result of this lengthy process, the final report presented to Congress 
did not necessarily reflect the current law enforcement and security 
risks posed by each country, or the positive steps that countries had 
made to address these risks. 

DHS Cannot Effectively Monitor Ongoing Concerns in Visa Waiver 
Countries: 

OIE is limited in its ability to achieve its mission because of 
insufficient staffing. The office has numerous responsibilities, 
including conducting the mandated biennial country reviews; monitoring 
law enforcement, security, and immigration concerns in visa waiver 
countries on an ongoing basis; and working with countries seeking to 
become members of the Visa Waiver Program. In 2004, the DHS OIG found 
that OIE's lack of resources directly undercut its ability to assess a 
security problem inherent in the program--lost and stolen passports. 
The office received funding to conduct the country reviews in 2004 and 
2005; however, OIE officials indicated that a lack of funding and full- 
time staff has made it extremely difficult to conduct additional 
overseas fieldwork, as well as track ongoing issues of concern in the 
27 visa waiver countries--a key limitation in DHS's ability to assess 
and mitigate the program's risks. According to OIE officials, the unit 
developed a strategic plan to monitor the program, but has been unable 
to implement its plan with its current staffing of two full-time 
employees, as well as one temporary employee from another DHS 
component. Without adequate resources, OIE is unable to monitor and 
assess participating countries' compliance with the Visa Waiver 
Program's statutory requirements. 

In addition to resource constraints, DHS has not clearly communicated 
its mission to stakeholders at overseas posts, nor identified points of 
contact within U.S. embassies, so it can communicate directly with 
field officials positioned to monitor countries' compliance with Visa 
Waiver Program requirements and report on current events and issues of 
potential concern. In particular, within DHS's various components, we 
found that OIE is largely an unknown entity and, therefore, is unable 
to leverage the expertise of DHS officials overseas. A senior DHS 
representative at one post showed us that her organizational directory 
did not contain contact information for OIE. Additionally, a senior DHS 
official in Washington, D.C., told us that he may find out about 
developments--either routine or emergent--in visa waiver countries by 
"happenstance." Due to the lack of outreach and clear communication 
about its mission, OIE is limited in its ability to monitor the day-to- 
day law enforcement and security concerns posed by the Visa Waiver 
Program, and the U.S. government is limited in its ability to influence 
visa waiver countries' progress in meeting requirements. 

DHS Faces Difficulties in Mitigating Program Risks: 

DHS has taken some actions to mitigate the risks of the Visa Waiver 
Program. However, though the law has required the timely reporting of 
blank passport thefts for continued participation in the Visa Waiver 
Program since 2002, DHS has not established and communicated time 
frames and operating procedures to participating countries. In 
addition, DHS has sought to expand this requirement to include the 
reporting of data, to the United States and Interpol, on lost and 
stolen issued passports; however, participating countries are resisting 
these requirements, and DHS has not yet issued guidance on what 
information must be shared, with whom, and within what time frame. 
Furthermore, U.S. border inspectors are unable to automatically access 
Interpol's data on reported lost and stolen passports, which makes 
detection of these documents at U.S. ports of entry more difficult. 

DHS Has Taken Some Actions to Mitigate Risks of the Visa Waiver 
Program: 

As previously mentioned, during the 2004 assessment process, the 
working group identified security concerns in several participating 
countries, and DHS took actions to mitigate some of these risks. 
Specifically, DHS determined that several thousand blank German 
temporary passports[Footnote 20] had been lost or stolen, and that 
Germany had not reported some of this information to the United States. 
As a result, as of May 1, 2006, German temporary passport holders are 
not allowed to travel to the United States under the Visa Waiver 
Program without a visa. In addition, DHS has enforced an October 26, 
2005, deadline requiring travelers under the Visa Waiver Program to 
have digital photographs in their passports. 

DHS Lacks Standard Procedures for Obtaining Stolen Blank Passport Data: 

A key risk in the Visa Waiver Program is stolen blank passports from 
visa waiver countries, because detecting these passports at U.S. ports 
of entry is extremely difficult, according to DHS. Some thefts of blank 
passports have not been reported to the United States until years after 
the fact, according to DHS intelligence reports. For example, in 2004, 
a visa waiver country reported the theft of nearly 300 stolen blank 
passports to the United States more than 9 years after the theft 
occurred. The 2002 Enhanced Security and Visa Entry Reform Act provides 
that the Secretary of Homeland Security must terminate a country from 
the Visa Waiver Program if he and the Secretary of State jointly 
determine that the country is not reporting the theft of its blank 
passports to the United States on a timely basis. However, DHS has not 
established time frames or operating procedures to enforce this 
requirement. While the statute requires visa waiver countries to 
certify that they report information on the theft of their blank 
passports to the United States on a timely basis, as of June 2006, DHS 
has not defined what constitutes "timely" reporting. Moreover, the 
United States lacks a centralized mechanism for foreign governments to 
report all stolen passports. In particular, DHS has not defined to whom 
in the U.S. government participating countries should report this 
information. 

Some Participating Visa Waiver Program Countries are Resisting 
Additional Reporting to United States and Interpol: 

In addition to blank passports, lost or stolen issued passports also 
pose a risk because they can be altered. In June 2005, DHS issued 
guidance to participating Visa Waiver Program countries requiring that 
they certify their intent to report lost and stolen passport data on 
issued passports by August 2005. However, DHS has not yet issued 
guidance on what information must be shared, with whom, and within what 
time frame. Moreover, some visa waiver countries have not yet agreed to 
provide this information to the United States, due in part to concerns 
over the privacy of their citizens' biographical information. In 
addition, several consular officials expressed confusion about the 
current and impending requirements about sharing this data, and felt 
they were unable to adequately explain the requirements to their 
foreign counterparts. 

In June 2005, the U.S. government also announced its intention to 
require visa waiver countries to certify their intent to report 
information on both lost and stolen blank and issued passports to 
Interpol. In 2002, Interpol developed a database of lost and stolen 
travel documents to which its member countries may contribute on a 
voluntary basis. While most visa waiver countries use and contribute to 
Interpol's database, four do not. Moreover, some countries that do 
contribute do not do so on a regular basis, according to Interpol 
officials. Participating countries have expressed concerns about 
reporting this information, citing privacy issues; however, Interpol's 
database on lost and stolen travel documents does not include the 
passport bearers' biographical information, such as name and date of 
birth.[Footnote 21] According to the Secretary General of Interpol, in 
light of the high value associated with passports from visa waiver 
countries, it is a priority for his agency to encourage countries to 
contribute regularly to the database. 

Inefficient Access to Interpol's Database on Lost and Stolen Passports: 

Though information from Interpol's database could potentially stop 
inadmissible travelers from entering the United States, CBP's border 
inspectors do not have automatic access to the database at the primary 
inspection point at U.S. ports of entry--the first line of defense 
against those who might exploit the Visa Waiver Program to enter the 
United States. The inspection process at U.S. ports of entry can 
include two stages--a primary and secondary inspection. If, during the 
primary inspection, the inspector suspects that the traveler is 
inadmissible either because of a fraudulent passport or other reason, 
the inspector refers the traveler to secondary inspection. At secondary 
inspection, border inspectors can contact officials at the National 
Targeting Center, who can query Interpol's stolen-travel-document 
database to determine if the traveler's passport had been previously 
reported lost or stolen, but is not yet on CBP's watch list.[Footnote 
22] However, according to DHS, State, and Justice officials, because 
Interpol's data on lost and stolen travel documents is not 
automatically accessible to border inspectors at primary inspection, it 
is not currently an effective border screening tool. Moreover, 
according to the Secretary General of Interpol, until DHS can 
automatically query Interpol's data, the United States will not have an 
effective screening tool for checking passports. According to Interpol 
officials, the United States is working actively with Interpol on a 
potential pilot project that would allow for an automatic query of 
aliens' passport data against Interpol's database at primary inspection 
at U.S. ports of entry. However, DHS has not yet finalized a plan to do 
so. 

Recommendations to Improve Program Oversight and DHS's Response: 

In our report, we made a series of recommendations to improve the U.S. 
government's process for assessing the risks in the Visa Waiver 
Program, including recommending that DHS provide additional resources 
to strengthen OIE's visa waiver monitoring unit; finalize clear, 
consistent, and transparent protocols for the biennial country 
assessments and provide these protocols to stakeholders at relevant 
agencies at headquarters and overseas; create real-time monitoring 
arrangements for all 27 participating countries; and establish 
protocols for direct communication between overseas posts and OIE's 
Visa Waiver Program Oversight Unit. In addition, we made 
recommendations to improve U.S. efforts to mitigate program risks, 
including requiring that all visa waiver countries provide the United 
States and Interpol with non-biographical data from lost or stolen 
issued passports, as well as from blank passports; developing clear 
standard operating procedures for the reporting of lost and stolen 
blank and issued passport data; and developing and implementing a plan 
to make Interpol's stolen travel document database automatically 
available during primary inspection at U.S. ports of entry. Given the 
lengthy time it took for DHS to issue the November 2005 summary report 
to Congress, and to ensure future reports contain timely information 
when issued, we also proposed that Congress establish a biennial 
deadline by which DHS must complete the country assessments and report 
to Congress. 

DHS either agreed with, or stated that it is considering, all of our 
recommendations. Regarding our matter for congressional consideration, 
DHS did not support the establishment of a deadline for the biennial 
report to Congress. Instead, DHS suggested that Congress should require 
continuous and ongoing evaluation. With continuous review, DHS stated 
that it would be able to constantly evaluate U.S. interests and report 
to Congress on the current 2-year reporting cycle on targeted issues of 
concern, rather than providing a historical evaluation. We agree that 
continuous and ongoing evaluation is necessary, and that is why we 
recommended that DHS create real-time monitoring arrangements and 
provide additional resources to the Visa Waiver Program Oversight Unit 
to achieve this goal. Regarding the mandated biennial country 
assessments, we believe that they can serve a useful purpose if they 
are completed in a timely fashion. 

In closing, the Visa Waiver Program aims to facilitate international 
travel for millions of people each year and promote the effective use 
of government resources. Effective oversight of the program entails 
balancing these benefits against the program's potential risks. To find 
this balance, the U.S. government needs to fully identify the 
vulnerabilities posed by visa waiver travelers, and be in a position to 
mitigate them. It is imperative that DHS commit to strengthen its 
ability to promptly identify and mitigate risks to ensure that the Visa 
Waiver Program does not jeopardize U.S. security interests. This is 
particularly important given that many countries are actively seeking 
to join the program. 

Mr. Chairman, this concludes my prepared statement. I will be happy to 
answer any questions you or Members of the Subcommittee may have. 

Contacts and Staff Acknowledgments: 

For questions regarding this testimony, please call Jess T. Ford, (202) 
512-4128 or fordj@gao.gov. Individuals making key contributions to this 
statement include John Brummet, Assistant Director, and Kathryn H. 
Bernet, Joseph Carney, and Jane S. Kim. 

[End of section] 

Related GAO Products and Ongoing Reviews: 

Issued Reports: 

Border Security: More Emphasis on State's Consular Safeguards Could 
Mitigate Visa Malfeasance Risks. GAO-06-115. October 6, 2005: 

Border Security: Strengthened Visa Process Would Benefit From 
Improvements in Staffing and Information Sharing. GAO-05-859. September 
13, 2005: 

Border Security: Actions Needed to Strengthen Management of Department 
of Homeland Security's Visa Security Program. GAO-05-801. July 29, 
2005. 

Border Security: Streamlined Visas Mantis Program Has Lowered Burden on 
Foreign Science Students and Scholars, but Further Refinements Needed. 
GAO-05-198. February 18, 2005. 

Border Security: State Department Rollout of Biometric Visas on 
Schedule, but Guidance Is Lagging. GAO-04-1001. September 9, 2004. 

Border Security: Additional Actions Needed to Eliminate Weaknesses in 
the Visa Revocation Process. GAO-04-795. July 13, 2004. 

Border Security: Improvements Needed to Reduce Time Taken to Adjudicate 
Visas for Science Students and Scholars. GAO-04-371. February 25, 2004. 

Border Security: New Policies and Procedures Are Needed to Fill Gaps in 
the Visa Revocation Process. GAO-03-798. June 18, 2003. 

Border Security: Implications of Eliminating the Visa Waiver Program. 
GAO-03-38. November 22, 2002. 

Technology Assessment: Using Biometrics for Border Security. GAO-03- 
174. November 15, 2002. 

Border Security: Visa Process Should Be Strengthened as an 
Antiterrorism Tool. GAO-03-132NI. October 21, 2002. 

Ongoing Reviews: 

Review of International Aviation Passenger Prescreening. Requested by 
the Chairman and Ranking Member, Committee on the Judiciary, and the 
Ranking Member, Committee on Homeland Security, House of 
Representatives. Report expected in the fall of 1006. 

Review of the Department of State's Measures to Ensure the Integrity of 
Travel Documents. Requested by the Chairman, Committee on the 
Judiciary, House of Representatives; Chairman John N. Hostettler and 
member Darrell E. Issa, Subcommittee on Immigration, Border Security 
and Claims, Committee on the Judiciary, House of Representatives; and, 
Chairman Lamar S. Smith, Subcommittee on Courts, the Internet, and 
Intellectual Property, Committee on the Judiciary, House of 
Representatives. Report expected in the spring of 2007. 

Review of the Department of State's Effort to Address Delays in Visa 
Issuance. Requested by the Chairman and Ranking Member of the Committee 
on Government Reform, House of Representatives. Report expected in the 
spring of 2007. 

Review of Immigrant Visa Processing. Requested by the Ranking Member, 
Committee on Homeland Security, House of Representatives. Report 
expected in mid-2007. 

FOOTNOTES 

[1] The participating countries are Andorra, Australia, Austria, 
Belgium, Brunei, Denmark, Finland, France, Germany, Iceland, Ireland, 
Italy, Japan, Liechtenstein, Luxembourg, Monaco, the Netherlands, New 
Zealand, Norway, Portugal, San Marino, Singapore, Slovenia, Spain, 
Sweden, Switzerland, and the United Kingdom. 

[2] The United States also issues visas to those who intend to 
immigrate to the United States. In this testimony, we use the term 
"visa" to refer to nonimmigrant visas only. 

[3] The Immigration Reform and Control Act of 1986, P.L. 99-603. 

[4] The Visa Waiver Permanent Program Act, P.L. 106-396. 

[5] Prior to this change, DHS was required to report at least once 
every 5 years. See the Enhanced Border Security and Visa Entry Reform 
Act, P.L 107-173. 

[6] Since September 11, 2001, the visa issuance process has taken on 
greater significance as an antiterrorism tool, as we have previously 
reported. GAO has issued a series of reports on the visa issuance 
process. See GAO, Border Security: Strengthened Visa Process Would 
Benefit from Improvements in Staffing and Information Sharing, GAO-05-
859 (Washington, D.C.: Sept. 13, 2005); Border Security: Actions Needed 
to Strengthen Management of Department of Homeland Security's Visa 
Security Program, GAO-05-801 (Washington, D.C.: July 29, 2005); and, 
Border Security: Visa Process Should be Strengthened as an 
Antiterrorism Tool, GAO-03-132NI (Washington, D.C.: Oct. 21, 2002). 

[7] GAO, Border Security: Stronger Actions Needed to Assess and 
Mitigate Risks of the Visa Waiver Program, GAO-06-844 (Washington, 
D.C.: July 28, 2006). 

[8] GAO, Process for Admitting Additional Countries into the Visa 
Waiver Program, GAO-06-835R (Washington, D.C.: July 28, 2006). 

[9] As of June 2006, the remaining 10 assessments were pending 
classification review, and assessments of the remaining two 
participating countries--Italy and Portugal--were in process. 

[10] OIE is located in the Office of Policy Development under the 
direction of the Assistant Secretary of Homeland Security for Policy. 

[11] DHS's Office of Policy began this review in early 2004, several 
months before the Visa Waiver Program Oversight Unit was established in 
July of that year. 

[12] The interagency working group charged in 2004 with assessing 
participating countries' adherence to the program's statutory 
requirements comprised officials from Justice's Office of International 
Affairs, State's Bureau of Consular Affairs, and several components 
within DHS, including the Intelligence and Analysis Directorate, Custom 
and Border Protection's Office of Field Operations, and Immigration and 
Customs Enforcement's Forensic Document Laboratory, among others. 
Representatives from some of these agencies formed the in-country site 
visit teams. 

[13] Interpol is the world's largest international police organization, 
with 184 member countries. Created in 1923, it facilitates cross-border 
police cooperation, and supports and assists all organizations, 
authorities, and services whose mission is to prevent or combat 
international crime. In July 2002, Interpol established a database on 
lost and stolen travel documents. As of June 2006, the database 
contained about 11.6 million records of lost and stolen passports. 

[14] Issued passports have been officially personalized with the 
bearer's biographical information. 

[15] P.L. 99-603. 

[16] See GAO, Border Security: Implications of Eliminating the Visa 
Waiver Program, GAO-03-38 (Washington, D.C.: Nov. 22, 2002). 

[17] Travelers with passports issued after the deadline that do not 
meet these requirements must obtain a visa from a U.S. embassy or 
consulate overseas before departing for the United States. In general, 
e-passports will contain a chip embedded in the passport that will 
store the same information that is printed on the data page of the 
passport, such as name, date of birth, gender, place of birth, dates of 
passport issuance and expiration, place of issuance, passport number, 
and a photo image of the bearer. 

[18] GAO-03-38. 

[19] GAO-05-859 and GAO-03-132NI. 

[20] German temporary passports are valid for one year, and are less 
expensive than standard German passports. In addition, they are issued 
at more than 6,000 locations across Germany, whereas the Ministry of 
Interior issues the standard passports centrally. 

[21] Interpol's database includes the passport's identity number, the 
country of issuance, and the country where the loss or theft occurred. 
According to officials from Justice's Interpol-U.S. National Central 
Bureau, it is particularly important that countries report this 
information, as well as the date of the theft and the issuance date. 

[22] Interpol's data on lost and stolen passports are not available 
when border inspectors screen travelers' passports at primary 
inspection unless Interpol has shared this information with the United 
States in separate reports and it has been manually entered into DHS 
watch lists. 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site (www.gao.gov). Each weekday, GAO posts 
newly released reports, testimony, and correspondence on its Web site. 
To have GAO e-mail you a list of newly posted products every afternoon, 
go to www.gao.gov and select "Subscribe to Updates." 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office 441 G Street NW, Room LM 
Washington, D.C. 20548: 

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202) 
512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 U.S. 
Government Accountability Office, 441 G Street NW, Room 7125 
Washington, D.C. 20548: 

Public Affairs: 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800 
U.S. Government Accountability Office, 441 G Street NW, Room 7149 
Washington, D.C. 20548: