Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa Waiver Program

In July 2006, GAO recommended (Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa Waiver Program, GAO-06-854, July 28, 2006) that the Department of Homeland Security (DHS) provide additional resources to strengthen the department's visa waiver monitoring unit. In June 2006, the visa waiver monitoring unit was staffed with two full-time employees and one temporary employee. We found that the office was limited in its ability to achieve its mission and conduct its numerous responsibilities because of insufficient staffing and funding. Since the publication of our 2006 report, DHS has provided the Visa Waiver Program Office with additional resources. As of April 2008, the office has five additional full-time employees, and two other staff from the Office of Policy devote at least 50 percent of their time to Visa Waiver Program tasks. Using these additional resources, DHS has taken actions to improve the ability of the Visa Waiver Program Office's to achieve its mission and perform its responsibilities.

In July 2006, GAO recommended (Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa Waiver Program, GAO-06-854, July 28, 2006) that DHS finalize clear, consistent, and transparent protocols for the biennial country assessments and provide these protocols to stakeholders at relevant agencies at headquarters and overseas. GAO found that DHS did not establish transparent protocols for the country assessments including internal milestones or deadlines for completing the final country assessments, the goals of the site visits, and an explanation of the clearance process. In November 2007, a DHS official provided us with the Standard Operating Procedures (SOP) for the Visa Waiver Program Office (VWPO). These SOPs were drafted in November 2007 and are to be used as guidance when conducting reviews of nominated and participating Visa Waiver countries. A DHS official noted that these SOPs are internal documents and that it would be inappropriate to widely share the hard copy SOP documents. However, this official noted that well in advance of an assessment DHS/VWPO staff communicates and coordinates extensively with various stakeholders (including other DHS components, Department of State, Consular Affairs, American embassies overseas, DHS officials overseas, and the foreign embassies in Washington) to explain the assessment process and solicit both substantive and logistical assistance. The procedures are also communicated to the team during the pre-visit training session. Based on this information, DHS has taken actions to improve the U.S. government's process for assessing risks in the Visa Waiver Program by finalizing transparent protocols for country assessments.

In response to the GAO recommendation, the Visa Waiver Program Office continuously monitors open source information and classified intelligence relating to the Visa Waiver Program to ensure awareness of changing conditions in VWP countries. According to the Department of Homeland Security (DHS), the VISA WAIVER PROGRAM OFFICE has established points of contact at U.S. embassies and Consulates in the 36 participating VWP countries to include Consular Section officials, Political Sections officials, Immigration and Customs Enforcement Attaches, Customs and Border Protection Attaches, and Legal Attaches. The VISA WAIVER PROGRAM OFFICE communicates informally and formally with these officials, that allows for continuous and substantive information exchange with VISA WAIVER PROGRAM OFFICE and posts, as well as between the VISA WAIVER PROGRAM OFFICE and Department of State (State) Bureau of Consular Affairs, the Department of Justice Office of International Affairs, and DHS Component Headquarters in Washington, D.C. Furthermore, DHS formally requests information from State, Immigration and Customs Enforcement, and Customs and Border Protection during the biennial review process or for formal information requests outside the biennial review process.

In July 2006, GAO recommended (Border Security:Stronger Actions Needed to Assess and Mitigate Risks of the Visa Waiver Program, GAO-06-854, July 28, 2006) that Department of Homeland Security (DHS) provide complete copies of the most recent country assessments to relevant stakeholders in headquarters and overseas posts. State's headquarters officers who cover diplomatic relations in Visa Waiver Program countries, as well as embassy officials in all of the posts we visited, stated that they had not seen the final country assessments. As a result, these officials were not able to communicate security concerns to officials in their host country. In January 2008, DHS placed the completed Visa Waiver Programs country assessments on the SIPRNET and post officials confirmed that these assessments were available to them during our site visits to Europe in Spring 2008. An official from the DHS Visa Waiver Program Office (VWPO) told us that DHS had drafted a memo to the State Department that requested that State notify post officials in Visa Waiver countries that they could access and read the VWPO's country security assessments on the SIPRNET. We received confirmation from a State Department official that the cable was sent out to posts in Visa Waiver countries on March 7, 2008. During our site visits to Paris and London in March 2008, post officials told us that they had received the cable with instructions on how to access the assessments on the SIPRNET. Based on this information, DHS has positively influenced post officials' ability to communicate security concerns to their officials in the host country and DHS has responded to our recommendation regarding the country security assessments.

In response to the GAO recommendation, the DHS the Visa Waiver Program Office has worked to build relationships with Embassy and Consulate officials in the Visa Waiver Program countries to ensure that relevant security and law enforcement concerns are address. DHS established points of contact with embassy officials in all the Visa Waiver Program countries. In addition, in interviews at several embassies, State Department and DHS officials at the posts indicated that correspondence with the Visa Waiver Program Office occurred regularly.

In comments on a draft of the 2006 report, the Department of Homeland Security (DHS) stated that the issue of lost and stolen passport reporting was of paramount importance, and that they would work to ensure compliance among all visa waiver countries. The "Implementing the Recommendations of the 9-11 Commission Act of 2007" further required each visa waiver country to enter into an agreement with the United States to report lost and stolen passport information to the United States directly, or through Interpol. According to DHS, as of July 2010, all visa waiver countries report lost and stolen passport data, in some manner, to Interpol's Stolen and Lost Travel Document database, to which the DHS has real-time access of U.S. ports of entry. According to Interpol officials, GAO's July 2006 report was central to its ability to encourage all visa waiver countries to share their lost and stolen passport information with Interpol and its member countries. In addition, thirty-two of the 36 visa waiver countries have signed agreements with the United States on lost and stolen passport reporting. DHS continues to work with the remaining 4 countries to finalize similar agreements.

In July 2006, (Border Security:Stronger Actions Needed to Assess and Mitigate Risks of the Visa Waiver Program, GAO-06-854)we found that a key risk in the Visa Waiver Program is stolen blank passports from visa waiver countries, because detecting these passports at U.S. ports of entry is extremely difficult. The 2002 Enhanced Security and Visa Entry Reform Act provides that the Secretary of Homeland Security must terminate a country from the Visa Waiver Program if he and the Secretary of State jointly determine that the country is not reporting the theft of its blank passports to the United States on a timely basis. We reported that the Departments of Homeland Security (DHS) and State (State) had chosen not to terminate from the program countries that have failed to report these incidents. DHS officials told us that the inherent political, economic, and diplomatic implications associated with removing a country from the Visa Waiver Program make it difficult to enforce the statutory requirement in the broadest terms. Moreover, DHS had not established time frames or operating procedures to enforce this requirement. While the statute required visa waiver countries to certify that they report information on the theft of their blank passports to the United States on a timely basis, as of June 2006, DHS had not defined what constitutes timely. Moreover, the United States lacked a centralized mechanism for foreign governments to report all stolen passports. In particular, DHS had not defined to whom in the U.S. government participating countries should report this information. Therefore, we recommended that DHS develop and communicate clear standard operating procedures for the reporting of lost and stolen blank and issued passport data, including a definition of timely reporting and to whom in the U.S. government countries should report. In 2008, we reported that, in response to our recommendation, DHS established criteria for the reporting of lost and stolen passport data--including a definition of timely reporting and an explanation of to whom in the U.S. government countries should report.

In July 2006, GAO recommended (Border Security: Stronger Actions Needed to Assess and Mitigate Risks of the Visa Waiver Program, GAO-06-854, July 28, 2006) that the Department of Homeland Security (DHS) develop and implement a plan to make Interpol's stolen travel document database automatically available during primary inspection at U.S. ports of entry. In our report, we noted that DHS is not using Interpol's data to its full potential as a border screening tool because DHS does not automatically access the data at primary inspection. Since the publication of our 2006 report, DHS has taken action on our recommendation. DHS, in coordination with the U.S. National Central Bureau, as of June 2008, has initiated a system that allows DHS to screen foreign nationals' arriving at all U.S. international airports against Interpol's database of lost and stolen travel documents before arriving in the country. Results to date illustrate that the system identifies two to three hits per month for fraudulent passports. According to the National Central Bureau, Interpol's database has intercepted passports that were not identified by DHS's other screening systems. Access to Interpol's database demonstrates DHS's actions to use the Interpol data to its full potential as a border screening tool.