The Visa Waiver Program (VWP) allows eligible nationals from 36 member countries to travel to the United States for tourism or business for 90 days or less without a visa. In 2007, Congress required the Secretary of Homeland Security, in consultation with the Secretary of State, to implement an automated electronic travel authorization system to determine, prior to travel, applicants' eligibility to travel to the United States under the VWP. Congress also required all VWP member countries to enter into an agreement with the United States to share information on whether citizens and nationals of that country traveling to the United States represent a security threat. In 2002, Congress mandated that the Department of Homeland Security (DHS) review, at least every 2 years, the security risks posed by each VWP country's participation in the program. In this report, GAO evaluates (1) DHS's implementation of an electronic system for travel authorization; (2) U.S. agencies' progress in negotiating informationsharing agreements; and (3) DHS's timeliness in issuing biennial reports. GAO reviewed relevant documents and interviewed U.S., foreign government, and travel industry officials in six VWP countries.

DHS has implemented the Electronic System for Travel Authorization (ESTA) and has taken steps to minimize the burden associated with the new program requirement. However, DHS has not fully evaluated security risks related to the small percentage of VWP travelers without verified ESTA approval. DHS requires applicants for VWP travel to submit biographical information and answers to eligibility questions through ESTA prior to travel. Travelers whose ESTA applications are denied can apply for a U.S. visa. In developing and implementing ESTA, DHS has made efforts to minimize the burden imposed by the new requirement. For example, although travelers formerly filled out a VWP application form for each journey to the United States, ESTA approval is generally valid for 2 years. Most travel industry officials GAO interviewed in six VWP countries praised DHS's widespread ESTA outreach efforts, reasonable implementation time frames, and responsiveness to feedback, but expressed dissatisfaction with the costs associated with ESTA. In 2010, airlines complied with the requirement to verify ESTA approval for almost 98 percent of VWP passengers prior to boarding, but the remaining 2 percent-- about 364,000 travelers--traveled under the VWP without verified ESTA approval. DHS has not yet completed a review of these cases to know to what extent they pose a risk to the program. To meet the legislative requirement, DHS requires that VWP countries enter into three information-sharing agreements with the United States; however, only half of the countries have fully complied with this requirement and many of the signed agreements have not been implemented. Half of the countries have entered into agreements to share watchlist information about known or suspected terrorists and to provide access to biographical, biometric, and criminal history data. By contrast, almost all of the 36 VWP countries have entered into an agreement to report lost and stolen passports. DHS, with the support of interagency partners, has established a compliance schedule requiring the last of the VWP countries to finalize these agreements by June 2012. Although termination from the VWP is one potential consequence for countries not complying with the information-sharing agreement requirement, U.S. officials have described it as undesirable. DHS, in coordination with State and Justice, has developed measures short of termination that could be applied to countries not meeting their compliance date. DHS has not completed half of the most recent biennial reports on VWP countries' security risks in a timely manner. According to officials, DHS assesses, among other things, counterterrorism capabilities and immigration programs. However, DHS has not completed the latest biennial reports for 18 of the 36 VWP countries in a timely manner, and over half of these reports are more than 1 year overdue. Further, in the case of two countries, DHS was unable to demonstrate that it had completed reports in the last 4 years. DHS cited a number of reasons for the reporting delays. For example, DHS officials said that they intentionally delayed report completion because they frequently did not receive mandated intelligence assessments in a timely manner and needed to review these before completing VWP country biennial reports. GAO recommends that DHS establish time frames for the regular review of cases of ESTA noncompliance and take steps to address delays in the biennial review process. DHS concurred with the report's recommendations.

Status Legend:

Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.

• In Process
• Open
• Closed - implemented
• Closed - not implemented

Recommendations for Executive Action

Recommendation: To ensure that DHS can identify and mitigate potential security risks associated with the VWP, the Secretary of Homeland Security should establish time frames for the regular review and documentation of cases of VWP passengers traveling to a U.S. port of entry without verified ESTA approval.

Agency Affected: Department of Homeland Security

Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: To ensure that DHS can identify and mitigate potential security risks associated with the VWP, the Secretary of Homeland Security should take steps to address delays in the biennial country review process so that the mandated country reports can be completed on time.

Agency Affected: Department of Homeland Security

Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.