This is the accessible text file for GAO report number GAO-06-115 entitled 'Border Security: More Emphasis on State's Consular Safeguards Could Mitigate Visa Malfeasance Risks' which was released on November 7, 2005. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to the Chairman, Committee on the Judiciary, House of Representatives: October 2005: Border Security: More Emphasis on State's Consular Safeguards Could Mitigate Visa Malfeasance Risks: [Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-115]: GAO Highlights: Highlights of GAO-06-115, a report to the Chairman, Committee on the Judiciary, House of Representatives: Why GAO Did This Study: Issuing a U.S. visa to a foreign citizen in exchange for money or something of value is a crime that can facilitate entry into the United States of unqualified persons, including those who may wish to do our country harm. Internal controls make it difficult for an employee to commit visa malfeasance without being detected, but, despite these safeguards, visa malfeasance does occur. GAO examined (1) State’s internal controls to prevent nonimmigrant visa malfeasance and if they are being implemented and (2) visa malfeasance cases from 2001-2004 and factors cited by State and the Department of Justice (Justice) that contributed to visa malfeasance and affected investigations and prosecutions. What GAO Found: State has a set of internal controls to prevent visa malfeasance and has taken actions to improve them; however, these internal controls are not being fully and consistently implemented by the posts we visited. While State’s controls are consistent with accepted control standards, we found noncompliance with required supervisory oversight at 6 of the 11 posts we visited. This included failure to inventory items used to issue visas, review visa decisions, and follow State’s procedures when issuing visas for applicants referred by officers within the post. Lack of full compliance with internal controls increases vulnerability to visa malfeasance. State recently established two headquarters entities to monitor post visa operations. While stronger oversight should help strengthen compliance with internal controls, State has not developed automated software to sort and analyze abnormalities in visa issuances that could indicate potential malfeasance. The Bureau of Diplomatic Security substantiated 28 visa malfeasance cases between 2001 and 2004 involving U.S. employees. The suspects were fired, chose to resign, or were arrested. State investigators could not tell us how many opened cases were referred to Justice for possible prosecution because they had not been routinely collecting that information. In fact, their case records did not permit investigators to identify malfeasance trends or consular managers to identify internal control weaknesses needing attention. Justice’s Public Integrity Section successfully prosecuted 10 U.S. government employees. State Diplomatic Security and Justice officials noted that their investigations and prosecutions were impeded by constraints on evidence gathering. Additionally, investigators can not obtain U.S. search warrants to search consular officer’s offices or residences overseas. Justice and State are discussing the possibility of pursuing legal changes and other means to address these constraints. Selected Key Internal Control Requirements and Status of Implementation: Issue: Control of accountable items; Requirement: State’s internal controls call for the maintenance of careful records on the use of controllable items; Implementation: Most posts did not reconcile the differences between inventory records and stocks of blank visas on hand quarterly as required, although daily reconciliations were routinely performed. Issue: Criteria for post-referred applicants; Requirement: State requires posts to establish a formal post-wide referral system, reissue the procedures annually, and ensure that the applicants meet the departmentwide criteria specified on the forms; Implementation: Compliance with State’s referral policies and procedures were not consistently followed at seven of the posts we reviewed. Moreover, four posts did not have the required post policy to supplement State policies. Source: GAO. [End of table] What GAO Recommends: To improve the safeguards over the visa process GAO recommends that the Secretary of State develop strategies to achieve strict compliance with internal controls and improve existing mechanisms to combat visa malfeasance. We also recommend that the Secretary of State and the Attorney General determine whether seeking additional overseas search authorities is warranted to facilitate investigations of visa malfeasance. State agreed with the conclusions in our report and is taking steps to implement the recommendations. www.gao.gov/cgi-bin/getrpt?GAO-06-115. To view the full product, including the scope and methodology, click on the link above. For more information, contact Jess T. Ford at (202) 512- 4128 or fordj@gao.gov. [End of section] Contents: Letter: Results in Brief: Background: Consular Affairs Has Internal Controls over the Visa Process, but Controls Are Not Being Fully Implemented at Posts GAO Reviewed: Documented Cases of Visa Malfeasance: Conclusions: Recommendations for Executive Action: Agency Comments and Our Evaluation: Appendix I: Scope and Methodology: Appendix II: Comments from the Department of State: Appendix III: GAO Contact and Staff Acknowledgments: Table: Table 1: State Department Key Internal Control Requirements and Status of Implementation: Figure: Figure 1: The Nonimmigrant Visa Process: Abbreviations: VAU: Vulnerability Assessment Unit: CMAT: Consular Management Assistance Teams: Letter October 6, 2005: The Honorable F. James Sensenbrenner, Jr.: Chairman: Committee on Judiciary: House of Representatives: Dear Mr. Chairman: Issuing a U.S. visa to a foreign citizen in exchange for money or something of value is a crime that can facilitate entry into the United States of unqualified persons, including those who may wish to do our country harm. In fiscal year 2004, Department of State (State) consular officers issued more than 5 million visas at 211 overseas posts.[Footnote 1] According to State's criminal investigators, some applicants offer bribes to U.S. government employees in an attempt to obtain visas. The integrity of U.S. government employees and controls over the visa process are pivotal to preventing visa malfeasance. Visa officers are professional employees who undergo extensive background checks, have top secret security clearances, and receive training and guidance in visa procedures and ethical conduct. However, some cases of visa malfeasance have occurred involving consular officers and other U.S. government officials.[Footnote 2] For example, in 2004, two consular officers were convicted and sentenced for selling visas for hundreds of thousands of dollars between 2000 and 2003. In this case, State's Bureau of Consular Affairs determined that the malfeasance occurred in part because of breaches in internal control procedures. Full compliance with internal controls makes it difficult for an employee to commit visa malfeasance without being detected. This report examines (1) State's internal controls to prevent visa malfeasance, and whether they are being implemented, and (2) visa malfeasance cases from 2001 to 2004, and factors cited by State and the Department of Justice (Justice) that contributed to visa malfeasance and affected investigations and prosecutions. To conduct our review, we analyzed key internal controls over the visa process identified by State. We visited posts in six countries: Mexico, Ecuador, Peru, Vietnam, Thailand, and India. We observed visa adjudications and assessed post adherence to those internal controls. We also obtained statistics on cases of visa malfeasance and the investigative outcomes. Additionally, we discussed the investigative process with State's Bureau of Diplomatic Security and the Office of the Inspector General. At Justice, we discussed general factors affecting Justice's decisions to prosecute cases and obtained data on the results of some prosecuted cases. We conducted our review from August 2004 to July 2005 in accordance with generally accepted government auditing standards. Appendix I provides more information on our scope and methodology. We have issued a separate report on actions taken to improve the visa process since 2002 and areas that need additional management attention.[Footnote 3] Results in Brief: State's Bureau of Consular Affairs has a set of internal controls to prevent visa malfeasance and has taken actions to improve them; however, these internal controls are not being fully and consistently implemented at the posts we visited. While State's controls are consistent with accepted control standards, we found noncompliance with required supervisory oversight of the visa process at 6 of the 11 posts we visited. This was manifested in a number of ways, including failure to (1) inventory accountable items used to issue visas, (2) independently review issued visas, and (3) follow State's established procedures when post officers refer applicants for expedited visa adjudication. Lack of full compliance with internal controls increases vulnerability to visa malfeasance. Consular Affairs recently strengthened its headquarters' oversight of post visa operations. For example, it established a headquarters unit to monitor visa adjudications. However, State has not developed software to sort and analyze abnormalities in visa issuances that could indicate potential malfeasance, but is in the process of doing so. This stronger oversight should help strengthen compliance with internal controls. According to the Bureau of Diplomatic Security, it substantiated 28 cases of alleged employee visa malfeasance between 2001 and 2004. The suspects were fired, chose to resign, or were arrested. Investigators from State's Bureau of Diplomatic Security could not tell us how many opened cases were referred to Justice for possible prosecution because they had not been routinely collecting that information. In fact, their case records did not allow for production of data on case trends, such as vulnerabilities in the visa process, which would be useful to consular managers. Justice's Public Integrity Section successfully prosecuted 10 government employees during this time period.[Footnote 4] Justice and State Diplomatic Security officials noted that prosecutions were impeded by legal constraints on evidence gathering. In particular, these officials said that it is difficult to investigate and prosecute visa malfeasance because other employee witnesses may not report their suspicions until they are reassigned to another post, and this delay makes the timely collection of evidence difficult. Furthermore, according to Justice and State, conducting investigations overseas is cumbersome for various reasons. For example, according to Justice, some host country laws can make it difficult for investigators to obtain financial records of U.S. employees residing overseas. Also, under U.S. law, U.S. magistrates generally cannot issue warrants for U.S. investigators to search an employee's office or leased residence overseas. Justice and State have discussed for some time the possibility of pursuing additional search authorities to address these constraints, but have not determined a course of action. To emphasize the importance of internal controls to consular officers, section heads, and post managers, we recommend that the Secretary of State: * Develop a strategy to achieve strict compliance with internal controls. The strategy should include a system to spot check compliance. The strategy should also include formalized procedures in Fraud Prevention Units to document how the post will address the risk of employee malfeasance and emphasize the importance of reporting suspected malfeasance to consular managers and post security officers. * Improve State's existing mechanisms to combat visa malfeasance. This could be accomplished by (1) improving the software available to the Vulnerability Assessment Unit to automatically sort data to identify and analyze abnormalities in post visa issuance statistics that could be an indication of malfeasance and (2) enhancing the investigative case tracking systems used by the Bureau of Diplomatic Security to better identify trends and vulnerabilities in the visa process for use by investigators and consular managers. We also recommend that the Secretary of State and the Attorney General determine whether seeking additional overseas search authorities is warranted to facilitate investigations of visa malfeasance. If they determine that such authorities are warranted, the Secretary of State and the Attorney General should develop an implementation plan and notify the Congress of any required legislative changes. State agreed with the conclusions in our report, is taking steps to reinforce and monitor compliance with internal controls at overseas posts, and plans to implement our recommendations. Background: Foreign citizens wishing to temporarily enter the United States generally fill out a visa application; make an appointment; pay a fee; submit photographs and other documents; provide 2-digit fingerprints; and appear for a document review, name check against government watch lists, and interview with a State consular officer at an American Embassy or Consulate. Consular officers review applications, interview applicants, execute name checks through the Consular Lookout and Support System,[Footnote 5] make notations, and assess whether the applicant may be an intending immigrant, a potential threat to national security, or otherwise ineligible. Following these steps, the applicant is granted or refused a visa, or subjected to additional security checks. (See fig. 1.) Consular officers are assisted by locally hired staff who are generally not U.S. citizens. These staff perform support tasks but do not adjudicate visas. Figure 1: The Nonimmigrant Visa Process: [See PDF for image] [End of figure] The Bureau of Consular Affairs considers the visa process to be a major element of national security. In addition to guidance on visa processing, State provides visa adjudicators, who are typically entry- level officers, with specific guidance and training on examining applicants' documentation, interviewing, and screening out applicants who may pose security concerns. This guidance is provided in the Foreign Affairs Manual and the Consular Management Handbook, as well as through periodic policy updates of standard operating procedures transmitted to overseas posts and placed on an intranet site. While the Office of the Inspector General and Diplomatic Security share authority for investigating visa malfeasance, Diplomatic Security conducts most of the investigations. In particular, Diplomatic Security's Visa Fraud Branch investigates visa malfeasance cases and carries out related enforcement functions for State. These cases are typically pursued by a regional security officer and consular management and involve observation of the suspected employee and collection of evidence to document the malfeasance. In cases where Justice determines sufficient evidence exits, it will prosecute employees who are accused of malfeasance. Consular Affairs Has Internal Controls over the Visa Process, but Controls Are Not Being Fully Implemented at Posts GAO Reviewed: The Bureau of Consular Affairs has established a number of key internal controls designed to mitigate the risk of employee malfeasance, some of which are new or have been reinforced since September 11, 2001. Among the controls State has emphasized are: limiting employee access to visa issuing systems and applicants, periodic reconciliations of visa stocks, specific criteria for post employees to follow when referring foreign individuals seeking visas for favorable treatment by consular officials, and mechanisms to provide oversight of key consular activities by post and Consular Affairs headquarters management. While Consular Affairs' controls are consistent with accepted control standards,[Footnote 6] we found that some of the controls were not always being followed at the posts we visited. Internal Controls Are in Place, and Many Are Either New or Have Been Reinforced: To prevent the issuances of nonimmigrant visas to unqualified applicants, Consular Affairs has strengthened its efforts to limit employee access to automated systems that issue visas and has taken steps to ensure that visa applicants cannot predict which officers will interview them. Additionally, Consular Affairs has a series of controls over accountable items. It has also strengthened its criteria for applicants referred by post employees for favorable consideration in obtaining a visa and expedited processing by consular officers. Further, Consular Affairs has increased its emphasis on both headquarters and post supervisory oversight. It also requires posts to certify in writing annually their compliance with key internal controls. Consular Affairs has issued guidelines on reporting suspicious behavior that may involve malfeasance. It has also enhanced its malfeasance prevention efforts. Controlled Access to Visa Issuing Systems: The increased dependence of consular officers on automated systems requires Consular Affairs to have effective management controls over these systems. Consular Affairs has strengthened its existing controls over visa issuing systems by restricting employee access to key systems and safeguarding passwords, thereby emphasizing consular officers' accountability for visa issuance and providing an audit trail to document which officer issued each visa. For example: * The Consular System Administrator controls employees' access to the automated consular systems by assigning user identifiers and roles. Designated consular officers ensure appropriate access to consular automated functions; an administrator specifically assigns each consular employee a specific role; and the computer system only allows consular staff to perform functions associated with that role. For example, only officers that adjudicate visas are assigned a system role that permits them to authorize visa issuance. * In February 2004, Consular Affairs strengthened controls over access to employee computers by requiring that passwords be known only to the users and that they be changed semi-annually. In the past, employee passwords were assigned by the system administrator, but are now chosen by the employee. As an additional safeguard, employees are now reminded to lock their computers when not at their desks, and the system is set to automatically lock after an interval of idleness. * Consular Affairs controls access of applicants to visa adjudicators and consular staff. To prevent applicants targeting a particular consular officer, Consular Affairs requires that consular officers interview applicants in a random manner, with no single person controlling the process. When translators are used, they are to be rotated among the adjudicators. Controls over Accountable Items: To reduce the risk that blank visas will be stolen or that visas will be issued without being properly recorded in the consular systems, it is Consular Affairs' standard practice to safeguard blank visas and other accountable items, closely monitor usage, conduct frequent inventories, and reconcile discrepancies quickly. Each post must designate a primary and backup accountable consular officer to be responsible for controlled items. Further, Consular Affairs procedures require controlled items to be reconciled daily, verified quarterly, and certified annually by senior consular or post officials. At least quarterly, the accountability officer must physically count the stock of each accountable item and reconcile the inventory ledger, ensuring that the number of the item on hand in fact matches the number that the ledger indicates should be on hand. Discrepancies between inventory records and stocks of blank visas on hand that can not be resolved must be reported within 24 hours to Consular Affairs management. Criteria for Post-Referred Applicants: U.S. officers from any U.S. government agency posted at embassies and consulates may refer to the consular section for favorable consideration and expedited processing foreign applicants where visa issuance would support U.S. interests or those of the mission.[Footnote 7] This so-called visa referral is a means for other embassy officials to provide additional information on a visa case and to document a perceived U. S. national interest served in facilitating the travel of the applicant. According to a 2005 State Inspector General's report,[Footnote 8] embassy staff or prominent local figures often appeal to ambassadors or other mission managers for favorable consideration in obtaining visas, and consular officers have felt pressure to provide such assistance. To ensure that post staff refer visas only for qualified applicants, Consular Affairs has strengthened and formalized its criteria for issuing referred visas.[Footnote 9] Prior to 2002, posts individually interpreted the guidelines on making referrals and many posts did not have formal referral policies. In 2002, Consular Affairs required posts to establish a formal postwide referral system. Under this system, referral procedures are to be reissued annually, and supervisory consular officers are to periodically review referral activities, specifically noting frequency of referrals by officer as well as applicant return-to-country rates. Consistent with the new congressionally mandated biometric and interview requirements, the new referral criteria require: * fingerprinting and photos of all applicants and personal interviews of nearly all referred visa applicants, * mandatory use of revised referral forms, * certification that the applicant is personally known to the sponsor and presents no threat to national security, * supervisory approval of the referral request by the sponsor's supervisor, * scanning of applicant forms and referral requests into the nonimmigrant visa system to provide a record and an audit trail, and: * post management reviews of aggregate visa trends by referrer. Since 2002, Consular Affairs has repeatedly reiterated referral criteria in policy updates and clarifications to overseas posts. Moreover, during our review, in June 2005, Consular Affairs again revised the referral policy reiterating the need for senior consular officers to adjudicate Class A referrals and requiring posts to provide the Bureau of Consular Affairs copies of their referral policies. In addition, Consular Affairs said that it gives briefings to every ambassador, deputy chief of mission, and principal officer emphasizing the importance of strict compliance with the visa referral policy, that visa referrals are tracked, and that mission leaders bear responsibility and liability for their own referrals. Emphasis on Supervisory Oversight: Citing cases of consular malfeasance resulting from lax supervision over consular functions, Consular Affairs has continually emphasized the need for supervisory oversight of the visa function, particularly by ambassadors, deputy chiefs of mission, or principal officers. Depending on the size of the post, daily oversight is exercised by senior consular officers over nonimmigrant visa section chiefs (who supervise adjudicating officers and other consular staff) or by the most senior available post officer. Senior consular section chiefs, who generally adjudicate referrals or other visas at smaller posts, are supervised by senior post managers. Consular Affairs requires that supervisors review all visa refusals daily and perform spot-checks of issuances, as well as undertake periodic reviews of post referrals. Supervisors have tools to assist with this responsibility. For example, the Nonimmigrant Visa application allows on-line oversight through reports of consular activities, such as daily visa refusals and issuances, including the time of visa issuance; the applicants interviewed and their nationalities; and the types of visas issued, including those for visitors, students, businesspersons, professionals, and performing artists, as well as the reasons for denials. Additionally, reports providing aggregate information on the number and types of referrals made by each post officer and their disposition are available. A recent enhancement to the system permits supervisors to view applications and referral forms showing applicant's purpose of travel and whether the referral was signed appropriately and reviewed as required. Consular Affairs also has emphasized in cables and training the importance of ambassadors, deputy chiefs of mission, and principal officers' supervisory role in reviewing the visa function. According to State officials, training courses for these offices have included information on the consular function, oversight responsibilities, and employee malfeasance. According to State training records, the senior managers at six posts we visited had received this training. Certification of Internal Controls: To ensure that the internal controls over the visa process are being implemented, State requires that chiefs of mission certify annually that the controls are adequate.[Footnote 10] In addition, since September 2002, State has required that consular managers certify their compliance with key controls over the visa process to chiefs of mission and to Consular Affairs. Each year, posts are required to issue a report certifying their compliance with internal controls, including routine inventory counts of controlled items, established referral policies and procedures, and supervisory reviews of visa refusals and issuances. In October 2004, Consular Affairs required the review of 19 controls by each post. Assessing Visa Malfeasance and Reporting Suspicious Behavior: To safeguard the visa process, consular sections are required to assess post vulnerability to employee malfeasance.[Footnote 11] Posts are to identify internal visa malfeasance risks, such as inadequate oversight procedures, and to assess post vulnerability to external fraud, such as bribery.[Footnote 12] To assess this vulnerability, Consular Affairs has established Fraud Prevention Units at posts and designated Fraud Prevention Manager positions. The units are responsible for detecting suspected fraud by visa applicants as well as possible employee malfeasance, and coordinating with the regional security officer and local law enforcement authorities as necessary. The positions are often filled on a part-time basis by consular officers who are responsible for making vulnerability assessments along with their other duties.[Footnote 13] Consular Affairs also has guidance on reporting suspicious behavior. Employees are required to report suspicions of employee malfeasance to the senior consular manager at post and the regional security officer, unless one of them is believed to be involved in the malfeasant activity.[Footnote 14] Further, State's guidance on reporting malfeasance emphasizes the need to protect the integrity of an investigation and the commitment of confidentiality to the source of an allegation. As such, State's standard operating procedures call for potential malfeasance information to be closely held at post and in the department. Increased Headquarters' Oversight: With 211 visa issuing posts, State requires adequate and continuous oversight to reduce the risks of visa malfeasance.[Footnote 15] Headquarters management is an essential part of that oversight. To assist headquarters in monitoring post operations, State established the Vulnerability Assessment Unit (VAU) jointly staffed by Consular Affairs and Diplomatic Security. In addition, Consular Affairs established Consular Management Assistance Teams (CMAT). VAU, established in 2003, attempts to detect and prevent possible employee malfeasance by analyzing consular data from State's Consular Consolidated Database. VAU reviews several different reports for variations that could indicate malfeasance. Among other things, these reports and other information can (1) identify whether senior officers with responsibility for reviewing adjudications have access to automated systems to do required reviews of visa adjudications, as well as whether they are actually doing so; (2) determine whether post employees follow procedures and use appropriate forms to make referrals for applicants; (3) review issuance and refusal rates of adjudicators; and (4) review rates of visa refusals overturned by senior officers. In 2003, State instituted CMATs to perform informal reviews of consular functions. The teams, which are provided VAU reports on consular activities, examine access controls, inventory reconciliations, training and knowledge of consular applications, appropriate use of referral procedures, supervisory reviews of daily adjudications, and other visa issues. Posts are selected for CMAT examination if there is knowledge of a management problem and a review can help to identify a systemic problem, if posts request a review, or if there has been a previous case of malfeasance at the post. CMAT reports, which may include recommendations to improve post management, are sent to State's Bureau of Consular Affairs and to the posts. State has conducted 81 CMAT reviews, including reviews of several posts twice, since program inception. Internal Controls Not Fully and Consistently Implemented: Consular Affairs has established and reinforced a system of internal controls, described above, designed to reduce visa malfeasance risks; however, we found that the controls were not being fully and consistently implemented. All the posts we visited had limited employee access to systems and applicant access to consular staff. However, we found that inventory counts of accountable items were performed inconsistently. Further, the referral policy was not followed. Also, supervisory adjudication reviews were not performed consistently. Moreover, we found that some posts had certified compliance with these controls when we, and in some cases, CMAT teams, indicated that they were not in compliance. In addition, staff were unclear on employee malfeasance reporting policies. Finally, headquarters oversight has been hindered by the lack of enhanced technical tools to identify potential malfeasance. Table 1 summarizes the results of our review of internal controls over the visa process at the 11 posts we visited. Table 1: State Department Key Internal Control Requirements and Status of Implementation: Issue: Access to sensitive systems; Requirement: These controls restrict employee access to key systems, safeguard passwords, and require additional oversight over controlled items; Implementation: We found that all 11 posts were in compliance with the internal controls designed to prevent unauthorized personnel from having access to sensitive systems. Issue: Access to adjudicators; Requirement: Consular sections are to ensure random access between applicants and adjudicators; Implementation: When able, most posts have implemented the systems and procedures necessary to ensure random access between applicants and adjudicators.[A]. Issue: Control of accountable items; Requirement: Specific records must be kept regarding the shipment, use, and destruction of controllable items on a daily, quarterly, and annual basis; Implementation: Most posts did not reconcile the differences between inventory records and stocks of blank visas on hand quarterly as required, although daily reconciliations were routinely performed. Issue: Criteria for applicants referred by officers within the post; Requirement: Posts must establish a formal post-wide referral system, reissue the procedures annually, and ensure that the applicants meet the departmentwide criteria specified on the referral forms; Implementation: Compliance with State's referral policies and procedures were not consistently followed at seven of the posts we reviewed. Moreover, four posts did not have the required post policy supplementing State issued policies. Issue: Emphasis on; post supervisory oversight; Requirement: Supervisory reviews are required daily on all visa refusals and spot- checks of issuances, as well as monthly reviews of post referrals; Implementation: Required daily supervisory reviews of visa adjudications were not always done at six of the posts we visited. Issue: Certification of internal controls; Requirement: Chiefs of missions must certify annually that internal controls are adequate. These certifications are based on consular managers' assessment of the section's adherence to internal controls; Implementation: We found that six posts had erroneously certified their compliance with internal controls and some posts submitted incomplete certifications. Issue: Assessing visa malfeasance; Requirement: Posts are required to have fraud prevention programs to address visa fraud risks, including employee malfeasance risks. Moreover, Consular Affairs encourages posts to develop standard procedures for all consular functions; Implementation: Although posts told us they have fraud prevention programs, many posts did not have the plans documented. None of the posts indicated they had written procedures for mitigating malfeasance risks. Issue: Reporting of suspicious behavior; Requirement: Internal control standards require agencies to clearly establish areas of authority and appropriate lines for reporting malfeasance. Consular Affairs requires suspected malfeasance be reported to Consular Affairs Managers and the Regional Security Officer; Implementation: Many staff at the posts we visited were not aware that suspected malfeasance should be reported to the Regional Security Officer. This could compromise subsequent investigations. Issue: Increased HQ oversight; Requirement: Internal control standards require top level analysis of agency performance; Implementation: State has established two units that provide top-level management with information on post performance. Source: GAO. [A] Posts with one or two consular officers have difficulty ensuring random access to adjudicators. [End of table] Access to Visa Systems and Staff Controlled: To reduce the risks of visa malfeasance, all the posts we visited had complied with department directives to limit employee access to visa issuing systems. This compliance ensured that employees only had appropriate level access to accomplish their responsibilities. We also observed at all posts that consular staff did not have exposed passwords at their workspace, and they logged off systems each time they left their desks. Moreover, most posts ensured that applicants did not have access to consular sections and that consular staff and applicants were interviewed in a random manner. Inventory Reconciliations Performed Inconsistently: To prevent malfeasant issuance of visas, Consular Affairs requires that blank visas (visa foils) be counted and safeguarded along with other controlled equipment.[Footnote 16] We found that not all posts reconciled visa inventories as required. Seven posts had not conducted quarterly reconciliations as required, although posts did routinely perform daily reconciliations. Moreover, some posts had certified that they had complied with inventory controls when they had not, and other posts did not accurately characterize their compliance. For example: * At one post, the accountable consular officer was absent and the back up officer did not have the combination to the controlled area. Therefore, we could not review inventory logs nor could the backup perform the required daily reconciliation. * Two posts had discrepancies in their monthly reconciliations due to miscounting. At one post, this discrepancy was discovered later when the post prepared for a CMAT review. Referral Policy Not Followed: A referral is also a useful foreign policy tool. However, if it is not implemented properly, it could create risks in the visa process by allowing expedited visa processing for potentially unqualified applicants to enter the United States. We found problems with the implementation and monitoring of referrals at seven posts. Moreover, in 2002, an Inspector General Report cited several instances where malfeasant employees sold referrals and recommended strengthening the nonimmigrant visa referral policy. The cases cited by the Inspector General involved Drug Enforcement Administration and Department of Commerce employees, but sales of referrals by State employees have also occurred.[Footnote 17] Consular Affairs has issued and reinforced guidance on referrals to posts three times since 2002. However, the Inspector General noted in March 2005 that the Bureau of Consular Affairs needed to be better informed of referral procedures in place at overseas posts. The report cited concerns that not all posts were following State guidance and recommended that posts verify that applicants had returned at the end of their authorized stay in the United States.[Footnote 18] State subsequently required posts to conduct periodic studies on whether referred applicants left the United States before their visa expired. State requires that all posts have a referral policy that defines specific criteria referred applicants must meet. The post policies are intended as a supplement to overall Consular Affairs guidance on referrals. As a further safeguard, referrals must be (1) adjudicated by senior consular officers, (2) reviewed by supervisors, and (3) monitored by post management.[Footnote 19] Class A referents,[Footnote 20] generally high-level foreign government, business, or cultural officials, are fingerprinted and undergo a document review but do not have to be interviewed by the consular section.[Footnote 21] We found that four posts did not have a current post-specific referral policy. Furthermore, based on our spot-checks of visa referral records, there was no evidence at six posts that some supervisors had performed the required reviews. In fact, at three of these posts, the supervisors, principal officers, or deputy chiefs of mission were not enabled to access the systems designed to permit and document supervisory review. Consular Affairs indicated that it encourages supervisors to document their review within the consular computer system. Our review of referral forms and applications revealed that not all referred applicants met State's referral criteria. For example, * A senior consular officer at one post issued referrals that did not meet Class A criteria, including approving referrals for the secretary of a foreign official and the adult children of foreign officials on personal travel, when only minor children accompanying the official qualify. * One post could not identify the individual who had made a referral. The recent referral was approved by the consular section in February 2005. The individual making the referral did not appear on the post roster, and the post agency where the referrer was assigned could not identify the individual at the time of our visit. U.S. personnel not under the authority of the Chief of Mission cannot use the referral system, according to Consular Affairs. As a result, the post was unable to verify that the referral was legitimate. To monitor the referral process, State requires consular managers to review referral adjudications daily (as they do other issuances) and to annually examine 12 months of referrals for anomalies. To comply, all posts had prepared, as required, executive management aggregate reports of referrals by employee. Our review of these aggregate reports indicated no abnormalities; however, when we reviewed individual referral and applicant forms available online, we found that referrals had not been submitted or adjudicated appropriately. For example: * One referral was made by a local employee, when only U.S. officers at the post are allowed to make referrals. * At one post, a referral was made and adjudicated by the same officer. Consular officers may not refer and approve the same applicants for visas. This referral was for a cousin of a consular section employee, and consular officers are not allowed to adjudicate matters involving friends. * Three posts had incorrectly used the Class A referral for local employees on personal travel. State permits Class A referrals for locally employed staff only for official travel. Supervisory Adjudication Reviews Inconsistent: Nonimmigrant Visa chiefs are to review daily all refusals and a sample of issuances.[Footnote 22] When visa section chiefs adjudicate, senior consular officers are to perform the reviews, while at small posts with one or two consular officers, the deputy chief of mission, principle officer, or other senior post staff are to do so. State policy recommends on-line reviews, but permits paper reviews as well. Reviewers have an automated system that provides management reports that would reveal anomalies in consular officer visa issuances. However, we found little evidence that reviews were being undertaken consistently at the posts we visited. For example: * Six posts did not consistently perform State required daily reviews of visa issuances and refusals. For example, at one post a review of the Nonimmigrant Visa system showed that required daily reviews had not been done for a month. * At one post, with the consular section located in a different building from the embassy, we saw several months of visa adjudications on the floor awaiting review by the deputy chief of mission. * A review of Nonimmigrant Visa adjudication reports at the posts we visited showed that some posts consistently reviewed daily visa applicant refusals, but did not follow Consular Affairs' policy to spot- check daily visa issuances. Certification of Internal Controls May Not Disclose Shortcomings: Due to inaccurate or incomplete submissions, the certifications of consular management controls may not provide the level of assurance desired that internal controls are being followed. For example: * Seven of the posts we visited had not conducted quarterly reconciliations, as required, although five had certified compliance with inventory controls. The October 2004 CMAT reviews of two of these posts had found similar problems, noting that required inventory controls had not been reconciled on a quarterly basis, although all had routinely performed daily reconciliations. * Some posts submitted the required certifications but did not indicate whether they were in compliance. Two posts, for example, reported reviewing controlled items, but did not note whether they were reconciled. Staff Unaware of Malfeasance Reporting Procedures: Many consular staff at most posts were aware that they should report suspected visa malfeasance but did not know the appropriate reporting procedures. Internal control standards require agencies to clearly establish areas of authority and appropriate lines for reporting. State policy requires that suspicions of malfeasance at posts be reported to Consular Affairs' consular section chiefs and Diplomatic Security's regional security officers, unless they are the subject of the allegations.[Footnote 23] In practice, most consular staff we spoke with said they report suspicions of consular malfeasance up their chain of command.[Footnote 24] If suspected malfeasance is not promptly reported to the regional security officer, subsequent investigations could be affected. In August 2005, Consular Affairs and Diplomatic Security provided more explicit guidance to the field on the actions that posts, in particular consular and security officers, must take in the event they suspect or uncover malfeasance. Headquarters Oversight Hindered by the Lack of Enhanced Technical Tools: Consular Affairs' headquarters oversight unit, the VAU, does not have adequate tools to assist their review of the visa process to identify fraud trends. The Consular Consolidated Database contains various reports that provide information on daily visa issuances, denials, and referrals by consular staff. Currently, the VAU can only recall this information on an ad-hoc basis, which is time consuming for the two staff assigned to the unit. For example, it took several hours for us and a VAU staff to review two categories of data--assigned roles allowing post staff to use consular databases and whether daily reviews of visa refusals and issuances were being conducted at five posts. Moreover, the unit has no automated means to sort data and generate reports that flag unusual variances in visa issuances or to track trends. As a result, the unit is currently reactive, focusing its research on supporting allegations and investigations of malfeasance and generating reports on individual post consular activities in preparation for CMAT team visits to posts. Unit officials indicated that they are working toward developing a more proactive approach to malfeasance analysis that will allow automated searches of anomalies, fraudulent or not, through a more efficient data mining and search capability. The new capability will include identification of consular activity outside of normal operating patterns, unusual timing of issuances, adjudications made by someone unauthorized to do so by controlled systems, and overrides of visa refusals, and would also result in further inquiry into the anomalies. Consular Affairs indicated that the software enhancements' usefulness would be tested beginning in late September 2005. Documented Cases of Visa Malfeasance: Between 2001 and 2004, Diplomatic Security substantiated through investigation 28 cases of U.S. employee visa malfeasance that resulted in various actions.[Footnote 25] In examining these case files, we could not discern why the malfeasance occurred in part because the data were not contained in Diplomatic Security case files or because in some instances the case was ongoing. However, in examining case data on several prosecuted cases, we found that a breakdown in post adherence to internal controls could have been a contributing factor. Several factors impede visa malfeasance investigations, including differences in U.S. and foreign laws, investigative techniques, and other issues. Malfeasance prosecutions also face several impediments. Nature and Substance of Malfeasance Allegations: Cases are opened only for those allegations found to be supported by some evidence, even if that evidence is eventually determined to be unreliable. Allegations of visa malfeasance, initiated from tips or reporting of suspicious activity, are vetted through post security officers and investigated when warranted. According to Diplomatic Security Investigators, the investigative process can result in several outcomes: * unfounded, with no reliable evidence found to support the allegation; * unsubstantiated, with some evidence found that might indicate wrongdoing, but not sufficient to establish culpability and build a criminal case; or: * substantiated, with sufficient evidence found to support the allegation of malfeasance. Substantiated cases lead to further investigation and typically result in resignation, termination, arrest, or referral to Justice for criminal prosecution. The 28 substantiated cases of visa malfeasance between 2001 and 2004 resulted in various dispositions, according to Diplomatic Security records. Thirteen investigations resulted in arrests, 13 resulted in termination of the employee, and 2 resulted in employee resignations. Generally, the officers involved in these cases were arrested and the majority of Foreign Service Nationals were terminated. Most of the 28 cases we reviewed involved the alleged sale of visas by both consular and other post officers and Foreign Service nationals. However, possibly because the information provided was not complete, we could not identify any particular trend in the cases we reviewed covering 2001 to 2004 or in the 28 cases that were substantiated. Diplomatic Security does not have the capability to automatically pinpoint specific types of visa malfeasance or perform trend analyses. As a law enforcement entity, Diplomatic Security and its regional security officers overseas focus on gathering sufficient evidence to substantiate the allegation and do not focus on what allowed the alleged activity to occur. Consequently, in reviewing the information provided, we could not consistently determine across cases, for example, how the alleged malfeasance was discovered, the exact nature of the malfeasance, the rank of the individual allegedly involved in the malfeasance, and whether similar allegations were made when the individual was at other posts. This type of information would benefit investigations and could be a tool for consular management's monitoring and training efforts. Diplomatic Security officials acknowledged this capability would be useful but noted that progress in developing this capability has been slow because Diplomatic Security has other priorities. Of the 28 cases substantiated, at least 10 individuals have been prosecuted.[Footnote 26] The individuals prosecuted received prison terms ranging from 18 to 63 months, and two individuals were given probation. In some of these cases, it appeared that the lack of adherence to internal controls could have played a role in allowing employee malfeasance to go undetected for a considerable period of time. Consular officials indicated that strict compliance to internal controls could not prevent malfeasance. However, they acknowledged that lack of strict compliance could create an environment that would make it easier to commit malfeasance. The following are examples of visa malfeasance or alleged visa malfeasance and how lack of strict compliance with internal controls may have been a contributing factor in creating an environment where the malfeasance could take place. * Consular Affairs requires supervisors to review reports on visa refusals and issuances to detect anomalous activity.[Footnote 27] Between 2000 and 2003, two consular employees at one post sold visas to unqualified applicants. Diplomatic Security said it did not know how many visas were sold. However, 181 visas were revoked after the malfeasance was discovered. Diplomatic Security believes that many of the persons with revoked visas had already entered the country. We believe that strict compliance with internal controls could have identified this malfeasance earlier. Applicants for nonimmigrant visas generally apply at an embassy or consulate with jurisdiction over their place of normal residence, although they are not required to do so. However, in this case, there were a large number of third country nationals receiving visas from the same officer. Supervisory review of the issuances to the third country nationals or review of a standard report on visa issuances could have alerted management to this unusual activity. The consular officer ceased the illegal activity following a supervisory reprimand but soon was able to resume selling visas. The convicted employees received a 63-month sentence and forfeited $750,000 in illicit gains. * Consular managers are required to continually oversee visa functions and suspicions of malfeasance must be examined carefully. Between 2000 and 2002 a senior consular officer at a small post accepted fraudulent applications and documents from a visa broker, issued them outside the normal process, and returned visas to the broker. After a supervisory reprimand, the officer revised the fraud scheme and conspired with the broker to approve visas for applicants with false passports. The officer received money for processing 85 visas, was convicted, and received a 24-month sentence. During the course of our work, State reported another case of visa malfeasance where we believe that lack of strict compliance with internal controls could have been a contributing factor. State requires consular and post management to periodically review referral activities and check on the return rates of applicants receiving a visa. Between 1999 and 2001, a State political officer at a small post allegedly referred unqualified applicants for visas, according to a State press release issued in April 2005. In the absence of the senior consular officer, the political officer was also responsible for visa adjudications and allegedly provided blank visa applications to an individual, assisted in filling them out, and then issued them to unqualified applicants. In return for these services the officer allegedly received a vintage BMW motorcycle. The officer was arrested in 2005. Consular Affairs emphasized that although some of its officers have engaged in visa malfeasance, other U.S. government employees and Foreign Service nationals have as well. Between 2000 and 2001, a U.S.- based Foreign Agricultural Service officer recommended 99 unqualified applicants and was able to influence the visa process through his recommendations and the submission of fraudulent documents, according to court documents. In exchange, the officer received bribes totaling $77,400. The officer, who was given the names of ineligible applicants by visa brokers,[Footnote 28] provided the applicants, on U.S. Department of Agriculture letterhead, letters stating that the individuals were agricultural specialists invited to the United States for official meetings. The officer then sent follow-up faxes to posts confirming the invitations. The individuals, who all listed the same destination address, presented the letters at embassy visa offices and unlawfully obtained visas. The officer was sentenced to 21 months in prison for participating in the visa malfeasance scheme. Factors Affecting Visa Malfeasance Investigations: Visa malfeasance investigations are impeded by several factors, according to Diplomatic Security officials, including untimely reporting of alleged visa malfeasance. The ability to gather evidence is adversely affected, for example, when allegations are made several years after the alleged malfeasance occurred and witnesses have been reassigned, or are unavailable. In particular, entry-level officers, fearing reprisal, may delay reporting malfeasance until after they have been reassigned to a new post, according to State officials. In such cases, reconstructing the actions constituting any malfeasance is difficult because years may have passed since the incident occurred. When visa malfeasance occurs overseas, differences in legal systems can pose obstacles to investigators. Local laws may not permit the use of U.S. investigative techniques such as recorded conversations, undercover operations, or interrogation of suspects, according to Diplomatic Security officials. Additionally, according to Diplomatic Security investigators, investigations of local employees may be complicated due to differences in U.S. and foreign laws. According to Diplomatic Security officials, bribery is not a criminal offense in some countries and therefore it is difficult and sometimes impossible to obtain local warrants for searches in these countries. Conflicting priorities may also impede evidence gathering. For example, at one post, the Diplomatic Security investigator noted that he had to concentrate on ensuring the security of the post and was not able to devote adequate attention to investigating a recent allegation of visa malfeasance.[Footnote 29] Diplomatic Security officials confirmed that protecting personnel and infrastructure is the first priority of post security officers. Additionally, when malfeasance is suspected, Consular Affairs' and Diplomatic Security's differing objectives may affect evidence gathering. Diplomatic Security officials abroad and in headquarters, as well as Justice officials, all noted that documenting the illegal activity and gathering a sufficient amount of evidence to make a criminal case often requires allowing the suspect to continue working, unaware of the investigation. Consular Affairs noted that when this occurs, consular management closely reviews the suspect's adjudications and monitors his or her activities to prevent issuances to ineligible applicants. However, Consular Affairs management interviewed on this issue expressed a preference for removing suspected individuals from their positions as quickly as possible. At one post, the ambassador, at the recommendation of the senior consular officer, took action to remove an employee under investigation in order to stop even the possibility that a visa could be issued to an ineligible applicant, thereby ending the covert investigation. As a result, a criminal case could not be developed, and the employee was dealt with administratively and was fired. Malfeasance Prosecutions Face Impediments: Justice's efforts to prosecute malfeasance are limited by a range of factors, including the inability to use U.S. warrants to search U.S. employees' offices and residences overseas, according to Justice. U.S. magistrates generally cannot issue warrants for overseas searches. Further, Justice officials noted that they only accept for prosecution cases with sufficient evidence to warrant convictions. Under Rule 41 of the Federal Rules of Criminal Procedures, U.S. magistrates do not have the authority to issue search warrants for locations outside their districts, such as an embassy or residence overseas.[Footnote 30] According to Diplomatic Security officials, the ability to obtain U.S. search warrants, rather than relying on local warrants issued and executed by the host government, is important since investigations of visa malfeasance generally focus on embassy property or diplomatic residences. The U.S. mission[Footnote 31] and the residences of certain U.S. diplomats in country are inviolable, which means that agents of the host government may not enter the premises without the consent of the head of the mission, according to State officials. State officials also told us that the United States will never waive inviolability for the U.S. mission, and, therefore, investigators could not rely on a host country's warrant to search an employee's office at the U.S. mission. However, in certain instances, State officials said that they would waive inviolability for the personal residences of U.S. diplomats, located outside the U.S. mission. In instances where inviolability is waived, the United States can use current tools, such as letter rogatories[Footnote 32] and Mutual Legal Assistance Treaties, to request that a host government issue and execute a search warrant under the host government's laws. Nonetheless, Diplomatic Security officials cited many difficulties they say can arise when using these tools. For example, according to these officials, differences between the United States' and some host government's techniques in gathering evidence can affect the admissibility of that evidence in U.S. courts. As a result of these and other difficulties, diplomatic security officials told us that they do not often utilize these tools to obtain local search warrants. In discussing with State and Diplomatic Security officials the possibility of obtaining additional search authorities under U.S. law, these officials raised issues regarding the magnitude of the need, as well as concerns over sovereignty and reciprocity. For example, Diplomatic Security officials indicated that in approximately six cases in the past year they would have wanted to conduct searches of employee residences and offices in connection with suspected visa malfeasance. State officials raised concerns that should the United States execute U.S. search warrants overseas, host governments could view this as a challenge to their sovereignty. Further, if the United States were to execute U.S. warrants overseas, the question arises whether the United States would have to extend the same privilege to foreign governments to execute their own warrants here in the United States. Conclusions: A visa system that is beyond reproach, with strong internal controls to protect against consular malfeasance, is critical to ensuring the integrity of visa decisions, national security, and U.S. immigration objectives. There is no way to prevent applicants from offering bribes; therefore, State recognizes that along with the integrity of its employees, an effective internal control program is needed to guard against employee malfeasance. Established internal controls make it more difficult for an employee to commit visa malfeasance. State has established a system of internal controls. However, at the posts we visited, we found that compliance with some of these internal controls was inconsistent. This increases the risk of visa malfeasance. Furthermore, most consular staff we spoke with did not know the appropriate way to report suspicions of employee visa malfeasance, which could hinder investigations. A further weakness to investigations is the lack of data on allegations and investigations to identify vulnerable points in the visa process. Finally, U.S. investigators cannot obtain a U.S. search warrant to search the offices or residences overseas of employees, which, according to Justice and Diplomatic Security officials, affects their ability to gather evidence in malfeasance cases. However, there are numerous factors that would need to be considered in pursuing additional search authorities. Recommendations for Executive Action: To emphasize the importance of internal controls to consular officers, section heads, and post managers, we recommend that the Secretary of State take the following two actions: * Develop a strategy to achieve strict compliance with internal controls. The strategy should include a system to spot check compliance. The strategy should also include formalized procedures in Fraud Prevention Units to document how the post will address the risk of employee malfeasance and emphasize the importance of reporting suspected internal malfeasance to consular managers and post security officers. * Improve State's existing mechanisms to combat visa malfeasance. This could be accomplished by (1) improving the software available to the Vulnerability Assessment Unit to automatically sort data to identify and analyze abnormalities in post visa issuance statistics that could be an indication of malfeasance and (2) enhancing the investigative case tracking systems used by the Bureau of Diplomatic Security in order to better identify trends and vulnerabilities in the visa process for use by investigators and consular managers. We also recommend that the Secretary of State and the Attorney General determine whether seeking additional overseas search authorities is warranted to facilitate investigations of visa malfeasance. If they determine that such authorities are warranted, the Secretary of State and the Attorney General should develop an implementation plan and notify the Congress of any required legislative changes. Agency Comments and Our Evaluation: We provided a draft of this report to the Departments of State and Justice. The Department of State provided written comments, which are included in appendix II. State concurred with our conclusions and recommendations and has begun taking actions to improve and monitor posts' adherence to internal controls. Specifically, the department said it will review and approve post referral policies, and it has established an ombudsman to ensure that there is no undue influence on consular officers to issue visas. To monitor compliance with internal controls, the department plans to establish an automated control system for controlled items, field test an automated data mining system of consular activities, and launch a worldwide fraud case tracking system in 2006. Lastly, the department said it will work with the Attorney General to determine if additional authority for overseas searches of employees' residences and offices is warranted and, if so, how it could best be achieved. Justice did not comment on our recommendations, but provided technical comments, which we incorporated in the report as appropriate. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its issue date. At that time, we will send copies of the report to relevant congressional committees and subcommittees, the Secretary of State, the Attorney General, and other interested parties. In addition, this report will be available at no charge on the GAO Web site at [Hyperlink, http://www.gao.gov]. If you or your staff have any questions about this report, please contact me at (202) 512-4128. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. Sincerely yours, Signed by: Jess T. Ford: Director, International Affairs and Trade: [End of section] Appendix I: Scope and Methodology: The scope of our work covered the visa application and adjudication process at selected U.S. Consulates and Embassies overseas. To assess the policies and procedures governing visa operations, we obtained copies of written procedures and interviewed officials from the Bureau of Consular Affairs. At the embassies and consulates we visited, we interviewed foreign service nationals, foreign service officers, adjudicating officers, the Nonimmigrant Visa section chiefs, the consular section chiefs, and the deputy chiefs of mission or principal officers. When available, we also interviewed consuls general and ambassadors. To assess the internal controls designed to prevent the illegal provision of visas, we asked State to identify the policies, procedures, and key internal controls governing visa operations. State identified a number of key internal controls, and, in particular, identified the Consular Management Handbook (Chapter 600), their Standard Operating Procedures, and the relevant sections of the Foreign Affairs Manual as sources for these controls. We obtained and examined the Department of State's Consular Management Handbook, Standard Operating Procedures, key sections of the Foreign Affairs Manual, and documents related to how the department develops and enforces standards of conduct for visa adjudication officers from the department's Bureau of Consular Affairs. To determine if supervisors were reviewing records of visa issuances, we reviewed on line reports at posts and at the Vulnerability Assessment Unit (VAU). To assess whether the key internal controls were being followed, we examined post records for the year preceding our visit, except in the case of referral policies, where we examined judgmental samples of four months of referrals at each post. We visited 11 consular posts in six countries to observe and verify the implementation of the key internal controls. These posts are Nogales, Guadalajara, and Mexico City, Mexico; Quito and Guayaquil, Ecuador; Lima, Peru; Ho Chi Minh City and Hanoi, Vietnam; Bangkok and Chiang Mai, Thailand; and Mumbai, India. To select the posts to visit, we reviewed overall post staffing data and issuance rates and selected posts that had both large and small staffing levels with varied experience. Selected posts performed a varying amount of adjudications, and some had regional responsibilities for fraud detection and investigations. Some posts had also undergone internal reviews and permitted examination of external oversight functions. Lastly, some posts selected had been the subject of fraud allegations, enabling the review of investigative procedures. Our reported results apply to the posts we visited, and we cannot generalize the results to posts not visited. To assess the nature and extent of malfeasance, we examined records provided by State's Bureau of Diplomatic Security on investigations of visa malfeasance involving employees between 2001 and 2004. We reviewed 140 cases collected by Diplomatic Security covering alleged visa malfeasance involving employees over the last 4 years. The cases reviewed represented 2004, 2003, and 2002, as well as prominent, but not all cases from 2001. The reports included information on the types of employees being investigated for visa malfeasance, such as U.S. Foreign Service officers, and employees of other U.S. government agencies overseas and locally hired staff. Diplomatic Security does not maintain automated data on employee malfeasance, and it obtained these reports for us by reviewing its files on all types of visa fraud and identifying those where employee malfeasance was involved. While Diplomatic Security reported that it made its best efforts to obtain complete data from 2002 through 2004, it could not assure us that it had identified every case that had been opened and involved employee malfeasance. These data covered 2001 to 2004 because this was the most recent information available. However, there were a number of limitations in these data. For example, the information available did not include a comprehensive set of allegations, nor completely describe the nature of the fraudulent activity under investigation. We determined that these data were sufficiently reliable to provide details on approximate figures of the employee malfeasance cases that were opened, as well as details about the types of cases. We also obtained information from the Department of Justice on visa fraud prosecutions by the Public Integrity Section conducted between January 2001 and March 2005. These data allowed us to determine how many cases this office in Justice has pursued in the last 4 years, as well as the status or outcome of those cases. Additionally, we interviewed officials from State's Office of the Inspector General, Consular Affairs' Office of Fraud Prevention, and its VAU. We observed VAU officials as they conducted their analysis and queries. We interviewed the fraud prevention staff and management at all the embassies and consulates visited, and also interviewed the Regional Security Officers and Assistant Regional Security Officers/Investigators at all posts where such officers were posted and available. To determine how State and Justice interact to investigate suspicious activity and allegations of employee malfeasance, we interviewed officials from State's Bureaus of Consular Affairs and Diplomatic Security, and Justice's Criminal Division, Public Integrity Section, and the Executive Office for United States Attorneys. We conducted our work from August 2004 through July 2005 in accordance with generally accepted government auditing standards. [End of section] Appendix II: Comments from the Department of State: United States Department of State: Assistant Secretary and Chief Financial Officer: Washington, D.C. 20520: Ms. Jacquelyn Williams-Bridgers: Managing Director: International Affairs and Trade: Government Accountability Office: 441 G Street, N.W. Washington, D.C. 20548-0001: SEP 22 2005: Dear Ms. Williams-Bridgers: We appreciate the opportunity to review your draft report, "BORDER SECURITY: More Emphasis on State's Consular Safeguards Could Mitigate Visa Malfeasance Risks," GAO Job Code 320298. The enclosed Department of State comments are provided for incorporation with this letter as an appendix to the final report. If you have any questions concerning this response, please contact Diane Bean, Senior Advisor, Visa Office, Bureau of Consular Affairs, at (202) 663-1155. Sincerely, Signed by: Sid Kaplan (Acting): cc: GAO - John Brummet; CA - Maura Harty; State/OIG - Mark Duda: Department of State Comments on GAO Draft Report: BORDER SECURITY: More Emphasis on State's Consular Safeguards Could Mitigate Visa Malfeasance Risks (GAO-05-931, GAO Code 320298): Thank you for the opportunity to respond to the report entitled Border Security: More Emphasis on State's Consular Safeguards Could Mitigate Visa Malfeasance Risks. We appreciate the GAO's recognition that the State Department has strengthened internal controls to guard against employee malfeasance in recent years. We are disappointed that during its own investigation, the GAO found individual cases of non-compliance with those controls, but we will use these findings to supplement plans already underway to improve even further our monitoring of the visa function and to guard against malfeasance. With respect to the individual areas the GAO addressed, we are pleased that the GAO determined all posts properly controlled access to sensitive consular systems and, by randomizing interview officers, prevented visa applicants from targeting particular visa adjudicating officers. Regarding GAO's observation that some posts did not perform the required quarterly reconciliations of controlled consular items, we note only that the daily reconciliations, which the GAO found to be performed by every post, are the most critical reconciliations in spotting inventory problems and investigating or resolving them before they continue. The quarterly reconciliations are redundant; we suspect this is the reason some were not done. Still, we will certainly remind consular managers that controlled items need to also be reconciled quarterly, as required in the Consular Management Handbook. The GAO's conclusion that some posts did not strictly follow referral procedures is of great concern to the Department. The referral process is a foreign policy tool by which any officer in a mission overseas can request expedited visa processing for an important official contact, whose travel to the United States is in the national interest. Consular officers are usually pleased to offer this service to facilitate the travel of important USG contacts and as a professional courtesy to embassy colleagues. The Department has long recognized that the referral process could be subject to abuse or undue influence by senior mission officers and must be strictly controlled, and has, as the GAO observed, issued repeated guidance and strengthened procedures on what posts must do to institute an effective referral program that is free from fraud, malfeasance or undue influence. In addition, we have instituted a requirement that post-specific referral policies be reviewed by the Visa Office before being issued at post and have designated a senior consular officer as an ombudsman to handle instances of real or perceived undue influence on the visa process. Even though minor violations of established referral procedures may not be seen at posts to have a negative impact upon U.S. visa integrity or security, the Department seeks strict compliance with referral policies. In recent. years CA has emphasized to all new ambassadors, deputy chiefs of mission and principal officers their responsibility for strict adherence to the Department's and the post's referral policies, which --as noted above --must be submitted to the Department for approval. In light of the GAO's observations, the Department will explore ways to reinforce this message further. The Department is similarly concerned about post and consular managers who fail to review daily visa adjudications properly, who erroneously certify compliance with internal controls, or who submit incomplete certifications. The Department will seek ways to remedy these lapses, including the increased use of enhanced technology to ensure compliance, as explained below. Finally, with respect to assessing visa malfeasance at posts and reporting suspicious behavior, the Department acknowledges that there is always room for improvement in fighting malfeasance. The Department is committed to ensuring the integrity of the visa process and has unambiguously stated and frequently reinforced its zero tolerance policy toward employee visa malfeasance. We have repeatedly directed our missions to be vigilant in investigating and reporting malfeasance, most recently in August 2005. That cable is attached to this letter as Exhibit 1. So far in 2005, four USG employees have been arrested for visa malfeasance. Malfeasant activity has occurred in a variety of sections in missions large and small. When visa malfeasance is suspected overseas, the Bureau of Diplomatic Security (DS), through its Regional Security Officers (RSOs), and CA, through its consular managers overseas, work closely together. The RSOs take the investigatory lead, under the direction of DS at headquarters, in coordination with CA, to determine how best to proceed in a manner that permits evidence to be developed while controlling further malfeasant activity by the suspect. If allegations are substantiated, the Department will take appropriate actions against the employee(s) involved, including dismissal or criminal prosecution if warranted. Prevention and prosecution of fraud and malfeasance is a priority for the Department. There are now 25 high-fraud posts with DS personnel who are focused solely on criminal investigations of visa and passport fraud and employee malfeasance. An additional three new posts and nine more local investigators are being proposed using new fraud prevention fees collected under the provisions of the "L-1 Visa and H1-B Visa Reform Act of 2004." In addition, under the Intelligence Reform Bill of 2004, DS is establishing a new analytical unit to develop and disseminate information on terrorist travel, document vendors, etc. The analysts in this new unit will also document all types of fraud trends, including case studies and analysis of recent malfeasance cases. Analytical personnel have already been hired and the establishment and training of this unit should be completed by late 2005. We note, however, that such measures will supplement, not replace, the vigilance and insight of officers on the ground. Most employee malfeasance cases have been uncovered by consular officers who notice quirks in applications procedures that might not be picked up by technology or statistical analysis. Our responses to the GAO's specific recommendations follow: Recommendation 1: The Secretary of State should develop a strategy to achieve strict compliance with internal controls. The strategy should include a system to spot check compliance. The strategy should also include formalized procedures in Fraud Prevention Units to document how the post will address the risk of employee malfeasance and emphasize the importance of reporting suspected internal malfeasance to consular managers and post security officers. We concur with these recommendations, and have already taken actions to implement them. The Department is continuing to turn to enhanced technology to reduce the vulnerability of consular operations to malfeasance and to strengthen management control and accountability. CA has begun to develop a comprehensive, uniform and fully automated system to track and account for sensitive, controlled and accountable consular items, such as visa foils and passports. This project, called "Automation Support for Consular Controlled Items Accountability," is well underway, and CA expects to complete it in 2006. The automated control system will record Department warehouse records of receipt, inventory and shipment of controlled items, will connect these records with posts' records to provide greater control over inventory worldwide, will track dispatch and receipt of shipments, and will maintain historical records, including providing an audit trail of critical transactions and activities involving controlled items. At each post, the new automated system will also track inventory and usage in each of the consular automated systems applications, including NIV of course, of all of the controlled items associated with that function. The' system will assist the Accountable Consular Officers (ACO) in their daily, quarterly and annual reconciliations; accountability, reconciliation and record keeping will be carried out within an electronic paradigm, while allowing for printed-paper copies of certain key records. More importantly, speaking directly to the GAO's recommendations, CA will be able to spot-check and monitor compliance with accountability procedures electronically from headquarters. With respect to instructing posts on procedures to document and report suspected malfeasance, the Department has recently issued a cable to all diplomatic and consular posts providing more explicit guidance to the field on the actions posts, in particular consular and RSOs, must take in the event they suspect or uncover malfeasance. The cable is State ALDAC 141874, and is attached to this letter as Exhibit 1. Recommendation 2: The Secretary of State should improve State's existing mechanisms to combat visa malfeasance. This could be accomplished by (1) improving the software available to the Vulnerability Assessment Unit to identify abnormalities in post visa issuance statistics that could be an indication of malfeasance, and (2 enhancing the investigative case tracking systems used by the Bureaus of Diplomatic Security in order to better identify trends and vulnerabilities in the visa process for use by investigators and consular managers. State is already implementing just such actions. The DS-CA jointly-staffed VAU, established specifically to detect and deter visa and other consular malfeasance (e.g., passports), has in recent months begun to focus more on the factors and circumstances that might encourage malfeasance or allow it to flourish. In order to do this, the unit requires more robust automated systems that will go beyond the reports on activity currently available in the Consular Consolidated Database. The unit is about to start field-testing a new risk analysis program which will alert VAU personnel when certain factors are present at a post which might indicate the need for management assistance, CMAT help or an investigation. Examples of such factors include: a spike in 3RD-country national applicants, visa processing activity after hours, severe staffing problems, a drop in the refusal rate, or issuance of a visa to a watch-listed individual. This new system will be a great improvement over the current set-up, which requires mining databases for individual records or specific information on an ad hoc basis. The new system will also give the VAU an automated means of generating pertinent information, flagging anomalies and interrupting the activity. This will allow the unit to shift to a more proactive posture, rather than simply verifying allegations of malfeasance or coming across problems when preparing background material for a CMAT. DS is currently in the process of developing its own new worldwide case- tracking database that will provide more detailed and comprehensive data, as recommended by the GAO. This new system is designed to allow DS to add features to the system such as analytical tools, new management reports, etc. This new database is currently in pilot phase, and the tentative launch date for version one of this new system will be early 2006. Work on version two will start immediately thereafter, to continue updating and improving the DS criminal case tracking system. Recommendation 3: The Secretary of State and the Attorney General should determine whether seeking additional overseas search authorities is warranted to facilitate investigations of visa malfeasance. If they determine such authorities are warranted, the Secretary of State and the Attorney General should develop an implementation plan and notify the Congress of any required legislative changes. We concur with this recommendation and with the observation that letters rogatory and MLATs have not been very helpful in investigating employee malfeasance overseas. State's Legal Adviser's Office will work with the Justice Department to determine whether seeking additional overseas search authorities is warranted and, if so, to develop an implementation plan and notify Congress of any necessary legislative changes. [End of section] Appendix III: GAO Contact and Staff Acknowledgments: GAO Contact: Jess Ford (202) 512-4128: Staff Acknowledgments: In addition to the person named above, John Brummet, Assistant Director; Claude Adrien; Joseph Carney; Martin de Alteriis; Etana Finkler; Patricia Martin; and Mary Moutsos made key contributions to this report. (320298): FOOTNOTES [1] For the purposes of this report, visas refer to nonimmigrant visas for temporary entry to the United States. State also issues immigrant visas for permanent entry to the United States. [2] For the purposes of this report, visa malfeasance refers to fraud committed by a U.S. government employee. This type of malfeasance is also called internal fraud. External fraud or fraud committed by a visa applicant or non-U.S. government personnel is not covered in this report. [3] See GAO, Border Security: Strengthened Visa Process Would Benefit from Improvements in Staffing and Information Sharing, GAO-05-859 (Washington D.C.: Sept. 13, 2005). [4] State does not keep records on all cases involving prosecution of its employees. Some of the individuals prosecuted were involved in the same fraud schemes. The United States Attorneys Offices also prosecute malfeasance cases. Although prosecuted by these offices, cases may be compiled and sorted according to the statute charged, for example, 18 U.S.C. 1546, available data do not separate out visa fraud cases that specifically charge malfeasance, as opposed to other types of visa fraud. Thus, we did not examine such cases. [5] This system, called CLASS, is a State name-check database that posts use to access critical information for visa adjudication. The system contains records provided by numerous agencies and includes information on persons with visa refusals, immigration violations, criminal histories, and terrorism concerns. [6] "Standards for Internal Control in the Federal Government," (GAO/AIMD-00-21.3.1, Nov. 1999) identifies the need for internal controls such as physical controls over vulnerable assets, segregation of duties to reduce the risk of fraud, limited access to and accountability of resources and systems, and top-level reviews of actual performance. [7] Class A referrals are generally for high level foreign officials, business persons, the press, military trainees, cultural exchanges, or well-known performers. The interview may be waived for these referrals. Class B referrals result in procedural courtesies, such as early appointments, and require both fingerprinting and applicant interviews. [8] Report of Inspection: Nonimmigrant Visa Adjudication: the Visa Referral Process, ISP-CA-05-56, March 2005. [9] State 9 FAM Appendix K, "Visa Referral Systems," dated May 16, 2002, provides criteria that posts must use in developing their referral policies. Unique characteristics of a post may dictate additional procedures that officers should follow when making a referral. [10] State Cables to posts 247059 and 201680, "Annual Certification of Consular Management Controls" dated August 2003 and September 2004, respectively. [11] Standard Operating Procedure 56, "Checklist for Preventing and/or Reporting Consular Malfeasance," December 2003 and updated in State cable 141874, "Reminder-Reporting Consular Malfeasance," August 1, 2005. [12] External fraud involves non-U.S. government employee assistance to individuals attempting to enter the United States illegally. [13] State established a Fraud Prevention Program in 1986 to combat visa fraud. Fraud Prevention Units at overseas posts have dedicated investigator positions, which generally are staffed by local hires. As of 2005, 13 Consular Affairs Officer positions worldwide were dedicated full-time to fraud prevention programs. [14] Standard Operating Procedure 56, "Checklist for Preventing and/or Reporting Consular Malfeasance," December 2003 and updated in State cable 141874, "Reminder-Reporting Consular Malfeasance," August 1, 2005. [15] Consular Management Handbook Section 600, Management Controls, Anti-Fraud, and Malfeasance, March 9, 2001. [16] Consular Management Handbook, Section 654.5-2, "Receipt, Inventory, and Accountability," March 9, 2001, and Standard Operating Procedure 55: Accountability of Controlled Consular Items, December 2003. [17] Inspector General report, "Review of Nonimmigrant Visa Issuance Policy and Procedures," Memorandum Report ISP-I-03-26, December 2002. [18] Inspector General report, "Nonimmigrant Visa Adjudication: the Visa Referral Process," ISP-CA-05-56, March 2005. [19] State 102994, "Standard Operating Procedure 66-Referral Policy Clarification," May 2004. [20] Class B referrals result in procedural courtesies such as expedited appointments and applicants are interviewed. [21] State requires employees who make referrals to attest to consular officers that they know the referred applicant personally, that the issuance of the visa to the applicant is in the national interest of the United States, and that the applicant does not constitute a threat to the safety or security of the United States. [22] 9 FAM 41.121 PN1.2-8 (2/25/2002) and State cable to posts 034743, "Front Office Oversight of Consular Function-A Reference Tool Continued," February 2004. [23] State 346750, Standard Operating Procedure 56, "Checklist for Preventing and/or Reporting Consular Malfeasance," December 2003. [24] Consular sections and Diplomatic Security investigators have different but valid objectives in addressing alleged visa malfeasance. For example, Diplomatic Security officials we spoke with prefer that allegations be reported to post security officers rather than consular officers to protect the integrity of the investigative process, while Consular Affairs' priority is to immediately stop the possibility of visa issuances to unqualified applicants. [25] Diplomatic Security reported opening about 140 cases involving employee visa malfeasance allegations between 2001 and 2004. [26] State was not able to provide comprehensive data on the total number of visa malfeasance cases brought to court. We were able to obtain data from Justice's Public Integrity Section for the 10 prosecutions involving State or other U.S. employees. Justice prosecuted 14 additional persons involved in visa malfeasance schemes who were not employed by the U.S. government. The U.S. Attorneys Offices may also prosecute visa malfeasance cases. Although these cases may be compiled and sorted according to the statute charged, for example, 18 U.S.C. 1546, available Offices data do not separate out visa fraud cases that specifically charge internal consular malfeasance, as opposed to other types of visa fraud. Thus, we did not examine such cases. [27] Consular Management Handbook, section 642.1, March 9, 2001, updated in August 2003 in Standard Operating Procedure 31, "Visa Referral Program." [28] Visa brokers are individuals that assist visa applicants in obtaining a visa, often through fraudulent means. [29] Diplomatic Security is in the process of adding additional officers at 25 posts to concentrate on investigations of visa fraud, including visa malfeasance. [30] The U.S.A. PATRIOT Act (P.L. 107-56) amended Rule 41 to allow magistrates to issue search warrants for property, but only in cases involving domestic and international terrorism; according to Diplomatic Security officials, this is generally not applicable to a typical case of visa malfeasance. According to a Justice official, in 1990 the United States Judicial Conference approved an amendment to Rule 41 that would have provided U.S. magistrates search warrant authority. However, in reviewing the recommendation, the Supreme Court concluded that the matter required further consideration and no action has been taken. [31] The U.S. mission generally refers to the buildings and land used for the purpose of the mission. This includes the embassies and consulate, as well as the residence of the head of the mission. [32] Letter Rogatories are letters of request from a court in one country to a foreign court requesting judicial assistance. Such requests can include the obtaining of testimony or other evidence from a person located in the foreign country. Requests rest entirely on the comity of courts towards each other, and customarily embody a promise of reciprocity. GAO's Mission: The Government Accountability Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO's Web site ( www.gao.gov ) contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as "Today's Reports," on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select "Subscribe to e-mail alerts" under the "Order GAO Products" heading. Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. Government Accountability Office 441 G Street NW, Room LM Washington, D.C. 20548: To order by Phone: Voice: (202) 512-6000: TDD: (202) 512-2537: Fax: (202) 512-6061: To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov Automated answering system: (800) 424-5454 or (202) 512-7470: Public Affairs: Jeff Nelligan, managing director, NelliganJ@gao.gov (202) 512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, D.C. 20548: