Visa Waiver Program:

DHS Has Implemented the Electronic System for Travel Authorization, but Further Steps Needed to Address Potential Program Risks

GAO-11-335: Published: May 5, 2011. Publicly Released: May 17, 2011.

Additional Materials:


Jess T. Ford
(202) 512-4268


Office of Public Affairs
(202) 512-4800

The Visa Waiver Program (VWP) allows eligible nationals from 36 member countries to travel to the United States for tourism or business for 90 days or less without a visa. In 2007, Congress required the Secretary of Homeland Security, in consultation with the Secretary of State, to implement an automated electronic travel authorization system to determine, prior to travel, applicants' eligibility to travel to the United States under the VWP. Congress also required all VWP member countries to enter into an agreement with the United States to share information on whether citizens and nationals of that country traveling to the United States represent a security threat. In 2002, Congress mandated that the Department of Homeland Security (DHS) review, at least every 2 years, the security risks posed by each VWP country's participation in the program. In this report, GAO evaluates (1) DHS's implementation of an electronic system for travel authorization; (2) U.S. agencies' progress in negotiating informationsharing agreements; and (3) DHS's timeliness in issuing biennial reports. GAO reviewed relevant documents and interviewed U.S., foreign government, and travel industry officials in six VWP countries.

DHS has implemented the Electronic System for Travel Authorization (ESTA) and has taken steps to minimize the burden associated with the new program requirement. However, DHS has not fully evaluated security risks related to the small percentage of VWP travelers without verified ESTA approval. DHS requires applicants for VWP travel to submit biographical information and answers to eligibility questions through ESTA prior to travel. Travelers whose ESTA applications are denied can apply for a U.S. visa. In developing and implementing ESTA, DHS has made efforts to minimize the burden imposed by the new requirement. For example, although travelers formerly filled out a VWP application form for each journey to the United States, ESTA approval is generally valid for 2 years. Most travel industry officials GAO interviewed in six VWP countries praised DHS's widespread ESTA outreach efforts, reasonable implementation time frames, and responsiveness to feedback, but expressed dissatisfaction with the costs associated with ESTA. In 2010, airlines complied with the requirement to verify ESTA approval for almost 98 percent of VWP passengers prior to boarding, but the remaining 2 percent-- about 364,000 travelers--traveled under the VWP without verified ESTA approval. DHS has not yet completed a review of these cases to know to what extent they pose a risk to the program. To meet the legislative requirement, DHS requires that VWP countries enter into three information-sharing agreements with the United States; however, only half of the countries have fully complied with this requirement and many of the signed agreements have not been implemented. Half of the countries have entered into agreements to share watchlist information about known or suspected terrorists and to provide access to biographical, biometric, and criminal history data. By contrast, almost all of the 36 VWP countries have entered into an agreement to report lost and stolen passports. DHS, with the support of interagency partners, has established a compliance schedule requiring the last of the VWP countries to finalize these agreements by June 2012. Although termination from the VWP is one potential consequence for countries not complying with the information-sharing agreement requirement, U.S. officials have described it as undesirable. DHS, in coordination with State and Justice, has developed measures short of termination that could be applied to countries not meeting their compliance date. DHS has not completed half of the most recent biennial reports on VWP countries' security risks in a timely manner. According to officials, DHS assesses, among other things, counterterrorism capabilities and immigration programs. However, DHS has not completed the latest biennial reports for 18 of the 36 VWP countries in a timely manner, and over half of these reports are more than 1 year overdue. Further, in the case of two countries, DHS was unable to demonstrate that it had completed reports in the last 4 years. DHS cited a number of reasons for the reporting delays. For example, DHS officials said that they intentionally delayed report completion because they frequently did not receive mandated intelligence assessments in a timely manner and needed to review these before completing VWP country biennial reports. GAO recommends that DHS establish time frames for the regular review of cases of ESTA noncompliance and take steps to address delays in the biennial review process. DHS concurred with the report's recommendations.

Recommendations for Executive Action

  1. Status: Closed - Implemented

    Comments: In response to the GAO recommendation, DHS issued the Electronic System for Travel Authorization Review of ESTA Denied and Non-Compliant Travelers Standard Operating Procedure in April 2011. The purpose of the document is "to establish the requirements and responsibilities for reviewing travelers who arrived under the Visa Waiver Program (VWP) as Electronic System for Travel Authorization (ESTA) noncompliant, or having been denied an ESTA to determine the level of risk posed to VWP security and identify improvements to minimize noncompliance. According to the document, DHS policy assigns responsibility to the ESTA Program Management Office (PMO) for conducting a quarterly review of all such travelers. To show that it had begun implementing the reviews, DHS provided us a memo sent to the Executive Director for Operations signed in May 2011 with recommendations based on a review of ESTA non-compliant passengers.

    Recommendation: To ensure that DHS can identify and mitigate potential security risks associated with the VWP, the Secretary of Homeland Security should establish time frames for the regular review and documentation of cases of VWP passengers traveling to a U.S. port of entry without verified ESTA approval.

    Agency Affected: Department of Homeland Security

  2. Status: Closed - Implemented

    Comments: According to DHS, the Visa Waiver Program (VWP) Office has conducted outreach within DHS and with interagency partners involved in the biennial report (eligibility) review process to discuss new reporting processes and related workflow issues, and to establish timeframes for document production and required clearances. One new step taken is to require that the Intelligence Community (IC) product that is produced in conjunction with each biennial country review be finalized and published at least 90 days in advance of the date of submission of a VWP Report to Congress to allow the VWP Office enough time to review the IC report and incorporate its views. According to DHS, it will send VWP reports to Congress every 2 years, starting in 2013

    Recommendation: To ensure that DHS can identify and mitigate potential security risks associated with the VWP, the Secretary of Homeland Security should take steps to address delays in the biennial country review process so that the mandated country reports can be completed on time.

    Agency Affected: Department of Homeland Security


Explore the full database of GAO's Open Recommendations »

Oct 20, 2020

Sep 30, 2020

Sep 29, 2020

Sep 24, 2020

Sep 10, 2020

Aug 19, 2020

Looking for more? Browse all our products here