Visa Waiver Program: Actions Are Needed to Improve Management of the Expansion Process, and to Assess and Mitigate Program Risks

GAO-08-967 Published: Sep 15, 2008. Publicly Released: Sep 15, 2008.
Jump To:
Skip to Highlights

The Visa Waiver Program, which enables citizens of participating countries to travel to the United States without first obtaining a visa, has many benefits, but it also has risks. In 2006, GAO found that the Department of Homeland Security (DHS) needed to improve efforts to assess and mitigate these risks. In August 2007, Congress passed the 9/11 Act, which provides DHS with the authority to consider expanding the program to countries whose short-term business and tourism visa refusal rates were between 3 and 10 percent in the prior fiscal year. Countries must also meet certain conditions, and DHS must complete actions to enhance the program's security. GAO has examined DHS's process for expanding the Visa Waiver Program and evaluated the extent to which DHS is assessing and mitigating program risks. GAO reviewed relevant laws and procedures and interviewed agency officials in Washington, D.C., and in U.S. embassies in eight aspiring and three Visa Waiver Program countries.

The executive branch is moving aggressively to expand the Visa Waiver Program by the end of 2008, but, in doing so, DHS has not followed a transparent process. DHS did not follow its own November 2007 standard operating procedures, which set forth key milestones to be met before countries are admitted into the program. As a result, Departments of State (State) and Justice and U.S. embassy officials stated that DHS created confusion among interagency partners and aspiring program countries. U.S. embassy officials in several aspiring countries told us it had been difficult to explain the expansion process to foreign counterparts and manage their expectations. State officials said it was also difficult to explain to countries with fiscal year 2007 refusal rates below 10 percent that have signaled interest in joining the program (Croatia, Israel, and Taiwan) why DHS is not negotiating with them, given that DHS is negotiating with several countries that had refusal rates above 10 percent (Hungary, Latvia, Lithuania, and Slovakia). Despite this confusion, DHS achieved some security enhancements during the expansion negotiations, including agreements with several aspiring countries on lost and stolen passport reporting. DHS, State, and Justice agreed that a more transparent process is needed to guide future program expansion. DHS has not fully developed tools to assess and mitigate risks in the Visa Waiver Program. To designate new program countries with refusal rates between 3 and 10 percent, DHS must first make two certifications. First, DHS must certify that it can verify the departure of not less than 97 percent of foreign nationals who exit from U.S. airports. In February 2008, we testified that DHS's plan to meet this provision will not help mitigate program risks because it does not account for data on those who remain in the country beyond their authorized period of stay (overstays). DHS has not yet finalized its methodology for meeting this provision. Second, DHS must certify that the Electronic System for Travel Authorization (ESTA) for screening visa waiver travelers in advance of their travel is "fully operational." While DHS has not announced when it plans to make this certification, it anticipates ESTA authorizations will be required for all visa waiver travelers after January 12, 2009. DHS determined that the law permits it to expand the program to countries with refusal rates between 3 and 10 percent after it makes these two certifications, and after the countries have met the required conditions, but before ESTA is mandatory for all Visa Waiver Program travelers. For DHS to maintain its authority to admit certain countries into the program, it must incorporate biometric indicators (such as fingerprints) into the air exit system by July 1, 2009. However, DHS is unlikely to meet this timeline due to several unresolved issues.In addition, DHS does not fully consider countries' overstay rates when assessing illegal immigration risks in the Visa Waiver Program. Finally, DHS has implemented many recommendations from GAO's 2006 report, including screening U.S.-bound travelers against Interpol's lost and stolen passport database, but has not fully implemented others. Implementing the remaining recommendations is important as DHS moves to expand both the program and the department's oversight responsibilities.

Skip to Recommendations


Recommendations for Executive Action

Agency Affected Recommendation Status
Department of Homeland Security To improve management of the Visa Waiver Program and better assess and mitigate risks associated with it, the Secretary of Homeland Security should establish a clear process, in coordination with the Departments of State and Justice, for program expansion that would include the criteria used to determine which countries will be considered for expansion and timelines for nominating countries, security assessments of aspiring countries, and negotiation of any bilateral agreements to implement the program's legislative requirements.
Closed – Implemented
According to DHS, the Department, in consultation with the State, updated the guidelines for engaging countries on VWP designation. DHS's Visa Waiver Program Office chairs a VWP Interagency Working Group, which includes representatives from DHS, State, and DOJ. The working group discusses potential candidate countries, the best methods for engaging each, and general timelines for when Program requirements must be met. Furthermore, the VWP Office conducts an initial evaluation to determine eligibility of a candidate country to the VWP. This review includes a site-visit and analysis of information received from various sources. Potential candidate countries continue to be evaluated on a case-by-case basis based on their ability to meet the statutory and policy requirements of the VWP, and are willing and able to enter into a close security relationship with the United States.
Department of Homeland Security To improve management of the Visa Waiver Program and better assess and mitigate risks associated with it, the Secretary of Homeland Security should designate an office with responsibility for developing overstay rate information for the purposes of monitoring countries' compliance with the statutory requirements of the Visa Waiver Program.
Closed – Implemented
According to DHS, the United States Visitor and Immigrant Status Indicator Technology (US-VISIT) Program in DHS develops overstay rate information in close coordination with other DHS Components, such as U.S. Customs and Border Protection (CBP), U.S. Citizenship and Immigration Services (USCIS) and U.S. Immigration and Customs Enforcement (ICE) and the Office of Policy's Office of Immigration Statistics (OIS). In addition, previous GAO reports acknowledge that US-VISIT is responsible for the maintenance of an entry-exit system which would calculate overstays.
Department of Homeland Security To improve management of the Visa Waiver Program and better assess and mitigate risks associated with it, the Secretary of Homeland Security should direct that established office and other appropriate DHS components to explore cost-effective actions necessary to further improve, validate, and test the reliability of overstay data.
Closed – Not Implemented
Since the issuance of the GAO report in 2008, DHS components have explored cost-effective actions to improve the reliability of overstay data. DHS has developed an enhanced biographic exit initiative to improve its ability to identify overstays and reduce their occurrence in the future. For example, DHS is implementing the Beyond the Border initiative to collect additional departure data on travelers departing the United States through land ports on the northern border. In October 2012, DHS and the Canada Border Services Agency began exchanging entry data on travelers crossing the border at selected land ports of entry. Because an entry into Canada constitutes a departure from the United States, DHS will be able to use Canadian entry data as proxies for U.S. departure records and match them against arrival records to identify potential overstays. DHS has also taken steps to improve connections among its component agencies' databases used to identify potential overstays and reduce the need for manual exchanges of data. However, DHS has not taken actions to validate or test the reliability of overstay data. According to DHS Office of Policy officials, the department is better positioned than in the past to describe the limitations in the overstay data. However, DHS has not assessed and documented how its changes to database connections have improved the reliability of its data for the purposes of reporting overstay rate calculations and has not analyzed the incremental improvements that database changes have made in data quality.
Department of Homeland Security To improve management of the Visa Waiver Program and better assess and mitigate risks associated with it, the Secretary of Homeland Security should direct the Visa Waiver Program Office to request an updated, validated study of estimated overstay rates for current and aspiring Visa Waiver Program countries, and determine the extent to which additional research and validation of these data are required to help evaluate whether particular countries pose a potential illegal immigration risk to the United States.
Closed – Not Implemented
According to the Department, DHS currently has a manual process that would allow it to further evaluate and validate a country's overstay numbers today. DHS indicated that initiated a significant modernization effort to build an enhanced exit system that is operationally feasible and better able to identify overstays. While GAO acknowledges that DHS has developed a plan to improve and validate the accuracy of overstay rates (see related recommendation for this report), GAO does not believe that the "manual process" described in the DHS response is sufficient to close the recommendation as implemented. Furthermore, DHS did not conduct a study to validate overstay rates, and GAO has reported on concerns regarding the validity and reliability of overstay data. For example, in April 2011, GAO reported that DHS's efforts to identify and report on visa overstays were hindered by unreliable data (Overstay Enforcement: Additional Mechanisms for Collecting, Assessing, and Sharing Data Could Strengthen DHS's Efforts but Would Have Costs, GAO-11-411). In addition, DHS continues to face challenges in reporting reliable overstay rates. Federal law requires DHS to report overstay estimates, but DHS or its predecessors have not regularly done so since 1994 (GAO-13-602T).

Full Report