In  August 2007, Congress enacted the 9/11 Act, which provides DHS with the  authority to consider admitting into the Visa Waiver Program countries  that otherwise meet the program requirements, but have refusal rates  between 3 percent and 10 percent, provided the countries meet certain  conditions (see app. In addition, DHS must complete two actions aimed at enhancing  the security of the program (see app. Executive Branch Is Moving Quickly to Expand the Visa Waiver Program without a Transparent Process

The executive branch is moving aggressively to expand the Visa Waiver  Program by the end of 2008, but, in doing so, DHS has not followed a  transparent process for admitting new countries to the program—an  approach that has created confusion among other U.S. agencies in  Washington, D.C.; U.S. embassy officials overseas; and those countries  that are seeking to join the Visa Waiver Program. During the expansion  negotiations, DHS has achieved some security enhancements, such as new  agreements that, among other things, require the reporting of lost and  stolen blank and issued passports. DHS Has Not Followed a Transparent Process for Visa Waiver Program Expansion

We found that the Visa Waiver Program Office has not followed its own  standard operating procedures, completed in November 2007, which set  forth the key milestones that DHS and aspiring countries must meet before  additional countries are admitted into the program. DHS is negotiating  with 4 Road Map countries with fiscal year 2007 refusal rates over 10  percent (Hungary, Latvia, Lithuania, and Slovakia), with the expectation  that fiscal year 2008 refusal rates for these countries will fall below 10  percent. DHS Has Not Fully Developed Tools Aimed at Assessing and Mitigating Risks in the Visa Waiver Program

As of early September 2008, DHS had not yet met two key certification  requirements in the 9/11 Act that are necessary to allow the department to  consider expanding the Visa Waiver Program to countries with refusal  rates between 3 percent and 10 percent. Finally, in reviewing recommendations from our  2006 report aimed at improving efforts to assess and mitigate program  risks, we found that DHS has implemented many of our prior  recommendations, but some are only partially implemented. DHS has not announced when it plans  to make this certification. Although  DHS program officials stated that DHS is on track to implement the  biometric exit system by July 2009, it is unlikely that DHS will meet this  timeline. While DHS has taken action on many of our recommendations, it has not  fully implemented others. Finally, DHS still needs to take actions to fully implement  our prior recommendations in light of plans to expand the program. Recommendations for Executive Action

To improve management of the Visa Waiver Program and better assess and  mitigate risks associated with it, we are recommending that the Secretary  of Homeland Security take the following four actions:    establish a clear process, in coordination with the Departments of State  and Justice, for program expansion that would include the criteria used to  determine which countries will be considered for expansion and timelines  for nominating countries, security assessments of aspiring countries, and  negotiation of any bilateral agreements to implement the program’s  legislative requirements;    designate an office with responsibility for developing overstay rate  information for the purposes of monitoring countries’ compliance with the  statutory requirements of the Visa Waiver Program;    direct that established office and other appropriate DHS components to  explore cost-effective actions necessary to further improve, validate, and  test the reliability of overstay data; and    direct the Visa Waiver Program Office to request an updated, validated  study of estimated overstay rates for current and aspiring Visa Waiver  Program countries, and determine the extent to which additional research  and validation of these data are required to help evaluate whether  particular countries pose a potential illegal immigration risk to the United  States. In addition, Justice discussed its efforts, in collaboration  with DHS, to include screening against Interpol’s lost and stolen passport  database as part of ESTA. The country must certify that it  issues machine-readable passports to its citizens. GAO Comments

1. Moreover, absent clear direction from DHS, U.S. embassy officials in  several aspiring countries told us that it had been difficult to explain  the expansion process to their foreign counterparts and manage their  expectations about when those countries might be admitted into the  Visa Waiver Program. 3. However, DHS does not anticipate that ESTA authorizations will be  mandatory for visa waiver travelers until after January 12, 2009. As we  state in our report, and as DHS noted, the department has not yet  certified that it can verify the departure of not less than 97 percent of  foreign nationals exiting U.S. airports, or that an Electronic System for  Travel Authorization (ESTA) for screening visa waiver travelers in  advance of their travel is “fully operational.” Moreover, DHS has not  yet implemented a biometric air exit system at U.S. airports.
Why GAO Did This Study

The Visa Waiver Program, which enables citizens of participating countries to travel to the United States without first obtaining a visa, has many benefits, but it also has risks. In 2006, GAO found that the Department of Homeland Security (DHS) needed to improve efforts to assess and mitigate these risks. In August 2007, Congress passed the 9/11 Act, which provides DHS with the authority to consider expanding the program to countries whose short-term business and tourism visa refusal rates were between 3 and 10 percent in the prior fiscal year. Countries must also meet certain conditions, and DHS must complete actions to enhance the program's security. GAO has examined DHS's process for expanding the Visa Waiver Program and evaluated the extent to which DHS is assessing and mitigating program risks. GAO reviewed relevant laws and procedures and interviewed agency officials in Washington, D.C., and in U.S. embassies in eight aspiring and three Visa Waiver Program countries.

What GAO Found

The executive branch is moving aggressively to expand the Visa Waiver Program by the end of 2008, but, in doing so, DHS has not followed a transparent process. DHS did not follow its own November 2007 standard operating procedures, which set forth key milestones to be met before countries are admitted into the program. As a result, Departments of State (State) and Justice and U.S. embassy officials stated that DHS created confusion among interagency partners and aspiring program countries. U.S. embassy officials in several aspiring countries told us it had been difficult to explain the expansion process to foreign counterparts and manage their expectations. State officials said it was also difficult to explain to countries with fiscal year 2007 refusal rates below 10 percent that have signaled interest in joining the program (Croatia, Israel, and Taiwan) why DHS is not negotiating with them, given that DHS is negotiating with several countries that had refusal rates above 10 percent (Hungary, Latvia, Lithuania, and Slovakia). Despite this confusion, DHS achieved some security enhancements during the expansion negotiations, including agreements with several aspiring countries on lost and stolen passport reporting. DHS, State, and Justice agreed that a more transparent process is needed to guide future program expansion. DHS has not fully developed tools to assess and mitigate risks in the Visa Waiver Program. To designate new program countries with refusal rates between 3 and 10 percent, DHS must first make two certifications. First, DHS must certify that it can verify the departure of not less than 97 percent of foreign nationals who exit from U.S. airports. In February 2008, we testified that DHS's plan to meet this provision will not help mitigate program risks because it does not account for data on those who remain in the country beyond their authorized period of stay (overstays). DHS has not yet finalized its methodology for meeting this provision. Second, DHS must certify that the Electronic System for Travel Authorization (ESTA) for screening visa waiver travelers in advance of their travel is "fully operational." While DHS has not announced when it plans to make this certification, it anticipates ESTA authorizations will be required for all visa waiver travelers after January 12, 2009. DHS determined that the law permits it to expand the program to countries with refusal rates between 3 and 10 percent after it makes these two certifications, and after the countries have met the required conditions, but before ESTA is mandatory for all Visa Waiver Program travelers. For DHS to maintain its authority to admit certain countries into the program, it must incorporate biometric indicators (such as fingerprints) into the air exit system by July 1, 2009. However, DHS is unlikely to meet this timeline due to several unresolved issues.In addition, DHS does not fully consider countries' overstay rates when assessing illegal immigration risks in the Visa Waiver Program. Finally, DHS has implemented many recommendations from GAO's 2006 report, including screening U.S.-bound travelers against Interpol's lost and stolen passport database, but has not fully implemented others. Implementing the remaining recommendations is important as DHS moves to expand both the program and the department's oversight responsibilities.