State’s Development Process Resulted in Cards That Generally Meet Standards and Guidance for International Travel Documents, but Improvements Could Be Made

State’s designs for the first and second generation passport card and the  second generation BCC generally meet standards and guidance for  international travel documents and DHS policies for travel credentials and,  in general, the recommended security features that are not included are  compensated for by other security features or would not greatly increase  the security of the cards. Moreover, State tested and evaluated the  security and durability of only prototypes of the passport card, which did  not include the personalization printing or background artwork. Without  fully evaluating the impact of the issues and recommendations on the  security and performance of the cards and testing and evaluating the final  designs for the first and second generation passport card and second  generation BCC, State does not have a complete understanding of the  cards’ overall security and performance. In addition, the cards include many security  features recommended as a best practice. While State addressed most of the issues raised and recommendations  made during evaluation and testing of the prototype passport card, it  either did not address some of the issues and recommendations or did not  document its reasons for not doing so. State  began issuing the second generation passport card in mid-April 2010. State agreed with the recommendation and has taken  steps to address it. Limitations in the Use of Technology and Inspection Time Restrict the Use of Security Features in the Inspection of Passport Cards and BCCs

Officers in primary inspection—the first and most critical opportunity at  U.S. ports of entry to identify individuals seeking to enter the United States  with fraudulent travel documents—are unable to take full advantage of the  security features in passport cards and BCCs due to the limited use of  technology in primary inspection. For example, CBP provided training to  inspection officers on the passport card and second generation BCC prior  to their issuance and provides continuing information to officers on  document fraud. As State continues to update its travel documents, we  continue to believe that State and DHS need to fully implement our prior  recommendation to improve training of its officers on new documents  prior to their issuance, which includes the provision of exemplars so that  they can be used during training to better familiarize officers with the look  and feel of the cards. However, State did not fully assess or test the security features incorporated  on the passport card or the second generation BCC. More fully conducting testing  of the passport card and BCC and addressing identified problems would  provide State with a fuller understanding of the overall security and  performance of the cards and greater assurance that its cards have been  produced with adequate security. However, the conduct of training without passport card or  BCC exemplars at the POEs we visited along the Northern border  indicates that improvements are still needed. Recommendations for Executive Action

To ensure the designs for the passport card and BCC physical security  features adequately mitigate the risk of fraudulent use, we recommend  that the Secretary of State take the following two actions to improve the  development process when conducting future redesigns or updates to the  passport card or BCC:    Fully address any issues or problems encountered during testing,  including the documentation of reasons for not addressing any of them. To determine how CBP officers use the security features of passport cards  and second generation BCCs to prevent fraudulent use at land ports of  entry, we interviewed officials from CBP and reviewed CBP policies,  procedures, guidance, and training documents regarding the inspection of  travelers presenting passport cards and second generation BCCs for the  purpose of entry to the United States, including the use of the cards’  physical security features and cardholder information retrieved from CBP  border inspection systems.
Why GAO Did This Study

In July 2008, the Department of State (State) began issuing passport cards as a lower-cost alternative to passports for U.S. citizens to meet Western Hemisphere Travel Initiative requirements. In October 2008, State began issuing the second generation border crossing card (BCC) based on the architecture of the passport card. GAO was asked to examine the effectiveness of the physical and electronic security features of the passport card and second generation BCC. This report addresses: (1) How effectively State's development process--including testing and evaluation--for the passport card and second generation BCC mitigates the risk of fraudulent use? (2) How are U.S. Customs and Border Protection (CBP) officers using the cards' security features to prevent fraudulent use at land ports of entry? To conduct this work, GAO evaluated the security features of passport cards and second generation BCCs against international standards and guidance and results from testing and evaluation and observed the inspection of these cards at five land ports of entry (POE).

What GAO Found

State developed a passport card and second generation BCC that generally meet standards and guidance for international travel documents and include numerous, layered security features that, according to document security experts in the Department of Homeland Security, provide adequate security against fraudulent use. While following standards and guidance helps to ensure the security of these documents, State's development process could be improved. State addressed most problems identified during evaluation and testing; however, it did not address some of the resulting issues and recommendations or did not document its reasons for not doing so. In addition, State tested and evaluated the security of only prototypes of the passport card, which did not include key features such as the background artwork, personalization features, and other security features that were added or changed for the final passport card. Moreover, State did not test the security of the second generation BCC or the updated passport card expected to be issued in the second quarter of 2010. Fully testing the passport card and BCC and addressing identified problems would provide State a more complete understanding of the overall security and performance of its cards and a greater assurance that its cards are adequately secure. CBP officers in primary inspection--the first and most critical opportunity to identify individuals seeking to enter the United States with fraudulent travel documents--use a variety of methods to identify fraudulent documents, but are unable to take full advantage of the security features in passport cards and BCCs because of time constraints, limited use of technology in primary inspection, and the lack of sample documents for training. While CBP has deployed technology tools for primary inspectors to use when inspecting passport cards and BCCs, it could still make better usage of fingerprint data to mitigate the risk of imposter fraud with BCCs, the most common type of fraud. In addition, although CBP provided training on security features of the passport card and second generation BCC to inspecting officers prior to their issuance, the conduct of training without sample passport cards or second generation BCCs at the Vermont POEs visited by GAO indicate that improvements are still needed. State and DHS need to fully implement GAO's prior recommendation to improve training on new documents prior to their issuance, including the provision of exemplars to be used during training to better familiarize officers with the look and feel of the actual documents.

What GAO Recommends

GAO recommends that State fully address any problems found during testing and evaluation, including documenting the reasons for not addressing any of them, and test and evaluate the security features on the cards as they will be issued. State agreed with the recommendations.