The program allows eligible nationals from the 38 VWP  countries to travel to the United States for 90 days or less for business or  pleasure without a visa and requires that VWP countries extend  reciprocal privileges to U.S. citizens. All VWP Countries Have Entered into Required Agreements or Equivalents, but Not All Are Sharing Information through Two Agreements

All 38 countries participating in the VWP have entered into the three types  of required information-sharing agreements, or their equivalents, with the  United States, but not all countries are sharing information through two of  the agreements. Also, about a third of  VWP countries had not yet shared criminal history information through  PCSC agreements. The  remaining VWP countries had not shared such information through the  agreements. Previously, in accordance with U.S.  law, DHS required VWP countries to enter into the arrangements and  agreements but did not require the countries to implement them in order  to participate in the program. However, contrary to standard program management practices, DHS did  not establish time frames for instituting the new requirements. Time frames for working with VWP countries to institute the  requirement to implement the HSPD-6 arrangements and PCSC  agreements could help DHS ensure that countries meet all legal criteria  for participating in the VWP—including the December 2015 law requiring  them to fully implement their agreements—and could help DHS protect  against threats to the United States or its citizens. Interests but Has Not Provided Required Reports to Congress on a Timely Basis

Our analysis of a nongeneralizable sample of 12 internal VWPO  evaluation reports on VWP countries found that VWPO assessed the  effect of the countries’ participation in the program on U.S. law  enforcement and security interests, including immigration enforcement, as  required by federal law. However, almost one-quarter of DHS’s most  recent reports to Congress regarding whether VWP countries should  continue to participate in the program were submitted, or remained  outstanding, 5 or more months after the dates when DHS had determined  that, under U.S. law, they were due. As a result, Congress may lack  timely information that it needs to conduct oversight of the VWP. U.S.  law requires DHS to submit a written report to Congress for each VWP  country not less than once every 2 years. DHS’s timeliness in reporting to Congress about VWP countries has  improved since 2011, when we found that the department had not  completed half of its recent VWP congressional reports in a timely  manner and that many of the reports were more than a year past due. Recommendations for Executive Action

To strengthen DHS’s ability to fulfill legislative requirements for the VWP  and protect the security of the United States and its citizens, we are  making the following two recommendations to the Secretary of Homeland  Security:
Specify time frames for working with VWP countries to institute the  additional VWP security requirements, including the requirement that  the countries fully implement agreements to share information about  known or suspected terrorists through the countries’ HSPD-6  arrangements and PCSC agreements with the United States. Take steps to improve DHS’s timeliness in reporting to Congress,  within the statutory time frame, the department’s determination of  whether each VWP country should continue participating in the  program and any effects of the country’s participation on U.S. law  enforcement and security interests. To determine the extent to which DHS has evaluated VWP countries’  effect on U.S. security and law enforcement interests, including  immigration enforcement, we selected and analyzed a nongeneralizable  sample of 12 internal DHS reports evaluating VWP countries. We  selected these reports on the basis of a number of factors chosen to  identify countries where concerns might exist regarding foreign terrorist  fighters traveling to the United States—for example, high estimated  numbers of foreign terrorist fighters; border security and counterterrorism  capacity concerns; a high number of ESTA denials; number of travelers to  the United States, including the percentage that traveled under the VWP;  relative population size (e.g., large or small); date of entry into the VWP  (i.e., pre-2000, 2001-2010, 2010-the present); geographic variation (e.g.,  Western Europe, Eastern Europe, the Asia Pacific region); and status of  VWP information-sharing agreements as characterized by U.S. agencies  (i.e., whether agreements had been signed, were ratified, and were in  force and whether sharing had occurred).
Why GAO Did This Study

The Visa Waiver Program allows nationals from the 38 VWP countries to travel to the United States for tourism or business for up to 90 days without a visa. To help prevent terrorists and others who present a threat from travelling to the United States, DHS requires VWP countries to, among other things, enter into information-sharing agreements with the United States. In addition, U.S. law requires DHS to evaluate, at least once every 2 years, the effect of each VWP country's participation on U.S. law enforcement, security, and immigration enforcement interests; determine whether the country should continue in the program; and report on its determination to Congress.
GAO was asked to review the VWP. In this report, GAO examines the extent to which VWP countries have implemented the required agreements. GAO also examines the extent to which DHS evaluated VWP countries and reported to Congress as required. GAO reviewed documents related to the VWP, including a sample of DHS reports. In addition, GAO interviewed U.S. officials in Washington, D.C., and U.S. and foreign officials in four VWP countries selected on the basis of factors such as high estimated numbers of foreign terrorist fighters. This is a public version of a classified report GAO issued in January 2016.

What GAO Found

All 38 countries participating in the Visa Waiver Program (VWP) have entered into required agreements, or their equivalents, to (1) report lost and stolen passports, (2) share identity information about known or suspected terrorists, and (3) share criminal history information. However, not all countries have shared information through the agreements. The Department of Homeland Security (DHS) reported that all VWP countries have reported passport information through the first agreement, but more than a third of VWP countries are not sharing terrorist identity information through the second agreement and more than a third of the countries have not yet shared criminal history information through the third agreement. While VWP countries may share information through other means, U.S. agency officials told GAO that information sharing through the agreements is essential for national security. In August 2015, DHS decided to require VWP countries to implement agreements to share terrorist identity and criminal history information; previously, VWP countries were required to enter into, but not to implement, these agreements. However, contrary to standard program management practices, DHS did not establish time frames for instituting the amended requirements. In December 2015, Congress passed a law requiring that VWP countries fully implement information-sharing agreements in order to participate in the program. Time frames for working with VWP countries to implement their agreements could help DHS enforce U.S. legal requirements and could strengthen DHS's ability to protect the United States and its citizens.
GAO's analysis of a nongeneralizeable sample of 12 internal DHS reports, each evaluating one VWP country, found the reports assessed the effects of the countries' participation on U.S. law enforcement, security, and immigration enforcement interests, as required by U.S. law. Since 2011, when GAO last reviewed the VWP, DHS has improved its timeliness in reporting to Congress at least once every 2 years its determinations of whether countries should continue in the program. Nonetheless, as of October 31, 2015, GAO found that about a quarter of DHS's most recent VWP congressional reports were submitted, or remained outstanding, 5 or more months past the statutory deadlines (see figure). As a result, Congress may lack timely information needed to conduct oversight of the VWP and assess whether further modifications are necessary to prevent terrorists from exploiting the program.

What GAO Recommends

DHS should (1) specify time frames for working with VWP countries on the requirement to implement information-sharing agreements and (2) take steps to improve its timeliness in reporting to Congress on whether VWP countries should continue in the program. DHS concurred with the recommendations.