State of Washington, et al., v. Trump., et al

Filing 194

MOTION for Leave to File Third Amended Complaint, filed by Plaintiffs Commonwealth of Massachusetts, State of California, State of Maryland, State of New York, State of Washington, Intervenor Plaintiff State of Oregon. (Attachments: # 1 Complaint 3rd Amended, # 2 Index of Exhibits, # 3 Index of Declarations, # 4 Exhibit A, # 5 Exhibit B, # 6 Exhibit C, # 7 Exhibit D, # 8 Exhibit E, # 9 Exhibit F, # 10 Exhibit G, # 11 Exhibit H, # 12 Exhibit I, # 13 Exhibit J, # 14 Exhibit K, # 15 Exhibit L, # 16 Exhibit M, # 17 Exhibit N, # 18 Decl of Joint Former National Security Officials, # 19 Decl of Nima Ala, # 20 2nd Decl of Rabyaah Althaibani, # 21 Decl of Alireza Ayoubi, # 22 Decl of Shervin Beygi, # 23 Decl of Bahareh Bina, # 24 Decl of Ethan Devenport, # 25 Decl of Yasaman Esmaili, # 26 Decl of Mahdi Hajiaghayi, # 27 Decl of Mojdeh Jalali Heravi, # 28 Decl of Vahid Jazayeri, # 29 Decl of Mohammad Shafiei Khadem, # 30 Decl of Ahmad Moghaddam, # 31 Decl of Younes Nouri, # 32 Decl of Proshat Parsimoghadam, # 33 Decl of Emad Soroush, # 34 Decl of Tannaz Sattari Tabrizi, # 35 Decl of Seyed Danial Vaezi, # 36 Decl of Banafsheh Samareh Abolhasani, # 37 Decl of Armin Alaghi, # 38 Decl of Pegah Jalali Asheghabadi, # 39 3rd Decl of Rovy Branon, # 40 5th Decl of Asif Chaudhry, # 41 Decl of Maryam Dadkhahan, # 42 Decl of Jason Detwiler, # 43 2nd Decl of David Eaton, # 44 Decl of Kiana Ehsani, # 45 Decl of Ali Farhadi, # 46 Decl of Hoda Farhadi, # 47 Decl of Maryam Fayazi, # 48 Decl of Mohammad Ghaedi, # 49 Decl of Anne Greenbaum, # 50 Decl of Hannaneh Hajishirzi, # 51 2nd Decl of Deirdre Heatwole, # 52 Decl of Parisa Hosseinzadeh, # 53 Decl of Adam Mokhalalati, # 54 Decl of Shima Nofallah, # 55 4th Decl of Jeffrey Riedinger, # 56 Decl of Solmaz Shakerifard, # 57 Decl of Khadijeh Sheikhan, # 58 Decl of Ali Shojaie, # 59 Decl of Hema Yoganarasimhan, # 60 2nd Decl of Kathy Oline, # 61 2nd Decl of Dave Soike, # 62 2nd Decl of Rita Zawaideh, # 63 2nd Decl of Mitra Akhtari, # 64 2nd Decl of Melanie de Leon, # 65 Decl of Payam Fotouhiyehpour, # 66 2nd Decl of Marc Overbeck, # 67 2nd Decl of Sana Parsian, # 68 Decl of Sahar Z. Zangenah, # 69 2nd Decl of Dennis Galvan, # 70 Proposed Order) Noting Date 10/16/2017, (Melody, Colleen)

Third Amended
Complaint
Exhibit M

United States Government Accountability Office

Report to Congressional Requesters

May 2016

VISA WAIVER
PROGRAM
DHS Should Take
Steps to Ensure
Timeliness of
Information Needed to
Protect U.S. National
Security

GAO-16-498

May 2016

VISA WAIVER PROGRAM

Highlights of GAO-16-498, a report to
congressional requesters

DHS Should Take Steps to Ensure Timeliness
of Information Needed to Protect U.S. National
Security

Why GAO Did This Study

What GAO Found

The Visa Waiver Program allows
nationals from the 38 VWP countries to
travel to the United States for tourism
or business for up to 90 days without a
visa. To help prevent terrorists and
others who present a threat from
travelling to the United States, DHS
requires VWP countries to, among
other things, enter into informationsharing agreements with the United
States. In addition, U.S. law requires
DHS to evaluate, at least once every 2
years, the effect of each VWP country’s
participation on U.S. law enforcement,
security, and immigration enforcement
interests; determine whether the
country should continue in the program;
and report on its determination to
Congress.

All 38 countries participating in the Visa Waiver Program (VWP) have entered
into required agreements, or their equivalents, to (1) report lost and stolen
passports, (2) share identity information about known or suspected terrorists,
and (3) share criminal history information. However, not all countries have
shared information through the agreements. The Department of Homeland
Security (DHS) reported that all VWP countries have reported passport
information through the first agreement, but more than a third of VWP countries
are not sharing terrorist identity information through the second agreement and
more than a third of the countries have not yet shared criminal history
information through the third agreement. While VWP countries may share
information through other means, U.S. agency officials told GAO that information
sharing through the agreements is essential for national security. In August
2015, DHS decided to require VWP countries to implement agreements to share
terrorist identity and criminal history information; previously, VWP countries were
required to enter into, but not to implement, these agreements. However,
contrary to standard program management practices, DHS did not establish time
frames for instituting the amended requirements. In December 2015, Congress
passed a law requiring that VWP countries fully implement information-sharing
agreements in order to participate in the program. Time frames for working with
VWP countries to implement their agreements could help DHS enforce U.S.
legal requirements and could strengthen DHS’s ability to protect the United
States and its citizens.

GAO was asked to review the VWP. In
this report, GAO examines the extent to
which VWP countries have
implemented the required agreements.
GAO also examines the extent to which
DHS evaluated VWP countries and
reported to Congress as required. GAO
reviewed documents related to the
VWP, including a sample of DHS
reports. In addition, GAO interviewed
U.S. officials in Washington, D.C., and
U.S. and foreign officials in four VWP
countries selected on the basis of
factors such as high estimated
numbers of foreign terrorist fighters.
This is a public version of a classified
report GAO issued in January 2016.

GAO’s analysis of a nongeneralizeable sample of 12 internal DHS reports, each
evaluating one VWP country, found the reports assessed the effects of the
countries’ participation on U.S. law enforcement, security, and immigration
enforcement interests, as required by U.S. law. Since 2011, when GAO last
reviewed the VWP, DHS has improved its timeliness in reporting to Congress at
least once every 2 years its determinations of whether countries should continue
in the program. Nonetheless, as of October 31, 2015, GAO found that about a
quarter of DHS’s most recent VWP congressional reports were submitted, or
remained outstanding, 5 or more months past the statutory deadlines (see
figure). As a result, Congress may lack timely information needed to conduct
oversight of the VWP and assess whether further modifications are necessary to
prevent terrorists from exploiting the program.

What GAO Recommends
DHS should (1) specify time frames for
working with VWP countries on the
requirement to implement informationsharing agreements and (2) take steps
to improve its timeliness in reporting to
Congress on whether VWP countries
should continue in the program. DHS
concurred with the recommendations.

Visa Waiver Program Congressional Reports Past Due by 5 or More Months

View GAO-16-498. For more information,
contact Michael J. Courts at [phone] or
[e-mail]
United States Government Accountability Office

Contents

Letter

1
Background
All VWP Countries Have Entered into Required Agreements or
Equivalents, but Not All Are Sharing Information through Two
Agreements
DHS Has Evaluated Effects of VWP Countries’ Participation on
U.S. Interests but Has Not Provided Required Reports to
Congress on a Timely Basis
Conclusions
Recommendations for Executive Action
Agency Comments

4

18
20
21
21

Appendix I

Scope and Methodology

26

Appendix II

Comments from the Department of Homeland Security

30

Appendix III

GAO Contact and Staff Acknowledgments

33

11

Figures
Figure 1: Map of 38 Visa Waiver Program (VWP) Countries, with
Ranges of VWP Traveler Admissions to the United
States, Fiscal Year 2013
Figure 2: Visa Waiver Program Congressional Reports Past Due
by 5 or More Months

Page i

5
20

GAO-16-498 Visa Waiver Program

Abbreviations
CBP
DHS
DOJ
ESTA
FBI
HSPD-6
INTERPOL
ISIS
LASP
NOFORN
PCSC
State
TSC
VWP
VWPO

U.S. Customs and Border Protection
Department of Homeland Security
Department of Justice
Electronic System for Travel Authorization
Federal Bureau of Investigation
Homeland Security Presidential Directive 6
International Criminal Police Organization
Islamic State in Iraq and Syria
Lost and Stolen Passport
Not for release to foreign nationals
Preventing and Combating Serious Crime
Department of State
Terrorist Screening Center
Visa Waiver Program
Visa Waiver Program Office

This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.

Page ii

GAO-16-498 Visa Waiver Program

Letter

441 G St. N.W.
Washington, DC 20548

May 5, 2016
Congressional Requesters
The Visa Waiver Program (VWP) was established in 1986 to facilitate the
legitimate travel of visitors for business or tourism to the United States.
Qualifying nationals from the 38 countries participating in the VWP (VWP
countries)—for example, France, Germany, and Hungary—may travel
without a visa to the United States for business or tourism stays of up to
90 days. 1 In 2013, nationals from VWP countries were responsible for
more than $90 billion in travel and tourism expenditures in the United
States. However, some members of Congress have expressed concern
that foreign terrorist fighters might attempt to exploit the program to travel
to the United States, creating a potential terrorist threat. The Department
of State (State) has reported that in recent years, thousands of foreign
terrorist fighters—including many from VWP countries—have traveled to
countries such as Syria and Iraq to train with, support, or join extremist
groups, such as the self-proclaimed Islamic State in Iraq and Syria
(ISIS), 2 that are hostile to the United States.
The Department of Homeland Security (DHS), in consultation with State,
is responsible for oversight of the VWP. In 2007, Congress mandated
several changes to the program that were intended to enhance bilateral
cooperation on critical counterterrorism and information-sharing
initiatives, support and expand tourism and business opportunities to
enhance long-term competitiveness, and strengthen bilateral
relationships. 3 In response, DHS began requiring, among other things,
that VWP countries enter into bilateral agreements with the United States

1

The 38 VWP countries include Taiwan. Although the United States does not have
diplomatic relations with Taiwan, the Taiwan Relations Act of 1979 provides that
“[w]henever the laws of the United States refer or relate to foreign countries, nations,
states, governments, or similar entities, such terms shall include and such laws shall apply
with respect to Taiwan.” Pub. L. No. 96-8, §4, 93 Stat. 14, 15 (1979).
2
ISIS is also known as the Islamic State of Iraq and the Levant and by its Arabic acronym,
Da’esh.
3
Implementing Recommendations of the 9/11 Commission Act of 2007, Pub. L. No. 11053, Title VII, §711, 121 Stat. 266 (Aug. 3, 2007).

Page 1

GAO-16-498 Visa Waiver Program

to report information about the theft or loss of passports, share watch list
information about known or suspected terrorists, and establish
frameworks for enhanced law enforcement cooperation to share
information on criminal history and potential serious criminals. In addition,
Congress separately mandated that DHS, at least once every 2 years,
evaluate the effect that each VWP country’s participation in the program
has on the law enforcement and security interests of the United States,
including immigration enforcement; determine whether the country should
continue in, or be terminated from, the program; and report its
determination to Congress. 4 In 2011, we reported that only half of the
then 36 VWP countries had entered into all of the required informationsharing agreements. 5 In December 2015, Congress passed the Visa
Waiver Program Improvement and Terrorist Travel Prevention Act of
2015, amending certain VWP requirements to provide enhanced security
measures for the program, among other purposes. 6
You asked us to review the VWP. In this report, we examine the extent to
which (1) VWP countries have shared information through the required
information-sharing agreements 7 and U.S. agencies have been able to
use this information to address U.S. law enforcement and security
interests. We also examine the extent to which (2) DHS has, as required,
evaluated the effect of VWP countries’ participation on U.S. law

4

8 U.S.C. § 1187(c)(5).

5
GAO, Visa Waiver Program: DHS Has Implemented the Electronic System for Travel
Authorization, but Further Steps Needed to Address Potential Program Risks,
GAO-11-335 (Washington, D.C.: May 5, 2011).
6

Pub. L. No. 114-113, Div. O, Title II, § 201 et seq, Dec. 18, 2015. The law now prohibits
individuals who are nationals of, or have been present in, Iraq, Syria, or other designated
countries on or after March 1, 2011, from traveling to the United States through the VWP,
with certain exceptions; however, those individuals may apply for a U.S. visa. The law also
now requires that countries fully implement passenger information exchange agreements
in order to participate in the VWP. Additional requirements have been added regarding
machine-readable, electronic passports for individuals; country certifications of a
mechanism to validate passports; termination of designation for countries that fail to share
information or fail to screen individuals admitted to, or departing, the country for unlawful
activity; designation of high-risk program countries that may be suspended from the
program; and other enhancements to the electronic system for travel authorization.
7
In this report, “information-sharing agreements” generally refers to both agreements and
arrangements.

Page 2

GAO-16-498 Visa Waiver Program

enforcement and security interests and reported to Congress its
determinations of whether countries should continue participating in the
program.
This is a public version of a classified report we issued in January 2016.
DHS deemed information related to information sharing with specific VWP
countries, data provided through INTERPOL, and information related to
specific internal DHS procedures to be For Official Use Only. DOJ
deemed information related to information sharing with specific VWP
countries to be SECRET//NOFORN. 8
To determine the extent to which VWP countries have shared information
through the required information-sharing agreements, we reviewed
documentation of agreements, as well as relevant U.S. laws and agency
policies; analyzed U.S. agency data; and interviewed U.S. and selected
VWP country officials responsible for negotiating and implementing the
agreements. We interviewed VWP country officials in four countries
(Belgium, Greece, France, and Spain) that we selected on the basis of a
number of factors—in particular, high estimated total and per capita
numbers of foreign terrorist fighters and concerns about border security
and counterterrorism capacity. To determine the extent to which U.S.
agencies are able to use the shared information to address U.S. law
enforcement and security interests, we reviewed U.S. agency data and
documents and discussed with U.S. law enforcement and
counterterrorism officials in the United States and overseas the value and
utility of information obtained through the agreements.
To assess the extent to which DHS has evaluated VWP countries’ effect
on U.S. law enforcement and security interests, we selected and
analyzed a nongeneralizable sample of DHS reports of its evaluations of
12 VWP countries. We selected these countries on the basis of factors
such as high estimated numbers of foreign terrorist fighters and concerns
about border security and counterterrorism capacity. We also reviewed
relevant U.S. agency documents and guidance, such as DHS’s “Visa
Waiver Program Continuing Designation Country Reviews Standard

8

GAO, Visa Waiver Program: DHS Should Take Steps to Ensure Timeliness of
Information Needed to Protect U.S. National Security, GAO-16-178C (Washington, D.C.:
Jan. 27, 2016).

Page 3

GAO-16-498 Visa Waiver Program

Operating Procedures.” Additionally, in the four VWP countries we visited,
we interviewed U.S. agency and VWP country officials regarding DHS’s
processes for conducting its evaluations. To determine the extent to
which DHS has submitted the required reports to Congress, we collected
and analyzed information from DHS about the dates when the most
recent reports were due and when they were delivered, and we compared
the results of this analysis with findings from our 2011 review of the VWP
program. 9 In addition, we interviewed DHS officials about the process for
preparing the reports and submitting them to Congress. For additional
details of our scope and methodology, see appendix I.
We conducted this performance audit from October 2014 to January 2016
in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that
the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objectives.

Background

The VWP was established as a pilot program, with two participating
countries, in November 1986 10 and became a permanent program in
October 2000. 11 The program allows eligible nationals from the 38 VWP
countries to travel to the United States for 90 days or less for business or
pleasure without a visa and requires that VWP countries extend
reciprocal privileges to U.S. citizens. Additionally, the VWP makes it
possible for State to allocate more resources to visa-issuing posts in
countries with higher-risk applicant pools. In fiscal year 2013, there were
nearly 20 million traveler admissions to the United States under the VWP,
with admissions from each of the 38 countries ranging from about 700 to
more than 4 million (see fig. 1).

9

GAO-11-335.

10

Pub. L. No. 99-603, § 313, 100 Stat. 3359 (Nov. 6, 1986).

11

Visa Waiver Permanent Program Act, Pub. L. No. 106-396, 114 Stat. 1637 (Oct. 30,
2000).

Page 4

GAO-16-498 Visa Waiver Program

Figure 1: Map of 38 Visa Waiver Program (VWP) Countries, with Ranges of VWP Traveler Admissions to the United States,
Fiscal Year 2013

Page 5

GAO-16-498 Visa Waiver Program

Electronic System for
Travel Authorization

In August 2008, responding to a requirement in the Implementing
Recommendations of the 9/11 Commission Act of 2007, 12 DHS’s U.S.
Customs and Border Protection (CBP) introduced the Electronic System
for Travel Authorization (ESTA). In 2009, CBP began requiring all
travelers arriving by air or sea under the VWP to, among other things,
submit an application through ESTA before departure. VWP travelers are
also required to possess a passport containing an electronic chip (epassport) issued by the VWP country. 13
Before a traveler can depart for the United States under the VWP, CBP
vets the traveler’s ESTA application against several databases. 14 These
databases include, among others, the Federal Bureau of Investigation’s
(FBI) Terrorist Screening Database—the U.S. government’s consolidated
watch list of known or suspected terrorists—and the International Criminal
Police Organization’s (INTERPOL) Stolen and Lost Travel Documents
database. 15 If CBP approves an ESTA application, the VWP traveler is
authorized to depart for the United States. If CBP denies an ESTA
application, CBP refers the traveler to the U.S. embassy or consulate to
complete the standard visa application process. This process includes
submitting an application and being interviewed, fingerprinted, and vetted
against the FBI’s Terrorist Screening Database and INTERPOL’s Stolen
and Lost Travel Documents database, among others, before travel to the

12

Pub. L. No. 110-53, Title VII, Subtitle B, 121 Stat. 266, Aug. 3, 2007.

13

Before April 2016, VWP travelers were required to possess either a valid machinereadable passport or an e-passport.

14

In addition, according to DHS officials, CBP revets approved ESTA applications during
their validity periods to ensure that valid ESTAs are vetted against any new derogatory
information.

15

According to CBP officials, CBP also vets ESTA applications against, among others,
State’s Visa Revocation Service database, CBP’s Automated Targeting System–
Passenger database, the intelligence community’s system for vetting, and INTERPOL’s
Criminal Information System. In addition, airlines are required to submit information to
CBP at two points before a plane arrives at a U.S. port of entry. (1) When tickets are
purchased, airlines must submit each passenger’s name, destination, and flight details. (2)
Before passengers board commercial flights or vessels destined for a U.S. port of entry,
airlines must submit to CBP the full name, gender, and country of passport issuance for
each passenger, including those traveling under VWP. CBP uses this information to
identify potential threats and coordinate with carriers and foreign law enforcement to
prevent persons of interest from traveling to the United States.

Page 6

GAO-16-498 Visa Waiver Program

United States. At U.S. ports of entry, CBP interviews, fingerprints, and
photographs VWP travelers arriving by air or sea with an approved ESTA
as well as travelers with a U.S. visa and vets the fingerprints against
biometrics databases. 16
In November 2014, DHS revised the ESTA application to address
concerns that foreign terrorist fighters might exploit the VWP to enter the
United States. The revised application requires additional passport data,
contact information, information about connections to U.S. persons, and
any other names or aliases. According to DHS documents, DHS
determined that these revisions would improve its ability to vet
prospective VWP travelers and to more accurately and effectively identify
those who pose a security risk to U.S. interests. 17 DHS also rephrased
questions in the ESTA application to make them easier for the general
public to understand.

Requirements for
Continuing Participation in
VWP

In response to the Implementing Recommendations of the 9/11
Commission Act of 2007, 18 DHS worked with interagency partners to
develop several requirements to help prevent terrorists from using the
VWP to travel to the United States, according to DHS officials. To
continue participating in the program, each VWP country must, among
other things, accept repatriation of any citizens, former citizens, and
nationals ordered removed from the United States within 3 weeks of the
final order of removal. In addition, since before the 2007 act, VWP
countries have been required to extend reciprocal visa-free travel to U.S.

16

According to CBP officials, for individuals who travel to the United States, CBP officers
review entry documents, query CBP and other law enforcement databases, collect
biometrics, and interview each traveler to determine the purpose and intent of the travel
and to determine whether any further inspection is necessary, including questioning the
traveler further regarding national security, admissibility, customs, or agriculture concerns.

17

According to DHS officials, in addition to being useful for vetting travelers before they
arrive at a U.S. port of entry for inspection, data from ESTA applications allow DHS to look
for connections between persons known or suspected to be dangerous who are
attempting to enter the United States.

18

Pub L. No. 110-53, Title VII, Subtitle B, 121 Stat. 266, Aug. 3, 2007.

Page 7

GAO-16-498 Visa Waiver Program

citizens and issue machine-readable passports. 19 Further, the U.S.
government requires each country to enter into a
1. Lost and Stolen Passport (LASP) agreement to report information
about the theft or loss of passports,
2. Homeland Security Presidential Directive 6 (HSPD-6) arrangement to
share watch list information about known or suspected terrorists, and
3. Preventing and Combating Serious Crime (PCSC) agreement to
establish frameworks for enhanced law enforcement cooperation,
including sharing of criminal history information.
As of December 2015, all VWP countries are also required by law to,
among other things, fully implement their agreements to share information
on whether their citizens and nationals traveling to the United States
represent a threat to the security or welfare of the United States or its
citizens. 20
Under existing law, a number of factors can result in a VWP country’s
termination or suspension from the program. DHS is required to terminate
a country’s VWP designation if the country (1) experiences an emergency
that the DHS Secretary, in consultation with the Secretary of State,
determines to be a threat to the law enforcement or security interests of
the United States, including interests in enforcing U.S. immigration laws; 21
(2) does not report the theft or loss of passports, as jointly determined by

19

8 U.S.C. § 1187(a)(2)(A), (a)(3).

20

Pub. L. No. 114-113, Div. O, Title II, § 204(c).

21

8 U.S.C. § 1187(c)(5)(B) defines emergency as the overthrow of a democratically
elected government; war (including undeclared war, civil war, or other military activity) on
the territory of the program country; a severe breakdown in law and order affecting a
significant portion of the program country’s territory; a severe economic collapse in the
program country; or any other extraordinary event in the program country that threatens
the law enforcement or security interests of the United States (including the interest in
enforcement of the immigration laws of the United States) and where the country’s
participation in the program could contribute to that threat.

Page 8

GAO-16-498 Visa Waiver Program

DHS and State; 22 or (3) does not share required passenger information. 23
In addition, DHS may place on probationary status or, in certain
circumstances, terminate the designation of any VWP country if, following
certain criteria, more than 2 percent of the country’s nationals who
applied for admission as nonimmigrant visitors to the United States during
the previous fiscal year were denied admission, withdrew their application
for admission, or were admitted as nonimmigrant visitors and violated the
terms of admission. 24
In consultation with State, DHS also may for any reason—including
national security—rescind any waiver or designation previously granted at
any time or may refrain from waiving the visa requirement for nationals of
any country that may otherwise qualify for designation. 25 In addition, DHS
may terminate a VWP country’s designation if, in consultation with State,
DHS determines through its biennial evaluation that a country’s
participation is inconsistent with the law enforcement and security
interests of the United States, including U.S. interests in enforcing

22

Previously, the U.S. Attorney General had authority to terminate a VWP country’s
designation. In 2003, the Attorney General placed Belgium on provisional status because
of concerns about the integrity of non-machine-readable Belgian passports and the
Belgian government’s inadequate reporting of lost or stolen passports by the Belgian
government.
23

In addition, the Visa Waiver Program Improvement and Terrorist Travel Prevention Act
of 2015 requires DHS to terminate a country’s VWP designation if the country is not
screening for unlawful activity each noncitizen or nonnational of that country who is
admitted to, or departs from, the country, by using relevant databases and notices
maintained by INTERPOL, or other means designated by the Secretary of Homeland
Security. The screening requirement does not apply to travel between countries in the
Schengen zone.

24

8 U.S.C. § 1187(c)(3)(A), (f)(1)-(4). DHS must not continue the designation of a VWP
country if the sum of (a) the total number of nationals of that country who were denied
admission at the time of arrival or withdrew their application for admission during the
previous fiscal year and (b) the total number of nationals of that country who were
admitted as nonimmigrant visitors during the previous fiscal year who violated the terms of
admission was greater than 2 percent of the total number of nationals who applied for
admission. In addition, if the VWP country’s disqualification rate is greater than 2 percent
but less than 3.5 percent, the attorney general shall place the VWP country in
probationary status for a period not to exceed 2 full fiscal years following the year in which
the determination of the disqualification rate is made (8 U.S.C. § 1187(f)(1)(B)).
25

8 U.S.C. § 1187(d).

Page 9

GAO-16-498 Visa Waiver Program

immigration laws and securing criminal extraditions. 26 Further, in
consultation with State, DHS may suspend a VWP country’s designation
if the Director of National Intelligence informs the Secretary of Homeland
Security of any current and credible threat of an imminent danger to the
United States or its citizens that originates from a VWP country. 27

DHS Responsibilities for
VWP

Under U.S. law, DHS is required to periodically evaluate VWP countries
and report its findings to Congress. 28 In particular, DHS, in consultation
with State, must perform the following at least once every 2 years:
Evaluate the effect of each VWP country’s continued participation in
the program on U.S. law enforcement and national security interests
(including immigration enforcement interests).
Determine, based on the evaluation conducted, whether each VWP
country’s participation in the program should be continued or
terminated.
Submit a written report to appropriate congressional committees,
including the Secretary’s determination with an explanation of any
effects of each VWP country’s continued participation in the program
on U.S. law enforcement and security interests.
Submit a written report to Congress regarding the implementation of
the electronic system for travel authorization. 29

26

8 U.S.C. § 1187(c)(5)(A).

27

8 U.S.C. § 1187(c)(5)(B).

28

8 U.S.C. § 1187(c)(5).

29

In addition, as of December 2015, DHS is required to submit a report to the appropriate
congressional committees that includes an assessment of the threat to U.S. national
security of the designation of each VWP country, including the compliance of the
government of each country with requirements to enter into, and implement, informationsharing agreements as well as each government’s capacity to comply with such
requirements. Appropriate congressional committees comprise the Committee on the
Judiciary, the Committee on Foreign Affairs, the Permanent Select Committee on
Intelligence, and the Committee on Homeland Security of the House of Representatives
and the Committee on the Judiciary, the Committee on Foreign Relations, the Select
Committee on Intelligence, and the Committee on Homeland Security and Governmental
Affairs of the Senate.

Page 10

GAO-16-498 Visa Waiver Program

Within DHS, the Visa Waiver Program Office (VWPO) is responsible for
overseeing and monitoring VWP countries’ adherence to the program’s
statutory and policy requirements. VWPO’s responsibilities include
evaluating the effects of VWP countries’ participation in the program,
preparing the Secretary of Homeland Security’s determinations to
continue or terminate VWP countries’ participation, and submitting the
written reports to Congress. According to VWPO officials, the office also
monitors VWP country security, law enforcement, and immigration
enforcement issues outside the formal review periods to identify issues
that could negatively affect U.S. interests. In addition, the DHS Office of
Intelligence and Analysis produces an independent intelligence review of
each VWP country, examining threats associated with the country’s
participation in the VWP, the country’s counterterrorism capabilities, and
the country’s information sharing with the United States about terrorist
threats, according to officials from that office.

All VWP Countries
Have Entered into
Required Agreements
or Equivalents, but
Not All Are Sharing
Information through
Two Agreements

All 38 countries participating in the VWP have entered into the three types
of required information-sharing agreements, or their equivalents, with the
United States, but not all countries are sharing information through two of
the agreements. According to DHS, all VWP countries are reporting
losses or thefts of passports through LASP agreements, although DHS
previously placed two countries on provisional status partly because of a
lack of timely reporting. However, as of December 2015, about a third of
VWP countries were not sharing identity information about known or
suspected terrorists through HSPD-6 arrangements. Also, about a third of
VWP countries had not yet shared criminal history information through
PCSC agreements. Although U.S. agencies receive law enforcement and
national security information from VWP countries through other means,
such as multilateral entities, the U.S. government identified the
information-sharing agreements as critical for protecting the United States
from nationals of VWP countries who might present a threat. While U.S.
law before December 2015 required VWP countries to enter into, but not
to implement, the agreements, DHS announced in August 2015 that it
had developed a new requirement that countries implement them by

Page 11

GAO-16-498 Visa Waiver Program

sharing information. 30 However, contrary to standard program
management practices, DHS has not specified time frames for working
with VWP countries to institute this and other new VWP security
requirements.

VWP Countries Are
Reporting through LASP
Agreements, and U.S.
Agencies Use Shared
Information to Vet
Travelers

All 38 VWP countries have entered into LASP agreements with the United
States and, according to DHS officials, are reporting lost or stolen
passports through the agreements. Before December 2015, U.S. law
required that VWP countries enter into an agreement with the United
States to report, or to make available to the U.S. government through
INTERPOL or other means designated by the Secretary of Homeland
Security, information about the theft or loss of passports within a strict
time limit and in a manner specified in the agreement. Since December
2015, U.S. law has required that countries agree to report on lost and
stolen passports not later than 24 hours after becoming aware of the theft
or loss. 31 Of the 38 countries, 35 agreed to report lost or stolen travel
documents exclusively through INTERPOL and in accordance with
INTERPOL standards. According to DHS officials, 2 of the remaining
countries agreed to report through the Regional Movement Alert System,
an alternative mechanism for reporting LASP information that provides a
direct query capability between national document-issuing authorities and
border control systems; the third country agreed to report through another
means. According to VWPO officials, VWPO considers all VWP countries
to be in compliance with the requirement to report lost and stolen
passports. VWPO officials noted that VWPO bases its compliance
determinations in part on data from INTERPOL’s Stolen and Lost Travel
Documents database that are available to VWPO and other U.S.
agencies.
DHS and State use information about lost and stolen passports to vet
travelers to the United States. DHS’s CBP uses information obtained

30
In December 2015, Congress passed the Visa Waiver Program Improvement and
Terrorist Travel Prevention Act of 2015, amending certain VWP requirements (Pub. L. No.
114-113, Div. O, Title II, § 201 et seq, Dec. 18, 2015). Federal law now requires countries
to fully implement information-sharing agreements in order to participate in the VWP. 8
U.S.C. § 1187(c)(2)(F).
31

8 U.S.C. § 1187(c)(2)(D).

Page 12

GAO-16-498 Visa Waiver Program

through the LASP agreements to vet foreign travelers attempting to enter
the United States, which, according to CBP and DOJ documents, may
help counter the threat of foreign terrorist fighters. CBP and State use this
information to vet travelers’ ESTA applications and visa applications
before travel, and CBP uses it to vet foreign passports of all travelers
before boarding and at U.S. ports of entry. According to testimony by the
DHS Deputy Assistant Secretary for International Affairs, CBP has denied
over 165,000 ESTA applications since 2008 on the basis of LASP
information, potentially preventing criminals or terrorists from using stolen
passports to illegally enter the United States. In 2013, U.S. agencies—
primarily DHS—queried INTERPOL’s Stolen and Lost Travel Documents
database over 238 million times.

Not All VWP Countries Are
Sharing Information
through HSPD-6
Arrangements, but Shared
Information Has Enhanced
Terrorist Watch List

All VWP countries have entered into HSPD-6 or equivalent arrangements
to exchange information with the United States about known or suspected
terrorists, but not all countries are sharing information through these
arrangements. U.S. law requires that each VWP country enter into an
agreement with the United States to share information regarding whether
the country’s citizens and nationals traveling to the United States
represent a threat to the security or welfare of the United States or its
citizens. 32 Since December 2015, U.S. law has also required that VWP
countries fully implement these agreements. 33 State’s Bureau of
Counterterrorism and the FBI’s Terrorist Screening Center (TSC)
negotiate HSPD-6 arrangements between the U.S. government and VWP
countries. 34 Under the arrangements, VWP countries share information
directly with the TSC, which then integrates the information into the U.S.
terrorist watch list.

32
8 U.S.C. § 1187(c)(2)(F). The U.S. government determined that HSPD-6 arrangements,
in conjunction with PCSC agreements, would satisfy this requirement.
33

Pub. L. No. 114-113, Div. O, Title II, § 204(c); codified at 8 U.S.C. § 1187(c)(2)(F).

34

In 2003, the President signed HSPD-6, directing the Attorney General to establish an
organization to “consolidate the Government’s approach to terrorism screening and
provide for the appropriate and lawful use of Terrorist Information in screening processes.”
As a result, the Attorney General created the TSC within the FBI, with the goal of
developing the U.S. government’s consolidated, unified approach to watch-listing known
and suspected terrorists. TSC is the primary U.S. entity to manage and maintain the
terrorist watch list.

Page 13

GAO-16-498 Visa Waiver Program

As of December 2015, most VWP countries were exchanging information
about known or suspected terrorists with the TSC through HSPD-6
arrangements, but about a third of VWP countries were not exchanging
information directly with the TSC. The TSC reported in December 2015
that the number of known or suspected terrorist identities that each VWP
country had shared with the TSC through HSPD-6 arrangements ranged
from zero to over 1,000. For example, one country that entered into a
HSPD-6 arrangement in 2012 had not shared information through the
arrangement as of December 2015. According to DHS officials, some
countries share information about known or suspected terrorists with U.S.
agencies through alternative arrangements rather than sharing directly
with the TSC.
Information provided through the HSPD-6 arrangements has enhanced
U.S. traveler-screening capabilities and improved U.S. agencies’ ability to
prevent known and suspected terrorists from traveling to the United
States. According to FBI documents, from 2008 through 2015, the TSC
received information about approximately 9,000 known or suspected
terrorists, including approximately 3,500 who were previously unidentified,
through HSPD-6 arrangements with VWP countries. 35 The FBI integrates
into the Terrorist Screening Database the information that VWP countries
provide to the TSC, and U.S. agencies reported using the database to vet
travelers attempting to enter the United States. CBP vets ESTA
applications against the Terrorist Screening Database to identify any
potential known or suspected terrorists attempting to use the VWP to
travel to the United States. According to the DHS Deputy Assistant
Secretary for International Affairs, since 2008, CBP has denied over
4,300 ESTA applications for national security concerns as a result of
vetting against the Terrorist Screening Database and other terrorismrelated databases. In addition, at ports-of-entry, CBP vets every
international traveler attempting to enter the United States against the
database, according to DHS documents. State also uses the Terrorist
Screening Database to vet visa applicants.

35

According to FBI officials, since August 2015, the TSC has received information about
approximately 3,400 known or suspected terrorists, including approximately 1,000 who
were previously unidentified.

Page 14

GAO-16-498 Visa Waiver Program

Not All VWP Countries
Have Shared Information
through PCSC or
Equivalent Agreements,
but Shared Information
Has Aided Criminal
Investigations

As of February 2014, all 38 VWP countries had entered into PCSC
agreements, or their equivalents, with the United States regarding the
exchange of information about criminals who pose a risk to U.S. interests,
but not all VWP countries had shared information through the
agreements. U.S. law requires that VWP countries enter into an
agreement with the United States to share information regarding whether
citizens and nationals of that country traveling to the United States
represent a threat to the security or welfare of the United States or its
citizens. 36 Since December 2015, U.S. law has also required that VWP
countries fully implement these agreements. In some cases, countries
entered into the agreements several years after the requirement to enter
into agreements was established in 2008. According to DHS officials, the
existing domestic political environments of individual VWP countries may
have delayed some countries’ entry into the agreements.
As of September 2015, about two-thirds of VWP countries had shared
information about criminals with U.S. agencies through PCSC or
equivalent agreements, using interim, manual query mechanisms—either
electronic file transfer systems or compact disc exchanges. The
remaining VWP countries had not shared such information through the
agreements. For example, one country that entered into a PCSC
agreement in 2008 had not shared information through the agreement as
of September 2015. PCSC agreements are intended to automate and
expedite the sharing of information about individuals suspected or
convicted of committing serious crimes, according to DHS officials. 37
PCSC agreements allow for the exchange of biometric data, such as
fingerprints, and biographic data of suspected criminals while protecting
individual privacy. 38 According to DHS, by authorizing both the United

36

8 U.S.C. § 1187(c)(2)(F). The U.S. government determined that PCSC agreements, in
conjunction with HSPD-6 arrangements, would satisfy this requirement.

37

PCSC agreements include provisions similar to some of those of the 2005 Prüm
Convention, which Belgium, Germany, Spain, France, Luxembourg, the Netherlands, and
Austria signed in Prüm, Germany, in May 2005. The Prüm Convention’s purpose was to
increase cross-border cooperation, particularly in combating terrorism, cross-border crime,
and illegal migration.

38

PCSC agreements generally require measures to ensure the protection and privacy of
citizens in both countries. PCSC agreements contain numerous provisions pertaining to
the handling, sharing, and retention of relevant data, all designed to ensure privacy and
data protection.

Page 15

GAO-16-498 Visa Waiver Program

States and a VWP country to conduct automated queries of the other’s
criminal fingerprint databases, PCSC agreements establish a framework
for enhanced law enforcement cooperation.
Both DOJ and DHS reported using interim exchange mechanisms
established through PCSC agreements to aid in law enforcement
investigations. Likewise, many VWP countries had used interim exchange
mechanisms to query U.S. law enforcement databases. As of January
2016, U.S. agencies and VWP countries had not fully established virtual
private networks to allow for automated querying of criminal databases as
authorized by PCSC agreements. However, the FBI reported working with
several VWP countries to establish these networks.

U.S. Agencies May
Receive Information from
VWP Countries through
Other Means

In addition to receiving information through the three agreements required
for participation in VWP, U.S. agencies may receive information related to
national security and law enforcement through other means, such as
multilateral entities. For example, since 2013, INTERPOL has issued 670
notices seeking arrest and extradition of suspected foreign terrorist
fighters to all 190 of its members, and individual members had issued an
additional 2,100 alerts. The United States also works with an international
coalition—which includes at least 30 VWP countries—to counter threats
posed by ISIS, such as the threat of foreign terrorist fighters’ entering this
country. The coalition has a working group focused on disrupting the
recruitment, travel, and sustainment of foreign terrorist fighters.
While VWP countries may use other means to share information that is
useful to U.S. agencies responsible for law enforcement and national
security, the U.S. government identified the three information-sharing
agreements as critical for protecting the United States from nationals of
VWP countries who might present a threat. As we reported in 2011, DHS
officials told us that formal agreements—in contrast to the sharing of
information on an informal, case-by-case basis—expand the pool of
information to which the United States has systematic access and
generally expedite information sharing by laying out specific terms that
can be referenced easily in requests for data. 39 DHS officials observed

39

GAO-11-335.

Page 16

GAO-16-498 Visa Waiver Program

that timely access to information is especially important for CBP officials
at ports of entry.

DHS Lacks Time Frames
for Instituting a
Requirement to Share
Information through
HSPD-6 Arrangements
and PCSC Agreements

In August 2015, the Secretary of Homeland Security announced that DHS
and other agencies were developing additional requirements for VWP
participation, including a requirement to implement HSPD-6 and PCSC
agreements by sharing information. 40 Previously, in accordance with U.S.
law, DHS required VWP countries to enter into the arrangements and
agreements but did not require the countries to implement them in order
to participate in the program. According to testimony by the Secretary,
DHS developed the new VWP requirements in order to detect and
prevent travel by foreign terrorist fighters. 41
However, contrary to standard program management practices, DHS did
not establish time frames for instituting the new requirements. In October
2015, DHS officials confirmed that the department had not established
time frames for DHS’s consultations with each country or for instituting
the new requirements. 42 Standard practices in program and project
management call for, among other things, developing a plan to execute
specific projects needed to obtain defined results within a specified time
frame. 43 Time frames for working with VWP countries to institute the
requirement to implement the HSPD-6 arrangements and PCSC
agreements could help DHS ensure that countries meet all legal criteria
for participating in the VWP—including the December 2015 law requiring

40

The additional security criteria that DHS announced in August 2015 also include (1)
required use of e-passports for all VWP travelers coming to the United States, (2)
permission for the expanded use of U.S. federal air marshals on international flights from
VWP countries to the United States, (3) collection and analysis of travel data, (4) use of
INTERPOL’s Stolen and Lost Travel Documents database to screen travelers, (5)
reporting of foreign fighters to multilateral security organizations, and (6) cooperation on
the screening of refugees and asylum seekers. In November 2015, the administration
issued a separate statement about changes to the VWP.

41

In December 2015, Congress passed a law requiring VWP countries to fully implement
the agreements in order to participate in the program.

42

In January 2016, DHS officials stated that DHS has developed a timeline for
implementing the requirement for all VWP travelers to use e-passports.

43

Project Management Institute, The Standard for Program Management (2013).

Page 17

GAO-16-498 Visa Waiver Program

them to fully implement their agreements 44—and could help DHS protect
against threats to the United States or its citizens.

DHS Has Evaluated
Effects of VWP
Countries’
Participation on U.S.
Interests but Has Not
Provided Required
Reports to Congress
on a Timely Basis

Our analysis of a nongeneralizable sample of 12 internal VWPO
evaluation reports on VWP countries found that VWPO assessed the
effect of the countries’ participation in the program on U.S. law
enforcement and security interests, including immigration enforcement, as
required by federal law. However, almost one-quarter of DHS’s most
recent reports to Congress regarding whether VWP countries should
continue to participate in the program were submitted, or remained
outstanding, 5 or more months after the dates when DHS had determined
that, under U.S. law, they were due. As a result, Congress may lack
timely information that it needs to conduct oversight of the VWP.

Sampled Internal
Evaluations of VWP
Countries Addressed U.S.
Law Enforcement and
Security Interests,
Including Immigration
Enforcement

The internal VWPO evaluation reports for 12 countries that we reviewed
showed that, for each of these countries, VWPO assessed the effect of
the country’s participation in the program on U.S. law enforcement and
security interests, including immigration enforcement, as required by U.S.
law. The law states, among other things, that DHS, in consultation with
State, must periodically evaluate the effect of each VWP country’s
continued participation in the program on U.S. law enforcement and
security interests, including immigration enforcement interests. 45 VWPO
standard operating procedures lay out steps for conducting, and for
reporting internally on, VWPO’s evaluations of VWP countries, which it
uses to prepare the required DHS reports to Congress. 46

44

Pub. L. No. 114-113, Div. O, Title II, § 204(c); codified at 8 U.S.C. § 1187(c)(2)(F).

45

8 U.S.C. § 1187(c)(5). DHS, in consultation with State, must conduct this evaluation not
less than once every 2 years.

46

Department of Homeland Security, Visa Waiver Program Office, “Visa Waiver Program
Continuing Designation Country Reviews Standard Operating Procedures” (January
2015).

Page 18

GAO-16-498 Visa Waiver Program

For the 12 countries, VWPO completed 10 internal evaluation reports
after a site visit to the relevant VWP country and completed 2 reports on
the basis of desk-based, administrative reviews. In the 12 reports, the
required sections on law enforcement interests and security interests,
including immigration enforcement interests, had been updated from
previous evaluations of the VWP country. The reports showed that VWPO
consulted broadly with relevant U.S. agency officials, both in Washington,
D.C., and at overseas posts and also consulted with relevant foreign
VWP country officials to gather information about law enforcement
interests, security interests, and immigration enforcement interests.
Moreover, according to U.S. officials and VWP country officials whom we
spoke with overseas, VWPO’s site visits, including questionnaires sent to
countries beforehand, were generally thorough and complete and
addressed the topic of foreign terrorist fighters.

DHS Has Not Consistently
Submitted Required
Reports about Visa Waiver
Program Countries on a
Timely Basis to Support
Congressional Oversight

Our review showed that almost a quarter of DHS’s most recent reports to
Congress about VWP countries were submitted 5 or more months after
the dates when, according to DHS, they were due under U.S. law. 47 U.S.
law requires DHS to submit a written report to Congress for each VWP
country not less than once every 2 years. Each report must provide
DHS’s determination of whether the country’s participation in the program
should be continued or terminated as well as an explanation of any
effects of the country’s continued participation on U.S. law enforcement
and security interests, including immigration enforcement interests. 48
Because of DHS’s inconsistency in submitting the reports within the
required statutory time frame, Congress may lack access to timely
information needed for its oversight of the VWP.
DHS’s timeliness in reporting to Congress about VWP countries has
improved since 2011, when we found that the department had not
completed half of its recent VWP congressional reports in a timely

47

To determine the extent to which DHS has submitted the required reports to Congress,
we collected and analyzed information from DHS that documented the dates when its
most recent reports were due to Congress and the dates when they were delivered.

48

8 U.S.C. § 1187(c)(5).

Page 19

GAO-16-498 Visa Waiver Program

manner and that many of the reports were more than a year past due. 49
Nonetheless, our current analysis shows that as of October 31, 2015, 28
of DHS’s 38 most recent congressional reports on VWP countries had
been submitted, or remained outstanding, 1 or more months after the due
dates. Nine of those reports were 5 or more months past due, including 2
that were past due by more than a year (see fig. 2).
Figure 2: Visa Waiver Program Congressional Reports Past Due by 5 or More
Months

Conclusions

Since its establishment in 1986, the VWP has evolved to address U.S.
national security and law enforcement interests while allowing travelers
from VWP countries to contribute significantly to the U.S. economy. Most
recently, the Visa Waiver Program Improvement and Terrorist Travel
Prevention Act of 2015 included changes to the program—including
requiring VWP countries to fully implement their agreements—that may
help prevent foreign terrorist fighters from attempting to exploit it to travel
to this country. U.S. agencies have used information that some VWP
countries have shared under the required agreements or their equivalents
to mitigate this and other threats to U.S. interests. However, because
many VWP countries have not yet provided information through the
agreements—possibly including information about known or suspected
terrorists—agencies’ access to this critical information may be limited.
Time frames for instituting the new requirement that VWP countries fully

49

Our 2011 report recommended that DHS take steps to address delays in submitting
VWP congressional reports to Congress (see GAO-11-335). According to VWPO officials,
VWPO began sending VWP congressional reports in a batch system in 2012, partly in
response to our 2011 recommendation.

Page 20

GAO-16-498 Visa Waiver Program

implement the information-sharing agreements could help strengthen
DHS’s ability to protect against threats to the security of the United States
and its citizens.
The VWPO internal reports that we reviewed showed that DHS has
evaluated the effect of VWP countries’ participation in the program on
U.S. security and law enforcement interests, as required by law. DHS has
also improved the timeliness of its required reports to Congress about the
effects of VWP countries’ participation in the program on U.S. interests
and its determinations of countries’ eligibility to continue in the program.
Nonetheless, DHS’s inconsistency in submitting its congressional reports
by the statutory deadlines may have limited Congress’s access to
information needed for conducting oversight of the VWP and identifying
any modifications to the program necessary to protect U.S. law
enforcement and national security interests.

Recommendations for
Executive Action

To strengthen DHS’s ability to fulfill legislative requirements for the VWP
and protect the security of the United States and its citizens, we are
making the following two recommendations to the Secretary of Homeland
Security:
Specify time frames for working with VWP countries to institute the
additional VWP security requirements, including the requirement that
the countries fully implement agreements to share information about
known or suspected terrorists through the countries’ HSPD-6
arrangements and PCSC agreements with the United States.
Take steps to improve DHS’s timeliness in reporting to Congress,
within the statutory time frame, the department’s determination of
whether each VWP country should continue participating in the
program and any effects of the country’s participation on U.S. law
enforcement and security interests.

Agency Comments

We provided a draft of the classified report to DHS, DOJ, and State for
their review and comment. DHS and DOJ provided technical comments,
which we incorporated as appropriate. DHS also provided written
comments, which are reproduced in appendix II. In its written comments,
DHS concurred with both of our recommendations. In addition, DHS
noted that it had begun taking steps to address our first recommendation
and was planning actions to address our second recommendation.

Page 21

GAO-16-498 Visa Waiver Program

As agreed with your offices, unless you publicly announce the contents of
this report earlier, we plan no further distribution until 30 days from the
report date. At that time, we will send copies to the appropriate
congressional committees, the Secretary of Homeland Security, the
Secretary of State, and the Attorney General of the United States. In
addition, the report will be available at no charge on the GAO website at
http://www.gao.gov.
If you or your staff have any questions concerning this report, please
contact Michael J. Courts at [phone] or [e-mail].
Contact points for our Offices of Congressional Relations and Public
Affairs may be found on the last page of this report. GAO staff who made
key contributions to this report are listed in appendix III.

Michael J. Courts
Director, International Affairs and Trade

Page 22

GAO-16-498 Visa Waiver Program

List of Requesters
The Honorable Michael T. McCaul
Chairman
The Honorable Bennie G. Thompson
Ranking Member
Committee on Homeland Security
House of Representatives
The Honorable Martha McSally
Chairman
The Honorable Filemon Vela
Ranking Member
Subcommittee on Border and Maritime Security
Committee on Homeland Security
House of Representatives
The Honorable Peter T. King
Chairman
The Honorable Brian Higgins
Ranking Member
Subcommittee on Counterterrorism and Intelligence
Committee on Homeland Security
House of Representatives
The Honorable John Ratcliffe
Chairman
The Honorable Cedric L. Richmond
Ranking Member
Subcommittee on Cybersecurity, Infrastructure Protection,
and Security Technologies
Committee on Homeland Security
House of Representatives
The Honorable Daniel M. Donovan, Jr.
Chairman
The Honorable Donald M. Payne, Jr.
Ranking Member
Subcommittee on Emergency Preparedness, Response,
and Communications
Committee on Homeland Security
House of Representatives

Page 23

GAO-16-498 Visa Waiver Program

The Honorable Scott Perry
Chairman
The Honorable Bonnie Watson Coleman
Ranking Member
Subcommittee on Oversight and Management Efficiency
Committee on Homeland Security
House of Representatives
The Honorable John M. Katko
Chairman
The Honorable Kathleen M. Rice
Ranking Member
Subcommittee on Transportation Security
Committee on Homeland Security
House of Representatives
The Honorable Susan Brooks
House of Representatives
The Honorable Jeff Duncan
House of Representatives
The Honorable Richard Hudson
House of Representatives
The Honorable William R. Keating
House of Representatives
The Honorable James R. Langevin
House of Representatives
The Honorable Sheila Jackson Lee
House of Representatives
The Honorable Patrick Meehan
House of Representatives
The Honorable Candice S. Miller
House of Representatives
The Honorable Loretta Sanchez
House of Representatives

Page 24

GAO-16-498 Visa Waiver Program

The Honorable Norma J. Torres
House of Representatives

Page 25

GAO-16-498 Visa Waiver Program

Appendix I: Scope and Methodology

Appendix I: Scope and Methodology

To determine whether Visa Waiver Program (VWP) countries have
entered into the required Lost and Stolen Passport (LASP) agreements,
Homeland Security Presidential Directive 6 (HSPD-6) arrangements, and
Preventing and Combating Serious Crime (PCSC) agreements, we
analyzed data provided by the Department of Homeland Security (DHS)
and interviewed officials from DHS and the Department of State (State) in
Washington, D.C. We also reviewed supporting documentation from DHS
and State, such as diplomatic notes, letters of intent, and memorandums
of understanding, that indicate whether countries entered into the
agreements. To identify the information-sharing requirements, we
reviewed relevant U.S. law and DHS policy. In addition, to better
understand what each agreement entailed and to learn of any associated
challenges, we interviewed officials from the agencies that are
responsible for negotiating each agreement. We determined that the
information we obtained was sufficiently reliable for our purposes.
To determine the extent to which VWP countries have implemented LASP
agreements, HSPD-6 arrangements, and PCSC agreements, or their
equivalents, we analyzed data from DHS and the Department of Justice
(DOJ) showing the status of, and information sharing through, the signed
agreements and arrangements. We also visited four VWP countries:
Belgium, Greece, France, and Spain. We selected these countries from
among the 38 VWP countries on the basis of numerous factors—in
particular, high estimated total and per capita numbers of foreign fighters
and concerns about border security and counterterrorism capacity. In
these four countries, we interviewed U.S. and VWP country officials
responsible for implementing the agreements and arrangements to
understand challenges associated with the countries’ sharing information
with the United States.

LASP agreements. To examine VWP countries’ sharing of information
about lost and stolen passports, we reviewed data provided by DHS
and INTERPOL for calendar years 2014 and 2015. We also discussed
with DHS officials their level of engagement with VWP countries
regarding the timeliness of their information sharing under the LASP
agreement. Although we discussed the DHS and INTERPOL data
with DHS and DOJ officials, we did not interview officials of all VWP
countries that report through INTERPOL. DOJ officials described their
uses and checks of the data they received. We determined that the
DHS and INTERPOL data were sufficiently reliable for placing the
reporting countries in broad categories that indicate the relative
frequency with which they report to INTERPOL but were not

Page 26

GAO-16-498 Visa Waiver Program

Appendix I: Scope and Methodology

sufficiently reliable for determining the countries’ compliance with the
VWP requirement to report lost and stolen passports. We did not
independently verify the legal status of each VWP country’s LASP
agreement.
HSPD-6 arrangements. To examine VWP countries’ information
sharing through HSPD-6 arrangements, we reviewed information that
we received from the Federal Bureau of Investigation (FBI) about
VWP countries’ provision of information through these arrangements
or their equivalents. When we encountered anomalies in the
information we received, we discussed and resolved them with
agency officials. We discussed the data with DOJ officials but did not
interview officials of all VWP countries that report to the Terrorist
Screening Center. DOJ officials described their uses and checks of
the data they received but stated that they did not formally study the
accuracy of the underlying data. We determined that the FBI data we
received were sufficiently reliable for placing the reporting countries in
broad categories that indicate the relative volume and frequency of
their reporting of information to the Terrorist Screening Center through
HSPD-6 arrangements or their equivalents. We did not independently
verify the legal status of each VWP country’s HSPD-6 arrangement.
PCSC agreements. To examine VWP countries’ information sharing
through PCSC agreements, as well as the mechanisms that VWP
countries have established for sharing information through the
agreements, we reviewed information and data that DHS and DOJ
provided. We discussed the data with DOJ officials but did not
interview VWP country officials regarding the data. DOJ officials
described their uses and checks of the data they received but stated
that they did not formally study the data’s accuracy. We determined
that the data were sufficiently reliable to place countries into broad
categories that indicate the relative frequency with which they shared
information. We did not independently verify the legal status of each
VWP country’s PCSC agreement.
In addition, to determine the extent to which U.S. agencies have been
able to use the shared information to address U.S. law enforcement and
security interests, we reviewed U.S. agency data and documents
reporting the agencies’ use of information shared through the
agreements. We also discussed the value and utility of information
obtained through the agreements with U.S. law enforcement and
counterterrorism officials in the United States and in the countries where

Page 27

GAO-16-498 Visa Waiver Program

Appendix I: Scope and Methodology

we conducted our fieldwork. We determined that the information and data
provided were sufficiently reliable for the purposes of this report.
To determine the extent to which DHS has evaluated VWP countries’
effect on U.S. security and law enforcement interests, including
immigration enforcement, we selected and analyzed a nongeneralizable
sample of 12 internal DHS reports evaluating VWP countries. We
selected these reports on the basis of a number of factors chosen to
identify countries where concerns might exist regarding foreign terrorist
fighters traveling to the United States—for example, high estimated
numbers of foreign terrorist fighters; border security and counterterrorism
capacity concerns; a high number of ESTA denials; number of travelers to
the United States, including the percentage that traveled under the VWP;
relative population size (e.g., large or small); date of entry into the VWP
(i.e., pre-2000, 2001-2010, 2010-the present); geographic variation (e.g.,
Western Europe, Eastern Europe, the Asia Pacific region); and status of
VWP information-sharing agreements as characterized by U.S. agencies
(i.e., whether agreements had been signed, were ratified, and were in
force and whether sharing had occurred). We used a data collection
instrument developed in consultation with a methodological expert to
analyze the nongeneralizable sample of 12 internal DHS reports. We also
reviewed relevant U.S. agency documents and guidance, such as
VWPO’s January 2015 “Visa Waiver Program Continuing Designation
Country Reviews Standard Operating Procedures.” In addition, we
interviewed U.S. agency and VWP country officials regarding the
processes for conducting the evaluations and communicating results of
the evaluations to VWP countries.
To determine the extent to which DHS has submitted required reports
about VWP countries to Congress, we collected and analyzed information
from DHS that documented the due dates and actual delivery dates to
Congress for DHS’s most recent VWP congressional reports. To assess
DHS’s timeliness in submitting the required reports to Congress since
2011, when we last reviewed the VWP, we compared the results of our
current analysis with our 2011 findings on DHS’s timeliness in submitting

Page 28

GAO-16-498 Visa Waiver Program

Appendix I: Scope and Methodology

the reports. 1 In addition, we interviewed VWPO officials regarding the
process they use to prepare the reports and submit them to Congress.
We determined that the information we obtained was sufficiently reliable
for our purposes.
We conducted this performance audit from October 2014 to January 2016
in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that
evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objectives.

1

(U) GAO, Visa Waiver Program: DHS Has Implemented the Electronic System for Travel
Authorization, but Further Steps Needed to Address Potential Program Risks,
GAO-11-335 (Washington, D.C.: May 5, 2011).

Page 29

GAO-16-498 Visa Waiver Program

Appendix II: Comments from the Department
of Homeland Security
Appendix II: Comments from the Department
of Homeland Security

Page 30

GAO-16-498 Visa Waiver Program

Appendix II: Comments from the Department
of Homeland Security

Page 31

GAO-16-498 Visa Waiver Program

Appendix II: Comments from the Department
of Homeland Security

.

Page 32

GAO-16-498 Visa Waiver Program

Appendix III: GAO Contact and Staff
Acknowledgments
Appendix III: GAO Contact and Staff
Acknowledgments

GAO Contact

Michael J. Courts, [phone] or [e-mail].

Staff
Acknowledgments

In addition to the contact named above, Hynek Kalkus (Assistant
Director), Ian Ferguson, Brandon Hunt, Reid Lowe, and Christal Ann
Simanski made key contributions to this report. Ashley Alley, Kathryn
Bernet, Jose Cardenas, Martin De Alteriis, and Ozzy Trevino also
provided assistance.

(100477)

Page 33

GAO-16-498 Visa Waiver Program

GAO’s Mission

The Government Accountability Office, the audit, evaluation, and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding decisions.
GAO’s commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

Obtaining Copies of
GAO Reports and
Testimony

The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO’s website (http://www.gao.gov). Each weekday
afternoon, GAO posts on its website newly released reports, testimony,
and correspondence. To have GAO e-mail you a list of newly posted
products, go to http://www.gao.gov and select “E-mail Updates.”

Order by Phone

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s website,
http://www.gao.gov/ordering.htm.
Place orders by calling [phone], toll free [phone], or
TDD [phone].
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Subscribe to our RSS Feeds or E-mail Updates.
Listen to our Podcasts and read The Watchblog.
Visit GAO on the web at www.gao.gov.

To Report Fraud,
Waste, and Abuse in
Federal Programs

Contact:
Website: http://www.gao.gov/fraudnet/fraudnet.htm
E-mail: [e-mail]
Automated answering system: [phone] or [phone]

Congressional
Relations

Katherine Siggerud, Managing Director, [e-mail], (202) 5124400, U.S. Government Accountability Office, 441 G Street NW, Room
7125, Washington, DC 20548

Public Affairs

Chuck Young, Managing Director, [e-mail], [phone]
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, DC 20548

Please Print on Recycled Paper.