This is the accessible text file for GAO report number GAO-07-248 
entitled 'Border Security: US-Visit Program Faces Strategic, 
Operational, and Technological Challenges at Land Ports of Entry' which 
was released on December 14, 2006. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to Congressional Requesters: 

United States Government Accountability Office: 

GAO: 

December 2006: 

Border Security: 

US-VISIT Program Faces Strategic, Operational, and Technological 
Challenges at Land Ports of Entry: 

GAO-07-248: 

GAO Highlights: 

Highlights of GAO-07-248, a report to congressional requesters 

Why GAO Did This Study: 

The Department of Homeland Security (DHS) established the U.S. Visitor 
and Immigrant Status Indicator Technology (US-VISIT) program to 
collect, maintain, and share data on selected foreign nationals 
entering and exiting the United States at air, sea and land ports of 
entry (POEs). These data, including biometric identifiers like digital 
fingerprints, are to be used to screen persons against watch lists, 
verify visitors’ identities, and record arrival and departure. GAO was 
asked to review implementation at land POE facilities and in doing so 
GAO analyzed: (1) efforts to implement US-VISIT entry capability; (2) 
efforts to implement US-VISIT exit capability; and (3) DHS’s efforts to 
define how US-VISIT fits with other emerging border security 
initiatives. GAO reviewed DHS and US-VISIT program documents, 
interviewed program officials, and visited 21 land POEs with varied 
traffic levels on both borders. 

What GAO Found: 

US-VISIT entry capability has been installed at 154 of the 170 land 
POEs. Officials at all 21 sites GAO visited reported that US-VISIT had 
improved their ability to process visitors and verify identities. DHS 
plans to further enhance US-VISIT’s capabilities by, among other 
things, requiring new technology and equipment for scanning all 10 
fingerprints (see photo, left, below). While this may aid border 
security, installation could increase processing times and adversely 
affect operations at land POEs where space constraints, traffic 
congestion, and processing delays already exist. GAO’s work indicated 
that management controls in place to identify such problems and 
evaluate operations were insufficient and inconsistently administered. 
For example, GAO identified computer processing problems at 12 sites 
visited; at 9 of these, the problems were not always reported. US-VISIT 
has developed performance measures, but measures to gauge factors that 
uniquely affect land POE operations were not developed; these would put 
US-VISIT officials in a better position to identify areas for 
improvement. 

US-VISIT officials concluded that, for various reasons, a biometric US-
VISIT exit capability cannot now be implemented without incurring a 
major impact on land POE facilities. An interim nonbiometric exit 
technology being tested (see photo, right, below) does not meet the 
statutory requirement for a biometric exit capability and cannot ensure 
that visitors who enter the country are those who leave. DHS has not 
yet reported to Congress on a required plan describing how it intends 
to fully implement a biometric entry/exit program, or use nonbiometric 
solutions. Until this plan is finalized, neither DHS nor Congress is in 
a good position to prioritize and allocate program resources or plan 
for POE facilities modifications. 

DHS has not yet articulated how US-VISIT is to align with other 
emerging land border security initiatives and mandates, and thus cannot 
ensure that the program will meet strategic program goals and operate 
cost effectively at land POEs. Knowing how US-VISIT is to work with 
these initiatives, such as one requiring U.S. citizens, Canadians, and 
others to present passports or other documents at the border in 2009, 
is important for understanding the broader strategic context for US-
VISIT and identifying resources, tools, and potential facility 
modifications needed to ensure success. 

Figure: US-VISIT entry capability ste-up with computer and camera 
(left); non biometric exit identification readers mounted over highway 
(right): 

[See PDF for Image] 

Source: GAO. 

[End of Figure] 

What GAO Recommends: 

GAO recommends that DHS improve existing management controls for US-
VISIT; develop performance measures to assess the impact of US-VISIT at 
land POEs; and ensure that a statutorily mandated report describes how 
DHS will move to a biometric entry/exit capability and align US-VISIT 
with emerging land border security initiatives. DHS generally agreed 
and said that it has begun to or plans to implement GAO’s 
recommendations. 

[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-248]. 

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact Richard Stana at (202) 
512-8777 or stanar@gao.gov. 

[End of Section] 

Contents: 

Letter: 

Results in Brief: 

Background: 

DHS Has Installed US-VISIT Biometric Entry Capability at Nearly All 
Land POEs, but Faces Challenges Identifying and Monitoring the 
Operational Impacts on POE Facilities: 

DHS Cannot Currently Implement a Biometric US-VISIT Exit Capability at 
Land POEs and Faces Uncertainties as Testing of an Alternative Exit 
Strategy Continues: 

DHS Has Not Articulated How US-VISIT Strategically Fits with Other Land-
Border Security Initiatives: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments and Our Evaluation: 

Appendix I: Objective, Scope, and Methodology: 

Appendix II: Visa Waiver Countries: 

Appendix III: Legislative Overview of the US-VISIT Program: 

Appendix IV: The 20 Busiest Land Ports of Entry (POE) by Volume of 
Individuals Entering the United States in Fiscal Year 2005: 

Appendix V: Land Ports of Entry (POE) at Which US-VISIT Has Been 
Installed: 

Appendix VI: Actions Taken by US-VISIT Program Office to Mitigate 
Privacy Risks Associated with RFID at Land POEs: 

Appendix VII: US-VISIT Test of Radio Frequency Identification (RFID) 
Readers Upon Exit and Re-entry at Selected Land POEs: 

Appendix VIII: Comments from the U.S. Department of Homeland Security: 

Appendix IX: GAO Contact and Acknowledgments: 

Tables: 

Table 1: Summary of the Scope, Schedule for Completion, and Intended 
Functionality of the US-VISIT Increment Schedule: 

Table 2: US-VISIT Appropriations Enacted, Fiscal Years 2003 Through 
2007 (in millions of dollars): 

Table 3: Land POEs visited by GAO, August 2005 to February 2006: 

Table 4: Countries Participating in the Visa Waiver Program: 

Table 5: RFID Read Rate Test Results for Persons in Vehicles and 
Pedestrians Exiting the Country with RFID-Readable Documents: 

Table 6: RFID Test Read Rates for Persons Re-Entering the Country in 
Vehicles at Locations Where US-VISIT Tested RFID Technology: 

Table 7: RFID Test Read Rates for Pedestrians Re-entering the Country 
at Locations Where US-VISIT Tested RFID Technology: 

Figures: 

Figure 1: Persons Processed under US-VISIT as a Percentage of all 
Border Crossings at Land, Air, and Sea Ports of Entry, Fiscal Year 
2004: 

Figure 2: US-VISIT Equipment (computer, camera, and printer) at a Land 
POE Secondary Inspection Area: 

Figure 3: Overview of US-VISIT Enrollment at Land POEs for Visitors 
with and without Visas Entering the Country for the First Time: 

Figure 4a: Land POE at Blaine-Peace Arch in Blaine, Washington: 

Figure 4b: Land POE Facility at the Detroit-Windsor Tunnel in Detroit, 
Michigan: 

Figure 4c: Land POE Facility at Rouses Point, New York: 

Figure 5: Nogales-Morley Gate POE, Arizona: 

Figure 6: Aerial View of San Ysidro, California, POE: 

Figure 7a: Metal Gantry with RFID Readers and Antennas at the Thousand 
Islands Bridge POE, Alexandria Bay, New York: 

Figure 7b: RFID Portals Positioned Next to Exit Doors at the Blaine- 
Peace Arch POE in Washington State: 

Figure 8a: RFID Installation at the Nogales-Mariposa POE in Arizona, 
Facing Toward Mexico: 

Figure 8b. Two Pedestrians Exiting the Country at the Nogales-Mariposa 
POE, Arizona, Walking Toward Mexico: 

Abbreviations: 

AIDMS: Automated Identification Management System: 

APIS: Advance Passenger Information System: 

BCC: Border Crossing Card: 

CBP: Customs and Border Protection: 

DHS: Department of Homeland Security: 

DMIA: Immigration and Naturalization Service Data Management 
Improvement Act: 

FBI: Federal Bureau of Investigation: 

ICAO: International Civil Aviation Organization: 

ICE: Immigration and Customs Enforcement: 

IDENT: Automated Biometric Identification System: 

IIRIRA: Illegal Immigration Reform and Immigrant Responsibility Act: 

INS: Immigration and Naturalization Service: 

OIG: Office of Inspector General: 

POE: port of entry: 

RFID: radio frequency identification: 

SBI: Secure Border Initiative: 

TECS: Treasury Enforcement Communications System: 

US-VISIT: United States Visitor and Immigrant Status Indicator 
Technology: 

VWP: Visa Waiver Program: 

WHTI: Western Hemisphere Travel Initiative: 

December 6, 2006: 

Congressional Requesters: 

This report is a publicly available version of our report on the 
implementation of the U.S. Visitor and Immigrant Status Indicator 
Technology (US-VISIT) program at land ports of entry (POE).[Footnote 1] 
Our original report was designated For Official Use Only because, 
according to the Department of Homeland Security (DHS), it contained 
specific information of a sensitive nature. 

In the years since the 2001 terrorist attacks, the need to secure U.S. 
borders has taken on added importance and has received increasing 
attention from Congress and the public. In an effort to avoid 
repetition of such attacks, and improve overall national security, 
Congress and the Administration have sought better ways to record and 
track the entry and departure of foreign visitors who pass through U.S. 
POEs by air, land, or sea, to verify their identities, and to 
authenticate their travel documentation. In March 2003, responsibility 
for these efforts was transferred from the former Immigration and 
Naturalization Service to DHS. Pursuant to several statutory mandates, 
DHS, in consultation with the Department of State, established an 
automated visitor system to integrate information on the entry and exit 
from the United States of foreign nationals, called the US-VISIT 
Program. 

According to DHS, the purpose of US-VISIT is to enhance the security of 
U.S. citizens and visitors, facilitate legitimate travel and trade, 
ensure the integrity of the U.S. immigration system, and protect 
visitors' privacy. The program is managed by the US-VISIT Program 
Office, which is headed by the US-VISIT Director, who currently reports 
to the DHS Deputy Secretary. US-VISIT is used in the field by officers 
with U.S. Customs and Border Protection (CBP), a separate DHS 
component. US-VISIT processing is one of many activities that takes 
place at POEs, where CBP officers enforce U.S. immigration laws 
governing the admissibility of the millions of aliens entering and U.S. 
citizens reentering the country daily; screen cargo for weapons or 
illegal or dangerous goods; prevent narcotics, agricultural pests, and 
smuggled goods from entering the country; and identify and arrest those 
with outstanding criminal warrants. 

US-VISIT is designed to use biographic information (e.g., name, 
nationality, and date of birth) and biometric information (e.g., 
digital fingerprint scans and photographs) to verify the identity of 
those covered by the program. The program applies to certain visitors 
whether they hold a nonimmigrant visa or are traveling from a country 
that has a visa waiver agreement with the United States under the Visa 
Waiver Program.[Footnote 2] U.S. citizens, lawful permanent residents, 
and most Canadian and Mexican[Footnote 3] citizens are currently exempt 
from being processed under US-VISIT upon entering and exiting the 
country.[Footnote 4] Foreign nationals subject to US-VISIT who intend 
to enter the country encounter different inspection processes at 
different types of POEs depending on their mode of travel. Foreign 
nationals subject to US-VISIT who intend to enter the United States at 
an air or sea POE are to be processed, for purposes of US-VISIT, in the 
primary inspection area upon arrival. Generally, these visitors are 
subject to prescreening before they arrive via passenger manifests, 
which are forwarded to CBP by commercial air or sea carrier in advance 
of arrival.[Footnote 5] By contrast, foreign nationals intending to 
enter the United States at land POEs are generally not subject to 
prescreening because they arrive in private vehicles or on foot and 
there is no manifest to record their pending arrival. Thus, when 
foreign nationals subject to US-VISIT arrive at a land POE, they are 
directed by CBP officers from the primary inspection area to the 
secondary inspection area for further processing. At all POEs, visitors 
covered by US-VISIT who are determined to be admissible are issued an I-
94 arrival/departure form, which, among other things, records their 
date of arrival and the date their authorized period of admission 
expires. The requirement that arriving nonimmigrants admitted to the 
United States, unless otherwise exempted, be issued an I-94 as evidence 
of the terms of their admission predates implementation of US-VISIT and 
was incorporated into US-VISIT processing.[Footnote 6] 

Many aspects of US-VISIT program implementation have been driven or 
defined by various legislative mandates. These include a 2001 statutory 
requirement to focus particularly on the use of biometric technology in 
developing the integrated entry-exit system subsequently named US- 
VISIT; a 2002 statutory requirement to develop biometric identifier 
standards to be used to verify the identity of persons seeking to enter 
the United States at POEs; and a requirement to install at all POEs 
equipment and software to allow biometric comparison and authentication 
of U.S. visas and other travel and entry documents issued to aliens, as 
well as Visa Waiver Program participant passports. In addition, by law, 
an integrated entry and exit data system was to be implemented at all 
U.S. POEs, including land POEs, by December 31, 2005, but there was no 
specific requirement to collect any new data on foreign nationals 
departing at land POEs by that date. The Intelligence Reform and 
Terrorism Prevention Act of 2004, on the other hand, did require the 
collection of biometric exit data for all individuals subject to US- 
VISIT, but it did not set a deadline for implementation of this 
requirement. 

The United States shares over 7,500 miles of land border with Canada 
and Mexico and currently, CBP operates 170 land POEs on the northern 
border with Canada and the southwest border with Mexico. These POEs are 
diverse in nature, with some operating in urban areas, such as Detroit, 
Michigan, and others operating in remote areas, such as the northern 
plains in Montana or along the southwest border. Taken together, land 
POEs process the largest number of visitors to the United States each 
year among all POEs (about 79 percent of about 425 million total border 
crossings during fiscal year 2004) and process fewer US-VISIT eligible 
visitors as compared to other POEs (about 11 percent of about 42 
million border crossings processed via US-VISIT during fiscal year 
2004). 

As US-VISIT was being installed at land POEs, questions arose about the 
impact the program was having on the existing POE facilities where 
legitimate land-border crossings take place, particularly in light of a 
goal, stated by a former DHS Undersecretary, to develop a "smart 
border--one that speeds through legitimate trade and travel, but stops 
terrorists in their tracks." We were asked to review implementation of 
US-VISIT at land POE facilities. Specifically, we analyzed the 
following issues: (1) What has the US-VISIT Program Office done to 
implement US-VISIT entry capabilities at land POEs and what impact has 
US-VISIT had on these facilities? (2) What is the status of US-VISIT 
Program Office efforts to implement a US-VISIT exit capability at land 
POE facilities? (3) What has DHS done to define a strategic context to 
show how US-VISIT entry and exit capabilities at land POE facilities 
fit with other current and emerging border security initiatives? 

To meet our objectives, we met with officials at CBP and the US-VISIT 
Program Office within DHS in Washington, D.C. We reviewed applicable 
laws and regulations and studies on the US-VISIT program and examined 
available DHS documents on US-VISIT entry and exit capability and 
deployment at land POEs. We also visited 21 selected land POEs on the 
northern and southern borders where US-VISIT entry capability had been 
installed. Along the northern border, we visited land POEs at the 
Windsor Tunnel and Ambassador Bridge in Detroit, Michigan; the Thousand 
Islands Bridge at Alexandria Bay, Champlain, Overton Corners, and 
Rouses Point in northern New York State; Highgate Springs and Alburg 
Springs in northern Vermont; and Blaine-Pacific Highway and Blaine- 
Peace Arch in Blaine, Washington. Along the southern border, we visited 
the DeConcini, Morley Gate, and Mariposa POEs in Nogales, Arizona; the 
POE in San Ysidro in California; and POEs in Brownsville-Matamoros 
Bridge, Brownsville-Gateway, and Brownsville-Los Tomates/Veterans 
International Bridge, Hidalgo, Progreso, Pharr, and Los Ebanos in 
Texas. We selected these locations to ensure coverage on both borders 
and to obtain a mix of sites with varied types of environments and 
levels of traffic volume. Where feasible, we also chose to visit some 
geographically proximate POEs to minimize travel costs. In addition, 
five of these POEs (Thousand Islands Bridge, Blaine-Peace Arch, Blaine- 
Pacific Highway, DeConcini, and Mariposa) had been designated by DHS as 
locations to test exit technology. At all the locations we visited, we 
observed how US-VISIT equipment was installed and operated and 
interviewed CBP officials about US-VISIT installation and operations 
following deployment. We also observed the impacts of US-VISIT 
equipment and operations on POE facilities and infrastructures. In 
addition, we examined whether internal control mechanisms were in place 
and being used to ensure that program objectives were being achieved, 
consistent with GAO's Standards for Internal Controls in the Federal 
Government.[Footnote 7] The information from our site visits is limited 
to the 21 land ports we visited and is not generalizable to all land 
ports of entry. Appendix I discusses our scope and methodology in 
greater detail. 

We conducted our work from September 2005 through October 2006 in 
accordance with generally accepted government auditing standards. 

Results in Brief: 

DHS has installed the entry portion of US-VISIT at 154 of the nation's 
170 land POEs,[Footnote 8] usually with minimal new construction or 
changes to existing facilities. As required by law, the US-VISIT entry 
capability includes biometric features--such as digital scans of 2 
fingerprints--to help verify the identity of visitors. CBP officials at 
all 21 land POEs we visited told us that US-VISIT's entry capability 
has generally enhanced their ability to process visitors subject to US- 
VISIT by providing assurance that visitors' identities can be confirmed 
through biometric identifiers and by automating the paperwork 
associated with processing I-94 arrival/departure forms. Going forward, 
DHS plans to introduce changes and enhancements to US-VISIT at land 
POEs intended to further bolster CBP's ability to verify the identity 
of individuals entering the country, including a transition from 
digitally scanning 2 fingerprints to 10. While such changes are 
intended to further enhance border security, deploying them may have an 
impact on aging and space-constrained land POE facilities because they 
could increase inspection times and adversely affect POE operations. 
Moreover, our previous and current work showed that the US-VISIT 
program office had not taken necessary steps to help ensure that US- 
VISIT entry capability operates as intended. For example, in February 
2006 we reported that the approach taken by the US-VISIT program office 
to evaluate the impact of US-VISIT on land POE facilities focused on 
changes in I-94 processing time at 5 POEs and did not examine other 
operational factors, such as US-VISIT's impact on physical facilities 
or work force requirements.[Footnote 9] As a result, program officials 
did not always have the information they needed to anticipate problems 
that occurred, such as problems processing high volumes of visitors in 
space constrained facilities. Turning to another aspect of our 
evaluation, our standards for internal controls in the federal 
government state that it is important for agencies to have controls in 
place to help ensure that policies and procedures are applied and that 
managers be made aware of problems so that that they can be addressed 
and resolved in a timely fashion.[Footnote 10] CBP officials at 12 of 
21 land POE sites we visited told us about US-VISIT-related computer 
slowdowns and freezes which adversely affected visitor processing and 
inspection times and at 9 of the 12 sites, computer processing problems 
were not always reported to CBP's computer help desk, as required by 
CBP guidelines. Although various controls are in place to alert US- 
VISIT and CBP officials to problems as they occur, these controls did 
not alert officials to all problems, given they had been unaware of the 
problems we identified before we brought them to their attention. These 
computer processing problems have the potential to not only 
inconvenience travelers because of the increased time needed to 
complete the inspection process, but to compromise security, 
particularly if CBP officers are unable to perform biometric checks-- 
one of the critical reasons US-VISIT was installed at POEs. Our 
internal control standards also call for agencies to establish 
performance measures throughout the organization so that actual 
performance can be compared to expected results. While the US-VISIT 
program office established performance measures for fiscal years 2005 
and 2006 intended to gauge performance of various aspects of US-VISIT 
at air, sea and land POEs in the aggregate, performance measures 
specifically for land POEs have not been developed. It is important to 
do so, given that there are significant operational and facility 
differences among these different types of POEs. Additional performance 
measures that consider operational and facility differences at land 
POEs would put US-VISIT program officials in a better position to 
identify problems, trends, and areas needing improvements. 

US-VISIT has concluded that, for various reasons, it cannot currently 
implement a biometric US-VISIT exit capability without incurring a 
major impact on land POE facilities. According to officials, 
implementing a biometrically based exit recording system like that used 
to record those entering or re-entering the country is potentially 
costly (an estimated $3 billion), would require new infrastructure, and 
would produce major traffic congestion because travelers would have to 
stop their vehicles upon exit to be processed--an option officials 
consider unacceptable. US-VISIT officials stated that they believe 
technological advances over the next 5 to 10 years will enable the 
biometric verification of persons exiting the country without a major 
impact on facilities. In the interim, the US-VISIT program office is 
testing radio frequency identification (RFID) technology as a 
nonbiometric means of recording visitors as they exit. RFID technology 
can be used to electronically identify and gather information contained 
on a tag--in this case, a unique identifying number embedded in a tag 
on a visitor's arrival/departure form--which an electronic reader at 
the POE is intended to detect. While RFID technology has thus far 
required few facility and infrastructure changes, US-VISIT's initial 
testing and analysis of this technology has identified numerous 
performance and reliability problems, such as the failure of RFID 
readers to detect a majority of travelers' tags during testing. 
Additional testing is planned to address such problems. Nevertheless, 
the RFID solution does not meet the statutory requirement for a 
biometric exit capability because the technology as tested cannot meet 
a key goal of US-VISIT--ensuring that visitors who enter the country 
are the same ones who leave. Specifically, the RFID tag in the 
visitor's arrival/departure form cannot be physically tied to an 
individual, which means that while a document may be detected as 
leaving the country, the person to whom it was issued at time of entry 
may be somewhere else. By statute, DHS was to have reported to Congress 
by June 2005 on how it intended to fully implement an entry/exit 
program. This plan is to include, among other things, a description of 
the manner in which the US-VISIT program meets the goals of a 
comprehensive entry and exit screening system--including both biometric 
entry and exit--and how it will fulfill statutory obligations. As of 
October 2006, this plan was still under review in the Office of the 
Secretary, according to US-VISIT officials. Without such a plan, DHS 
cannot articulate how entry/exit concepts fit together--including any 
interim nonbiometric solutions--and neither DHS nor Congress is in a 
good position to prioritize and allocate resources, including funds for 
any facility modifications that might be needed, for a US-VISIT exit 
capability, to plan for the program's future, or to consider trade-offs 
between traveler convenience and security. 

DHS has not yet articulated how US-VISIT is to strategically fit with 
other land-border security initiatives and mandates, and thus cannot 
ensure that these programs work in harmony to meet mission goals and 
operate cost effectively. As we reported 3 years ago, agency programs 
need to properly fit within a common strategic context governing key 
aspects of program operations, such as what functions are to be 
performed, what facility or infrastructure changes will be needed to 
ensure that they operate in harmony and as intended, and what standards 
govern the use of technology. DHS has drafted a strategic plan defining 
an overall immigration and border management strategy, but has not yet 
approved it, and did not provide it to us for review. Meanwhile, new 
border security initiatives or mandates are planned or under way that 
could potentially have an impact on US-VISIT operations and facilities 
at land POEs. For example, no later than June 2009, U.S. citizens and 
foreign nationals of Canada, Bermuda, and Mexico will be required, for 
the first time, to present a passport or other documents deemed 
sufficient to show identity and citizenship when entering the country 
from within the western hemisphere. It is not yet known what types of 
documents, other than passports, may be permitted at land POEs, or 
whether these documents and the equipment required to read them can be 
aligned with US-VISIT technologies. Until decisions for this and other 
initiatives are made, it remains unclear how this program will be 
integrated with US-VISIT, if at all--raising the possibility that CBP 
would be faced with managing differing technology platforms and border 
inspection processes at each land POE. Knowing how US-VISIT is to work 
in concert with other border security and homeland security initiatives 
and what facility or facility modifications might be needed could help 
Congress, DHS, and others better understand what resources and tools 
are needed to ensure success and ensure that land POE facilities are 
positioned to accommodate them. 

To help DHS optimize its investment in US-VISIT at land POEs, we are 
recommending that the Secretary of Homeland Security direct the US- 
VISIT Program Director, in collaboration with the Commissioner of CBP, 
to (1) improve existing controls for identifying and reporting computer 
processing and other operational problems to help ensure that these 
controls are consistently administered and (2) develop performance 
measures specifically for assessing the impact of US-VISIT operations 
at land POEs. Also, in view of the fact that DHS has not met the 
statutory requirement that it issue a report describing a comprehensive 
biometric entry and exit system for US-VISIT, we are also recommending 
that as DHS finalizes the mandated report, the Secretary of Homeland 
Security take steps to ensure that the report includes, among other 
things, information on the costs, benefits, and feasibility of 
deploying biometric and nonbiometric exit capabilities at land POEs; a 
discussion of how DHS intends to move from a nonbiometric exit 
capability, such as the technology currently being tested, to a 
reliable biometric exit capability that meets statutory requirements; 
and a description of how DHS plans to align US-VISIT with other 
emerging land border security initiatives and what facilities or 
facility modifications would be needed at land POEs to ensure that 
different technologies and processes work in harmony. 

DHS generally agreed with our recommendations and stated that it either 
had begun to take or is planning to take actions to implement them. It 
acknowledged that the exit technology tested by DHS would not satisfy 
statutory requirements for a biometric exit system and said that it 
would perform research and industry outreach to satisfy the mandate. 
DHS, however, disagreed with our finding that the US-VISIT program 
office did not fully consider the impact of US-VISIT on the overall 
operations at POEs. It said that US-VISIT impacts are limited to 
changes in Form I-94 processing time, which according to officials 
improved, and that issues related to capacity, staffing, and other 
factors are "arguably" beyond the scope of US-VISIT. We agree that the 
approach taken to do operational assessments of the impact of US-VISIT 
land POE facilities focused on changes to I-94 processing time. Our 
concern is that the assessments did not examine other operational 
factors, such as US-VISIT's impact on physical facilities, to help 
ensure that US-VISIT operates as intended. We believe more complete 
assessments of the impact of US-VISIT on land POE operations would 
better position DHS to anticipate potential problems and develop 
solutions, especially as additional US-VISIT capabilities, such as 10 
fingerprint scanning, are introduced at these facilities. 

Background: 

US-VISIT is a large, complex governmentwide program intended to achieve 
the goals of (1) enhancing the security of U.S. citizens and visitors, 
(2) facilitating legitimate travel and trade, (3) ensuring the 
integrity of the U.S. immigration system, and (4) protecting the 
privacy of visitors. The program is intended to carry out these goals 
by: 

² collecting, maintaining, and sharing information on certain foreign 
nationals who enter and exit the United States; 

² identifying foreign nationals who (1) have overstayed or violated the 
terms of their visit; (2) can receive, extend, or adjust their 
immigration status; or (3) should be apprehended or detained by law 
enforcement officials; 

² detecting fraudulent travel documents, verifying visitor identity, 
and determining visitor admissibility through the use of biometrics 
(digital fingerprints and a digital photograph); and: 

² facilitating information sharing and coordination within the 
immigration and border management community. 

Currently, US-VISIT's scope includes the pre-entry, entry, status, and 
exit of hundreds of millions of foreign national travelers who enter 
and leave the United States at over 300 air, sea, and land POEs. 

Legislative Overview: 

The current statutory framework for US-VISIT originates with a 
requirement to implement an integrated entry and exit data system for 
foreign nationals, enacted in the Immigration and Naturalization 
Service Data Management Improvement Act (DMIA) of 2000.[Footnote 11] 
The DMIA replaced in its entirety a provision of the Illegal 
Immigration Reform and Immigrant Responsibility Act of 1996 (IIRIRA) 
that had required an automated system to record and then match the 
departure of every foreign national from the United States to the 
individual's arrival record.[Footnote 12] The DMIA instead required an 
electronic system that would provide access to and integrate foreign 
national arrival and departure data that are authorized or required to 
be created or collected under law and are in an electronic format in 
certain databases, such as those used at POEs and consular offices. 
Unlike the earlier law, the DMIA specifically provided that it not be 
interpreted to impose any new documentary or data collection 
requirements on any person, but it also provided that it not be 
construed to reduce or curtail the authority of DHS or State under any 
other provision of law. Thus, the DMIA did not specifically require the 
collection of any new data on foreign nationals departing at land POEs. 

The system as described in the DMIA is to compare available arrival 
records to available departure records; allow on-line search procedures 
to identify foreign nationals who may have overstayed their authorized 
period of admission; and use available data to produce a report of 
arriving and departing foreign nationals. The DMIA also required the 
implementation of the system at airports and seaports by December 31, 
2003, at the 50 highest volume land POEs by December 31, 2004; and at 
all remaining POEs by December 31, 2005. 

Laws passed after the DMIA also provided specific requirements with 
regard to the use of biometrics for those entering and leaving the 
country. For example, the USA PATRIOT Act required, by October 26, 
2003, the development and certification of a technology standard, 
including appropriate biometric identifier standards, that can be used 
to verify the identity of persons applying for a U.S. visa, or seeking 
to enter the United States pursuant to a visa, for the purposes of 
conducting background checks, confirming identity, and ensuring that a 
person has not received a visa under a different name.[Footnote 13] The 
act also provided that in developing US-VISIT, DHS and State were to 
focus particularly on the utilization of biometric technology and the 
development of tamper-resistant documents readable at POEs. The 
Enhanced Border Security and Visa Entry Reform Act of 2002 required DHS 
and State to implement, fund, and use the technology standard, 
including biometric identifier standards, developed under the USA 
PATRIOT Act at U.S. POEs; it also required the installation at all POEs 
of equipment and software to allow biometric comparison and 
authentication of all U.S. visas and other travel and entry documents 
issued to aliens, and passports issued by Visa Waiver Program 
participating countries with biometric identifiers. The Intelligence 
Reform and Terrorism Prevention Act of 2004,[Footnote 14] unlike the 
DMIA, specifically required the collection of biometric exit data for 
all categories of individuals required to provide biometric entry data 
under US-VISIT, regardless of the port of entry where they entered the 
United States. The 2004 law did not set a deadline for implementation 
of this requirement, however. Appendix III discusses the legislative 
history of the US-VISIT program in greater detail. 

Management and Implementation of US-VISIT: 

Within DHS, the US-VISIT Program Office is headed by the US-VISIT 
Director, who reports directly to the Deputy Secretary for Homeland 
Security. The US-VISIT Program Office has responsibility for managing 
the acquisition, deployment, operation, and sustainment of US-VISIT and 
has been delivering US-VISIT capability incrementally. According to US- 
VISIT, increments 1 and 2 include a mix of interim or temporary 
solutions and permanent deployments. For example, increment 1B, dealing 
with exit capability at airports, is still being piloted, while US- 
VISIT entry capability at the 50 busiest land POEs--increment 2B--is 
considered to be a permanent deployment. Increment 3--providing entry 
capability at the land POEs not covered under Increment 2B--is 
considered by US-VISIT to be a permanent deployment and increment 4 is, 
according to US-VISIT, the yet-to-be defined US-VISIT strategic 
capability. Table 1 summarizes the scope, timeline, and intended 
functionality of the US-VISIT increment schedule. This report focuses 
generally, but not exclusively, on increments 2B (entry capability at 
the 50 busiest land POEs), 2C (exit capability at the 50 busiest land 
POEs), and 3 (entry capability at the remaining land POEs)--the 
increments and information that are shown in bold in table 1. 

Table 1: Summary of the Scope, Schedule for Completion, and Intended 
Functionality of the US-VISIT Increment Schedule: 

Increment: 1; 
A; 
Scope: Entry at air and sea ports of entry; 
Schedule for completion: Jan. 5, 2004[A]; 
Intended functionality: Deliver the initial operational biometric entry 
capability to 115 air and 14 sea ports. 

Increment: 1; 
B; 
Scope: Exit at air and sea ports of entry; 
Schedule for completion: Nov. 30, 2004; 
Intended functionality: Evaluate exit pilot alternatives at 13 air and 
2 seaports. 

Increment: 2; 
A; 
Scope: Read visas and other travel documents embedded with biometric 
information upon entry at all ports of entry; 
Schedule for completion: Oct. 26, 2006; 
Intended functionality: Deliver the initial operating capability to 
compare and verify biometric data embedded in machine-readable visas 
and other travel documents at all ports of entry. 

Increment: 2; 
B; 
Scope: Entry at 50 busiest land ports of entry; 
Schedule for completion: Dec. 31, 2004[B]; 
Intended functionality: Provide biometric entry capability at the 50 
busiest land ports of entry, including an automated process for issuing 
the I-94 entry and exit form. 

Increment: 2; 
C; 
Scope: Exit and reentry at land ports of entry; 
Schedule for completion: Jul. 2005-undefined; 
Intended functionality: Automate recording of exit and reentry at 
busiest 50 land ports of entry. 

Increment: 3; 
Scope: Remaining land ports of entry; 
Schedule for completion: Dec. 31, 2005[B]; 
Intended functionality: Provide increment 2B entry capability at 
remaining land ports. 

Increment: 4; 
Scope: Undefined; 
Schedule for completion: Undefined; 
Intended functionality: Define, design, build, and implement a 
strategic US-VISIT capability.[C]. 

Source: US-VISIT Program Office. 

Note: Bold text reflects increments primarily focused on land POEs. 

[A] The statutory deadline for implementing US-VISIT at air and sea 
ports of entry was December 31, 2003; the Federal Register notice 
announcing implementation of increment 1A by that date was published on 
January 5, 2004. 

[B] Denotes a statutory deadline. 

[C] According to US-VISIT program officials, increment 4 will likely 
consist of a further series of enhancements. 

[End of table] 

From fiscal year 2003 through fiscal year 2007, total funding for the 
US-VISIT program has been about $1.7 billion. Table 2 summarizes 
appropriations for US-VISIT for fiscal years 2003 through 2007, as 
enacted. 

Table 2: US-VISIT Appropriations Enacted, Fiscal Years 2003 Through 
2007 (in millions of dollars): 

Budget activity: US-VISIT; 
2003 appropriated: $362; 
2004 appropriated: $328; 
2005 appropriated: $340; 
2006 appropriated: $337; 
2007 appropriated: $362. 

Source: US-VISIT Program Office. 

Note: Starting in Fiscal Year 2004, funding for the US-VISIT program 
has been appropriated on a "no-year" basis, meaning that there is no 
time limit on the spending of appropriated funds; funds that remain 
unexpended at the end of a fiscal year are carried over into the next 
fiscal year. 

[End of table] 

In prior reports on US-VISIT, we have identified numerous challenges 
that DHS faces in delivering program capabilities and benefits on time 
and within budget. In September 2003, we reported that the US-VISIT 
program is a risky endeavor, both because of the type of program it is 
(large, complex, and potentially costly) and because of the way that it 
was being managed[Footnote 15]. We reported, for example, that the 
program's acquisition management process had not been established, and 
that US-VISIT lacked a governance structure. In March 2004, we 
testified that DHS faces a major challenge maintaining border security 
while still welcoming visitors. Preventing the entry of persons who 
pose a threat to the United States cannot be guaranteed, and the missed 
entry of just one can have severe consequences. Also, US-VISIT is to 
achieve the important law enforcement goal of identifying those who 
overstay or otherwise violate the terms of their visas. Complicating 
the achievement of these security and law enforcement goals are other 
key US-VISIT goals: facilitating trade and travel through POEs and 
providing for enforcement of U.S. privacy laws and regulations[Footnote 
16]. Subsequently, in May 2004, we reported that DHS had not employed 
the kind of rigorous and disciplined management controls typically 
associated with successful programs[Footnote 17]. Moreover, in February 
2006, we reported that while DHS had taken steps to implement most of 
the recommendations from our 2003 and 2004 reports, progress in 
critical areas had been s[Footnote 18]low. Of 18 recommendations we 
made since 2003, only 2 had been fully implemented, 11 had been 
partially implemented, and 5 were in the process of being implemented, 
although the extent to which they would be fully carried out was not 
yet known. 

US-VISIT Scope, Operations, and Processing at Land POEs: 

As mentioned earlier, US-VISIT currently applies to a certain group of 
foreign nationals--non-immigrants from countries whose residents are 
required to obtain nonimmigrant visas before entering the United States 
and residents of certain countries who are exempt from U.S. visa 
requirements when they apply for admission to the United States for up 
to 90 days for tourism or business purposes under the Visa Waiver 
Program.[Footnote 19] US-VISIT also applies to (1) Mexican 
nonimmigrants traveling with a Border Crossing Card (BCC) who wish to 
remain in the United States longer than 30 days or who declare that 
they intend to travel more than 25 miles into the country from the 
border (or more than 75 miles from the Arizona border in the Tucson 
area)[Footnote 20] and (2) Canadians traveling to the United States for 
certain specialized reasons.[Footnote 21] 

Most land border crossers--including U.S. citizens, lawful permanent 
residents, and most Canadian and Mexican citizens--are, by regulation 
or statute, not required to enroll into US-VISIT.[Footnote 22] In 
fiscal year 2004, for example, U.S. citizens and lawful permanent 
residents comprised about 57 percent of land border crossers; Canadian 
and Mexican citizens comprised about 41 percent; and less than 2 
percent were US-VISIT enrollees. Figure 1 shows the number and percent 
of persons processed under US- VISIT as a percentage of all border 
crossings at land, air, and sea POEs in fiscal year 2004. 

Figure 1: Persons Processed under US-VISIT as a Percentage of all 
Border Crossings at Land, Air, and Sea Ports of Entry, Fiscal Year 
2004: 

[See PDF for image] 

Source: GAO analysis of DHS data. 

Note: Persons processed by US-VISIT may include foreign nationals who 
were also issued an I-94 valid for multiple entries and who have re- 
entered multiple times. Total entering the U.S. includes U.S. citizens 
who may have re-entered the country multiple times and foreign 
nationals, including those not issued I-94s, such as Canadian citizens 
and Mexicans with BCCs, and those issued multiple entry I-94s who also 
may have re-entered multiple times. U.S. citizens do not fall within 
the statutory scope of US-VISIT and therefore are exempt from US-VISIT 
screening. 

[End of figure] 

Foreign nationals covered by US-VISIT enter the United States via a 
multi-step process. For individuals required to obtain visas before 
entering the United States, the US-VISIT process begins overseas at 
U.S. consular offices, which in addition to other processes, collect 
biographic data (i.e., country of origin and date of birth) and 
biometric data (i.e., digital fingerscans and a digital photograph) 
from the applicant. These data are checked against databases or watch 
lists of known criminals and suspected terrorists. If the individual's 
name does not appear on any watch list and the individual is not 
disqualified on the basis of other issues that may be relevant, he or 
she is to be issued a visa and may seek admission to the United States 
at a POE. 

When visitors in vehicles first arrive at a land POE, they initially 
enter the primary inspection area where CBP officers, often located in 
booths, are to visually inspect travel documents and query the visitors 
about such matters as their place of birth and proposed destination. 
Visitors arriving as pedestrians enter an equivalent primary inspection 
area, generally inside a CBP building. If the CBP officer believes a 
more detailed inspection is needed or if the visitors are required to 
be processed under US-VISIT for the first time,[Footnote 23] the 
visitors are to be referred to the secondary inspection area--an area 
away from the primary inspection area--which is generally inside a 
facility. The secondary inspection area inside the facility generally 
contains office space, waiting areas, and space to process visitors, 
including US-VISIT enrollees. Equipment used for US-VISIT processing 
includes a computer, printer, digital camera, and a two-fingerprint 
scanner. Figure 2 shows US-VISIT equipment installed at one land POE. 

Figure 2: US-VISIT Equipment (computer, camera, and printer) at a Land 
POE Secondary Inspection Area: 

[See PDF for image] 

Source: US-Visit Program Office. 

[End of figure] 

CBP officers use a document reader to scan machine readable travel 
documents, such as a passport or visa, and use computers to check 
biographic data from the documents against watch list databases. For US-
VISIT processing, biometric verification is performed in part by taking 
a digital scan of visitors' fingerprints (the left and right index 
fingers) and by taking a digital photograph of the visitor. These data 
are stored in the system's databases. The computer system compares the 
two index fingerprints to those stored in DHS's Automated Biometric 
Identification System (IDENT) that, among other things, collects and 
stores biometric data about foreign nationals, including FBI 
information on all known and suspected terrorists. 

If the fingerprints are already in IDENT, the system performs a match 
against the existing digital scans to confirm that the person 
submitting the fingerprints at secondary inspection at the POE is the 
one on file. In addition, the CBP officer visually compares the person 
to the photograph that is in the database, which is brought up onto the 
computer screen. If no prints are found in IDENT (for example, if the 
visitor is from a visa-waiver country), that person is then processed 
into US-VISIT, with biographic data entered into the databases, a 
digital scan of his or her two index fingerprints, and a digital 
photograph. Once the CBP officer deems the visitor to be admissible, 
the individual is issued an I-94 or an I-94W (for persons from visa 
waiver countries) arrival/departure form. Figure 3 shows how U.S. 
citizens and most Mexicans, Canadians, and foreign nationals subject to 
US-VISIT are to be processed at land POEs. 

Figure 3: Overview of US-VISIT Enrollment at Land POEs for Visitors 
with and without Visas Entering the Country for the First Time: 

[See PDF for image] 

Sources: GAO (analysis), MapArt (map). 

Note: Most Mexican entrants with BCCs are not required to obtain an I- 
94 arrival/departure form if CBP officers determine that the entrants 
do not intend to travel more than 25 miles into the country or stay 
more than 30 days. If it is determined by the CBP officer that a 
Mexican citizen intends to exceed either limit, the entrant is referred 
to secondary inspection at the POE, where they are to be processed into 
US-VISIT, and issued an I-94 form, if no grounds are found on which to 
deny them entry. According to federal regulation (8 CFR § 
235.1(f)(1)(v)(A)), in the Tucson sector, Mexican visitors may travel 
up to 75 miles into the country without being issued an I-94 form, 
which means that they generally would not be processed into US-VISIT 
upon entry. 

[End of figure] 

In addition to IDENT, US-VISIT relies on a number of information 
systems to process visitors. Among the computer software applications 
utilized as part of US-VISIT is U.S. Arrival, which provides an 
integrated process for issuing I-94 forms and collection of biometric 
data for visitors covered by US-VISIT who arrive at land POEs. Another 
is U.S. Pedestrian, which is used by CBP officers in conducting 
inspections of visitors who arrive at land POEs, entering the United 
States on foot, mostly along the southern border. 

Overview of Land POE Facilities: 

As of August 2006, there were 170 land POEs that are geographically 
dispersed along the nation's more than 7,500 miles of borders with 
Canada and Mexico. Some are located in rural areas (such as Alexandria 
Bay, New York and Blaine-Pacific Highway, Washington) and others in 
cities (such as Detroit) or in U.S. cities across from Mexican cities, 
such as Laredo and El Paso, Texas. The volume of visitor traffic at 
these POEs varies widely, with the busiest four POEs characterized by 
CBP as San Ysidro, Calexico, and Otay Mesa, California, and Bridge of 
the Americas in El Paso, Texas. Appendix IV lists the 20 busiest land 
POEs, based on the number of individuals in vehicles and pedestrian 
traffic recorded entering the country through POEs in fiscal year 2005. 

From a facilities standpoint, land POEs vary substantially in building 
type and size (square footage) as shown in Figures 4a, 4b, and 4c. 

Figure 4a: Land POE at Blaine-Peace Arch in Blaine, Washington: 

[See PDF for image] 

Source: US_VISIT Program Office. 

[End of figure] 

Figure 4b: Land POE Facility at the Detroit-Windsor Tunnel in Detroit, 
Michigan: 

[See PDF for image] 

Source: GAO. 

[End of figure] 

Figure 4c: Land POE Facility at Rouses Point, New York: 

[See PDF for image] 

Source: GAO. 

[End of figure] 

DHS Has Installed US-VISIT Biometric Entry Capability at Nearly All 
Land POEs, but Faces Challenges Identifying and Monitoring the 
Operational Impacts on POE Facilities: 

DHS has installed US-VISIT biometric entry capability at nearly all 
land POEs consistent with statutory deadlines, but faces challenges 
identifying and monitoring the operational impacts on POE facilities. 
CBP officials at the 21 land POEs we visited told us that US-VISIT has 
generally enhanced the officials' ability to process visitors subject 
to US-VISIT by providing officials the ability to do biometric checks 
and automating the issuance of the visitor I-94 arrival/departure form. 
DHS plans to introduce changes and enhancements to US-VISIT at land 
POEs intended to bolster border security, but deploying them poses 
potential operational challenges to land POE facilities that are known 
by DHS to be space-constrained. US-VISIT's efforts to evaluate the 
impact of US-VISIT on land POE facilities thus far raises questions 
about whether sufficient management controls exist to ensure that 
additional operational impacts, such as processing delays or further 
space constraints, will be anticipated, identified, and appropriately 
addressed and resolved. 

US-VISIT Biometric Entry Capability Was Installed at Nearly All Land 
POEs with Minimal Construction, According to Program Officials: 

In December 2005, DHS officials announced that US-VISIT biometric entry 
capability had been installed at land POEs in conformance with 
statutory mandates and Increments 2B and 3 of DHS's US-VISIT schedule. 
Deployment at the 50 busiest land POEs was completed by December 31, 
2004, and at all but 2 of the other land POEs where DHS determined the 
program should operate by December 31, 2005, as required by law. Our 
review of US-VISIT records and discussions with US-VISIT program 
officials indicated that DHS installed US-VISIT biometric entry 
capability at 154 of 170 land POEs. (App. V lists all land POEs where 
US-VISIT has been installed.) With regard to 14 of the 16 POEs where US-
VISIT was not installed, CBP and US-VISIT program office officials told 
us there was no operational need for US-VISIT because visitors who are 
required to be processed into US-VISIT are, by regulation, not 
authorized to enter the United States at these locations.[Footnote 24] 
Generally, these POEs are small facilities in remote areas. At 2 other 
POEs, US-VISIT needs to be installed in order to achieve full 
implementation as required by law, but both of these present 
significant challenges to installation of US-VISIT. These POEs do not 
currently have access to appropriate communication transmission lines 
to operate US-VISIT. CBP officials told us that, given this constraint, 
they determined that they could continue to operate as before. Thus, 
CBP officers at these locations process foreign visitors manually. 

US-VISIT program officials reported and available records showed that 
equipment for US-VISIT entry capability was installed with minimal 
construction at the 154 land POEs. At the 21 land POEs we visited, we 
observed that US-VISIT entry capability equipment had been installed 
with little or no change to facilities. For example, at the Detroit- 
Windsor tunnel and the Detroit Ambassador Bridge POEs in Detroit, 
Michigan, officials confirmed that no additional computer workstations 
were required to be installed; at the Blaine-Peace Arch POE at Blaine, 
Washington, electrical capacity was upgraded to accommodate US-VISIT 
computer needs. In general, our review of reports prepared for each of 
these POEs indicated that DHS upgraded existing or added new computer 
workstations and printers in the secondary inspections areas of these 
facilities (the area where US-VISIT enrollees are processed); installed 
digital cameras to photograph those to be processed in US-VISIT; 
installed two-fingerprint scanners that digitally record fingerprints; 
and installed electronic card readers for detecting data embedded in 
machine-readable passports and visas. According to US-VISIT officials, 
funding for installing US-VISIT entry equipment nationwide was 
approximately $16 million--about 9 percent of the $182 million budgeted 
for US-VISIT deployment at land ports between fiscal year 2003 and 
fiscal year 2005. Officials reported that the remaining funds were 
allocated to computer network infrastructure (about 72 percent) and 
design and development, network engineering, fingerscan devices, and 
public awareness and outreach (about 19 percent).[Footnote 25] 

During our site visits, CBP officials at all 21 facilities told us that 
having US-VISIT biometric entry capability generally improved their 
ability to process visitors required to enroll in US-VISIT because it 
provided them additional assurance that visitors are who they say they 
are and automated the paperwork associated with processing the I-94 
arrival/departure form. For example, with US-VISIT, the ability to scan 
a visitor's passport or other travel document enables the computer at 
the inspection site to capture basic biographic information and 
automatically print it on the I-94 form; prior to US-VISIT deployment, 
the I-94 was filled in manually by the CBP officer or the visitor. 

Steps Have Been Taken to Address Operational Challenges Identified at 
Land POEs, but DHS May Face Additional Challenges Resulting from 
Planned Enhancements: 

DHS plans to introduce changes and enhancements to US-VISIT at land 
POEs that are designed to further bolster CBP's ability to verify that 
individuals attempting to enter the country are who they say they are. 
While these changes may further aid border security, deploying them 
poses potential challenges to land POE facilities where US-VISIT 
operates and where millions of visitors are processed annually. Our 
site visits, interviews with US-VISIT and CBP officials, and the work 
of others suggest that both before and after US-VISIT entry capability 
was installed at land POEs, these facilities faced a number of 
challenges--operational and physical--including space constraints 
complicated by the logistics of processing high volumes of visitors and 
associated traffic congestion. 

With respect to operational challenges at land POE facilities, we 
reported in November 2002--more than 2 years before US- VISIT entry 
capability was installed at the 50 busiest land POEs--that busy land 
POEs were experiencing 2-to 3-hour delays in processing visitors and 
that any lengthening of the entry process could affect visitors 
significantly, through additional wait times.[Footnote 26] While we 
cannot generalize about the impact US-VISIT has had on processing time 
at all land POEs, at one of the busiest land POEs we visited--San 
Ysidro, California, where more than 41 million visitors entering the 
country in 2005 were processed--CBP officials told us that, although 
they had not measured differences in processing times before and after 
US-VISIT was installed, the steps required to process US-VISIT visitors 
had added to the total time needed to process all visitors entering 
through the port. As a result, CBP officials told us that they must 
occasionally direct visitors arriving at peak times, such as holidays, 
to leave and return later in the day because there was no room for them 
to wait. In this case, US-VISIT had an effect on both visitor 
processing times and on the capacity of the facility to physically 
accommodate pedestrian and vehicular traffic.[Footnote 27] 

A similar type of operational problem that reflects how complex visitor 
processing activities occur at facilities was reported by a contractor 
retained by DHS to study wait times associated with the I-94 issuance 
process at another busy POE, Nogales-DeConcini in Arizona.[Footnote 28] 
The study, which examined wait times for 3 separate time periods over a 
3-month period in the summer of 2005, found that wait times varied by 
day (ranging from about 3½ minutes to almost 7 minutes across the time 
periods studied) and was more a function of the number of people 
waiting for an I-94 rather than the time needed to process each 
individual under US-VISIT.[Footnote 29] The contractor noted that the 
group size, wait time, and processing all affected the dynamics of the 
secondary-processing area or room, which measured approximately 40 feet 
by 50 feet. During one day of the study, the contractor noted that the 
secondary processing room became crowded, straining processing 
capacity. The contractor stated that this occurred because some of the 
individuals waiting to obtain I-94s were students or seasonal workers 
that required checks that included phone calls to verify their visa 
status.[Footnote 30] The contractor concluded that US-VISIT provided an 
advantage over manual I-94 processing because the processing was 
ultimately more efficient. Nevertheless, the extent to which these 
problems occur is unknown because US-VISIT has not performed comparable 
studies at other locations. 

DHS has long been aware of space constraints and other capacity issues 
at land POE facilities. A task force report developed in response to 
the Immigration and Naturalization Service Data Management Improvement 
Act of 2000 found that 117 of 166 land POEs operating at that time 
(about 70 percent) had three-fourths or less of the required 
space.[Footnote 31] The US-VISIT Program Office subsequently confirmed 
that land POEs had traffic flow problems (i.e., lack of space, 
insufficient roadways, and poor access to facilities) and that many 
were aging and undersized; the majority of land POEs were constructed 
before 1970 when the volume of border crossings was not as great as it 
is now. Our work for this report indicates that such problems persist, 
though we cannot generalize to all facilities. For example, at the 
Nogales-Morley Gate POE in Arizona, where up to 6,000 visitors are 
processed daily (and up to 10,000 on holidays), US-VISIT equipment was 
installed, but the system is not used there because CBP determined that 
it could not accommodate US-VISIT visitors because of concerns about 
CBP's ability to carry out the process in a constrained space while 
thousands of other people not subject to US-VISIT processing already 
transit through the facility daily.[Footnote 32] Thus, if a visitor is 
to be processed into US-VISIT from Morley Gate, that person is directed 
to return to Mexico (a few feet away) and to walk the approximately 100 
yards to the Nogales-DeConcini POE facility, which has the capability 
to handle secondary inspections of this kind. Figure 5 shows the 
Nogales-Morley Gate POE building--the small windowed structure on the 
right is the processing site. 

Figure 5: Nogales-Morley Gate POE, Arizona: 

[See PDF for image] 

Source: US-VISIT Program Office. 

[End of figure] 

CBP officials at three other land POEs on the southwest border also 
told us that space constraints were a factor in their ability to 
efficiently process those subject to US-VISIT. Specifically, at the 
POEs at Los Tomates, Gateway, and Brownsville/Matamoros, Texas, CBP 
officials told us that US-VISIT had made I-94 processing more 
efficient, but travelers continued to experience delays of up to 2 
hours on peak holiday weekends as they had before US-VISIT was 
installed. Officials at these facilities told us that they believe they 
could alleviate this problem if the facility had the space to install 
more workstations capable of operating US-VISIT entry capability. 

According to CBP officials, CBP has begun to examine the condition of 
each facility with the intent of developing a list of border station 
construction and modification needs and plans to prioritize 
construction projects based on need. In the meantime, CBP and US-VISIT 
officials told us that they have taken steps to address problems 
operating US-VISIT when space constraints are an issue. For example, at 
the POE in Highgate Springs, Vermont, CBP officials told us that US- 
VISIT computers and those needed to process commercial truck drivers 
and their cargoes were competing for space at the interior counter area 
of the building. Following our visit, we were told that the POE had 
adjusted its space allocation inside the POE building so that there are 
now five workstations for US-VISIT and other noncommercial visitor 
processing, one of which can do both. According to the POE assistant 
area port director, the POE also extended the hours during which truck 
drivers can be processed in a separate building designed entirely for 
processing them and their cargoes, in order to relieve the space 
pressures in the main building that occur during the high-volume 
tourist summer season. 

US-VISIT and CBP officials reported that they have taken other steps to 
try to minimize any problems that may arise integrating US-VISIT entry 
capability operations with other CBP operations. For example, to help 
ensure that US-VISIT does not have an adverse impact on CBP's 
operations at ports of entry, US-VISIT and CBP established a liaison 
office in June 2005, involving supervisory managers detailed from 
various CBP offices. The liaison officers worked with US-VISIT staff to 
overcome operational issues at POEs; review plans; develop and deliver 
training; set up call sites during busy holiday periods to provide 
support to POEs needing assistance; and work through technology 
problems. A CBP official told us that he believes both US-VISIT and CBP 
have been successful in helping land POEs overcome problems as they 
arise (such as those that might occur operating new technology at space 
constrained facilities). The CBP officers detailed to the liaison 
office have since returned to their original duty stations. According 
to CBP officials, CBP has an open invitation to re-initiate the liaison 
office at any time. 

While past challenges with facilities are well known to US-VISIT and 
CBP officials and efforts have been made to address them, it is not 
clear whether US-VISIT or CBP is prepared to anticipate additional 
facilities challenges--challenges already acknowledged by senior US- 
VISIT officials--that may arise as new US-VISIT capabilities are added. 
The following two key initiatives, in particular, could affect 
operations at land POEs: 

² 10-fingerprint scanning of US-VISIT enrollees. DHS plans to require 
that individuals subject to US-VISIT undergo a 10-fingerprint scan, in 
place of the current 2, to ensure the highest levels of accuracy in 
identifying people entering and exiting the country. Under this plan, 
US-VISIT visitors would be required to have all fingerprints scanned 
the first time they enroll in US-VISIT and to submit a 2-fingerprint 
scan during subsequent visits. A cost/benefit analysis of this 
capability is under way by DHS, selected components, and other 
agencies, with an anticipated transition period (from the 2-to 10- 
fingerprint scan requirement) taking place later this year and next. In 
January 2006, the former Director of US-VISIT testified before the 
Senate Appropriations Subcommittee on Homeland Security that in order 
to introduce a 10-fingerprint scan capability at land POEs and other 
locations, DHS would need a 6-to-8-month period to develop the 
capability and additional time to introduce initial operating 
capability. The former Director testified that unresolved technical 
challenges create the potential for a significant increase in the 
length of time needed to process individuals subject to US-VISIT at 
POEs once the 10-fingerprint requirement is in place.[Footnote 33] In 
commenting on this report, DHS noted that US-VISIT has been working 
with industry to speed up processing time and reduce the size of 10- 
print capture devices to "eliminate or significantly reduce the impact 
of deploying 10-print scanning." As noted earlier, our past work has 
shown that any lengthening in the process of entering the United States 
at the busiest POEs could inconvenience travelers and result in fewer 
visits to the United States or lost business to the nation.[Footnote 
34] 

² Electronic passport readers for Visa Waiver Program travelers. All 
Visa Waiver Program travelers with passports issued after October 26, 
2005 must have passports that contain a digital photograph printed in 
the document; passports issued to visa waiver travelers after October 
26, 2006 must have integrated circuit chips, known as electronic 
passports, which are also called "e-passports." (The Visa Waiver 
Program allows travelers from certain countries to gain entry to the 
United States without a visa.) These e-passports are to contain 
biographic and biometric information that can be read by an e-passport 
reader or scanner, a device which electronically reads or scans the 
information embedded in the e-passport at close proximity, about 4 
inches to the reader. According to DHS, all POEs must have the ability 
to compare and authenticate e-passports as well as visas and other 
travel and entry documents issued to foreign nationals by DHS and the 
Department of State. Earlier this year, DHS announced it had 
successfully tested e-passports and e-passport scanners. A US-VISIT 
Program Office official told us that deployment of these scanners is 
moving toward implementation at POEs located at 34 selected 
international airports where about 97 percent of the Visa Waiver 
Program travelers enter the country. The official said that e-passport 
readers will not initially be installed at land POEs--which process a 
small percentage of visa waiver travelers--and there is no timeline for 
deploying the scanners at land POEs, although there are plans to do so 
at some point. CBP's Director of Automated Programs in the Office of 
Field Operations told us that e-passport readers and the database used 
to process e-passport information do not operate as fast as current 
processes at land POEs and thus could cause additional delays, 
especially at POEs experiencing processing backlogs and wait times, 
such as San Ysidro, California, and Nogales-Mariposa, Arizona. 

Given the potential impact that enhancements to US-VISIT could have 
both on visitor processing overall and on land POE facilities, it is 
important for US-VISIT and CBP to be able to gauge how new changes 
associated with US-VISIT may affect operations. However, our past work 
showed that US-VISIT had not taken all needed steps to help ensure that 
US-VISIT entry capability operates as intended because the approaches 
used to gauge or anticipate the impact of US-VISIT operations on land 
POE facilities was limited. Specifically, in 2005, in an effort to 
evaluate the impact of US-VISIT on the busiest land POEs, DHS completed 
evaluations of the time needed to process and issue the I-94 arrival/ 
departure form at 5 POEs. To conduct its study, DHS studied the I-94 
process before and after US-VISIT was installed at five land POEs at 
three locations (Port Huron, Michigan; Douglas, Arizona; and Laredo, 
Texas). Based on data collected from these 5 POEs, US-VISIT officials 
concluded that no additional staff or facility modifications were 
needed at other POEs in order to accommodate US-VISIT. We reported in 
February 2006 that the scope of this evaluation was too limited to 
determine potential operational impacts on POEs. [Footnote 35] We 
reported three limitations, in particular: (1) that the evaluations did 
not take into account the impact of US-VISIT on workforce requirements 
or facility needs because the evaluations focused solely on I-94 
processing time; (2) that the locations selected were chosen in part 
because they already had sufficient staff to support a US-VISIT pilot- 
test; and (3) that US-VISIT officials did not base their evaluation of 
I-94 processing times on a constant basis before and after deployment 
of US-VISIT--that is, pre-deployment sites used fewer computer 
workstations to process travelers than did sites studied after 
deployment. We recommended that DHS explore alternative means to 
obtaining a full understanding of the impact of US-VISIT on land POEs, 
including its impact on workforce levels and facilities and that POE 
sites be surveyed that had not been included in their original 
assessment. US-VISIT responded that wait times at land POEs were 
already known and that it would conduct operational assessments at POEs 
as new projects came online. However, apart from a study conducted at 
one POE facility by a DHS contractor in August 2005 (cited above), US- 
VISIT has not provided documentation on any additional evaluations 
conducted that would provide additional insights about the effect of US-
VISIT on land POE operations, including wait times. 

We recognize that it may not be cost-effective for US-VISIT or CBP to 
conduct a formal assessment of the impact US-VISIT has on each land POE 
now that the entry capability has been installed or of all facilities 
once new enhancements are introduced. Nevertheless, the assessment 
methodology US-VISIT has used in the past--which focused on measuring 
changes in I-94 processing times--raises questions about how the agency 
will assess the impact that the transition from 2-to 10-fingerprint 
scanning may have on land POE operations. That is, if US-VISIT uses the 
same methodology and focuses on the changes in processing time, rather 
than on the overall impact on operations, including facilities, 
staffing, and support logistics, the results will have the same 
limitations we highlighted in our earlier study. Our February 2006 
recommendation would also be applicable to enhancements that have the 
potential to negatively affect operations. 

Management Controls Did Not Always Alert US-VISIT and CBP to 
Operational Problems: 

US-VISIT and CBP have management controls in place to alert them to 
operational problems as they occur, but these controls did not always 
work to ensure that US-VISIT operates as intended. Specifically, US- 
VISIT and CBP officials had not been made aware of computer processing 
problems that affected operations, in particular, until we brought them 
to their attention, partly because these problems were not always 
reported. These computer processing problems have the potential to not 
only inconvenience travelers because of the increased time needed to 
complete the inspection process, but to compromise security, 
particularly if CBP officers are unable to perform biometric checks-- 
one of the critical reasons US-VISIT was installed at POEs. 

Our standards for internal control in the federal government state that 
it is important for agencies to provide reasonable assurance that they 
can achieve effective and efficient operations.[Footnote 36] This 
includes establishing and maintaining a control environment that sets a 
positive and supportive attitude toward control activities that are 
designed to help ensure that management's directives are carried out. 
Control activities include reviewing and monitoring agency operations 
at the functional level (i.e., at land POEs) to compare operational 
performance with planned or expected results and to ensure that 
controls described in policies and procedures are actually applied and 
applied properly, and having relevant, reliable, and timely 
communications to ensure that information flows down, across, and up 
the organization thereby helping program managers carry out their 
responsibilities and providing assurance that timely action is taken on 
implementation problems or information that requires follow-up. 

Our site visit interviews suggest that current monitoring and control 
activities were not sufficient to ensure that US-VISIT performs in 
accordance with its security mission and objectives. For example, at 12 
of the 21 land POEs we visited, computer-processing problems arose 
that, according to CBP officials at those locations, had an impact on 
processing times and traveler delays. Generally, officials at these 12 
sites said that computer problems occurred with varying frequency and 
duration; some said that computers were at times slow or froze up 
during certain times of the day, while others said that problems were 
sporadic and they could not ascribe them to a particular time of the 
day.[Footnote 37] None of the officials we interviewed had formally 
assessed the impact of computer slowdowns or freezes on visitors and 
visitor wait times, but nonetheless cited computer problems as a cause 
of visitor delays. In November 2005, we notified a US-VISIT program 
official in headquarters that we had heard about computer processing 
problems at some of the POEs we had visited. The official told us that 
US-VISIT had not been aware of these problems and said that, as a 
result of our work, CBP had been contacted to investigate the problem. 
In June 2006, a CBP official responsible for information technology at 
CBP's data center told us that POEs had experienced slowdowns 
associated with certain US-VISIT data queries.[Footnote 38] The CBP 
official told us that since the computer processing problems were 
identified and resolved, performance had greatly improved. We did not 
verify whether the actions taken fully resolved these problems. 

Others have also reported computer processing problems associated with 
US-VISIT. Our review of the report prepared by the contractor hired by 
DHS to study wait times at the POE in Nogales-DeConcini, Arizona 
(discussed earlier) confirmed that slowdowns had occurred at the 
facility during two of the periods covered by its study (June 2005 to 
August 2005).[Footnote 39] According to the contractor, these slowdowns 
resulted in CBP officers having to revert to manual I-94 processing 
without the benefit of US-VISIT biometric checks. Specifically, in its 
reports, the contractor noted that: 

"...on the morning of Thursday, June 23, the computer systems used to 
perform secondary inspections became very slow, impacting the issuance 
of I-94 and enrollment in US-VISIT. The staff had to revert to using 
the paper I-94s, which visitors had to fill out by hand..."

"As happened during the [prior] study, the computer systems were 
unavailable for a period of time. This occurred on Tuesday from 1:00 to 
2:00 p.m. Port officials decided to revert to the manual process 
because the network had become very slow and the queue was growing. CBP 
officers told … researchers that it was taking up to twenty minutes to 
receive responses to queries...."

In an undated memorandum commenting on the contractor's report, US-
VISIT's Director of Mission Operations expressed concern about the 
contractor's discussion of computer "downtime" as a factor impacting US-
VISIT processing times. He stated that these problems can be caused by 
a variety of factors, including factors related to I-94 processing and 
that capturing biometric information "is only rarely responsible for 
the inability to complete the process." Based on our work, it is 
unclear what analysis US-VISIT had done to make this determination. 

US-VISIT officials told us that various controls are in place to alert 
them to problems as they occur, but the lack of awareness about 
computer-processing problems raises questions about whether these 
controls are working as intended. US-VISIT officials told us that it is 
their position that once US-VISIT entry capability equipment was 
installed and operating, CBP became responsible for identifying 
problems and notifying US-VISIT when US-VISIT-related problems occurred 
so that US-VISIT can work with CBP to resolve them. The officials 
stated that computer problems can be attributable to other processes 
and systems not related to US-VISIT which are not the US-VISIT Program 
Office's responsibility. In addition, the Acting Director of US-VISIT 
noted that there are mechanisms in place to help CBP and US-VISIT 
identify problems. For example, US-VISIT officials told us that US-
VISIT and CBP headquarters officials meet regularly to discuss issues 
associated with US-VISIT implementation and CBP maintains a help desk 
at its Virginia data center to resolve technology problems raised by 
CBP field officials. Regarding the latter, the Acting Director noted 
that if POE officials do not report problems, there is nothing CBP and 
US-VISIT can do to resolve them. During our review, we noted that CBP 
officers are required--in training and as part of standard operating 
procedures--to report problems with US-VISIT technology to the CBP help 
desk. Nevertheless, CBP officials at 9 of the 12 sites we visited where 
computer processing problems were identified said they did not always 
use the help desk to report or resolve computer problems (and thereby 
generating a record of the problems). Officials at 5 of the 9 sites 
told us they temporarily resolved the problem by turning off and 
restarting the computers. 

Although US-VISIT and CBP have some controls in place to help them 
identify and address problems like those discussed above, these 
controls may not have been implemented consistently or may not be 
sufficient to ensure that US-VISIT operates as intended because 
officials did not always alert CBP and US-VISIT program managers to the 
fact that problems were occurring that adversely affected operations. 
It is important that US-VISIT and CBP managers are alerted to problems 
as they occur to ensure continuity of operations consistent with US- 
VISIT's goal of providing security to U.S. citizens and travelers. 
Moreover, in light of the fact that US-VISIT plans to enhance security 
through additional technology investments and that it may be 
challenging to deploy and operate at facilities that are already known 
to be aging and undersized, it is incumbent upon the US-VISIT program 
office to play a continuing and proactive role in the management 
control structure. 

Our internal control standards also call for agencies to establish 
performance measures and indicators throughout the organization so that 
actual performance can be compared to expected results. The US-VISIT 
program office has established and implemented performance measures for 
fiscal years 2005 and 2006 that are designed to gauge performance of 
various aspects of US-VISIT covering a variety of areas, but these 
measures do not gauge the performance of US-VISIT entry capabilities at 
land POEs. For example, according to a July 2006 draft report prepared 
by the US-VISIT program office, US-VISIT has begun to measure the ratio 
of adverse actions (defined as decisions to deny entry into the 
country) to total-biometric-watch-list "hits" when visitors are 
processed at ports of entry.[Footnote 40] According to US- VISIT, this 
measure seeks to help CBP focus its inspection activities on preventing 
potential known or suspected criminals or terrorists from entering the 
country. US-VISIT reported that it had not established a baseline or 
target for this measure in fiscal year 2005. However, according to US-
VISIT, CBP officers at all POEs combined denied entrance to 30 percent 
of persons whose biometric information appeared on a watch list during 
fiscal year 2005 (about 617 of the 2,059 watch list "hits"). US-VISIT 
established a target for this measure during fiscal year 2006 of 33 
percent. 

Another measure is designed to gauge the wait time incurred by a 
specific US-VISIT activity at all air, land, and sea POEs, namely the 
average response time to deliver results on biometric watch list 
queries for finger scans. (This measure does not gauge other US-VISIT 
related activities such as scanning the visa or passport, taking and 
processing a digital photograph, or printing an I-94.) To ensure that 
wait times are not increased substantially due to additional US-VISIT 
capabilities at POEs, US-VISIT has established a goal of 10 seconds and 
reported that, since October 2004, US-VISIT has been able to maintain, 
on average, less than an 8-second response time at POEs at which US- 
VISIT had been installed. 

These and other existing measures of certain key aspects of program 
performance with respect to both security and efficiency can be useful 
in analyzing trends and measuring results against planned or expected 
results. However, because there are operational and facility 
differences among air, sea, and land POEs, it is important to be able 
to measure and distinguish differences--one would not expect baseline 
or target measures to be the same across these environments. At air and 
sea ports, visitors are processed in primary inspection in a controlled 
environment and CBP officers are able to prescreen visitors using 
passenger manifests, which are transmitted to CBP while passengers are 
enroute to the POE. By contrast, at land POEs, visitors arrive on foot 
or in a vehicle and CBP officers refer them to secondary inspection for 
US-VISIT processing without the benefit of a manifest and based on the 
information available to officers at the point of initial contact--a 
process substantially different than that used at air and sea ports. 
The measures used in August 2006 aggregated baselines and targets for 
all POEs and did not distinguish among them with regard to air, land, 
and sea POEs. 

Without additional performance measures to more fully gauge operational 
impacts of US-VISIT on land POEs, CBP and US-VISIT may not be well 
equipped to identify problems, trends, and areas needing improvements 
now and as additional US-VISIT entry capabilities, such as 10-finger 
scans, are introduced. Consistent with our past work, we believe such 
measures could help DHS identify and quantify problems, evaluate 
alternatives, allocate resources, track progress, and learn from any 
mistakes that may have been made while deploying and operating US-VISIT 
at land POEs.[Footnote 41] 

DHS Cannot Currently Implement a Biometric US-VISIT Exit Capability at 
Land POEs and Faces Uncertainties as Testing of an Alternative Exit 
Strategy Continues: 

While federal laws require the creation of a US-VISIT exit capability 
using biometric verification, the US-VISIT Program Office concluded 
that implementing a biometrically-based exit-recording system like that 
used to record visitors entering the country would require additional 
staff and new infrastructure (such as buildings and roadways) that 
would be prohibitively costly, would likely produce major traffic 
congestion in exit lanes at the busier land POEs and could have adverse 
impacts on trade and commerce. Although current technology does not 
exist to enable biometric verification of those leaving the country 
without major infrastructural changes, US-VISIT officials believe 
technological advances over the next 5-to 10-years will enable them to 
record who is leaving the country using biometrics without requiring 
travelers to stop at a facility, thereby minimizing the need for major 
infrastructure changes. In the interim, US-VISIT is testing an 
alternative nonbiometric technology for recording visitors as they exit 
the country, in which electronic tags containing a numeric identifier 
associated with each visitor are embedded in I-94 forms. US-VISIT's own 
analysis of this technology and our analysis and that of others has 
identified numerous performance and reliability problems with this 
solution, including the inability of the nonbiometric solution to 
ensure that the person exiting the country is the same who entered. US- 
VISIT has taken corrective actions and testing is still ongoing, but 
uncertainties remain about how US-VISIT will use technology in the 
future to meet biometric exit requirements. These uncertainties reflect 
the fact that DHS has not met a June 2005 statutory requirement to 
submit a report to the Congress that describes (1) the status of 
biometric exit data systems already in use at POEs and (2) the manner 
in which US-VISIT is to meet the goal of a comprehensive screening 
system, with both entry and exit biometric capability. 

Various Factors Have Prevented US-VISIT from Implementing a Biometric 
Exit Capability: 

Federal laws require the creation of a US-VISIT exit capability using 
biometric verification methods to ensure that the identity of visitors 
leaving the country can be matched biometrically against their entry 
records.[Footnote 42] However, according to officials at the US-VISIT 
program office and CBP and US-VISIT program documentation, there are 
interrelated logistical, technological, and infrastructure constraints 
that have precluded DHS from achieving this mandate, and there are cost 
factors related to the feasibility of implementation of such a 
solution. The major constraint to performing biometric verification 
upon exit at this time, in the US-VISIT Program Office's view, is that 
the only proven technology available would necessitate mirroring the 
processes currently in use for US-VISIT at entry. A mirror-image system 
for exit would, like entry, require CBP officers at land POEs to 
examine the travel documents of those leaving the country, take 
fingerprints, compare visitors' facial features to photographs, and, if 
questions about identity arise, direct the departing visitor to 
secondary inspection for additional questioning. These steps would be 
carried out for exiting pedestrians as well as for persons exiting in 
vehicles. The US-VISIT Program Office concluded in an internal January 
2005 report assessing alternatives to biometric exit that the mirror- 
imaging solution was "an infeasible alternative for numerous reasons, 
including but not limited to, the additional staffing demands, new 
infrastructure requirements, and potential trade and commerce 
impacts."[Footnote 43] 

US-VISIT officials told us that they anticipated that a biometric exit 
process mirroring that used for entry could result in delays at land 
POEs with heavy daily volumes of visitors. And they stated that in 
order to implement a mirror-image biometric exit capability, additional 
lanes for exiting vehicles and additional inspection booths and staff 
would be needed, though they have not determined precisely how many. 
According to these officials, it is unclear how new traffic lanes and 
new facilities could be built at land POEs where space constraints 
already exist, such as those in congested urban areas. (For example, 
San Ysidro, California, currently has 24 entry lanes, each with its own 
staffed booth and 6 unstaffed exit lanes. Thus, if full biometric exit 
capability were implemented using a mirror image approach, San Ysidro's 
current capacity of 6 exit lanes would have to be expanded to 24 exit 
lanes.) As shown in figure 6, based on observations during our site 
visit to the San Ysidro POE, the facility is surrounded by dense urban 
infrastructure, leaving little, if any, room to expand in place. Some 
of the 24 entry lanes for vehicle traffic heading northwards from 
Mexico into the United States appear in the bottom left portion of the 
photograph, where vehicles are shown waiting to approach primary 
inspection at the facility; the six exit lanes (traffic towards 
Mexico), which do not have fixed inspection facilities, are at the 
upper left. 

Figure 6: Aerial View of San Ysidro, California, POE: 

[See PDF for image] 

Source: GAO. 

[End of figure] 

Other POE facilities are similarly space-constrained. At the POEs at 
Nogales-DeConcini, Arizona, for example, we observed that the facility 
is bordered by railroad tracks, a parking lot, and industrial or 
commercial buildings. In addition, CBP has identified space constraints 
at some rural POEs. For example, the Thousand Islands Bridge POE at 
Alexandria Bay, New York, is situated in what POE officials described 
as a "geological bowl," with tall rock outcroppings potentially 
hindering the ability to expand facilities at the current location. 
Officials told us that in order to accommodate existing and anticipated 
traffic volume upon entry, they are in the early stages of planning to 
build an entirely new POE on a hill about a half-mile south of the 
present facility. CBP officials at the Blaine-Peace Arch POE in 
Washington state said that CBP also is considering whether to relocate 
and expand the POE facility, within the next 5-to-10 years, to better 
handle existing and projected traffic volume. According to the US-VISIT 
program officials, none of the plans for any expanded, renovated, or 
relocated POE include a mirror-image addition of exit lanes or 
facilities comparable to those existing for entry. 

In 2003, the US-VISIT Program Office estimated that it would cost 
approximately $3 billion to implement US-VISIT entry and exit 
capability at land POEs where US-VISIT was likely to be installed and 
that such an effort would have a major impact on facility 
infrastructure at land POEs. We did not assess the reliability of the 
2003 estimate. The cost estimate did not separately break out costs for 
entry and exit construction, but did factor in the cost for building 
additional exit vehicle lanes and booths as well as buildings and other 
infrastructure that would be required to accommodate a mirror imaging 
at exit of the capabilities required for entry processing. US-VISIT 
program officials told us that they provided this estimate to 
congressional staff during a briefing, but that the reaction to this 
projected cost was negative and that they therefore did not move ahead 
with this option. No subsequent cost estimate updates have been 
prepared, and DHS's annual budget requests have not included funds to 
build the infrastructure that would be associated with the required 
facilities. 

US-VISIT officials stated that they believe that technological advances 
over the next 5-to-10 years will make it possible to utilize 
alternative technologies that provide biometric verification of persons 
exiting the country without major changes to facility infrastructure 
and without requiring those exiting to stop and/or exit their vehicles, 
thereby precluding traffic backup, congestion, and resulting delays. US-
VISIT's report assessing biometric alternatives noted that although 
limitations in technology currently preclude the use of biometric 
identification because visitors would have to be stopped, the use of 
the as-yet undeveloped biometric verification technology supports the 
long-term vision of the US-VISIT program.[Footnote 44] However, no such 
technology or device currently exists that would not have a major 
impact on facilities. The prospects for its development, manufacture, 
deployment and reliable utilization are currently uncertain or unknown, 
although a prototype device that would permit a fingerprint to be read 
remotely without requiring the visitor to come to a full stop is under 
development. 

While logistical, technical, and cost constraints may prevent 
implementation of a biometrically based exit technology for US-VISIT at 
this time, it is important to note that there currently is not a 
legislatively mandated date for implementation of such a solution. The 
Intelligence Reform and Terrorism Prevention Act of 2004 requires US- 
VISIT to collect biometric-exit-data from all individuals who are 
required to provide biometric entry data.[Footnote 45] The act did not 
set a deadline, however, for requiring collection of biometric exit 
data from all individuals who are required to provide biometric entry 
data. Although US-VISIT had set a December 2007 deadline for 
implementing exit capability at the 50 busiest land POEs, US-VISIT has 
since determined that implementing exit capability by this date is no 
longer feasible, and a new date for doing so has not been set. 

The US-VISIT Program Office Is Testing Nonbiometric Technology to 
Record Travelers' Departure[Footnote 46] 

Because there is at present no biometric technology that can be used to 
verify a traveler's exit from the country at land POEs without also 
making major and costly changes to POE infrastructure and facilities, 
the US-VISIT Program Office sought an alternative means of recording a 
visitor's exit from the country, using nonbiometric technology, that 
could be tested at land POEs. US-VISIT determined that the chosen 
nonbiometric technology would have to meet certain criteria. According 
to the US-VISIT Program Office, the technology would have to: (1) 
permit recording of an exiting visitor in order that stopping or 
slowing down would not be required and privacy issues were addressed; 
(2) result in no increase in wait times for visitors; (3) create no 
degradation in the level of service at exit lanes; (4) create no 
significant degradation in traffic patterns (that is, no additional 
traffic congestion); (5) be convenient to the visitor, and (6) be 
commercially available. None of these criteria directly addressed or 
reflected the legislative mandate to deploy a system to record entry 
and exit by foreign travelers using biometric identifiers in order to 
ensure that persons leaving the country were those who had entered. 
Rather, the criteria focused on choosing a technology that would not 
require a major investment in facilities, would protect privacy, and 
would not generate large traffic backups that would inconvenience or 
delay both travelers and commercial carriers. 

Among the technologies considered for testing by the US-VISIT Program 
Office, the only one that met all the US-VISIT evaluation criteria was 
passive, automated, radio frequency identification (RFID).[Footnote 47] 
This technology, according to US-VISIT, "best satisfied all the 
assessment criteria." RFID is an automated data-capture technology that 
can be used to electronically store information contained on a very 
small tag that can be embedded in a document (or some other physical 
item). This information can then be identified, and recorded as having 
been identified, by RFID readers that are connected to computer 
databases. 

For purposes of US-VISIT's testing of the nonbiometric technology, the 
RFID tag is embedded in a modified I-94 arrival/departure form, called 
an I-94A. Each RFID tag has only a single number stored in it; privacy 
is protected because no information is stored on these tags other than 
a unique ID number that is linked to the visitor's biographic 
information. To facilitate the transmission of the number from the RFID 
tag, a new DHS system of records--the Automated Identification 
Management System (AIDMS) [Footnote 48]--was created to link the unique 
RFID tag ID number to existing information stored in the Treasury 
Enforcement Communications System (TECS) database, which is used by CBP 
to verify travel information and update traveler data.[Footnote 49] 
According to US-VISIT, limiting the data on the tag to a single number 
helps preserve the privacy of travelers; acquisition of the number 
would provide no meaningful information to non-authorized persons, 
since they would then have to access TECS to link the number to 
biographic data. However, access to computers and their databases at 
land POEs is restricted to authorized personnel and involves additional 
protections such as passwords as well as entrance into physically 
restricted areas inside POE buildings. (A more detailed discussion of 
RFID technology and privacy issues is contained in appendix VI.) 

The RFID technology used in this way is considered passive because the 
tag cannot initiate communications. Rather, the tag responds to radio 
frequency emissions from an RFID reader--an electronic device that can 
be installed on a pole, or on a steel gantry of the kind that holds 
highway signs over the entire width of a roadway (see figure 11)--and 
transmits the numeric information stored on the tag back to the reader, 
from up to 30 feet away, according to the US-VISIT Program Office. 
Figure 7a shows RFID readers mounted on a metal gantry at the Thousand 
Islands Bridge land POE, Alexandria Bay, New York. The readers are 
attached to metal extensions that project out from the right side of 
the gantry, to record an I-94A embedded with tags that are inside the 
vehicles that pass underneath. RFID readers can also be installed in 
portals or on poles at pedestrian traffic areas to read the I-94A 
embedded with tags of persons leaving the country on foot. Figure 7b 
shows RFID readers in portals positioned on either side of pedestrian 
exit doors at the Blaine-Peace Arch POE in Washington State. 

Figure 7a: Metal Gantry with RFID Readers and Antennas at the Thousand 
Islands Bridge POE, Alexandria Bay, New York: 

[See PDF for image] 

Source: GAO. 

[End of figure] 

Figure 7b: RFID Portals Positioned Next to Exit Doors at the Blaine- 
Peace Arch POE in Washington State: 

[See PDF for image] 

Source: GAO. 

[End of figure] 

Initial Results of Testing Using RFID Technology Indicate Problems 
Meeting a Key Program Goal--Verifying the Identity of Persons Leaving 
the Country: 

In December 2004 and January 2005, a team of US-VISIT contractors 
conducted the first part of a feasibility study to test passive RFID 
equipment in a simulated environment-at a mock POE in Virginia. At this 
site, different types of vehicles-including cars, buses, and trucks--
were run at different speeds to test RFID read rates. Pedestrians 
carrying documents with RFID tags embedded or attached were not tested. 
The feasibility study raised numerous issues about the reliability and 
performance of the RFID technology. For example, RFID readers held on a 
gantry over a roadway had difficulty detecting RFID-detectable tags 
that were inside vehicles with metallic tinted windows (whether the 
windows were open or closed). The read rate was improved from about 56 
percent to about 70 percent if the readers were moved to both sides of 
the road, rather than overhead, and if the occupants held their 
documents with the RFID-detectable tags up to the vehicle's side 
windows. The study concluded that the physical actions of the visitor 
had to be taken into account when obtaining a read of the I-94A and 
made specific recommendations to improve read rates, such as suggesting 
that vehicle occupants hold the I-94A up to a side window and keep 
multiple forms apart. 

After the feasibility study, US-VISIT proceeded, as planned, with phase 
1 of proof-of-concept testing for RFID at five land POEs at the 
northern and southern borders to determine what corrective actions, if 
any, should be taken to improve RFID read rates for exiting vehicles 
and pedestrians. This effort comprised testing for both exit and for re-
entry by persons who have been issued a tag-embedded I-94A that is 
valid for multiple entries over several months. [Footnote 50] The RFID 
performance tests were conducted for one-week periods at land POEs, as 
follows:[Footnote 51] vehicular traffic was tested at Nogales-Mariposa 
and Nogales-DeConcini POEs in Nogales, Arizona; the Blaine-Pacific 
Highway and Blaine-Peace Arch POEs in Blaine, Washington; and Thousand 
Islands Bridge POE in Alexandria Bay, New York; pedestrian traffic was 
tested at the Nogales-Mariposa and Nogales-DeConcini POEs. 

For these exit tests, the US-VISIT Program Office developed critical 
success factor target read rates to compare them to the actual read 
rates obtained during the test for both pedestrians carrying an I-94A 
with RFID-detectable tags and for travelers in vehicles who also had an 
RFID-detectable I-94A with them inside the vehicles. The target exit 
read rates ranged from an expected success rate of 70 percent to 95 
percent, based on anticipated performance under different conditions, 
partly as demonstrated in the earlier feasibility study, on business 
requirements, and on a concept of operation plan prepared for Increment 
2C.[Footnote 52] 

In a January 2006 assessment[Footnote 53] of the test results, the US- 
VISIT Program Office reported that the exit read rates that occurred 
during the test generally fell short of the expected target rates for 
both pedestrians and for travelers in vehicles. For example, according 
to US-VISIT, at the Blaine-Pacific Highway test site, of 166 vehicles 
tested, RFID readers correctly identified 14 percent; the target read 
rate was 70 percent.[Footnote 54] Another problem that arose was that 
of cross-reads, in which multiple RFID readers installed on gantries or 
poles picked up information from the same visitor, regardless of 
whether the individual was entering or exiting in a vehicle or on foot. 
Thus, cross-reads resulted in inaccurate record-keeping. According to a 
January 2006 US-VISIT corrective-action report, signal-filtering 
equipment is to be installed to correct the problem and additional 
testing is to be conducted to confirm and understand the extent of the 
problem. The report also noted that remedying cross-reads would require 
changes to equipment and infrastructure on a case-by-case basis at each 
land POE, because each has a different physical configuration of 
buildings, roadways, roofs, gantries, poles, and other surfaces against 
which the signals can bounce and cause cross-reads. Each would 
therefore require a different physical solution to avoid the signal 
interference that triggers cross-reads. Although cost estimates or time 
lines have not been developed for such alterations to facilities and 
equipment, it is possible that having to alter the physical 
configuration at each land POE in some regard and then test each 
separately to ensure that cross-reads had been eliminated would be both 
time consuming and potentially costly, in terms of changes to 
infrastructure and equipment. 

We observed potential problems with the RFID exit system relating to 
facilities and infrastructure at some of the POEs we visited. At the 
Nogales-Mariposa POE, in Nogales, Arizona, for example, we observed 
that RFID portals for pedestrians had been placed on the right side of 
the CBP POE building, on a rocky, sloping hillside, and that there was 
no signage directing pedestrians to walk between them, nor was a 
walkway installed, as shown in figure 8a. Although travelers were 
expected to walk between the portals, this configuration enabled 
pedestrians to avoid the portals altogether--to walk around them or 
cross the road to avoid them, as shown in figure 8b. 

Figure 8a: RFID Installation at the Nogales-Mariposa POE in Arizona, 
Facing Toward Mexico: 

[See PDF for image] 

Source: GAO. 

[End of figure] 

Figure 8b: Two Pedestrians Exiting the Country at the Nogales-Mariposa 
POE, Arizona, Walking Toward Mexico: 

[See PDF for Image] 

Source: GAO. 

[End of Figure] 

According to the US-VISIT corrective actions report, 15 percent of 
exiting pedestrian (including those participating in the test and those 
who did not) used the pathway between the two portals at the Nogales 
facility during a September 2005 observation period.[Footnote 55] In 
this same report, US-VISIT acknowledged that there was no defined 
pathway or infrastructure for pedestrian exit at Nogales-Mariposa, 
Arizona, and that only one of the three pedestrian paths were covered 
by the portals that had been placed there. US-VISIT reported that while 
the placement of the portal readers will not be changed, it is taking 
steps to improve the likelihood of detection with additional antennae, 
readers, and signage. However, there are no plans at present to modify 
the existing POE infrastructure on the west side of the building where 
the portals were installed, such as by installing a paved walkway or by 
constructing fencing to divert those exiting to go through the readers 
in order to increase the chances that exiting pedestrians are detected. 
In commenting on this report, DHS stated that it had constructed a new 
primary pedestrian exit walkway parallel to the existing pedestrian 
entry and had installed signage, sidewalks, and a new secure gate. 
However, according to a CBP official at the Nogales- Mariposa POE, the 
newly constructed pedestrian exit walkway is on the other (east) side 
of the building from the pathway where the portal readers were placed 
and tested. 

During the period that US-VISIT carried out RFID exit tests at land 
POEs, US-VISIT also tested read rates for RFID-detectable documents 
carried by pedestrians or persons in vehicles who had been issued an I-
94A during a prior visit to the United States, had subsequently left 
the country, and were intending to re-enter.[Footnote 56] (I-94s can be 
issued that are valid for up to 6 months for multiple re-entries into 
the country.) US-VISIT performed the re-entry test for documents held 
by persons in vehicles at the Mariposa and DeConcini POEs in Nogales, 
Arizona; the Blaine-Pacific Highway and Blaine-Peace Arch, POEs in 
Washington state; and Thousand Islands Bridge POE at Alexandria Bay, 
New York. For pedestrians, the re-entry test was performed at the 
Mariposa and DeConcini POEs in Nogales, Arizona (see tables 6a and 6b, 
appendix VII). US-VISIT set higher expected target read rates for the 
re-entry test than for exit because all persons and vehicles entering 
or re-entering the country must stop for questioning by CBP officers 
and must take travel documents out of their pockets or from inside a 
vehicle, and show them to the officer, enhancing the likelihood that 
RFID-detectable documents would be detected. As expected by US-VISIT, 
read rates for the re-entry test for vehicles were generally higher 
than for exit, although the results did not meet the critical success 
factors initially projected by US-VISIT. Appendix VII discusses the 
results of RFID performance for exit and re-entry in greater detail. 

Beyond RFID operations issues that affect facilities, our work and that 
of the DHS Privacy Office have identified other performance and 
reliability problems related to passive RFID. In June 2005, we 
testified before the Subcommittee on Economic Security, Infrastructure 
Protection, and Cybersecurity of the House Committee on Homeland 
Security on similar reliability problems with RFID.[Footnote 57] We 
noted, for example, that when an object close to the reader or tag 
interferes with the radio waves, read-rate accuracy decreases, and that 
environmental conditions, such as temperature and humidity, can make 
tags unreadable. We further noted that tags read at high speeds have a 
significant decrease in read rates. 

According to US-VISIT officials, phase 2 of the RFID proof- of-concept 
testing, which is to expand the capabilities identified at the five 
phase 1 locations will, among other things, link visitor data to 
vehicle exit data (or re-entry, if the visitor already has an RFID- 
embedded I-94 form), address deficiencies noted in phase 1, and further 
evaluate RFID performance. At the time of our review, many 
uncertainties about the future of a US-VISIT exit capability remained 
because US-VISIT had not developed a plan to show when phase 2 of proof-
of-concept testing of RFID would conclude, when an evaluation of the 
technology would be completed, and how US-VISIT would define success. 

However, even if RFID deficiencies were to be fully addressed and 
deadlines set, questions remain about DHS's intentions going forward. 
For example, the RFID solution does not meet the congressional 
requirement for a biometric exit capability because the technology that 
has been tested cannot meet a key goal of US-VISIT-- ensuring that 
visitors who enter the country are the same ones who leave. By design, 
an RFID tag embedded in an I-94 arrival/departure form cannot provide 
the biometric identity-matching capability that is envisioned as part 
of a comprehensive entry/exit border security system using biometric 
identifiers for tracking overstays and others entering, exiting, and re-
entering the country. Specifically, the RFID tag in the I-94 form 
cannot be physically tied to an individual. This situation means that 
while a document may be detected as leaving the country, the person to 
whom it was issued at time of entry may be somewhere else. 

DHS was to have reported to Congress by June 2005 on how the agency 
intended to fully implement a biometric entry/exit program. As of 
October 2006, this plan was still under review in the Office of the 
Secretary, according to US-VISIT officials. According to statute, this 
plan is to include, among other things, a description of the manner in 
which the US-VISIT program meets the goals of a comprehensive entry and 
exit screening system--including both biometric entry and exit--and 
fulfills statutory obligations imposed on the program by several laws 
enacted between 1996 and 2002.[Footnote 58] Until such a plan is 
finalized and issued, DHS is not able to articulate how entry/exit 
concepts will fit together--including any interim nonbiometric 
solutions--and neither DHS nor Congress is positioned to prioritize and 
allocate resources for a US-VISIT exit capability or plan for the 
program's future. 

In commenting on this report, DHS acknowledged that the interim non-
biometric exit technology using RFID tags embedded in the I-94 does not 
meet the statutory requirement for a biometric exit capability. DHS 
stated that it used the non-biometric technology because industry was 
not to the point of developing a device that could satisfy US-VISIT 
requirements, such as not impacting traffic flows or not having safety 
impacts. DHS said that US-VISIT officials would perform subsequent 
research and industry outreach activities in an attempt to satisfy 
statutory requirements for a biometric exit capability. 

DHS Has Not Articulated How US-VISIT Strategically Fits with Other Land-
Border Security Initiatives: 

In recent years, DHS has planned or implemented a number of initiatives 
aimed at securing the nation's borders. However, DHS has not defined a 
strategic context that shows how US-VISIT fits with other land border 
initiatives. As we reported in September 2003, agency programs need to 
properly fit within a common strategic context governing key aspects of 
program operations--e.g., what functions are to be performed by whom; 
when and where they are to be performed; what information is to be used 
to perform them; what rules and standards will govern the application 
of technology to support them; and what facility or infrastructure 
changes will be needed to ensure that they operate in harmony and as 
intended.[Footnote 59] Without a clear strategic context for US-VISIT, 
the risk is increased that the program will not operate with related 
programs and thus not cost-effectively meet mission needs. 

In our September 2003 report, we stated that DHS had not defined key 
aspects of the larger homeland security environment in which US-VISIT 
would need to operate. For example, certain policy and standards 
decisions had not been made, such as whether official travel documents 
would be required for all persons who enter and exit the country, 
including U.S. and Canadian citizens, and how many fingerprints would 
be collected--factors that could potentially increase inspection times 
and ultimately increase traveler wait times at some of the higher 
volume land POE facilities. To minimize the impact of these changes, we 
recommended that DHS clarify the context in which US-VISIT is to 
operate. Three years later, defining this strategic context remains a 
work in progress. Thus, the program's relationships and dependencies 
with other closely allied initiatives and programs are still unclear. 

According to the US-VISIT Chief Strategist, the Program Office drafted 
in March 2005 a strategic plan that showed how US-VISIT would be 
strategically aligned with DHS's organizational mission and also 
defined an overall vision for immigration and border 
management.[Footnote 60] According to this official, the draft plan 
provided for an immigration and border management enterprise that 
unified multiple internal departmental and other external stakeholders 
with common objectives, strategies, processes, and infrastructures. As 
of October 2006, we were told that DHS had not approved this strategic 
plan. This draft plan was not available to us, and it is unclear how it 
would provide an overarching vision and road map of how all these 
component elements can at this time be addressed given that critical 
elements of other emerging border security initiatives have yet to be 
finalized. For example, under the Intelligence Reform and Terrorism 
Prevention Act of 2004, DHS and State are to develop and implement a 
plan, no later than June 2009, which requires U.S. citizens and foreign 
nationals of Canada, Bermuda, and Mexico to present a passport or other 
document or combination of documents deemed sufficient to show identity 
and citizenship to enter the United States (this is currently not a 
requirement for these individuals entering the United States via land 
POEs from within the western hemisphere). This effort, known as the 
Western Hemisphere Travel Initiative (WHTI), was first announced in 
2005, and some members of Congress and others have raised questions 
about agencies' progress carrying out WHTI. In May 2006, we issued a 
report that provided our observations on efforts to implement WHTI 
along the U.S. border with Canada.[Footnote 61] We stated that DHS and 
State had taken some steps to carry out the Travel Initiative, but they 
had a long way to go to implement their proposed plans, and time was 
slipping by. Among other things, we found that: 

* key decisions had yet to be made about what documents other than a 
passport would be acceptable when U.S. citizens and citizens of Canada 
enter or return to the United States--a decision critical to making 
decisions about how DHS is to inspect individuals entering the country, 
including what common facilities or infrastructure might be needed to 
perform these inspections at land POEs; 

* a DHS and Department of State proposal to develop an alternative form 
of passport, called a PASS card, would rely on RFID technology to help 
DHS process U.S. citizens re-entering the country, but DHS had not made 
decisions involving a broad set of considerations that include (1) 
utilizing security features to protect personal information, (2) 
ensuring that proper equipment and facilities are in place to 
facilitate crossings at land borders, and (3) enhancing compatibility 
with other border crossing technology already in use. 

As of September 2006, DHS had still not finalized plans for changing 
the inspection process and using technology to process U.S. citizens 
and foreign nationals of Canada, Bermuda, and Mexico reentering or 
entering the country at land POEs. In the absence of decisions about 
the strategic direction of both programs, it is still unclear (1) how 
the technology used to facilitate border crossings under the Travel 
Initiative will be integrated with US-VISIT technology, if at all, and 
(2) how land POE facilities would have to be modified to accommodate 
both programs to ensure efficient inspections that do not seriously 
affect wait times. This raises the possibility that CBP would be faced 
with managing differing technology platforms and border inspection 
processes at high-volume land POEs facilities that, according to DHS, 
already face space constraints and congestion. 

Similarly, it is not clear how US-VISIT is to operate in relation to 
another emerging border security effort, the Secure Border Initiative 
(SBI)--a new comprehensive DHS initiative, announced last year, to 
secure the country's borders and reduce illegal migration. According to 
DHS, as of June 2006, SBI is to focus broadly on two major themes: 

* border control--gaining full control of the borders to prevent 
illegal immigration, as well as security breaches, and: 

* interior enforcement--disrupting and dismantling cross border crime 
into the interior of the United States while locating and removing 
aliens who are present in the United States in violation of law. 

Under SBI and its CBP component, called SBInet, DHS plans to use a 
systems approach to integrate personnel, infrastructures, technologies, 
and rapid response capability into a comprehensive border protection 
system. DHS reports that, among other things, SBInet is to encompass 
both the northern and southern land borders, including the Great Lakes, 
under a unified border control strategy whereby CBP is to focus on the 
interdiction of cross-border violations between the ports and at the 
official land POEs and funnel traffic to the land POEs. 

DHS has recently awarded a contract to help DHS design, build, and 
execute SBInet. Although DHS has published some information on various 
aspects of SBI and SBInet, it remains unclear how SBInet will be 
linked, if at all, to US-VISIT so that the two systems can share 
technology, infrastructure, and data across programs. For example, from 
a border control perspective, questions arise on whether CBP needs 
additional resources, facilities or facility modifications, and 
procedural changes at land POEs if all those who attempt to enter the 
country on the northern and southern border are successfully funneled 
to land POEs. 

Also, given the absence of a comprehensive entry and exit system, 
questions remain about what meaningful data US-VISIT may be able to 
provide other DHS components, such as Immigration and Customs 
Enforcement (ICE), to ensure that DHS can, from an interior enforcement 
perspective, identify and remove foreign nationals covered by US-VISIT 
who may have overstayed their visas. In a May 2004 report, we stated 
that although no firm estimates were available, the extent of 
overstaying is significant.[Footnote 62] We stated that most long-term 
overstays appeared to be motivated by economic opportunities, but a few 
had been identified as terrorists or involved in terrorist-related 
activities. Notably, some of the September 11 hijackers had overstayed 
their visas. We further reported that US-VISIT held promise for 
identifying and tracking overstays as long as it could overcome 
weaknesses matching visitors' entry and exit. 

Conclusions: 

Developing and deploying complex technology that records the entry and 
exit of millions of visitors to the United States, verifies their 
identities to mitigate the likelihood that terrorists or criminals can 
enter or exit at will, and tracks persons who remain in the country 
longer than authorized is a worthy goal in our nation's effort to 
enhance border security in a post-9/11 era. But doing so also poses 
significant challenges; foremost among them is striking a reasonable 
balance between US-VISIT's goals of providing security to U.S. citizens 
and visitors while facilitating legitimate trade and travel. DHS has 
made considerable progress making the entry portion of the US-VISIT 
program at land ports of entry (POEs) operational, and border officials 
have clearly expressed the benefits that US-VISIT technology and 
biometric identification tools have afforded them. Nevertheless, US-
VISIT is one in a series of ambitious border security initiatives that 
could take a toll on the current facilities and infrastructure in place 
to support the activities at land POEs, which already process a large 
majority (more than 75 percent) of all visitors entering the United 
States via legal checkpoints. Many land POEs operate out of small, 
aging structures that are constrained by space and that were 
constructed before technology and associated equipment played a 
prominent role in processing activities. 

Our current and past work has raised questions on whether DHS has 
adequately assessed how US-VISIT has affected operations at land POEs, 
given current constraints at facilities that routinely experience high 
traffic volumes and which encounter occasional computer-processing 
problems. As additional US-VISIT capabilities-- such as 10-fingerprint 
scanning--are installed at land POEs and as other border security 
initiatives unfold, including the Western Hemisphere Travel Initiative, 
it is particularly important that DHS be able to anticipate potential 
problems and develop solutions to minimize any operational and 
logistical impacts on aging and already overcrowded land POE 
facilities. Our earlier recommendation on this issue suggested that DHS 
needed to expand upon prior efforts to assess the impact of US-VISIT on 
busy land POEs in order to obtain a fuller understanding of the 
system's impact on these facilities from an operational and human 
capital perspective. We believe this remains an important step to take 
because it would help DHS establish a baseline or foundation from which 
to anticipate potential problems while providing a framework for 
developing strategies and action plans to overcome them. Although US- 
VISIT has said it would conduct operational assessments at POEs as new 
projects came online, the assessment methodology US-VISIT has used in 
the past--which focused on measuring changes in I-94 processing times-
-raised questions about how the agency will perform future assessments. 

In addition, because US-VISIT will likely continue to have an impact on 
land POE facilities as it evolves, it is important for US-VISIT and CBP 
officials to have sufficient management controls for identifying and 
reporting potential computer and other operational problems as they 
arise--problems that could affect the ability of US-VIST entry 
capability to operate as intended. If additional delays in processing 
visitors were to occur, the ability of POE facilities to handle 
additional vehicular and pedestrian traffic could be further strained, 
and incidents requiring officials to turn visitors away temporarily may 
increase. Likewise, if disruptions to US-VISIT computer operations are 
not consistently and promptly reported and resolved and if 
communication between CBP and US-VISIT officials about computer-related 
problems and other operational challenges is not effective, then it is 
possible that a critical US-VISIT function--notably, the ability to use 
biometric information to confirm visitors' identities through various 
databases--could be disrupted, as has occurred in the past. The need to 
avoid disruptions to biometric verification is important given that one 
of the primary goals of US-VISIT is to enhance the security of U.S. 
citizens and visitors, and in light of the substantial investment DHS 
has made in US-VISIT technology and equipment. 

US-VISIT has taken appropriate steps to develop performance measures 
that focus on various aspects of US-VISIT performance across air, land, 
and sea POEs. However, these measures do not go far enough to assess 
the affect of US-VISIT on POE operations, particularly land POEs, which 
are operationally distinctive from air and sea POEs where US-VISIT 
entry has also been installed. Such measures are needed to ensure that 
officials can identify and address problems at land-based facilities 
where improvements may be needed. 

With respect to DHS's effort to create an exit verification capability, 
developing and deploying this capability for US-VISIT at land POEs has 
posed a set of challenges that are distinct from those associated with 
entry. US-VISIT has not determined whether it can achieve, in a 
realistic time frame, or at an acceptable cost, the legislatively 
mandated capability to record the exit of travelers at land POEs using 
biometric technology. Apart from acquiring new facilities and 
infrastructure at an estimated cost of billions of dollars, US-VISIT 
officials have acknowledged that no technology now exists to reliably 
record travelers' exit from the country, and to ensure that the person 
leaving the country is the same person who entered, without requiring 
them to stop upon exit--potentially imposing a substantial burden on 
travelers and commerce. US-VISIT officials stated that they believe a 
biometrically based solution that does not require those exiting the 
country to stop for processing, that minimizes the need for major 
facility changes, and that can used to definitively match a visitor's 
entry and exit will be available in 5 to 10 years. In the interim, it 
remains unclear how officials plan to proceed--whether a nonbiometric 
alternative now being tested can provide an acceptable interim solution 
or whether the government ought to wait for a viable biometric solution 
to become available. According to statute, DHS was required to report 
more than a year ago on its plans for developing a comprehensive 
biometric entry and exit system, but DHS has yet to finalize this road 
map for Congress. Reporting might provide better assurance that US- 
VISIT can balance its goals of providing security, serving the 
immigration system, facilitating trade and travel, and protecting 
privacy at land POEs. This plan would also give DHS the opportunity to 
discuss the costs, benefits, barriers, and opportunities associated 
with various strategies for deploying biometric and nonbiometric exit 
capabilities and keep Congress informed of its progress overall. Until 
DHS finalizes such a plan, neither Congress nor DHS are likely to have 
sufficient information as a basis for decisions about various factors 
relevant to the success of US-VISIT, ranging from funding needed for 
any land POE facility modifications in support of the installation of 
exit technology to the trade-offs associated with ensuring traveler 
convenience while providing verification of travelers' departure 
consistent with US-VISIT's national security and law enforcement goals. 

Finally, DHS has not articulated how US-VISIT fits strategically and 
operationally with other land-border security initiatives, such as the 
Western Hemisphere Travel Initiative and Secure Border Initiative. 
Without knowing how US-VISIT is to be integrated within the larger 
strategic context governing DHS operations, DHS faces substantial risk 
that US-VISIT will not align or operate with other initiatives at land 
POEs and thus not cost-effectively meet mission needs. Knowing how US- 
VISIT is to work in harmony with these initiatives could help Congress, 
DHS, and others better understand what resources, tools, and 
investments in land POE facilities and infrastructure are needed to 
ensure their success, while providing critical information to help make 
decisions about other DHS missions. This could include, for example, 
information on what funds and staffing resources ICE would need to 
enforce immigration laws if US-VISIT were able to provide reliable and 
timely information on potentially millions of persons who have 
overstayed the terms of their visas, some of whom may pose a threat to 
the nation's security. 

Recommendations for Executive Action: 

To help DHS achieve benefits commensurate with its investment in US- 
VISIT at land POEs and security goals and objectives, we are 
recommending that the Secretary of Homeland Security direct the US- 
VISIT Program Director, in collaboration with the Commissioner of CBP, 
to take the following two actions: 

² improve existing management controls for identifying and reporting 
computer processing and other operational problems as they arise at 
land POEs and ensure that these controls are consistently administered; 
and: 

² develop performance measures for assessing the impact of US-VISIT 
operations specifically at land POEs. 

We also recommend that as DHS finalizes the statutorily mandated report 
describing a comprehensive biometric entry and exit system for US- 
VISIT, the Secretary of Homeland Security take steps to ensure that the 
report include, among other things, 

² information on the costs, benefits, and feasibility of deploying 
biometric and nonbiometric exit capabilities at land POEs; 

² a discussion of how DHS intends to move from a nonbiometric exit 
capability, such as the technology currently being tested, to a 
reliable biometric exit capability that meets statutory requirements; 
and: 

² a description of how DHS expects to align emerging land border 
security initiatives with US-VISIT and what facility or facility 
modifications would be needed at land POEs to ensure that technology 
and processes work in harmony. 

Agency Comments and Our Evaluation: 

We requested comments on a draft of this report from the Secretary of 
Homeland Security. In an October 31, 2006, letter, DHS provided written 
comments, which are summarized below and included in their entirety in 
appendix VIII. 

DHS generally agreed with our recommendations and stated that it needed 
to improve existing management controls associated with US-VISIT, 
develop performance measures to assess the impact of US-VISIT 
operations at land POEs, and ensure that the statutorily mandated 
report describes how DHS will move to a biometric entry and exit 
capability and align US-VISIT with emerging land border initiatives. 
DHS did not provide timelines for when it plans to take these steps, 
including finalizing the statutorily mandated report, which was to have 
been issued to the Congress in June 2005. 

DHS disagreed with certain aspects of or sought clarification on some 
of our findings. DHS disagreed with our finding that the US-VISIT 
program office did not fully consider the impact of US-VISIT on the 
overall operations at POEs. It said that US-VISIT impacts are limited 
to changes in Form I-94 processing time, which it says are positive, as 
supported by US-VISIT evaluations. According to DHS other factors 
related to capacity, staffing, and the volume of travelers are 
"arguably" beyond the scope of US-VISIT. 

We agree that the approach taken to do operational assessments of the 
impact of US-VISIT land POE facilities focused on changes to I-94 
processing time and that a variety of factors and processes can affect 
traveler inspections and associated wait times at land POEs. However, 
as discussed in this and our February 2006 report, the assessment 
methodology US-VISIT has used thus far had limitations--including 
focusing solely on I-94 processing time.[Footnote 63] Unanticipated 
problems at facilities that routinely experience high traffic volumes 
and occasionally encounter computer processing shortfalls raise 
questions about whether DHS has adequately assessed how US-VISIT has 
affected operations at land POEs. Although it may not be cost-effective 
for US-VISIT or CBP to conduct a formal assessment of the impact of US- 
VISIT at each land POE, it is important that DHS be positioned to 
anticipate potential problems and develop solutions to minimize any 
operational and logistical impacts on aging and already overcrowded 
land POE facilities. This is especially true given that DHS recognizes 
that the transition from 2-to 10-print digital scanning has a high 
likelihood of impacting port facilities. 

Regarding the latter, we have amended our report to clarify, consistent 
with DHS's comments, that US-VISIT is currently working with industry 
to speed up processing time and reduce the size of the 10-print capture 
devices to "eliminate or significantly reduce the impact of deploying 
10-print scanning." DHS efforts to work with industry highlights the 
need to more fully assess how US-VISIT affects land POEs so that 
potential problems can be identified and addressed before the readers, 
or any other new programs, are introduced at land POEs. As noted in our 
report, based on our past work, any lengthening in the process of 
entering the United States at the busiest land POEs could inconvenience 
travelers and result in fewer visits to the United States or lost 
business to the nation.[Footnote 64] 

DHS also suggested that we clarify its acknowledgement that the non- 
biometric technology tested did not meet the statutory requirement for 
biometric exit capability. DHS stated that the non-biometric technology 
was used because industry has yet to develop a biometric exit device 
that could satisfy mission requirements such as not impacting traffic 
flow and not having safety impacts. We have amended our report to 
clarify that DHS acknowledged that the non-biometric technology would 
not satisfy statutory requirements and to reflect that it would perform 
research and industry outreach to satisfy the mandate. Nonetheless, the 
fact that the non-biometric exit technology used does not satisfy the 
congressionally mandated biometric exit capability underscores the 
importance of our recommendation for DHS to clearly articulate how it 
plans to move from a non-biometric exit technology to a biometric exit 
solution. 

In addition, DHS suggested that we clarify that, with regard to the 
RFID pedestrian exit portals at the Nogales-Mariposa, Arizona, POE, it 
had constructed a new primary pedestrian exit walkway parallel to the 
existing pedestrian entry and had installed signage, sidewalks, and a 
new secure gate. We have amended the report to include information 
about the new pedestrian exit walkway. However, as we noted in our 
report, portals were installed only on one of the three pedestrian 
pathways used to exit the United States. According to a CBP official at 
the Nogales-Mariposa POE, the newly constructed pedestrian exit walkway 
is on the other side of the building from the pathway where the portal 
readers were placed and tested and thus would not mitigate the 
vulnerabilities we identified. 

Finally, DHS provided other comments that we considered technical in 
nature. We have amended our report to incorporate these clarifications, 
where appropriate. 

As agreed with your offices, unless you publicly announce its contents 
earlier, we plan no further distribution of this report until 30 days 
after the issuance date of our original report, which, as discussed 
earlier, was classified For Official Use Only. At that time, we will 
provide copies of this report to appropriate departments and interested 
congressional committees. We will also make copies available to others 
upon request. In addition, this report will be available on GAO's Web 
site at [Hyperlink, http://www.gao.gov]. 

If you or your staff have any questions about this report or wish to 
discuss the matter further, please contact me at (202) 512-8777 or 
stanar@gao.gov. Contact points for our Offices of Congressional 
Relations and Public Affairs may be found on the last page of this 
report. Major contributors to this report are listed in appendix IX. 

Signed by: 

Richard M. Stana: 
Director, Homeland Security and Justice Issues: 

List of Requesters: 

The Honorable Peter T. King: 
Chairman: 
The Honorable Bennie G. Thompson: 
Ranking Minority Member: 
Committee on Homeland Security: 
House of Representatives: 

The Honorable Robert Filner: 
House of Representatives: 

The Honorable Raul M. Grijalva: 
House of Representatives: 

The Honorable Ruben E. Hinojosa: 
House of Representatives: 

The Honorable Solomon P. Ortiz: 
House of Representatives: 

The Honorable Silvestre Reyes: 
House of Representatives: 

[End of Section] 

Appendix I: Objective, Scope, and Methodology: 

This report addresses the progress the Department of Homeland Security 
and U.S. Customs and Border Protection (CBP) have made in implementing 
the United States Visitor Status Indicator Technology (US-VISIT) 
program at existing land Ports of Entry (POE). Specifically, we 
analyzed the following issues: (1) What has the US-VISIT Program Office 
done to implement US-VISIT entry capabilities at land POEs and what 
impact has US-VISIT had on these facilities? (2) What is the status of 
US-VISIT Program Office efforts to implement a US-VISIT exit capability 
at land POE facilities? (3) What has DHS done to define a strategic 
context to show how US-VISIT entry and exit capabilities at land POE 
facilities fit with other current and emerging border security 
initiatives? 

We performed our work at the Department of Homeland Security's US-VISIT 
Program Office and CBP. We also carried out work at 21 of 154 land POEs 
where US-VISIT entry capability had been installed. At 3 of these 21 
land POEs, DHS was also testing exit capability. Table 3 shows the 21 
land POEs we visited, by location and state, between August 2005 and 
February 2006. 

Table 3: Land POEs visited by GAO, August 2005 to February 2006: 

Northern border. 

POE Name: Ambassador Bridge; 
Location: Detroit; 
State: Mich. 

POE Name: Detroit-Windsor Tunnel; 
Location: Detroit; 
State: Mich. 

POE Name: Overton Corners; 
Location: Rouses point; 
State: N.Y. 

POE Name: St. John's Hwy; 
Location: Rouses Point; 
State: N.Y. 

Thousands Island Bridge; 
Location: Alexandria Bay; 
State: N.Y. 

POE Name: Champlain; 
Location: Champlain; 
State: N.Y. 

POE Name: Highgate Springs; 
Location: Highgate Springs; 
State: Vt. 

POE Name: Alburg; 
Location: Alburg; 
State: Vt. 

POE Name: Peace Arch; 
Location: Blaine; 
State: Wash. 

POE Name: Pacific Highway; 
Location: Blaine; 
State: Wash. 

Southern border. 

POE Name: DeConcini; 
Location: Nogales; 
State: Ariz. 

POE Name: Morley Gate; 
Location: Nogales; 
State: Ariz. 

POE Name: Mariposa; 
Location: Nogales; 
State: Ariz. 

POE Name: San Ysidro; 
Location: San Diego; 
State: Calif. 

POE Name: Los Tomates; 
Location: Brownsville; 
State: Tex. 

POE Name: Gateway; 
Location: Brownsville; 
State: Tex.

POE Name: Brownsville Matamoros Bridge; 
Location: Brownsville; 
State: Tex.

POE Name: Hidalgo; 
Location: Hidalgo; 
State: Tex. 

POE Name: Progreso; 
Location: Progreso; 
State: Tex. 

POE Name: Los Ebanos; 
Location: Los Ebanos; 
State: Tex. 

POE Name: Pharr; 
Location: Pharr; 
State: Tex. 

Source: GAO. 

[End of table] 

In selecting land POEs to visit, we originally selected 10 land POEs on 
the northern border and 10 POEs on the southern border based on 
geographic dispersion along the border and taking into consideration 
POEs that were located near each other to minimize travel costs. We 
added the Morley Gate POE after we initially selected sites because it 
is physically located about 100 yards from the DeConcini POE in 
downtown Nogales (Ariz.) and after learning that US-VISIT was treating 
Morley Gate as a stand-alone POE for US-VISIT deployment 
purposes.[Footnote 65] In making our selections, we also considered US- 
VISIT deployment schedules, facility size, and the number of border 
crossings and I-94 issuances.[Footnote 66] Fifteen of the 21 selected 
sites in our study were among the 50 busiest land POEs for which US- 
VISIT entry capability was to be operating by December 31, 2004, as 
required by law. The other 6 sites were among those remaining POEs 
where, according to law, US-VISIT entry capability was to be operating 
by December 31, 2005. While selecting sites, we also included the five 
POEs at which the US-VISIT program office was testing radio frequency 
identification (RFID) technology as part of a proof of concept for 
meeting US-VISIT exit capability requirements. These were: Blaine-Peace 
Arch; Blaine-Pacific Highway; Thousand Islands Bridge, Alexandria Bay; 
Nogales-Mariposa; and Nogales-DeConcini. The information from our site 
visits is limited to the 21 POEs we visited and is not generalizable to 
the remaining POEs. 

To examine what the US-VISIT Program Office has done to implement US- 
VISIT entry capabilities at land POEs and what impact US-VISIT has had 
on these facilities, we interviewed US-VISIT and CBP headquarters 
officials as well as CBP officials at the 21 locations we visited. We 
obtained and analyzed available DHS reports on US-VISIT entry 
capability planning, deployment, and operations across land POEs, 
including the 21 we visited. At the 21 locations, we (1) discussed US- 
VISIT entry capability deployment at the facility, any facility-related 
barriers or constraints encountered during installation, and any 
operational issues encountered since and (2) obtained any available 
documentation about US-VISIT deployment and operations at the facility. 
We also toured secondary inspection at each facility to observe what US-
VISIT equipment was installed, how it was installed, and where 
possible, how it operated when visitors covered by US-VISIT arrived at 
the facility for processing into the country. While doing our site 
visits, we met with US-VISIT and CBP officials at headquarters to 
discuss our field work; discern why problems we identified in the field 
may have occurred, and if problems occurred, gather and analyze 
available US-VISIT and CBP information about those problems, including 
information on any corrective actions. We also examined whether 
internal or management controls were in place to alert officials to the 
problems we identified, and examined whether these controls were being 
applied, consistent with GAO's Standards for Internal Controls in the 
Federal Government.[Footnote 67] In addition, we interviewed CBP and US-
VISIT headquarters officials about plans for installing and operating 
new technology and equipment related to US-VISIT, such as 10- finger-
scan readers, at land POEs; reviewed available DHS documents about 
plans to implement these devices; and reviewed available DHS documents 
that discussed performance measures for US-VISIT overall. We also 
reviewed applicable laws, regulations, and DHS federal register notices 
pertaining to US-VISIT entry capability deployment at land POEs, as 
well as reports prepared by DHS, GAO, the DHS Office of Inspector 
General, and the Congressional Research Service. 

To determine the status of DHS's efforts to implement a US-VISIT exit 
capability at land POEs, we interviewed US-VISIT and CBP headquarters 
officials and CBP officials at the five locations where US-VISIT exit 
capability was being tested (Nogales-Mariposa, Nogales-DeConcini, 
Blaine-Pacific Highway, Blaine-Peace Arch, and Alexandria Bay). At each 
of the locations, we toured the areas where exit testing equipment and 
technology had been installed and discussed with CBP officials how it 
was installed and to be tested. We also reviewed applicable laws and 
regulations and obtained and analyzed available DHS reports on US-VISIT 
exit capability including an operational alternatives assessment; 
feasibility studies; and proof of concept performance evaluation and 
corrective action reports. Our analysis of these reports focused on DHS 
strategies for selecting, testing, acquiring, and evaluating 
alternative methods that could meet the requirements; DHS's criteria 
used to select and test the potential of RFID technology; and the 
challenges encountered, including any privacy issues associated with 
RFID use. Finally, we obtained and analyzed DHS reports on the costs of 
the equipment and related facility infrastructure, such as the metal 
gantry erected over roadways to hold RFID readers, to estimate what it 
would cost to install RFID equipment at all land POEs. We developed our 
overall estimate based on the average cost to date (about $1 million 
each) of installing exit gantries and associated RFID equipment at the 
four POEs where gantries and equipment were installed. (Although RFID 
use was tested at five POEs, at the DeConcini POE in downtown Nogales, 
Arizona, the RFID readers were placed on poles on either side of entry 
lanes, since all entering vehicles pass under a large permanent canopy 
structure that precludes installing a gantry. At the other four POEs, 
RFID readers were attached to metal gantries placed over roadway 
lanes.) 

To examine what DHS has done to define a strategic context to show how 
US-VISIT entry and exit capabilities at land POE facilities fit with 
other current and emerging border security initiatives, we reviewed 
past GAO reports and public DHS announcements about the Western 
Hemisphere Travel Initiative and the Secure Border Initiative (SBI). We 
also interviewed DHS officials about the status of efforts to implement 
these initiatives as well as the status of efforts to develop and 
promulgate a strategic plan for US-VISIT and compared available 
information on DHS plans to implement initiatives with the results of 
our discussions with US-VISIT program officials. 

We conducted our work from September 2005 through October 2006 in 
accordance with generally accepted government auditing standards. 

[End of Section] 

Appendix II: Visa Waiver Countries: 

The Department of State's (State) Visa Waiver Program (VWP) enables 
nationals of certain countries to travel to the United States for 
tourism or business for stays of 90 days or less without obtaining a 
visa. The program was established in 1986 with the objective of 
promoting better relations with U.S. allies, eliminating unnecessary 
barriers to travel, stimulating the tourism industry, and permitting 
the Department of State to focus consular resources in other areas. VWP 
eligible travelers may apply for a visa, if they prefer to do so. Not 
all countries participate in the VWP, and not all travelers from VWP 
countries are eligible to use the program. VWP travelers are screened 
prior to admission into the United States, and they are enrolled in the 
Department of Homeland Security's TUS-VISIT program. Currently, 27 
countries participate in the Visa Waiver Program as shown in the 
following table. 

Table 4: Countries Participating in the Visa Waiver Program: 

Andorra; 
Australia; 
Iceland; 
Ireland; 
Norway; 
Portugal; 
Austria; 
Italy; 
San Marino; 
Belgium; 
Japan; 
Singapore; 
Brunei; 
Liechtenstein; 
Slovenia; 
Denmark; 
Luxembourg; 
Spain; 
Finland; 
Monaco; 
Sweden; 
France; 
The Netherlands; 
Switzerland; 
Germany; 
New Zealand; 
United Kingdom. 

Source: Department of State. 

[End of table] 

[End of Section] 

Appendix III: Legislative Overview of the US-VISIT Program: 

The Illegal Immigration Reform and Immigrant Responsibility Act of 1996 
originally required the development of an automated entry and exit 
control system to collect a record of departure for every alien 
departing the United States and match the record of departure with the 
record of the alien's arrival in the United States; make it possible to 
identify nonimmigrants who remain in the country beyond the authorized 
period; and not significantly disrupt trade, tourism, or other 
legitimate cross-border traffic at land border ports of entry. It also 
required the integration of overstay information into appropriate 
databases of the INS and the Department of State, including those used 
at ports of entry and at consular offices. The system was originally to 
be developed by September 30, 1998; this deadline was changed to 
October 15, 1998, and was changed again for land border ports of entry 
and sea ports to March 30, 2001. 

The Immigration and Naturalization Service Data Management Improvement 
Act (DMIA) of 2000 replaced the 1996 statute in its entirety, requiring 
instead an electronic system that would provide access to and integrate 
alien arrival and departure data that are authorized or required to be 
created or collected under law, are in an electronic format, and are in 
a data base of the Department of Justice or the Department of State, 
including those created or used at ports of entry and at consular 
offices. The Act specifically provided that it not be construed to 
permit the imposition of any new documentary or data collection 
requirements on any person for the purpose of satisfying its 
provisions, but it further provided that it also not be construed to 
reduce or curtail any authority of the Attorney General (now Secretary 
of Homeland Security) or Secretary of State under any other provision 
of law. The integrated entry and exit data system was to be implemented 
at airports and seaports by December 31, 2003, at the 50 busiest land 
ports of entry by December 31, 2004, and at all remaining ports of 
entry by December 31, 2005. 

The DMIA also required that the system use available data to produce a 
report of arriving and departing aliens by country of nationality, 
classification as an immigrant or nonimmigrant, and date of arrival in 
and departure from the United States. The system was to match an 
alien's available arrival data with the alien's available departure 
data, assist in the identification of possible overstays, and use 
available alien arrival and departure data for annual reports to 
Congress. These reports were to include the number of aliens for whom 
departure data were collected during the reporting period, with an 
accounting by country of nationality; the number of departing aliens 
whose departure data was successfully matched to the alien's arrival 
data, with an accounting by country of nationality and classification 
as an immigrant or nonimmigrant; the number of aliens who arrived 
pursuant to a nonimmigrant visa, or as a visitor under the visa waiver 
program, for whom no matching departure data have been obtained as of 
the end of the alien's authorized period of stay, with an accounting by 
country of nationality and date of arrival in the United States; and 
the number of identified overstays, with an accounting by country of 
nationality. 

In 2001, the USA PATRIOT Act provided that, in developing the 
integrated entry and exit data system under the DMIA, the Attorney 
General (now Secretary of Homeland Security) and Secretary of State 
were to focus particularly on the utilization of biometric technology 
and the development of tamper-resistant documents readable at ports of 
entry. It also required that the system be able to interface with law 
enforcement databases for use by federal law enforcement to identify 
and detain individuals who pose a threat to the national security of 
the United States. The PATRIOT Act also required by January 26, 2003, 
the development and certification of a technology standard, including 
appropriate biometric identifier standards, that can be used to verify 
the identity of persons applying for a U.S. visa or persons seeking to 
enter the United States pursuant to a visa for the purposes of 
conducting background checks, confirming identity, and ensuring that a 
person has not received a visa under a different name. This technology 
standard was to be the technological basis for a cross-agency, cross- 
platform electronic system that is a cost-effective, efficient, fully 
interoperable means to share law enforcement and intelligence 
information necessary to confirm the identity of persons applying for a 
U.S. visa or persons seeking to enter the United States pursuant to a 
visa. This electronic system was to be readily and easily accessible to 
consular officers, border inspection agents, and law enforcement and 
intelligence officers responsible for investigation or identification 
of aliens admitted to the United States pursuant to a visa. Every 2 
years beginning on October 26, 2002, the Attorney General (now 
Secretary of Homeland Security) and the Secretary of State were to 
jointly report to Congress on the development, implementation, 
efficacy, and privacy implications of the technology standard and 
electronic database system. 

The Enhanced Border Security and Visa Entry Reform Act of 2002 required 
that, in developing the integrated entry and exit data system for the 
ports of entry under the DMIA, the Attorney General (now Secretary of 
Homeland Security) and Secretary of State implement, fund, and use the 
technology standard required by the USA PATRIOT Act at U.S. ports of 
entry and at consular posts abroad. The act also required the 
establishment of a database containing the arrival and departure data 
from machine-readable visas, passports, and other travel and entry 
documents possessed by aliens and the interoperability of all security 
databases relevant to making determinations of admissibility under 
section 212 of the Immigration and Nationality Act. In implementing 
these requirements, the INS (now DHS) and the Department of State were 
to utilize technologies that facilitate the lawful and efficient cross- 
border movement of commerce and persons without compromising the safety 
and security of the United States and were to consider implementing a 
North American National Security Program, for which other provisions in 
the act called for a feasibility study. 

The act, as amended, also established a number of requirements 
regarding biometric travel and entry documents. It required that not 
later than October 26, 2004, the Attorney General (now Secretary of 
Homeland Security) and the Secretary of State issue to aliens only 
machine-readable, tamper-resistant visas and other travel and entry 
documents that use biometric identifiers and that they jointly 
establish document authentication standards and biometric identifiers 
standards to be employed on such visas and other travel and entry 
documents from among those biometric identifiers recognized by domestic 
and international standards organizations. It also required by October 
26, 2005, the installation at all ports of entry of the United States 
equipment and software to allow biometric comparison and authentication 
of all U.S. visas and other travel and entry documents issued to aliens 
and passports issued by visa waiver participants. Such biometric data 
readers and scanners were to be those that domestic and international 
standards organizations determine to be highly accurate when used to 
verify identity, that can read the biometric identifiers used under the 
act, and that can authenticate the document presented to verify 
identity. These systems also were to utilize the technology standard 
established pursuant to the PATRIOT Act. 

The Intelligence Reform and Terrorism Prevention Act of 2004 did not 
amend the existing statutory provisions governing US-VISIT, but it did 
establish additional statutory requirements concerning the program. It 
described the program as an "automated biometric entry and exit data 
system" and required DHS to develop a plan to accelerate the full 
implementation of the program and to report to Congress on this plan by 
June 15, 2005. The report was to provide several types of information 
about the implementation of US-VISIT, including a "listing of ports of 
entry and other DHS and Department of State locations with biometric 
exit data systems in use." The report also was to provide a description 
of the manner in which the US-VISIT program meets the goals of a 
comprehensive entry and exit screening system, "including both entry 
and exit biometric;" and fulfills the statutory obligations imposed on 
the program by several laws enacted between 1996 and 2002. The act 
provided that US-VISIT "shall include a requirement for the collection 
of biometric exit data for all categories of individuals who are 
required to provide biometric entry data, regardless of the port of 
entry where such categories of individuals entered the United States." 

The new provisions in the 2004 act also addressed integration and 
interoperability of databases and data systems that process or contain 
information on aliens and federal law enforcement and intelligence 
information relevant to visa issuance and admissibility of aliens; 
maintaining the accuracy and integrity of the US-VISIT data system; 
using the system to track and facilitate the processing of immigration 
benefits using biometric identifiers; the goals of the program (e.g., 
serving as a vital counterterrorism tool, screening visitors 
efficiently and in a welcoming manner, integrating relevant databases 
and plans for database modifications to address volume increase and 
database usage, and providing inspectors and related personnel with 
adequate real time information); training, education, and outreach on 
US-VISIT, low risk visitor programs, and immigration law; annual 
compliance reports by DHS, State, the Department of Justice, and any 
other department or agency subject to the requirements of the new 
provisions; and development and implementation of a registered traveler 
program. 

[End of Section] 

Appendix IV: The 20 Busiest Land Ports of Entry (POE) by Volume of 
Individuals Entering the United States in Fiscal Year 2005: 

Rank Order: 1; 
Name of Land POE: San Ysidro; 
Location: San Diego; 
State: Calif; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 41,430,304. 

Rank Order: 2; 
Name of Land POE: Calexico; 
Location: Calexico; 
State: Calif; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 16,418,744. 

Rank Order: 3; 
Name of Land POE: Otay Mesa; 
Location: Otay Mesa; 
State: Calif; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 14,531,794. 

Rank Order: 4; 
Name of Land POE: Bridge of Americas; 
Location: El Paso; 
State: Tex; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 14,229,629. 

Rank Order: 5; 
Name of Land POE: Paso del Norte; 
Location: El Paso; 
State: Tex; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 13,443,901. 

Rank Order: 6; 
Name of Land POE: Hidalgo; 
Location: Hidalgo; 
State: Tex; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 12,788,679. 

Rank Order: 7; 
Name of Land POE: Nogales DeConcini; 
Location: Nogales; 
State: Ariz; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 12,425,006. 

Rank Order: 8; 
Name of Land POE: Lincoln-Juarez Bridge; 
Location: Laredo; 
State: Tex; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 12,328,941. 

Rank Order: 9; 
Name of Land POE: Niagara Falls[A]; 
Location: Niagara Falls; 
State: N.Y; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 9,656,444. 

Rank Order: 10; 
Name of Land POE: San Luis; 
Location: San Luis; 
State: Ariz; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 9,017,655. 

Rank Order: 11; 
Name of Land POE: Laredo Convent Bridge; 
Location: Laredo; 
State: Tex; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 8,376,604. 

Rank Order: 12; 
Name of Land POE: Detroit-Ambassador Bridge; 
Location: Detroit; 
State: Mich; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 7,438,654. 

Rank Order: 13; 
Name of Land POE: Douglas; 
Location: Douglas; 
State: Ariz; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 6,795,354. 

Rank Order: 14; 
Name of Land POE: Peace Bridge; 
Location: Buffalo; 
State: N.Y; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 6,725,942. 

Rank Order: 15; 
Name of Land POE: Brownsville-Gateway; 
Location: Brownsville; 
State: Tex; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 6,712,108. 

Rank Order: 16; 
Name of Land POE: Ysleta; 
Location: El Paso; 
State: Tex; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 6,492,695. 

Rank Order: 17; 
Name of Land POE: Calexico East; 
Location: Calexico; 
State: Calif; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 6,122,111. 

Rank Order: 18; 
Name of Land POE: Detroit Tunnel; 
Location: Detroit; 
State: Mich; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 5,719,476. 

Rank Order: 19; 
Name of Land POE: Port Huron; 
Location: Port Huron; 
State: Mich; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 5,080,176. 

Rank Order: 20; 
Name of Land POE: Eagle Pass Intern Bridge II; 
Location: Eagle Pass; 
State: Tex; 
Total Number of US and Foreign Entrants (Pedestrians and Vehicle 
Occupants): 4,945,237. 

Source: CBP. 

[A] This site comprises multiple POEs at this location. 

[End of table] 

[End of Section] 

Appendix V: Land Ports of Entry (POE) at Which US-VISIT Has Been 
Installed: 

According to the US-VISIT program office, US-VISIT entry capability was 
installed at the following land POE by December 31, 2005. The list is 
arranged in state alphabetical order. 

Alaska (3): 

Alcan, Alcan: 
Dalton's Cache, Dalton's Cache: 
Skagway, Skagway: 

Arizona (8): 

Douglas, Douglas: 
Lukeville, Lukeville: 
Nogales DeConcini: 
Nogales Mariposa: 
Morley Gate, Nogales: 
San Luis, San Luis: 
Sasabe, Sasabe: 
Naco, Naco: 

California (6): 

Andrade, Andrade: 
Calexico East-Imperial Valley, Calexico: 
Calexico West, Calexico: 
Otay Mesa, Otay Mesa: 
San Ysidro, San Ysidro: 
Tecate, Tecate: 

Idaho (2): 

Eastport, Eastport: 
Porthill, Porthill: 

Maine (15): 

Bar Harbor Ferry, Bar Harbor: 
Bridgewater, Bridgewater: 
Calais-Ferry Point Bridge, Calais: 
Coburn Gore, Coburn Gore: 
Eastport, Eastport: 
Fort Fairfield, Fort Fairfield: 
Fort Kent, Fort Kent: 
Hamlin, Hamlin: 
Houlton, Houlton: 
Jackman, Jackman: 
Limestone, Limestone: 
Lubec, Lubec: 
Madawaska, Madawaska: 
Van Buren, Van Buren: 
Vanceboro, Vanceboro: 

Michigan (6): 

Detroit Ambassador Bridge, Detroit: 
Detroit-Windsor Tunnel, Detroit: 
Port Huron-Blue Water Bridge, Port Huron: 
Sault Ste. Marie, Sault Ste. Marie: 
Algonac Ferry, Algonac: 
Marine City Ferry, Marine City: 

Minnesota (8): 

Baudette, Baudette: 
Ely, Ely: 
Grand Portage, Grand Portage: 
International Falls, International Falls: 
Lancaster, Lancaster: 
Pine Creek, Roseau: 
Roseau, Roseau: 
Warroad, Warroad: 

Montana (13): 

Chief Mountain, Chief Mountain: 
Del Bonita, Del Bonita: 
Morgan, Loring: 
Opheim, Opheim: 
Piegan, Babb: 
Raymond, Raymond: 
Roosville, Roosville: 
Scobey, Scobey: 
Sweetgrass, Sweetgrass: 
Turner, Turner: 
Willow Creek, Turner: 
Wild Horse, Havre: 
Whitetail, Whitetail: 

New Hampshire (1): 

Pittsburg, Pittsburg: 

New Mexico (3): 

Antelope Wells, Antelope Wells: 
Columbus, Columbus: 
Santa Teresa, Santa Teresa: 

New York (16): 

Cape Vincent Ferry, Cape Vincent: 
Champlain, Champlain: 
Chateaugay, Chateaugay: 
Fort Covington, Fort Covington: 
Heart Island Ferry, Alexandria Bay: 
Massena, Rooseveltown: 
Mooers, Mooers Niagara (Lewiston- Queenston, Whirlpool, and Rainbow 
Bridges), Niagara Falls: 
Niagara Falls Amtrak Station, Niagara Falls: 
Ogdensburg, Ogdensburg: 
Overton Corners, Champlain: 
Peace Bridge, Buffalo: 
Rochester Ferry, Rochester: 
Rouses Point, Rouses Point: 
Thousand Islands Bridge, Alexandria Bay: 
Trout River, Trout River: 

North Dakota (18): 

Ambrose, Ambrose: 
Antler, Antler: 
Carbury, Carbury: 
Dunseith, Dunseith: 
Fortuna, Fortuna: 
Hannah, Hannah: 
Hansboro, Hansboro: 
Maida, Maida: 
Neche, Neche: 
Noonon, Noonan: 
Northgate, Northgate: 
Pembina, Pembina: 
Portal, Portal: 
Sarles, Sarles: 
Sherwood, Sherwood: 
St. John, St. John: 
Walhalla, Walhalla: 
Westhope, Westhope: 

Ohio (1): 

Jackson Street Pier Ferry, Akron: 

Texas (25): 

Amistad Dam, Amistad Village: 
Bridge of the Americas/Cordova Bridge, El Paso: 
Brownsville-Gateway: 
Brownsville-Los Tomates/Veterans International Bridge: 
Brownsville-Matamoros Bridge: 
Columbia Solidarity Bridge, Laredo: 
Convent Street (or Gateway to the Americas International Bridge), 
Laredo: 
Del Rio International Bridge, Del Rio: 
Eagle Pass Bridge I, Eagle Pass: 
Eagle Pass Bridge II, Eagle Pass: 
Fabens, Fabens: 
Falcon Heights, Falcon Heights: 
Fort Hancock, Fort Hancock: 
Gateway International Bridge, Brownsville: 
Hidalgo, McAllen: 
Lincoln-Juarez Bridge, Laredo: 
Los Ebanos Ferry, Los Ebanos: 
Los Indios, Los Indios: 
Paso del Norte Bridge, El Paso: 
Pharr, Pharr: 
Presidio, Presidio: 
Progreso, Progreso: 
Rio Grande City, Rio Grande City: 
Roma, Roma: 
World Trade Bridge, Laredo: 
Ysleta-Zaragoza Bridge, El Paso: 

Vermont (14): 

Alburg Springs, Alburg Springs: 
Alburg, Alburg: 
Beebe Plain, Beebe Plain: 
Beecher Falls, Beecher Falls: 
Canaan, Canaan: 
Derby Line, Derby Line, I- 91: 
Derby Line, Derby Line, Rte 5: 
East Richford, East Richford: 
Highgate Springs, Highgate Springs: 
Morses Line, Morses Line: 
North Troy, North Troy: 
Norton, Norton: 
Richford, Richford: 
Richford/Pinnacle, Richford: 
West Berkshire, West Berkshire: 

Washington (13): 

Blaine-Pacific Highway, Blaine: 
Blaine-Peace Arch, Blaine: 
Boundary, Boundary: 
Danville, Danville: 
Ferry, Ferry: 
Frontier, Frontier: 
Laurier, Laurier: 
Lynden, Lynden: 
Metaline Falls, Metaline Falls: 
Nighthawk, Nighthawk: 
Oroville, Oroville: 
Point Roberts, Point Roberts: 
Sumas, Sumas: 

Canada (1): 

Vancouver Amtrak Station: 

[End of Section] 

Appendix VI: Actions Taken by US-VISIT Program Office to Mitigate 
Privacy Risks Associated with RFID at Land POEs: 

Protecting the privacy of visitors to the United States is one of the 
four stated primary mission goals of the US-VISIT program. We and 
others have raised questions in recent years about the potential 
privacy risks surrounding the use of RFID technology to track the 
movement of persons, as opposed to goods; the potential for the 
technology to be subverted for surveillance purposes, rather than 
identification; and the potential for "function creep," whereby 
information collected for one purpose gradually develops other 
secondary uses, such as has occurred with Social Security 
numbers.[Footnote 68] In congressional testimony, we have noted that 
the use of RFID tags and associated databases raises important security 
considerations related to the confidentiality, integrity, and 
availability of the data on the tags and in the databases, and in how 
this information is being protected.[Footnote 69] We have noted, as 
well, that while the federal government had begun using RFID technology 
for a variety of applications--to track and identify assets, weapons, 
and baggage on flights, for example--using this technology for generic 
inventory control did not raise the same privacy issues as using it to 
track the movement of persons.[Footnote 70] 

The US-VISIT Program Office has taken steps to meet statutory and 
congressional requirements protecting the privacy of individuals who 
would be affected if RFID technology were to be implemented as part of 
the US-VISIT exit and re-entry process, and to address the privacy 
concerns raised by us and others. According to OMB guidance,[Footnote 
71] a privacy impact assessment should be conducted before an agency 
develops or procures an information technology system, such as the 
proposed RFID system, which collects, maintains, or disseminates 
information about an individual--in this case, numeric information that 
may be linked to biographic information contained within databases. In 
January 2004, DHS published a Privacy Impact Assessment in the Federal 
Register, as required by law, for the initial deployment of US-VISIT, 
and published the latest in a series of updated Privacy Impact 
Assessments in July 2005, addressing privacy issues related to the 
proof-of-concept testing of RFID for Increment 2C.[Footnote 72] 

In its July 2005 Privacy Impact Assessment, DHS said that by design, 
the information embedded in the RFID-readable I-94 tag does not 
compromise a visitor's security, for the following reasons and with the 
following strictures: 

² Passive RFID minimizes privacy impacts and reduces the chance of 
visitors being surreptitiously tracked because it does not constantly 
transmit information or "beacon" a signal. 

² The numeric identifier read in the I-94 tag does not contain and is 
not derived from any personal information, and can only be used to 
obtain personal information when combined with data within the 
Automated Identification Management System (the system created to link 
the unique RFID tag ID number to existing biographic information 
received from the TECS database). 

² The Automated Identification Management System records the exit and 
re-entry data automatically captured for a particular RFID tag, rather 
than a specific individual. The individual's complete travel history is 
created only when the information captured from the RFID tag is sent 
along with the biographic information stored in the TECS database to a 
DHS Arrival and Departure Information System. 

² The Automated Identification Management System is undergoing the DHS 
certification and accreditation process, which includes having an 
approved detailed security plan and a comprehensive technical 
assessment of the risks of operating the system. The certification and 
accreditation process will be completed before the proof-of-concept 
becomes operational. 

² The Automated Identification Management System database can only be 
accessed by authorized personnel signed into authorized workstations 
that communicate with the system via a secure network. These computer 
workstations are generally in CBP POE buildings, inside work areas with 
physical controls over who can enter the area, according to the Privacy 
Impact Assessment, and each POE is required to be in compliance with 
DHS regulations with regard to security. Even if an RFID tag number 
were secretly detected by someone, that person would also have to 
obtain access to the Automated Identification Management System secure 
database, to link the number to an individual's records. 

DHS acknowledged that two potential privacy risks related to the RFID 
exit/re-entry solution have been identified, and that US-VISIT creates 
a pool of individuals whose personal information is at risk. 
Nevertheless, it is stated in the July 2005 Privacy Impact Assessment 
that the privacy risks will either be avoided or mitigated through the 
use of access controls, education and training, encryption, and 
minimizing collection and use of personal information will mitigate 
privacy risks associate with data sharing. The first stated risk is 
that, if the format or some other characteristic of the RFID tag number 
renders it recognizable as a US-VISIT RFID tag, this would allow an 
unauthorized reader to surreptitiously determine an individual's status 
(i.e., within US-VISIT covered population). DHS stated that the RFID 
tag number will be structured so that it cannot be used to identify an 
individual specifically as a nonimmigrant. Second, DHS noted there is a 
low risk that the RFID tag could be used to conduct surreptitious 
locational surveillance of an individual; i.e., to use the presence of 
the tag to follow an individual as he or she moves about in the United 
States. However, ensuring that RFID tag numbers do not exhibit 
properties that can be readily attributed to US-VISIT and using a 
limited radio frequency range effectively mitigates this risk, 
according to DHS. 

[End of Section] 

Appendix VII: US-VISIT Test of Radio Frequency Identification (RFID) 
Readers Upon Exit and Re-entry at Selected Land POEs: 

The US-VISIT Program Office has been testing the use of passive, 
automated, radio frequency identification (RFID) technology as a means 
to record the exit of visitors from the United States at land POEs. 
RFID is an automated data-capture technology that can be used to 
electronically store information contained on a very small tag that can 
be embedded in a document (or some other physical item); in this case, 
US-VISIT embedded the tag in a modified Form I-94, called an I-94A. 
This information can then be identified, and recorded as having been 
identified, by RFID readers that are connected to computer databases. 
The RFID tests were conducted for one-week periods at land POEs, as 
follows:[Footnote 73] vehicular traffic was tested at Nogales-Mariposa 
and Nogales-DeConcini POEs in Nogales, Arizona; the Blaine-Pacific 
Highway and Blaine-Peace Arch POEs in Blaine, Washington; and Thousand 
Islands Bridge POE in Alexandria Bay, New York; pedestrian traffic was 
tested at the Nogales-Mariposa and Nogales-DeConcini POEs. 

For these exit tests, the US-VISIT Program Office developed critical 
success factor target read rates to compare them to the actual read 
rates obtained during the test for both pedestrians carrying I-94As 
with RFID-detectable tags and for travelers in vehicles who also had 
RFID-detectable I-94As with them inside the vehicles. The target exit 
read rates ranged from an expected success rate of 70 percent to 95 
percent, based on anticipated performance under different conditions, 
partly as demonstrated in the earlier feasibility study, on business 
requirements, and on a concept of operation plan prepared for Increment 
2C.[Footnote 74] Table 5 shows the exit test results compared to the 
target read rates, reflecting specifically the percentage of persons 
detected by the readers who were carrying RFID-detectable documents for 
(1) pedestrians and (2) persons in vehicles, as they passed through the 
POE area, while exiting the country. 

Table 5: RFID Read Rate Test Results for Persons in Vehicles and 
Pedestrians Exiting the Country with RFID-Readable Documents: 

Type of test: Pedestrian Exit; 
Location of test: Nogales-Mariposa; 
Critical Success Factor Target Rate (%): 95; 
Actual Read Rate (%): 67; 
Sample Size (vehicles or pedestrians): 3[A]. 

Type of test: Vehicle Exit; 
Location of test: Blaine-Pacific Highway; Thousand Islands Bridge at 
Alexandria Bay; 
Critical Success Factor Target Rate (%): 70; 70; 
Actual Read Rate (%): 14; 4; 
Sample Size (vehicles or pedestrians): 166; 50. 

Source: US-VISIT Program Office: 

[A] Because of the small number of pedestrians carrying RFID readable 
documents in the test, any findings should be interpreted with caution. 

[End of table] 

In phase 1 of proof-of-concept testing for RFID, US-VISIT reported that 
read rates were higher for both vehicle occupants and pedestrians who 
held the I-94A up toward the reader, rather than leaving it inside a 
pocket. Through the use of billboards, radio and print advertisements, 
and other methods of communication, visitors were encouraged to place 
their RFID-detectable I-94A forms on the vehicle dashboard or up to a 
window. These locations were believed to increase the chances for a 
successful read. Those who took these actions were referred to as 
"participants," and those who did not as "nonparticipants." The US- 
VISIT Program Office reported that during the week-long proof-of- 
concept exit testing, one of the three pedestrians was a participant-- 
that is, the individual was observed as voluntarily complying with the 
instructions; for those exiting in a vehicle, these data were not 
reported. Moreover, although CBP officials made substantial pre-test 
efforts to encourage travelers to optimize the chances of I-94A tags 
being read, the report noted that this effort apparently met with mixed 
success and that no additional solutions were planned. 

During the time period that US-VISIT tested the performance of RFID 
readers for detecting I-94As carried by persons exiting the country in 
vehicles at two land POEs (Thousand Islands Bridge, Alexandria Bay, New 
York and Blaine-Pacific Highway, Washington), it also tested RFID 
reader performance for persons in vehicles with RFID-embedded I-94As 
who re-entered the country at both of these locations and three others 
(Blaine-Peace Arch, Washington; and, in Arizona, Nogales-Mariposa and 
Nogales-DeConcini). In addition, tests of RFID detectability carried by 
pedestrians re-entering the country were conducted at Nogales-Mariposa, 
and Nogales-DeConcini; pedestrian exit was tested only at Nogales- 
Mariposa because of operational constraints at Nogales-DeConcini, 
according to the report on the tests. Since persons re-entering the 
country with a RFID-enabled I-94 would already have obtained an I-94A 
on a prior visit to the United States, in order for it to be detected 
by an RFID reader, this process is sometimes referred to by the US- 
VISIT program office as "re-entry." 

DHS set separate, higher critical success factors (performance targets) 
for the RFID proof-of-concept tests for the vehicle re-entry process 
than for the vehicle exit process. According to a US-VISIT official, 
these higher performance targets were based, in part, on the fact that 
vehicles must stop as part of the re-entry process, which makes it more 
likely that a tag will be detected than is the case for exiting 
vehicles, which do not need to slow down or stop at land POEs.[Footnote 
75] As with the tests conducted for exit, test observers monitored 
traveler behavior to see whether, in compliance with numerous 
advertisements in print and on local radio, the vehicle driver placed 
the RFID-enabled I-94A on the vehicle dashboard or on an empty 
passenger seat, or, for vehicle occupants, if they held the I-94A up to 
a window or who made it otherwise visible, to better enable detection 
it by the reader. Vehicle drivers or occupants who displayed an I-94A 
in any of these requested ways were categorized as "participants," but 
read rates for them were, nevertheless, low at four of five test 
locations. For example, at Nogales-DeConcini, which had the lowest 
vehicle-entry read rates overall, the read rate was 27 percent for the 
62 persons re-entering in vehicles with visitors whom US -VISIT 
reported as making an effort to have their I-94A tags read. In 
contrast, at Nogales-Mariposa, which had the highest overall re-entry 
read rate for the vehicle test, US-VISIT reported that 83 out of 96 (86 
percent) of travelers who were categorized as participants were 
detected. Among those at this same location who did not make this 
effort, US-VISIT reported that I-94s with RFID tags were detected for 
about half (51 percent) of the persons in the vehicles. Table 6 shows 
the results of RFID read-rates upon re-entry for vehicle participants 
and nonparticipants. 

Table 6: RFID Test Read Rates for Persons Re-Entering the Country in 
Vehicles at Locations Where US-VISIT Tested RFID Technology: 

Type of test: Vehicle entry; 
Target read rate (%): 80; 
Nogales- Mariposa: Percent and Number: P: 86% (83/96); 
Nogales-DeConcini: Percent and Number: P: 27%; (17/62); 
Blaine-Pacific Highway: Percent and Number: P: 45% (13/29); 
Blaine-Peace Arch: Percent and Number: P: 55% (18/33); 
Thousand Islands Bridge: Percent and Number: P: 33% (3/9). 

Type of test: Vehicle entry; 
Target read rate (%): [Empty]; 
Nogales-Mariposa: Percent and Number: N: 51% (101/199); 
Nogales-DeConcini: Percent and Number: N: 11%; (25/236); 
Blaine-Pacific Highway: Percent and Number: N: 14% (15/110); 
Blaine- Peace Arch: Percent and Number: N: 19% (14/72); 
Thousand Islands Bridge: Percent and Number: N: 67% (2/3). 

Type of test: Vehicle entry; 
Target read rate (%): [Empty]; 
Nogales-Mariposa: Percent and Number: C: 62% (184/295); 
Nogales-DeConcini: Percent and Number: C: 14%; (425/ 298); 
Blaine-Pacific Highway: Percent and Number: C: 20% (28/139); 
Blaine-Peace Arch: Percent and Number: C: 30% (32/105); 
Thousand Islands Bridge: Percent and Number: C: 42% (5/12). 

Source: US-VISIT Program Office: 

P: Participants: those vehicle drivers who placed the I-94A form either 
on the dashboard, or on an empty seat; vehicle occupants who held the I-
94A up to a window or who placed it on the dashboard or who made it 
otherwise visible. 

N: Non-participants: Vehicle drivers and occupants who did not appear 
to comply with any of the specified modes of making the I-94A visible. 

C: Combined read rate for participants and nonparticipants. 

[End of table] 

Table 7 shows the results of RFID read-rate detection upon re-entry for 
pedestrian participants and nonparticipants. 

Table 7: RFID Test Read Rates for Pedestrians Re-entering the Country 
at Locations Where US-VISIT Tested RFID Technology: 

Type of test: Pedestrian entry; 
Target read rate (percent): 95; 
Nogales-Mariposa: Percent and Number[A]: P: 100%; (1 out of 1); 
Nogales-DeConcini: Percent and Number[A]: P: 84% (32/38); 
Blaine- Pacific Highway: Percent and Number: No data; 
Blaine-Peace Arch: Percent and Number: No data; 
Thousand Islands Bridge: Percent and Number: No data. 

Type of test: Pedestrian entry; 
Nogales-Mariposa: Percent and Number[A]: N: 50%; (6/12); 
Nogales- DeConcini: Percent and Number[A]: N: 68%; (179/264); 
Blaine-Pacific Highway: Percent and Number: [Empty]; 
Blaine-Peace Arch: Percent and Number: [Empty]; 
Thousand Islands Bridge: Percent and Number: [Empty]. 

Type of test: Pedestrian entry; 
Nogales-Mariposa: Percent and Number[A]: C: 54% (7/13); 
Nogales- DeConcini: Percent and Number[A]: C: 70%; (211/302); 
Blaine-Pacific Highway: Percent and Number: [Empty]; 
Blaine-Peace Arch: Percent and Number: [Empty]; 
Thousand Islands Bridge: Percent and Number: [Empty]. 

Source: US-VISIT Program Office: 

[A] Because of the small number of pedestrians that participated in the 
test, any findings should be interpreted with caution. 

Note: 

P is participants; defined as those pedestrians who held the I-94A form 
so that it was out and visible upon entering the processing area. 

N is non-participants; defined as those pedestrians who did not hold 
the I-94A form in such as a way that it was visible. 

C: Combined read rate for participants and nonparticipants: 

[End of table] 

[End of Section] 

Appendix VIII: Comments from the U.S. Department of Homeland Security: 

U.S. Department of Homeland Security: 
Washington, DC 20528: 

October 31, 2006: 

Mr. Richard M. Stana: 
Director: 
Homeland Security and Justice Issues: 
U.S. Government Accountability Office: 
441 G Street, NW: 
Washington, DC 20548: 

Dear Mr. Stana: 

RE: Draft Report GAO-07-56, Border Security: US-VISIT Program Faces 
Strategic, Operational, and Technological Challenges at Land Ports of 
Entry: (GAO Job Code 440427): 

Department of Homeland Security (DHS) officials appreciate the 
opportunity to review and comment on the draft report referenced above. 
The Government Accountability Office (GAO) makes two recommendations 
with which we generally agree. While we largely agree with GAO on many 
of the findings, there are some findings with which we disagree. Our 
attachment includes some clarifications and other comments that we 
consider more than technical. 

We appreciate the time GAO has taken to review the United States 
Visitor and Immigrant Status Indicator Technology (US-VISIT) Program's 
ability to collect, maintain, and share data on selected foreign 
nationals entering and exiting the United States at air, sea, and land 
ports of entry (POEs). US-VISIT represents the greatest advancement in 
border technology in three decades. DHS established US-VISIT to enhance 
the safety of our citizens and visitors, facilitate legitimate travel 
and trade, enhance the integrity of our immigration system, and protect 
the privacy of travelers to the United States. In the three years since 
its inception, US-VISIT has processed over 70 million visitors at ports 
of entry, linking together systems from DHS and the Departments of 
State and Justice. In FY 2005, US-VISIT was successfully deployed at 
154 land border ports of entry, with the majority of ports reporting 
improved process times. Even with US-VISIT's increased security checks, 
travelers have not been significantly inconvenienced. In fact, wait 
times for Form I-94 (Arrival-Departure Form) issuance at land border 
ports of entry have gone down, and surveys from travelers show that the 
vast majority do not object to US-VISIT's biometric procedures. 

For all the successes of US-VISIT, Department officials agree that we 
need to improve existing management controls associated with US-VISIT, 
develop performance measures to assess the impact of US-VISIT 
operations at land POEs, and ensure that the statutorily mandated 
report mentioned in the draft report describes how DHS will move to a 
biometric entry/exit capability and align US-VISIT with emerging land 
border security initiatives. DHS officials have already established a 
great deal of the foundation for meeting future challenges. 

Customs and Border Protection (CBP) officials will support US-VISIT 
program officials as they implement the first recommendation. In 
addition, CBP personnel have resolved the computer problems noted in 
the draft report, implemented preliminary monitoring of the system, and 
have established a working group to determine how to implement detailed 
monitoring of all applications including US Arrival and US Pedestrian 
at land border ports of entry. 

Comments associated with our "sensitivity review" will be provided 
under separate cover. 

Sincerely, 

Signed by: 

Steven J. Pecinovsky: 
Director: 
Departmental GAO/OIG Liaison Office: 

Attachment: 

DHS/US-VISIT Clarifications and Other Comments Associated with GAO's 
Draft Report Findings/Observations: 

1. GAO Highlights page, second paragraph: "An interim non-biometric 
exit technology being tested does not meet the statutory requirement 
for a congressionally mandated biometric exit capability and cannot 
ensure that visitors who enter the country are those who leave." DHS/ 
US-VISIT clarification: The interim solution (Passive RF embedded I-94) 
was used because industry was not to the point of developing a 
biometric exit device that could satisfy mission requirements such as 
not impacting traffic flow and not having safety impacts. This position 
is also reflected in operational alternatives documentation. Subsequent 
research and industry outreach will be performed so that DHS/US-VISIT 
officials can satisfy the biometric exit mandate. 

2. Page 5, Results in Brief: GAO infers that US-VISIT has not 
adequately evaluated the impact of the 2-to 10-print digital scanning 
effort. US-VISIT response: US-VISIT officials have recognized that this 
transition has a high likelihood of impacting port facilities and US- 
VISIT personnel have taken significant steps to work with industry to 
speed up processing time and to miniaturize the current 10-print 
capture devices in an attempt to eliminate and/or significantly reduce 
the impact of deploying 10-print scanning. 

3. Page 6: US-VISIT comment: The language implies that US-VISIT 
personnel did not fully consider the impact [of US-VISIT] on the 
overall operations at the land POEs. According to US-VISIT officials, 
the US-VISIT touch point in land border operations is in fact limited 
to changes in I-94 processing time; the other factors related to port 
secondary capacity, staffing and traveler throughput are constant 
regardless of whether US-VISIT had been implemented. For example, the 
lack of available port secondary parking due to CBP processing of 
increased numbers of applicants for admission is not a symptom of US- 
VISIT, (in fact in many cases US-VISIT decreased the processing time 
for I-94 issuance), but is indicative of an increase in traffic and/or 
policy changes as to what traveler population requires secondary 
processing. These factors are arguably beyond the scope of US-VISIT and 
are more appropriately addressed through a larger evaluation as to 
whether or not current port facilities and staff are adequate to meet 
mission requirements. It should also be noted that the 1-94 process is 
one of many steps, each of which may impact overall wait times. A 
similar discussion appears on page 32. 

4. Page 14: US-VISIT clarification/comment: The statutory mandates 
regarding biometric screening only applies to aliens and not U.S. 
citizens. On pages 14 and 15, in the text preamble to the pie charts 
[on page 16], GAO states that most land border crossers are, by 
regulation, exempt from US-VISIT screening and U.S. citizens are 
included in this group. Regulations flow from statutory language and US-
VISIT currently has no statutory mandate to screen U.S. citizens. GAO 
should re-draft any chart (and explanatory text) that includes U.S. 
citizens as part of the calculation of percentage of persons screened 
by US-VISIT. 

5. Page 16: US-VISIT comment: Crossing statistics appear misleading in 
the report. For example, where GAO offers its first set of pie charts 
on the number of persons processed via US-VISIT, the charts have 
included U.S. citizens in the total numbers. This offers the uninformed 
reader misleading percentage data regarding the sets of people US-VISIT 
is authorized to screen biometrically at the land ports of entry. 

6. Page 26: U.S. VISIT comment: The report presents conflicting 
positions on the benefits realized from US-VISIT deployments. In 
several locations the narrative notes that the capabilities provided by 
US-VISIT are recognized as providing efficiencies to the I-94 process 
(as supported by US-VISIT performance evaluations). In other sections 
(e.g., page 26) there are statements that the capabilities have added 
to the time required to process visitors. It is implied the additional 
time resulted in turning visitors away at the border. US-VISIT 
officials believe that the capabilities deployed have reduced the time 
required to process an I-94, and officials have validated this position 
with performance evaluations. Statements of increased time, based on 
the inclusion of factors outside of the I-94 issuance process, are not 
an accurate analysis of the operations at the POE. The concerns listed 
by the San Ysidro offices are indicative of staffing and facilities 
capacity factors, that were likely due to fully implementing national 
policy guidelines as to which traveler populations require secondary 
processing. These guidelines were not changed as a result of the 
implementation of US-VISIT. 

7. Page 50: "US-VISIT reported that while the placement of the portal 
readers will not be changed, it is taking steps to improve the 
likelihood of detection with additional antennae, readers, and signage. 
However, there are no plans at present to modify the existing POE 
infrastructure." US-VISIT comment: A new pedestrian walkway was 
constructed parallel to the existing pedestrian entry. Signage, 
sidewalks and a new secure roto-gate were installed to serve as the 
primary pedestrian exit walkway. 

8. Page 53: "According to the US-VISIT Chief Strategist, the Program 
Office drafted in March 2005 a strategic plan that showed how US-VISIT 
would be strategically aligned with DHS's organizational mission and 
also defined an overall vision for immigration and border management." 
GAO then has a footnote (number 59) saying, "This plan is distinct from 
the legislatively mandated plan that is to describe a comprehensive US- 
VISIT entry/exit screening system." US-VISIT comments: There is just 
one plan - not two. The GAO language implies that there is more than 
one plan. US-VISIT began working on a strategic plan in late 2004 and 
finished it in March 2005. The Intel Reform Act of 2004, in section 
7208(c), called for DHS to submit a plan to Congress on the current 
functionality of the entry/exit system, as well as a plan for how the 
Secretary intends to expedite full deployment. As part of the US-VISIT 
response to this report requirement, US-VISIT officials included the 
Executive Summary of the Strategic Plan to explain how entry/exit works 
across the entire border and immigration enterprise. 

[End of Section] 

Appendix IX: GAO Contact and Acknowledgments: 

GAO Contact: 

Richard M. Stana (202) 512-8777: 

Acknowledgments: 

In addition to the above, John F. Mortin, Assistant Director; Amy 
Bernstein, Frances Cook, Odi Cuero, Richard Hung, Amanda Miller, James 
R. Russell, and Jonathan Tumin made key contributions to this report. 

(440562): 

FOOTNOTES 

[1] A port of entry is generally a physical location, such as a 
pedestrian walkway and/or a vehicle plaza with booths, and associated 
inspection and administration buildings, at a land border crossing 
point, or a restricted area inside an airport or seaport, where entry 
into the country by persons and cargo arriving by air, land, or sea is 
controlled by U.S. Customs and Border Protection (CBP). 

[2] The Visa Waiver Program enables nationals of certain countries to 
travel to the United States for tourism or business for stays of 90 
days or less without obtaining a visa. Most western European countries 
participate in this program, along with Japan, Singapore, Australia, 
Brunei, and New Zealand. Appendix II lists all 27 Visa Waiver Program 
countries. 

[3] To visit the United States, Mexican citizens generally need either 
a Mexican passport and U.S. visa, or a Border Crossing Card (BCC), 
which is issued to Mexican visitors who wish to enter the country for 
business or pleasure for no more than 6 months. The BCC contains 
machine-readable biographic and biometric information. Mexican citizens 
with BCCs who are traveling within 25 miles of the border, (75 miles in 
Arizona, if entering through certain POEs near Tucson) and who plan to 
stay no more than 30 days, are generally not subject to US- VISIT 
processing upon entry. A Mexican citizen is subject to US-VISIT 
requirements, however, if a CBP officer determines that the entrant 
intends to stay more than 30 days or travel beyond the 25-or 75-mile 
limit. 

[4] On July 27, 2006 DHS issued a Notice of Proposed Rulemaking that, 
if finalized, would expand the scope of US-VISIT to include, among 
others, lawful permanent residents, aliens seeking admission on 
immigrant visas, refugees and asylees, and certain categories of 
Canadians. DHS did not report how many additional persons would be 
covered by US-VISIT if the rule were adopted. 

[5] Under the Enhanced Border Security and Visa Entry Reform Act of 
2002 (Pub. L. No. 107-173, § 402(a), 116 Stat. 543, 557-59), commercial 
air and sea carriers are to transmit crew and passenger manifests to 
appropriate immigration officials before arrival of an aircraft or 
vessel in the United States. These manifests are transmitted to CBP 
through the Advanced Passenger Information System (APIS), which helps 
officers identify (1) those arrivals for which biometric data are 
available and (2) foreign nationals who need to be scrutinized more 
closely. 

[6] Visitors traveling on nonimmigrant visas are issued Form I-94 and 
visitors from Visa Waiver Program countries are issued Form I-94W. Both 
forms show the date of arrival, port of entry, and date the authorized 
period of admission expires. Whereas passengers arriving on commercial 
air or sea liners are to fill out portions of an I-94 or I-94W arrival 
and departure form on the carrier in advance of arriving, visitors 
subject to US-VISIT at land POEs are to provide information for I-94s 
and I-94Ws during the inspection process, and the forms are issued 
after the process is completed. 

[7] GAO, Internal Control: Standards for Internal Control in the 
Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 
1999), and GAO, Internal Control Standards: Internal Control Management 
and Evaluation Tool, GAO-01-1008G (Washington, D.C.: August 2001). 

[8] US-VISIT was not installed at 14 of the 16 other POEs because 
visitors subject to US-VISIT are not permitted to enter the country at 
those locations; at the other 2 POEs, DHS lacked the infrastructure 
needed to install the equipment. 

[9] GAO, Homeland Security: Recommendations to Improve Key Border 
Security Programs Need to Be Implemented, GAO-06-296 (Washington, D.C.: 
February 2006). 

[10] GAO/AIMD-00-21.3.1 and GAO-01-1008G. 

[11] 8 U.S.C. § 1365a. 

[12] Pub. L. No. 104-208, div. C, § 110, 110 Stat. 3009-546, 3009-558- 
59. 

[13] 8 U.S.C. § 1379. The official title of the USA PATRIOT Act is the 
Uniting and Strengthening America by Providing Appropriate Tools 
Required to Intercept and Obstruct Terrorism Act of 2001. 

[14] Pub. L. No. 108-458. 

[15] GAO, Homeland Security: Risks Facing Key Border and Transportation 
Security Program Need to Be Addressed, GAO-03-1083 (Washington, D.C.: 
September 2003). 

[16] GAO, Homeland Security: Risks Facing Key Border and Transportation 
Security Program Need to Be Addressed, GAO-04-569T (Washington, D.C.: 
March 2004). 

[17] GAO, Homeland Security: First Phase of Visitor and Immigration 
Status Program Operating, but Improvements Needed, GAO-04-586 
(Washington, D.C.: May 2004). 

[18] GAO-06-296. 

[19] Certain holders of nonimmigrant visas, such as foreign diplomats 
and other representatives of foreign governments, and representatives 
of certain international organizations, are expressly exempted from US- 
VISIT requirements by regulation, as are individuals who are younger 
than 14 or older than 79 on the date of admission. 8 C.F.R. § 
235.1(d)(1)(iv)(A), (B). 

[20] Under 8 C.F.R. § 235.1(d)(1)(iv)(C), DHS and the State Department 
may jointly exempt a class of aliens from US-VISIT requirements. On 
August 31, 2004, DHS announced in the Federal Register that the two 
agencies had determined that US-VISIT requirements generally would 
apply only to Mexican nationals for whom a Form I-94 is issued under 8 
C.F.R. § 235.1(f)(1)(iii) or (v). This means that Mexican nationals 
using a BCC who are admitted for no more than 30 days to visit within 
25 miles of the border (or to visit within 75 miles of the Arizona 
border, if entering through certain POEs in Arizona) generally are not 
subject to US-VISIT requirements. 69 Fed. Reg. 53,318, 53,323 (2004). 
The CBP officer determines the intent of an applicant for admission 
through the inspection process at a port of entry, in which the 
applicant must establish that he or she is entitled to enter the United 
States under all applicable laws and regulations. 8 C.F.R. § 
235.1(d)(1). If a Mexican BCC holder is admitted to the United States 
without an I-94, the terms of that individual's admission to the 
country are the 30 day/25 mile or 75 mile limits, and violation of 
those terms makes the individual removable from the country and 
possibly inadmissible in the future. 8 U.S.C. §§ 1227(a)(1), 
1182(a)(6), (9). 

[21] These special cases include Canadians who are engaged to American 
citizens, and Canadians who are traveling for the purpose of making 
major financial investments in the United States. 

[22] Since the statute governing US-VISIT applies to foreign national 
arrival and departure data only, U.S. citizens do not fall within the 
scope of the program and therefore are exempt from US-VISIT screening. 
Also, in general, regardless of whether they are to be processed into 
US-VISIT, Mexican citizens must present either a passport and visa or a 
BCC when seeking admission to the United States, while Canadian 
citizens generally do not need such documents. According to US-VISIT, 
when Mexicans receive a BCC, the data on the individual entered into 
U.S. databases at the time of their visa application are accessible by 
US-VISIT--if they are to be processed into it for any reason. 

[23] At land border POEs, the I-94 issued to foreign nationals covered 
by US-VISIT who are deemed admissible is considered issued for multiple 
entries, unless specifically annotated otherwise. A multiple entry I-94 
permits them to reenter the country, generally for up to 6 months, 
without additional US-VISIT processing during the period covered by the 
I-94. 

[24] According to CBP, these ports are classified as Class B ports. 
Under 8 C.F.R. §100.4(c)(2), only citizens of the United States, 
Canada, and Bermuda, and Lawful Permanent Residents of the United 
States and certain holders of border crossing cards may enter through 
Class B ports. Other foreign nationals are allowed to enter the United 
States only at Class A ports. 

[25] According to US-VISIT officials, as of March 2006 about $179.5 
million of the total $182 million budget had been obligated. 

[26] GAO, Technology Assessment: Using Biometrics for Border Security, 
GAO-03-174 (Washington, D.C.: Nov. 15, 2002). 

[27] According to US-VISIT Program Office officials, prior to 
deployment of US-VISIT entry capability, San Ysidro had its own system 
that was specifically designed for the POE to minimize manual I-94 
processing and help officers speed up the I-94 issuance process. 
However, according to these officials, although San Ysidro's system was 
"probably" faster than US-VISIT, it did not meet current US-VISIT 
standards for data protection, integration, and privacy and did not 
require officers to do the same database checks that are part of US- 
VISIT. The officials noted that US-VISIT enhances security because it 
is designed to access multiple databases nationwide and brings 
uniformity to the I-94 issuance process across POEs. 

[28] Center for Transportation Research, the University of Texas at 
Austin, Assessing the Effects of US-VISIT RFID Technology 
Implementation on Vehicle and Pedestrian Crossing Times at DeConcini, 
Nogales, Ariz. Report No. 2 Pilot Data Collection and Analysis to 
Baseline Data (Austin, Tex., November 2005). The project was performed 
under contract for the DHS Private Sector Office. The report examines 
processing times at primary inspection for privately owned vehicles 
(POV) and pedestrians and also processing times for visitors who 
require enrollment in US-VISIT with a focus on the introduction of 
Radio Frequency Identification (RFID) technology at the POE, which is 
discussed later in this report. 

[29] The average wait times were reported by the US-VISIT contractor 
for the periods of June 20 through 25, 2005, and August 15 through 20, 
2005. No results were reported for the third period from July 7 through 
8, 2005. 

[30] According to CBP, CBP officers determine what checks are needed to 
determine admissibility depending on the purpose of travel. 

[31] DMIA Task Force, DMIA Task Force First Annual Report to Congress, 
Dec. 2002. 

[32] CBP based this decision on the high volume of pedestrians entering 
the United States through the Morley Gate POE; the fact that, before 
deployment, I-94s had not been previously issued at the Morley Gate 
POE; and the close proximity of the Morley Gate POE facility to the 
nearby DeConcini POE facility, about 100 yards away. 

[33] According to this official, there are at least four major unsolved 
technological challenges to 10-fingerprint scanning, including: no 
current fingerprinting device on the market that can take and process 
10 prints as quickly as 2; no current device to capture 10 prints from 
the visitor as physically easy as with 2; no current devices meet 
operational processing requirements for ports of entry, embassies, or 
consulates; and the need to manufacture sufficient quantities of 
scanners to respond to the initiative. 

[34] See GAO-03-171. 

[35] GAO-06-296. 

[36] GAO/AIMD-00-21.3.1 and GAO-01-1008G. 

[37] Our review of CBP's information technology "help desk" tickets 
from July 2005 through January 2006 suggested that similar types of 
problems occurred at other locations where US-VISIT was installed. CBP 
officers that operate US-VISIT in the field are instructed to call the 
CBP help desk at the Newington Data Center in Virginia if they 
encounter problems operating US-VISIT related software or equipment. 

[38] CBP officials also dealt with sporadic network outages. In one 
case, on December 2, 2005, the entire network went down for 3 hours 
because of an accident. According to port officials, visitors seeking 
entry into the country at the San Ysidro, California, POE were 
initially asked to wait until the systems came back up or return at 
another time. About an hour after the outage began, CBP officers began 
to manually process I-94s for US-VISIT, in accordance with CBP standard 
operating procedures, but without the benefit of a biometric 
verification of their identity under US-VISIT. 

[39] Center for Transportation Research, the University of Texas at 
Austin. Assessing the Effects of US-VISIT RFID Technology 
Implementation on Vehicle and Pedestrian Crossing Times at DeConcini, 
Nogales, Ariz. Report No. 2 Pilot Data Collection and Analysis to 
Baseline Data (Austin, Texas: November 2005). 

[40] US-VISIT, Draft Performance Measures Report (Rosslyn, Va.: July 
2006). 

[41] GAO, Executive Guide: Measuring Performance and Demonstrating 
Results of Information Technology Investments, AIMD-98-89 (Washington, 
D.C.: March 1998). 

[42] Intelligence Reform and Terrorism Prevention Act of 2004, § 7208, 
8 U.S.C. § 1365b. See also USA PATRIOT Act, Pub. L. No. 107-56, § 
414(b)(1), 115 Stat. 272, 353 (2001); 8 U.S.C. § 1365a(b)(2)-(4). 

[43] US-VISIT, Increment 2C Operational Alternatives Assessment--FINAL 
(Rosslyn, Va.: Jan. 31, 2005). 

[44] US-VISIT, Increment 2C Operational Alternatives Assessment--FINAL 
(Rosslyn, Va: Jan. 31, 2005). 

[45] 8 U.S.C. § 1365b(d). 

[46] 8 U.S.C.A. §1365c(2)(A)(ii). 

[47] US-VISIT evaluated 12 different exit-recording technologies 
against the six criteria listed above, including some that incorporated 
biometric features--scanning the retina or iris, and a facial 
recognition system. Because the biometric solutions considered would 
have required an exiting visitor to slow down, stop, or possibly enter 
a POE facility, they were rejected. Other alternatives, such as the use 
of a global positioning system, were rejected because they transmit 
signals that could facilitate surveillance of individuals, raising 
concerns about privacy. 

[48] AIDMS is a system separate from TECS, IDENT and other databases 
used in the US-VISIT process. 

[49] The Treasury Enforcement Communications System (TECS) is a system 
that maintains lookout (i.e., watch list) data, interfaces with other 
agencies' databases, and is currently used by inspectors at ports of 
entry to verify traveler information and update traveler data. Although 
still labeled as a Treasury system, TECS has been transferred to CBP. 

[50] According to the US-VISIT Program Office, approximately $104 
million was budgeted in fiscal years 2004 and 2005 to conduct proof-of- 
concept testing of RFID for exit and re-entry. No separate break-out of 
testing expenditures related to exit alone was available. 

[51] Site selection factors included potential physical constraints, 
such as protected historic structures that could hamper installation of 
gantries, potential environmental impact, daily traffic and I-94 
processing volume, speed limits, and weather conditions. 

[52] A concept of operations defines how day-to-day operations are (or 
will be) carried out to meet mission needs. The concept of operations 
includes high-level descriptions of information systems, their 
interrelationships, and information flows. It also describes the 
operations that must be performed, who must perform them, and where and 
how the operations will be carried out. 

[53] US-VISIT Program Office, Increment 2C Proof of Concept--Phase 1 
Performance Evaluation Report, Post Implementation (Rosslyn, VA: Jan. 
20, 2006). 

[54] A US-VISIT program official explained that for vehicles exiting 
during RFID testing, one could "reasonably expect" a read rate of 70 
percent because vehicles are not required to stop upon exit. The 
official also cited vehicle speed, safety, and awareness (of optimal I- 
94A positioning; for example, holding the I-94A up to the window of the 
vehicle) as factors that affected RFID read rates. 

[55] US-VISIT, Final Increment 2C Phase 1 Proof of Concept Corrective 
Actions (Rosslyn, Va: January 2006). 

[56] Although all the tests were carried out at five land POEs, the 
number of POEs tested at which pedestrians exit and enter, and vehicles 
exit and entry differed, due to varying test conditions, according to 
the US-VISIT Program Office. 

[57] GAO, Information Security: Key Considerations Related to Federal 
Implementation of Radio Frequency Identification Technology, GAO-05-
849T (Washington, D.C.: June 22, 2005). 

[58] 8 U.S.C. §1365b(c)(2)(E). 

[59] GAO, Homeland Security: Risks Facing Key Border and Transportation 
Security Program Need to Be Addressed, GAO-03-1083 (Washington, D.C.: 
Sept. 19, 2006). 

[60] In commenting on this report, DHS stated that this plan includes 
US-VISIT's draft response to the legislative requirement that DHS 
produce a report to the Congress by June 2005 that describes a 
comprehensive US-VISIT entry/exit screening system, as discussed 
earlier in this report. 

[61] GAO, Observations on Efforts to Implement the Western Hemisphere 
Travel Initiative on the U.S. Canadian Border, GAO-06-741R (Washington, 
D.C.: May 25, 2006). 

[62] GAO, Overstay Tracking: A Key Component of Homeland Security and a 
Layered Defense, GAO-04-82 (Washington, D.C.: May 2004). 

[63] GAO-06-296. 

[64] GAO-03-171. 

[65] At the time we selected sites for review, we were unaware that the 
Morley Gate POE was being treated as a land POE separate from the other 
land POEs at Nogales. However, since US-VISIT treated Morley Gate as a 
separate POE for deployment, we also counted it as a stand alone POE. 

[66] During fiscal year 2004, the number of I-94 issuances by the 21 
selected sites ranged from 22 in Alburg Springs to about 398,900 in San 
Ysidro. 

[67] See GAO/AIMD-00-21.3.1 and GAO-01-1008G. 

[68] GAO, Privacy: Key Challenges Facing Federal Agencies, GAO-06-777T 
(Washington, D.C.: May 17, 2006). See also, Electronic Frontier 
Foundation, letter of 4 April, 2005, to U.S. Department of State 
(Hyperlink, 
http://www.eff.org/Privacy/Surveillance/RFID/RFID_passport.pdf); and 
Juels, Ari; Molnar, David; and Wagner, David, Security and Privacy 
Issues in E-passports, Cryptology ePrint Archive: Report 2005/095 
(Hyperlink, http://eprint.iacr.org/2005/095). 

[69] GAO, Information Security: Key Considerations Related to Federal 
Implementation of Radio Frequency Identification Technology, GAO-05-
849T (Washington, D.C.: May 22, 2005). 

[70] GAO, Information Security: Radio Frequency Identification 
Technology in the Federal Government, GAO-05-551 (Washington, D.C.: May 
27, 2005). 

[71] OMB M-03-22, Memorandum for Heads of Executive Departments and 
Agencies, OMB Guidance for Implementing the Privacy Provisions of the E-
Government Act of 2002. 

[72] An updated Privacy Impact Assessment was also published in 
September 2004 to reflect inclusion of Visa Waiver Program visitors in 
US-VISIT, expansion of US-VISIT to the 50 busiest land POEs, and 
changes in the business processes used by DHS to share information with 
federal law enforcement agencies. 

[73] Site selection factors included potential physical constraints, 
such as protected historic structures that could hamper installation of 
gantries; potential environmental impact; daily traffic and I-94A 
processing volume; speed limits; and weather conditions. 

[74] A concept of operations defines how day-to-day operations are (or 
will be) carried out to meet mission needs. The concept of operations 
includes high-level descriptions of information systems, their 
interrelationships, and information flows. It also describes the 
operations that must be performed, who must perform them, and where and 
how the operations will be carried out. 

[75] According to a program official involved in setting the target 
rates, the read rates expected for vehicles entering the country were 
also expected to be lower than for pedestrians because of potential 
interference from metal in vehicles. 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site (www.gao.gov). Each weekday, GAO posts 
newly released reports, testimony, and correspondence on its Web site. 
To have GAO e-mail you a list of newly posted products every afternoon, 
go to www.gao.gov and select "Subscribe to Updates." 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office 441 G Street NW, Room LM 
Washington, D.C. 20548: 

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202) 
512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 U.S. 
Government Accountability Office, 441 G Street NW, Room 7125 
Washington, D.C. 20548: 

Public Affairs: 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800 
U.S. Government Accountability Office, 441 G Street NW, Room 7149 
Washington, D.C. 20548: