This is the accessible text file for GAO report number GAO-11-335 
entitled 'Visa Waiver Program: DHS Has Implemented the Electronic 
System for Travel Authorization, but Further Steps Needed to Address 
Potential Program Risks' which was released on May 17, 2011. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as 
part of a longer term project to improve GAO products' accessibility. 
Every attempt has been made to maintain the structural and data 
integrity of the original printed product. Accessibility features, 
such as text descriptions of tables, consecutively numbered footnotes 
placed at the end of the file, and the text of agency comment letters, 
are provided but may not exactly duplicate the presentation or format 
of the printed version. The portable document format (PDF) file is an 
exact electronic replica of the printed version. We welcome your 
feedback. Please E-mail your comments regarding the contents or 
accessibility features of this document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

United States Government Accountability Office: 
GAO: 

Report to the Committee on Homeland Security and Governmental Affairs, 
U.S. Senate: 

May 2011: 

Visa Waiver Program: 

DHS Has Implemented the Electronic System for Travel Authorization, 
but Further Steps Needed to Address Potential Program Risks: 

GAO-11-335: 

GAO Highlights: 

Highlights of GAO-11-335, a report to the Committee on Homeland 
Security and Governmental Affairs, U.S. Senate. 

Why GAO Did This Study: 

The Visa Waiver Program (VWP) allows eligible nationals from 36 member 
countries to travel to the United States for tourism or business for 
90 days or less without a visa. In 2007, Congress required the 
Secretary of Homeland Security, in consultation with the Secretary of 
State, to implement an automated electronic travel authorization 
system to determine, prior to travel, applicants’ eligibility to 
travel to the United States under the VWP. Congress also required all 
VWP member countries to enter into an agreement with the United States 
to share information on whether citizens and nationals of that country 
traveling to the United States represent a security threat. In 2002, 
Congress mandated that the Department of Homeland Security (DHS) 
review, at least every 2 years, the security risks posed by each VWP 
country’s participation in the program. In this report, GAO evaluates 
(1) DHS’s implementation of an electronic system for travel 
authorization; (2) U.S. agencies’ progress in negotiating information-
sharing agreements; and (3) DHS’s timeliness in issuing biennial 
reports. GAO reviewed relevant documents and interviewed U.S., foreign 
government, and travel industry officials in six VWP countries. 

What GAO Found: 

DHS has implemented the Electronic System for Travel Authorization 
(ESTA) and has taken steps to minimize the burden associated with the 
new program requirement. However, DHS has not fully evaluated security 
risks related to the small percentage of VWP travelers without 
verified ESTA approval. DHS requires applicants for VWP travel to 
submit biographical information and answers to eligibility questions 
through ESTA prior to travel. Travelers whose ESTA applications are 
denied can apply for a U.S. visa. In developing and implementing ESTA, 
DHS has made efforts to minimize the burden imposed by the new 
requirement. For example, although travelers formerly filled out a VWP 
application form for each journey to the United States, ESTA approval 
is generally valid for 2 years. Most travel industry officials GAO 
interviewed in six VWP countries praised DHS’s widespread ESTA 
outreach efforts, reasonable implementation time frames, and 
responsiveness to feedback, but expressed dissatisfaction with the 
costs associated with ESTA. In 2010, airlines complied with the 
requirement to verify ESTA approval for almost 98 percent of VWP 
passengers prior to boarding, but the remaining 2 percent—about 
364,000 travelers—traveled under the VWP without verified ESTA 
approval. DHS has not yet completed a review of these cases to know to 
what extent they pose a risk to the program. 

To meet the legislative requirement, DHS requires that VWP countries 
enter into three information-sharing agreements with the United 
States; however, only half of the countries have fully complied with 
this requirement and many of the signed agreements have not been 
implemented. Half of the countries have entered into agreements to 
share watchlist information about known or suspected terrorists and to 
provide access to biographical, biometric, and criminal history data. 
By contrast, almost all of the 36 VWP countries have entered into an 
agreement to report lost and stolen passports. DHS, with the support 
of interagency partners, has established a compliance schedule 
requiring the last of the VWP countries to finalize these agreements 
by June 2012. Although termination from the VWP is one potential 
consequence for countries not complying with the information-sharing 
agreement requirement, U.S. officials have described it as 
undesirable. DHS, in coordination with State and Justice, has 
developed measures short of termination that could be applied to 
countries not meeting their compliance date. 

DHS has not completed half of the most recent biennial reports on VWP 
countries’ security risks in a timely manner. According to officials, 
DHS assesses, among other things, counterterrorism capabilities and 
immigration programs. However, DHS has not completed the latest 
biennial reports for 18 of the 36 VWP countries in a timely manner, 
and over half of these reports are more than 1 year overdue. Further, 
in the case of two countries, DHS was unable to demonstrate that it 
had completed reports in the last 4 years. DHS cited a number of 
reasons for the reporting delays. For example, DHS officials said that 
they intentionally delayed report completion because they frequently 
did not receive mandated intelligence assessments in a timely manner 
and needed to review these before completing VWP country biennial 
reports. 

What GAO Recommends: 

GAO recommends that DHS establish time frames for the regular review 
of cases of ESTA noncompliance and take steps to address delays in the 
biennial review process. DHS concurred with the report’s 
recommendations. 

View [hyperlink, http://www.gao.gov/products/GAO-11-335] or key 
components. For more information, contact Jess Ford at (202) 512-4268 
or fordj@gao.gov. 

[End of section] 

Contents: 

Letter: 

Background: 

DHS Implemented ESTA to Meet Mandated Requirement but Has Not Fully 
Analyzed Risks from Noncompliance: 

Only Half of VWP Countries Have Entered Into All Required Information- 
Sharing Agreements: 

DHS Has Not Consistently Completed Timely Biennial Reports: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments and Our Evaluation: 

Appendix I: Scope and Methodology: 

Appendix II: How to Apply for ESTA Approval: 

Appendix III: Comments from the Department of Homeland Security: 

Appendix IV: GAO Contact and Staff Acknowledgments: 

Tables: 

Table 1: Visa Waiver Program Eligibility Questions in the ESTA 
Application: 

Table 2: U.S. Government Outreach Efforts Undertaken to Publicize ESTA: 

Table 3: Status of Information-Sharing Agreements Required Since 2007 
for VWP Countries as Reported by U.S. Government Agencies: 

Figures: 

Figure 1: Visa Waiver Program Member Countries: 

Figure 2: DHS Process for ESTA Application Review: 

Figure 3: ESTA Applications Approved and Denied, 2008-2010: 

Figure 4: Percentage of VWP Passengers Boarded with Verified ESTA 
Approval, 2008-2010: 

Figure 5: The ESTA Application Welcome Page: 

Abbreviations: 

9/11 Act Implementing Recommendations of 9/11 Commission Act of 2007 

CBP: U.S. Customs and Border Protection: 

DNI: Director of National Intelligence: 

DHS: Department of Homeland Security: 

ESTA: Electronic System for Travel Authorization: 

HSPD-6: Homeland Security Presidential Directive 6: 

Interpol: International Criminal Police Organization: 

Justice: Department of Justice: 

LASP: Lost and Stolen Passports: 

PCSC: Preventing and Combating Serious Crime: 

State: Department of State: 

TPA: Travel Promotion Act of 2009: 

TSC: Terrorist Screening Center: 

VWP: Visa Waiver Program: 

[End of section] 

United States Government Accountability Office: 
Washington, DC 20548: 

May 5, 2011: 

The Honorable Joseph Lieberman: 
Chairman: 
The Honorable Susan Collins: 
Ranking Member: 
Committee on Homeland Security and Governmental Affairs: 
United States Senate: 

In 2010, more than 17 million foreign nationals from 36 participating 
countries entered the United States for tourism or business for 90 
days or less under the Visa Waiver Program (VWP). Congress established 
the program in 1986 to facilitate international travel without 
threatening U.S. security. The Implementing Recommendations of the 
9/11 Commission Act of 2007 (9/11 Act) called for the Department of 
Homeland Security (DHS), which implements the program, to take steps 
to enhance the security of the VWP.[Footnote 1] Among the mandated 
changes were (1) the implementation of an electronic system for travel 
authorization designed to determine in advance of travel the 
eligibility of VWP applicants to travel to the United States under the 
program, (2) a requirement that all VWP countries enter into 
agreements to share information with the United States on whether 
citizens and nationals of that country traveling under the program 
represent a threat to the security or welfare of the United States, 
and (3) a requirement that all VWP countries enter into agreements 
with the United States to report or make available lost and stolen 
passport data to the United States. Prior to these changes, Congress 
also mandated in 2002 that DHS evaluate and report on the security 
risks posed by each visa waiver country's participation in the program 
at least once every 2 years. In 2006, GAO identified deficiencies in 
DHS's biennial reporting process and recommended the finalization of 
protocols that included deadlines for report completion.[Footnote 2] 

VWP travelers are not subject to the same degree of screening as those 
with visas because they are not interviewed by a Department of State 
(State) consular officer before arriving at a U.S. port of entry. As a 
result, concerns have been raised that the VWP could be exploited to 
gain illegal entry into the United States. Effective oversight of the 
VWP is essential to find the right balance between facilitating 
legitimate travel and screening for potential terrorists, criminals, 
and others that may pose national security, law enforcement, or 
immigration concerns. 

In response to your request, this report (1) reviews DHS's 
implementation of the Electronic System for Travel Authorization 
(ESTA); (2) assesses U.S. agencies' progress in negotiating the 
required information-sharing agreements with VWP countries; and (3) 
assesses the timeliness of DHS's biennial reports on VWP countries. 

To assess the implementation of ESTA, we reviewed relevant 
documentation, including 2006 and 2008 GAO reports evaluating the VWP 
and statistics on program applicants and travelers.[Footnote 3] We 
also interviewed consular, public diplomacy, and law enforcement 
officials at U.S. embassies in six VWP countries: France, Ireland, 
Japan, South Korea, Spain, and the United Kingdom. We met with 
political and commercial officers at five of the six U.S. embassies. 
In the six countries, we also met with airline officials and travel 
industry officials regarding ESTA implementation. While the results of 
our site visits are not generalizable, they provided perspectives on 
VWP and ESTA implementation. To assess DHS's progress in meeting 
information-sharing agreement requirements, we reviewed the templates 
used to begin negotiations for information-sharing agreements and 
lists of countries that have met the requirement to enter into 
information-sharing agreements with the United States. We interviewed 
officials from DHS, State, and the Department of Justice (Justice) at 
headquarters and at U.S. embassies in six VWP countries who have 
participated in negotiating or implementing information-sharing 
agreements with VWP countries. We also interviewed foreign government 
officials from agencies responsible for negotiating information-
sharing agreements with the U.S. government and International Criminal 
Police Organization (Interpol) officials in Lyon, France, who receive 
the information on lost and stolen passports from VWP country 
governments. To assess the timeliness of biennial reports on VWP 
countries, we reviewed documentation of DHS biennial report completion 
and DHS's standard operating procedures for conducting biennial 
reviews. 

We conducted this performance audit from January 2010 to May 2011, in 
accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our 
findings and conclusions based on our audit objectives. 

We received written comments from DHS, which we have reprinted in 
appendix III. We also received technical comments from DHS, State, and 
Justice and incorporated those comments, as appropriate. DHS agreed 
with our recommendations and stated that it is undertaking and 
considering efforts to address them. DHS provided additional 
information on its efforts to monitor and assess issues that may pose 
a risk to U.S. interests. 

Background: 

Legislation Authorizing the VWP: 

The Immigration Reform and Control Act of 1986 created the VWP as a 
pilot program,[Footnote 4] and the Visa Waiver Permanent Program Act 
permanently established the program in October 2000.[Footnote 5] The 
program's purpose is to facilitate the legitimate travel of visitors 
for business or tourism. By providing visa-free travel to the United 
States, the program is intended to boost international business and 
tourism, as well as airline revenues, and create substantial economic 
benefits to the United States. Moreover, the program allows State to 
allocate more resources to visa-issuing posts in countries with higher 
risk applicant pools. 

In November 2002, Congress passed the Homeland Security Act of 2002, 
which established DHS and gave it responsibility for establishing visa 
policy, including policy for the VWP.[Footnote 6] Previously, Justice 
had overall responsibility for managing the program. In July 2004, DHS 
created the Visa Waiver Program Oversight Unit within the Office of 
International Enforcement and directed that unit to oversee VWP 
activities and monitor participating VWP countries' adherence to the 
program's statutory and policy requirements. In September 2007, the 
office was renamed the Visa Waiver Program Office. To help fulfill its 
responsibilities, DHS established an interagency working group 
comprising representatives from State, Justice, and several DHS 
component agencies and offices, including U.S. Customs and Border 
Protection (CBP) and U.S. Immigration and Customs Enforcement. 

Since the attacks on the United States on September 11, 2001, Congress 
has passed several other laws to strengthen border security policies 
and procedures. For example, the Enhanced Border Security and Visa 
Entry Reform Act of 2002[Footnote 7] increased the frequency--from 
once every 5 years to at least once every 2 years--of mandated 
assessments of the effect of each country's continued participation in 
the VWP on U.S. security, law enforcement, and immigration 
interests.[Footnote 8] The 9/11 Act also added security requirements 
for all VWP countries, such as the requirement that countries enter 
into an agreement with the United States to share information on 
whether citizens and nationals of that country traveling to the United 
States represent a threat to the security or welfare of the United 
States or U.S. citizens. 

VWP Member Countries: 

When the Visa Waiver Pilot Program was established in 1986, 
participation was limited to eight countries. Since then, the VWP has 
expanded to 36 countries.[Footnote 9] Figure 1 shows the locations of 
the current member countries. 

Figure 1: Visa Waiver Program Member Countries: 

[Refer to PDF for image: illustrated maps] 

Andorra; 
Austria; 
Australia; 
Belgium; 
Brunei; 
Czech Republic; 
Denmark; 
Estonia; 
Finland; 
France; 
Germany; 
Greece; 
Hungary; 
Iceland; 
Ireland; 
Italy; 
Japan; 
Latvia; 
Liechtenstein; 
Lithuania; 
Luxembourg; 
Malta; 
Monaco; 
The Netherlands; 
New Zealand; 
Norway; 
Portugal; 
San Marino; 
Singapore; 
Slovakia; 
Slovenia; 
South Korea; 
Spain; 
Sweden; 
Switzerland; 
United Kingdom. 

Sources: DHS (data); Map Resources (map). 

[End of figure] 

VWP Requirements: 

To qualify for the VWP a country must: 

* offer reciprocal visa-free travel privileges to U.S. citizens; 

* have had a refusal rate of less than 3 percent for the previous 
fiscal year for its nationals who apply for business and tourism visas; 

* issue machine-readable passports to its citizens; 

* enter into an agreement with the United States to report or make 
available through Interpol or other means as designated by the 
Secretary of Homeland Security information about the theft or loss of 
passports; 

* accept the repatriation of any citizen, former citizen, or national 
against whom a final order of removal is issued no later than 3 weeks 
after the order is issued; 

* enter into an agreement with the United States to share information 
regarding whether citizens and nationals of that country traveling to 
the United States represents a threat to U.S. security or welfare; and: 

* be determined not to compromise the law enforcement (including 
immigration enforcement) or security interests of the United States by 
its inclusion in the program. 

In addition, all passports issued after October 26, 2005, must contain 
a digital photograph in the document for travel to the United States 
under the program, and passports issued after October 26, 2006, must 
be e-passports that are tamper-resistant and incorporate a biometric 
identifier.[Footnote 10] Nationals from countries that have joined the 
VWP since 2008 must use e-passports in order to travel under the VWP. 
Effective July 1, 2009, all emergency or temporary passports must be e-
passports as well for use under the VWP. 

To be eligible to travel without a visa under the program, nationals 
of VWP countries must: 

* have received an authorization to travel under the VWP through ESTA; 

* have a valid passport issued by the participating country and be a 
national of that country; 

* seek entry for 90 days or less as a temporary visitor for business 
or tourism; 

* have been determined by CBP at the U.S. port of entry to represent 
no threat to the welfare, health, safety, or security of the United 
States; 

* have complied with conditions of any previous admission under the 
program (for example, individuals must not have overstayed the 90-day 
limit during prior visits under the VWP); 

* if entering by air or sea, possess a return trip ticket to any 
foreign destination issued by a carrier that has signed an agreement 
with the U.S. government to participate in the program, and must have 
arrived in the United States aboard such a carrier; and: 

* if entering by land, have proof of financial solvency and a domicile 
abroad to which they intend to return. 

Travelers who do not meet these requirements are required to obtain a 
visa from a U.S. embassy or consulate overseas before traveling to the 
United States. Unlike visa holders, VWP travelers generally may not 
apply for a change in status or an extension of the allowed period of 
stay. Individuals who have been refused admission to the United States 
previously must also apply for a visa. VWP travelers waive their right 
to review or appeal a CBP officer's decision regarding their 
admissibility at the port of entry or to contest any action for 
removal, other than on the basis of an application for asylum. 

DHS Implemented ESTA to Meet Mandated Requirement but Has Not Fully 
Analyzed Risks from Noncompliance: 

DHS has implemented ESTA to meet the 9/11 Act requirement intended to 
enhance program security and has taken steps to minimize the burden on 
travelers to the United States added by the new requirement, but it 
has not fully analyzed the risks of carrier and passenger 
noncompliance with the requirement. DHS developed ESTA to collect 
passenger data and complete security checks on the data before 
passengers board a U.S. bound carrier. In developing and implementing 
ESTA, DHS took several steps to minimize the burden associated with 
ESTA use. For example, ESTA reduced the requirement that passengers 
provide biographical information to DHS officials from every trip to 
once every 2 years. In addition, because of ESTA, DHS has informed 
passengers who do not qualify for VWP travel that they need to apply 
for a visa before they travel to the United States. Moreover, most 
travel industry officials we interviewed in six VWP countries praised 
DHS's widespread ESTA outreach efforts, reasonable implementation time 
frames, and responsiveness to feedback but expressed dissatisfaction 
over ESTA fees. Also, although carriers complied with the ESTA 
requirement to verify ESTA approval for almost 98 percent of VWP 
passengers before boarding them in 2010, DHS does not have a target 
completion date for a review to identify potential security risks 
associated with the small percentage of cases of traveler and carrier 
noncompliance with the ESTA requirement. 

DHS Implemented ESTA to Meet Congressional Requirement and Use Rose 
Rapidly After DHS Made It Mandatory: 

DHS Implemented ESTA to Assist with Preboarding Checks of Passenger 
Data: 

Pursuant to the 9/11 Act, DHS implemented ESTA, an automated, Web-
based system, to assist in assessing passengers' eligibility to travel 
to the United States under the VWP by air or sea before they board a 
U.S. bound carrier.[Footnote 11] DHS announced ESTA as a new 
requirement for travelers entering the United States under the VWP on 
June 9, 2008, and began accepting ESTA applications on a voluntary 
basis in August 2008. Beginning January 12, 2009, DHS required all VWP 
travelers to apply for ESTA approval prior to travel to the United 
States. DHS began enforcing compliance with ESTA requirements in March 
2010, exercising the right to fine a carrier or rescind its VWP 
signatory status for failure to comply with the ESTA requirement. 
Although passengers may apply for ESTA approval anytime before they 
board a plane or ship bound for the United States, DHS recommends that 
travelers apply when they begin preparing travel plans.[Footnote 12] 
Prior to ESTA's implementation, all travelers from VWP countries 
manually completed a form--the I-94W--en route to the United States, 
supplying biographical information and answering questions to 
determine eligibility for the VWP. DHS officials collected the forms 
from VWP passengers at U.S. ports of entry and used the information on 
the forms to qualify or disqualify the passengers for entry into the 
United States without a visa. 

DHS uses ESTA to electronically collect VWP applicants' biographical 
information and responses to eligibility questions. The ESTA 
application requires the same information collected through the I-94W 
forms. When an applicant submits an ESTA application, DHS systems 
evaluate the applicant's biographical information and responses to VWP 
eligibility questions. (See table 1.) If the DHS evaluation results in 
a denial of the application, the applicant is directed to apply for a 
U.S. visa.[Footnote 13] For all other applications, if this review 
process locates no information requiring further analysis, DHS 
notifies the applicant that the application is approved;[Footnote 14] 
if the process locates such information, DHS notifies the applicant 
that the application is pending, and DHS performs a manual check on 
the information. For example, if an applicant reports that a previous 
U.S. visa application was denied, DHS deems the ESTA application 
pending and performs additional review. If on further review of any 
pending application DHS determines that information disqualifies the 
applicant from VWP travel, the application is denied, and the 
individual is directed to apply for a visa; otherwise the applicant is 
approved. 

Table 1: Visa Waiver Program Eligibility Questions in the ESTA 
Application: 

a) Do you have a communicable disease; physical or mental disorder; or 
are you a drug abuser or addict? 

b) Have you ever been arrested or convicted for an offense or crime 
involving moral turpitude or a violation related to a controlled 
substance; or have been arrested or convicted for two or more offenses 
for which the aggregate sentence to confinement was five years or 
more; or have been a controlled substance trafficker; or are you 
seeking entry to engage in criminal or immoral activities? 

c) Have you ever been or are you now involved in espionage or 
sabotage; or in terrorist activities; or genocide; or between 1933 and 
1945 were you involved, in any way, in persecutions associated with 
Nazi Germany or its allies? 

d) Are you seeking to work in the U.S.; or have you ever been excluded 
and deported; or been previously removed from the United States or 
procured or attempted to procure a visa or entry into the U.S. by 
fraud or misrepresentation? 

e) Have you ever detained, retained or withheld custody of a child 
from a U.S. citizen granted custody of the child? 

f) Have you ever been denied a U.S. visa or entry into the U.S. or had 
a U.S. visa canceled? 

g) Have you ever asserted immunity from prosecution? 

Source: DHS Electronic System for Travel Authorization application. 

Note: This table is a direct download from the DHS application with no 
changes. 

[End of table] 

Figure 2 illustrates the ESTA application review process. (See 
appendix II for information on how to apply for ESTA.) 

Figure 2: DHS Process for ESTA Application Review: 

[Refer to PDF for image: illustration] 

Electronic submission of ESTA application: 

1) Electronic evaluation of application. 
If no disqualifying information is identified: Application approved. 
If confirmed disqualifying information is identified Application 
denied[A]. 
If potentially disqualifying information is identified: Pending. 

2) Manual review of application. 

3) If manual review clears DHS concerns: Application approved. 
Or: 

4) If manual review determines that applicant is ineligible for 
travel: Application denied[A]. 

Source: GAO analysis of DHS data. 

[A] When an application is denied, the response from DHS directs the 
applicant to State's Web site for information about applying for a 
visa. 

[End of figure] 

ESTA Use Rose Rapidly Once Mandatory; DHS Has Approved Most ESTA 
Applications but Deemed Thousands Ineligible: 

According to DHS data, the number of individuals submitting ESTA 
applications increased from about 180,000 per month in 2008, when 
applying was voluntary, to more than 1.15 million per month in 2009 
and 2010 after DHS made ESTA mandatory. DHS approved over 99 percent 
of the almost 28.6 million ESTA applications submitted from August 
2008 through December 2010, but it also denied the applications of 
thousands of individuals it deemed ineligible to travel to the United 
States under the VWP. The denial rate has decreased slightly from 0.42 
percent in 2008 to 0.24 percent in 2010. (See figure 3.) 

Figure 3: ESTA Applications Approved and Denied, 2008-2010: 

[Refer to PDF for image: vertical bar graph] 

Year: 2008 (Application voluntary); 
Number of applicants: 900,155; 
Denied applications: 3,751 (0.42%). 

Year: 2009 (Application mandatory after January 12, 2009); 
Number of applicants: 13,765,000; 
Denied applications: 40,695 (0.29%). 

Year: 2010 (Application mandatory after January 12, 2009)
Number of applicants: 13,855,899; 
Denied applications: 32,784 (0.24%). 

Source: GAO analysis of DHS data. 

[End of figure] 

DHS data show that DHS denied 77,132 of the almost 28.6 million 
applications for VWP travel submitted through ESTA from 2008 through 
2010. Reasons for denials included applicants' responses to the 
eligibility questions, as well as DHS's discovery of other information 
that disqualified applicants from travel under the VWP. Examples are 
as follows: 

* DHS denied 19,871 applications because of applicant responses to the 
eligibility questions. 

* DHS denied 36,744 pending applications because of the results of 
manual reviews of passenger data. 

* DHS denied 15,078 applications because the applicants had unresolved 
cases of a lost or stolen passport that DHS decided warranted an in- 
person visa interview with a State consular officer. 

In addition, ESTA applications are regularly reevaluated as new 
information becomes available to DHS, potentially changing applicants' 
ESTA status. 

DHS Made Efforts to Minimize Burden of ESTA Requirement: 

In developing and implementing ESTA, DHS has taken steps to minimize 
the burden associated with ESTA's use. 

* Less frequent applications. ESTA approval for program participants 
generally remains valid for 2 years. Prior to ESTA implementation, 
passengers traveling under the program were required to complete the I-
94W form to determine their program eligibility each time they boarded 
a carrier to the United States. When DHS implemented ESTA, the burden 
on passengers increased because DHS also required ESTA applicants to 
complete an I-94W form. However, on June 29, 2010, DHS eliminated the 
I-94W requirement for most air and sea travelers who had been approved 
by ESTA. According to travel industry officials in the six VWP 
countries we visited, this change has simplified travel for many 
travelers, especially business travelers who travel several times each 
year. DHS officials said the change also eliminated the problems of 
deciphering sometimes illegible handwriting on the I-94W forms. 

* Earlier notice of ineligibility. ESTA notifies passengers of program 
ineligibility, and therefore of the need to apply for a visa, before 
they embark for the United States. Prior to ESTA implementation, 
passengers from VWP countries did not learn until reaching the U.S. 
port of entry whether they were eligible to enter under the VWP or 
would be required to obtain a visa. Because DHS received passengers' 
completed I-94W forms at the port of entry, DHS officials did not 
recommend that carriers prevent passengers from VWP countries from 
boarding a U.S. bound carrier without a visa unless they were deemed 
ineligible based on other limited preboarding information provided by 
carriers. 

* Widespread U.S. government outreach. VWP country government and 
travel industry officials praised widespread U.S. government efforts 
to provide information about the ESTA requirements.[Footnote 15] After 
announcing ESTA, DHS began an outreach campaign in VWP countries and 
for foreign government embassy staff in the United States, with the 
assistance of other U.S. agencies, to publicize the requirement. DHS 
officials said they spent $4.5 million on ESTA outreach efforts. 
Although none of the six embassies we visited tracked the costs 
associated with outreach, each embassy provided documentation of their 
use of many types of outreach efforts listed in table 2. VWP country 
government officials and travel industry officials we met said that 
although they were initially concerned that ESTA implementation would 
be difficult and negatively affect airlines and many VWP passengers, 
implementation went more smoothly than expected. 

Table 2: U.S. Government Outreach Efforts Undertaken to Publicize ESTA: 

Outreach effort: ESTA ads; 
Target audience: General public, travel industry officials; 
Where used (examples): U.S. embassy Web sites, travel industry 
publications, national newspapers, YouTube™. 

Outreach effort: Informational and promotional materials; 
Target audience: General public, travel industry officials; 
Where used (examples): U.S. embassies, airports, travel agencies, 
travel industry events. 

Outreach effort: Conferences and media events; 
Target audience: General public, travel industry officials; 
Where used (examples): U.S. embassies, airports, travel industry 
events. 

Outreach effort: Outreach to U.S. and foreign government officials; 
Target audience: U.S. embassy officials, foreign government officials; 
Where used (examples): U.S. embassies, embassy day events. 

Sources: DHS and State officials. 

[End of table] 

* Reasonable implementation time frames. Most of the VWP country 
airline officials with whom we met said that the ESTA implementation 
time frames set by DHS were reasonable. In 2008, DHS introduced ESTA 
and made compliance voluntary. The following year, DHS made ESTA 
mandatory but did not levy fines if airlines did not verify 
passengers' ESTA approval before boarding them. This allowed the U.S. 
government more time to publicize the requirement, according to DHS 
officials. Enforcement began in March 2010. According to most of the 
officials we interviewed from 17 airlines in the six VWP countries we 
visited, the phased-in compliance generally allowed passengers 
sufficient time to learn about the ESTA requirement and allowed most 
airlines sufficient time to update their systems to meet the 
requirement. ESTA officials said that the phased-in compliance also 
provided time to fix problems with the system before enforcing airline 
and passenger compliance. 

* DHS responsiveness to travel industry feedback. VWP travel industry 
officials said that DHS officials' efforts to adapt ESTA in response 
to feedback have clarified the application process. Since initial 
implementation of ESTA in 2008, DHS has issued updates to the system 
on 21 occasions. According to DHS officials, many of these changes 
addressed parts of the application that were unclear to applicants. 
For example, DHS learned from some travel industry officials that many 
applicants did not know how to answer a question on the application 
about whether they had committed a crime of moral turpitude because 
they did not know the definition of "moral turpitude." In September 
2010, DHS released an updated ESTA application that included a 
definition of the term directly under the question. Further, updates 
have made the ESTA application available in 22 languages instead of 
only English. DHS also made it possible for denied applicants to 
reapply and be approved if they mistakenly answered "yes" to select 
eligibility questions. Although travel industry officials we met with 
in six VWP countries said there are still ways ESTA should be 
improved, they said that DHS's responsiveness in amending the ESTA 
application had made the system more user friendly. 

* Shorter reported passenger processing times. According to a study 
commissioned by DHS and conducted at three U.S. ports of entry, ESTA 
has reduced the average time DHS takes to process a VWP passenger 
before deciding whether to admit them into the United States by a 
range of between 17.8 and 54 percent.[Footnote 16] The study 
attributed this time savings to factors such as the reduction in 
number of documents DHS officers needed to handle and evaluate and the 
reduction in data entry needed at the port of entry. 

Although DHS took steps to minimize the burden imposed by ESTA 
implementation, almost all government and travel industry officials we 
met in six VWP countries expressed dissatisfaction over the Travel 
Promotion Act of 2009 (TPA)[Footnote 17] fee collected as part of the 
ESTA application. In September 2010, the U.S. government began to 
charge ESTA applicants a $14 fee when they applied for ESTA approval, 
including $10 for the creation of a corporation to promote travel to 
the United States and $4 to fund ESTA operations.[Footnote 18] 
According to many of the VWP country government and travel industry 
officials with whom we met, the TPA fee is unfair because it burdens 
those traveling to the United States with an added fee to encourage 
others to travel to the United States. Some of the officials pointed 
out that it was unrelated to VWP travel and that it runs counter to 
the program objective of simplifying travel for VWP participants. DHS 
officials said that many government and travel industry officials from 
VWP countries view the fee as a step away from visa-free travel and 
consider ESTA with the fee "visa-lite." By comparison, a nonimmigrant 
visitor visa costs over $100 but is generally valid for five times as 
long as ESTA approval. Several foreign officials said they expected 
that the fee amount would continue to rise over time. DHS officials 
stated that they cannot control the TPA portion of the ESTA fee 
because it was mandated by law.[Footnote 19] 

In addition, some airline officials expressed concern that the ESTA 
requirement was one of many requirements imposed by DHS that required 
the carriers to bear the cost of system updates. DHS officials said 
that the ESTA requirement did impose a new cost to carriers, but that 
it was necessary to strengthen the security of the VWP. 

Carrier Compliance with ESTA Requirement Increased After DHS Made ESTA 
Mandatory, but DHS Has Not Fully Assessed Risks of Noncompliance: 

According to DHS, air and sea carriers are required to verify that 
each passenger they board has ESTA approval before boarding them. 
Carriers' compliance with the requirement has increased since DHS made 
ESTA mandatory and has exceeded 99 percent in recent months. DHS data 
show the following: 

* 2008. In 2008, when VWP passenger and carrier compliance was 
voluntary, airlines and sea carriers verified ESTA approval for about 
5.4 percent of passengers boarded under the VWP. According to DHS 
officials, carriers needed time to update their systems to receive 
passengers' ESTA status, and DHS needed time to publicize the new 
travel requirement. 

* 2009. ESTA became mandatory in January 2009, and carriers verified 
ESTA approval for about 88 percent of passengers boarded under the VWP 
that year. 

* 2010. In March 2010, DHS began enforcing carrier compliance. In that 
year, carriers verified ESTA approval for almost 98 percent of VWP 
passengers. As of January 2011, DHS had imposed fines on VWP carriers 
for 5 of the passengers who had been allowed to board without ESTA 
approval.[Footnote 20] 

Figure 4 shows the percentage of VWP passengers boarded by carriers 
who had verified the passengers' ESTA approval. In addition, from 
September 2010 through January 2011, carrier compliance each month 
exceeded 99 percent. 

Figure 4: Percentage of VWP Passengers Boarded with Verified ESTA 
Approval, 2008-2010: 

[Refer to PDF for image: 3 pie-charts] 

2008: 
Verification voluntary. 
VWP travelers boarded without verified ESTA approval: 94.6%; 
VWP travelers boarded with verified ESTA approval: 5.4%. 

2009: 
Verification mandatory as of January 12, 2009. 
VWP travelers boarded without verified ESTA approval: 12.3%; 
VWP travelers boarded with verified ESTA approval: 87.7%. 

2010: 
Compliance enforced as of March 20, 2010. 
VWP travelers boarded without verified ESTA approval: 2.2%; 
VWP travelers boarded with verified ESTA approval: 97.8%. 

Source: GAO analysis of DHS data. 

[End of figure] 

DHS Has Not Fully Analyzed Risks Associated with ESTA Noncompliance: 

Although carriers verified ESTA approval for almost 98 percent of VWP 
passengers before boarding them for VWP travel in 2010, DHS has not 
fully analyzed the potential risks posed by cases where carriers 
boarded passengers for VWP travel without verifying that they had ESTA 
approval. In 2010, about 2 percent--364,086 VWP passengers--were 
boarded without verified ESTA approval. For most of these passengers-- 
363,438, or about 99.8 percent--no ESTA application had been recorded. 
The remainder without ESTA approval--648, or about 0.2 percent--were 
passengers whose ESTA applications had been denied.[Footnote 21] DHS 
officials told us that, although there is no official agency plan for 
monitoring and oversight of ESTA, the ESTA office is undertaking a 
review of each case of a carrier's boarding a VWP traveler without an 
approved ESTA application; however, DHS has not established a target 
date for completing this review. In its review of these cases, DHS 
officials said they expect to determine why the carrier boarded the 
passengers, whether and why DHS admitted these individuals into the 
United States, and whether the airline or sea carrier should be fined 
for noncompliance. 

DHS tracks some data on passengers that travel under the VWP without 
verified ESTA approval but does not track other data that would help 
officials know the extent to which noncompliance poses a risk to the 
program. For example, although DHS officials said that about 180 VWP 
travelers who arrive at a U.S. port of entry without ESTA approval are 
admitted to the United States each day, they have not tracked how 
many, if any, of those passengers had been denied by ESTA.[Footnote 
22] DHS also reported that 6,486 VWP passengers were refused entry 
into the United States at the port of entry in 2010, but that number 
includes VWP passengers for whom carriers had verified ESTA approval. 
Officials did not track how many of those had been boarded without 
verified ESTA approval. DHS also did not know how many passengers 
without verified ESTA approval were boarded with DHS approval after 
system outages precluded timely verification of ESTA approval. 

Without a completed analysis of noncompliance with ESTA requirements, 
DHS is unable to determine the level of risk that noncompliance poses 
to VWP security and to identify improvements needed to minimize 
noncompliance. In addition, without analysis of data on travelers who 
were admitted to the United States without a visa after being denied 
by ESTA, DHS cannot determine the extent to which ESTA is accurately 
identifying individuals who should be denied travel under the program. 

Only Half of VWP Countries Have Entered Into All Required Information- 
Sharing Agreements: 

Although DHS and partners at State and Justice have made progress in 
negotiating information-sharing agreements with VWP countries, 
required by the 9/11 Act, only half of the countries have entered into 
all required agreements. In addition, many of the agreements entered 
into have not been implemented. The 9/11 Act does not establish an 
explicit deadline for compliance, but DHS with support from State and 
Justice has produced a completion schedule that requires agreements to 
be entered into by the end of each country's current or next biennial 
review cycle, the last of which will be completed by June 2012. In 
coordination with State and Justice, DHS also outlined measures short 
of termination that may be applied to VWP countries not meeting their 
compliance date. 

DHS Requires VWP Countries to Enter Into Three Agreements: 

The 9/11 Act specifies that each VWP country must enter into 
agreements with the United States to share information regarding 
whether citizens and nationals of that country traveling to the United 
States represent a threat to the security or welfare of the United 
States and to report lost or stolen passports. DHS, in consultation 
with other agencies, has determined that VWP countries can satisfy the 
requirement by entering into the following three bilateral agreements: 

* Homeland Security Presidential Directive 6 (HSPD-6), 

* Preventing and Combating Serious Crime (PCSC), and: 

* Lost and Stolen Passports (LASP).[Footnote 23] 

According to DHS officials, countries joining the VWP after the 9/11 
Act entered into force are required to enter into HSPD-6 and PCSC 
agreements with the United States as a condition of admission into the 
program. In addition, prior to joining the VWP, such countries are 
required to enter into agreements containing specific arrangements for 
information sharing on lost and stolen passports. As illustrated in 
table 3 below, DHS, State, and Justice have made some progress with 
VWP countries in entering into the agreements. 

Table 3: Status of Information-Sharing Agreements Required Since 2007 
for VWP Countries as Reported by U.S. Government Agencies: 

Agreement: HSPD-6; 
Number entered into: 19; 
Percentage entered into: 53%; 
Number implemented: 13; 
Percentage implemented: 36%; 
Type of information shared: Known and suspected terrorists. 

Agreement: PCSC; 
Number entered into: 18[A]; 
Percentage entered into: 50%; 
Number implemented: 0; 
Percentage implemented: 0%; 
Type of information shared: Perpetrators of serious crime. 

Agreement: LASP; 
Number entered into: 34; 
Percentage entered into: 94%; 
Number implemented: 34[B]; 
Percentage implemented: 94%; 
Type of information shared: Lost and stolen passports. 

Sources: DHS, Justice, and State. 

[A] As of January 2011, the following 18 countries have met the 
requirement to enter into PCSC agreements: Austria, the Czech 
Republic, Denmark, Estonia, Finland, Germany, Greece, Italy, Latvia, 
Lithuania, Hungary, Malta, the Netherlands, Portugal, Slovakia, South 
Korea, Spain, and the United Kingdom. According to DHS officials, pre-
existing agreements with one of these countries fulfill PCSC 
information-sharing requirements and eliminate the need to enter into 
a separate PCSC agreement. 

[B] Although 2 VWP countries have not signed LASP agreements, 
according to Interpol officials, all VWP countries share LASP data. 

[End of table] 

All VWP countries and the United States share some information with 
one another on some level, but the existence of a formal agreement 
improves information sharing, according to DHS officials. As opposed 
to informal case-by-case information sharing, formal agreements expand 
the pool of information to which the United States has systematic 
access. They can draw attention to and provide information on 
individuals of whom the United States would not otherwise be aware. 
According to officials, formal agreements generally expedite the 
sharing of information by laying out specific terms that can be easily 
referred to when requesting data. DHS officials observed that timely 
access to information is especially important for CBP officials at 
ports of entry. 

HSPD-6 Agreement: 

HSPD-6 agreements establish a procedure between the United States and 
partner countries to share watchlist information about known or 
suspected terrorists. As of January 2011, 19 of the 36 VWP countries 
had signed HSPD-6 agreements, and 13 have begun sharing information 
according to the signed agreements.[Footnote 24] (See table 3.) 
Justice's Terrorist Screening Center (TSC) and State have the primary 
responsibility to negotiate and conclude these information-sharing 
agreements. An interagency working group, co-led by TSC and State that 
also includes representatives from U.S. law enforcement, intelligence, 
and policy communities, addresses issues with the exchange of 
information and coordinates efforts to enhance information exchange. 
While the agreements are based on a template that officials use as a 
starting point for negotiations, according to TSC officials, the terms 
of each HSPD-6 agreement are unique, prescribing levels of information 
sharing that reflect the laws, political will, and domestic policies 
of each partner country. TSC officials said most HSPD-6 agreements are 
legally nonbinding. Officials said that this allows more flexibility 
in information-sharing procedures and simplifies negotiations with 
officials from partner countries. The TSC officials noted that the 
nonbinding nature of the agreements may allow some VWP countries to 
avoid bureaucratic and political hurdles. 

Noting that State and TSC continue to negotiate HSPD-6 agreements with 
VWP countries, officials cited concerns regarding privacy and data 
protection expressed by many VWP countries as reasons for the delayed 
progress. According to these officials, in some cases, domestic laws 
of VWP countries limit their ability to commit to sharing some 
information, thereby complicating and slowing the negotiation process. 
The terms of HSPD-6 agreements are also extremely sensitive, TSC 
officials noted, and therefore many HSPD-6 agreements are classified. 
Officials expressed concern that disclosure of the agreements 
themselves might either (1) cause countries that had already signed 
agreements to become less cooperative in sharing data on known or 
suspected terrorists and reduce the exchange of information or (2) 
cause countries in negotiation to become less willing to sign 
agreements or insist on terms prescribing less information sharing. 

The value and quality of information received through HSPD-6 
agreements vary, and some partnerships are more useful than others, 
according to TSC officials. The officials stated that some partner 
countries were more willing than others to share data on known or 
suspected terrorists. For example, according to TSC officials, some 
countries do not share data on individuals suspected of terrorist 
activity but only on those already convicted. In other cases, TSC 
officials stated that some partner countries did not have the 
technical capacity to provide all information typically obtained 
through HSPD-6 agreements. For example, terrorist watchlist data 
include at least the name and date of birth of the suspect and may 
also include biometric information such as fingerprints or 
photographs. According to DHS officials, some member countries do not 
have the legal or technical ability to store such information. 

TSC has evidence that information is being shared as a result of HSPD- 
6 agreements. They provided the number of encounters with known or 
suspected terrorists generated through sharing watchlist information 
with foreign governments.[Footnote 25] TSC officials noted that they 
viewed these data as one measure of the relevance of the program, but 
not as comprehensive performance indicators. Although TSC records the 
number of encounters, HSPD-6 agreements do not contain terms requiring 
partner countries to reveal the results of these encounters, and there 
is no case management system to track and close them out, according to 
TSC officials. 

PCSC Agreement: 

The PCSC agreements establish the framework for law enforcement 
cooperation by providing each party automated access to the other's 
criminal databases that contain biographical, biometric, and criminal 
history data. (See table 3.) As of January 2011, 18 of the 36 VWP 
countries had met the PCSC information-sharing agreement requirement, 
but the networking modifications and system upgrades required to 
enable this information sharing to take place have not been completed 
for any VWP countries. The language of the PCSC agreements varies 
slightly because, according to agency officials, partner countries 
have different legal definitions of what constitutes a serious crime 
or felony, as well as varying demands regarding data protection 
provisions. 

Achieving greater progress negotiating PCSC agreements has been 
difficult, according to DHS officials, because the agreements require 
lengthy and intensive face-to-face discussions with foreign 
governments. Justice and DHS, with assistance from State, negotiate 
the agreements with officials from partner countries that can include 
representatives from their law enforcement and justice ministries, as 
well as their diplomatic corps. Further, sharing sensitive personal 
information with the United States is publicly unpopular in many VWP 
countries, even if the countries' law enforcement agencies have no 
reluctance to share information. Officials in some VWP countries told 
us that efforts to overcome political barriers have caused further 
delays. 

Though officials expect to complete networking modifications necessary 
to allow queries of Spain's and Germany's criminal databases in 2011, 
the process is a legally and technically complex one that has not yet 
been completed for any of the VWP countries. According to officials, 
DHS is frequently not in a position to influence the speed of PCSC 
implementation for a number of reasons. For example, according to DHS 
officials, some VWP countries require parliamentary ratification 
before implementation can begin. Also U.S. and partner country 
officials must develop a common information technology architecture to 
allow queries between databases. 

LASP Agreement: 

In a 2006 GAO report,[Footnote 26] we found that not all VWP countries 
were consistently reporting data on lost and stolen passports. We 
recommended that DHS develop clear standard operating procedures for 
such reporting, including a definition of timely reporting. As of 
January 2011, all VWP countries were sharing lost and stolen passport 
information with the United States, and 34 of the 36 VWP countries had 
entered into LASP agreements.[Footnote 27] (See table 3.) 

The 9/11 Act requires VWP countries to enter into an agreement with 
the United States to report, or make available to the United States 
through Interpol or other means as designated by the Secretary of 
Homeland Security information about the theft or loss of passports. 
According to DHS officials, other international mandates have helped 
the United States to obtain LASP information. Since 2005, all European 
Union countries have been mandated to send data on lost and stolen 
passports to Interpol for its Stolen and Lost Travel Documents 
database. In addition, Australia and New Zealand have agreements to 
share lost and stolen passport information through the Regional 
Movement Alert System. According to officials, in fiscal year 2004, 
more than 700 fraudulent passports from VWP countries were intercepted 
at U.S. ports of entry; however, by fiscal year 2010, this number had 
decreased to 64. DHS officials attributed the decrease in the use of 
fraudulent passports in part to better LASP reporting to Interpol. 
More complete data has allowed DHS to identify more individuals 
attempting VWP travel with a passport that has been reported lost or 
stolen before they begin travel. 

DHS Established a Compliance Schedule for Entering Into Information- 
Sharing Agreements: 

Although the 9/11 Act does not establish an explicit deadline, DHS, 
with the support of partners at State and Justice, has produced a 
compliance schedule that requires agreements to be entered into by the 
end of each country's current or next biennial review cycle, the last 
of which will be completed by June 2012. In March 2010, State sent a 
cable to posts in all VWP countries that instructed the appropriate 
posts to communicate the particular compliance date to the government 
of each noncompliant VWP country. However, DHS officials expressed 
concern that some VWP countries may not have entered into all 
agreements by the specified compliance dates. 

DHS Has Outlined Measures to Encourage VWP Countries to Enter Into 
Information-Sharing Agreements: 

According to DHS officials, termination from the VWP is one potential 
consequence for VWP countries that do not enter into information- 
sharing agreements. However, U.S. officials described termination as 
undesirable, saying that it would significantly impact diplomatic 
relations and would weaken any informal exchange of information. 
Further, termination would require all citizens from the country to 
obtain visas before traveling to the United States. According to 
officials, particularly in the larger VWP countries, this step would 
overwhelm consular offices and discourage travel to the United States, 
thereby damaging trade and tourism. U.S. embassy officials in France 
told us that when the United States required only a small portion of 
the French traveling population--those without machine-readable 
passports--to obtain visas, U.S. embassy officials logged many 
overtime hours, while long lines of applicants extended into the 
embassy courtyard. 

DHS helped write a classified strategy document that outlines a 
contingency plan listing possible measures short of termination from 
the VWP that may be taken if a VWP country does not meet its specified 
compliance date for entering into information-sharing agreements. 
[Footnote 28] The strategy document provides steps that would need to 
be taken prior to selecting and implementing one of these measures. 
According to officials, DHS plans to decide which measures to apply on 
a case-by-case basis. 

DHS Has Not Consistently Completed Timely Biennial Reports: 

DHS conducts reviews to determine whether issues of security, law 
enforcement, or immigration affect VWP country participation in the 
program; however, the agency has not completed half of the mandated 
biennial reports resulting from these reviews in a timely manner. In 
2002, Congress mandated that, at least once every 2 years, DHS 
evaluate the effect of each country's continued participation in the 
program on the security, law enforcement, and immigration interests of 
the United States. The mandate also directed DHS to determine based on 
the evaluation whether each VWP country's designation should continue 
or be terminated and to submit a written report on that determination 
to select congressional committees.[Footnote 29] 

To fulfill this requirement, DHS conducts reviews of VWP countries 
that examine and document, among other things, counterterrorism and 
law enforcement capabilities, border control and immigration programs 
and policies, and security procedures. To document its findings, DHS 
composes a report on each VWP country reviewed and a brief summary of 
the report to submit to congressional committees. In conjunction with 
DHS's reviews, the Director of National Intelligence (DNI) produces 
intelligence assessments that DHS reviews prior to finalizing its VWP 
country biennial reports.[Footnote 30] According to VWP officials, 
they visited 12 program countries in fiscal year 2009 and 10 countries 
in fiscal year 2010 to gather the data needed to complete these 
reports. As of February 2011, the Visa Waiver Program Office had 
completed 3 country visits and anticipated conducting 10 more for 
fiscal year 2011. If issues of concern are identified during the VWP 
country review process, DHS drafts an engagement strategy documenting 
the issues of concern and suggesting recommendations for addressing 
the issues. According to VWP officials, they also regularly monitor 
VWP country efforts to stay informed about any emerging issues that 
may affect the countries' VWP status. 

In 2006, we found that DHS had not completed the required biennial 
reviews in a timely fashion, and we recommended that DHS establish 
protocols including deadlines for biennial report completion. DHS 
established protocols in 2007 that include timely completion of 
biennial reports as a goal. Our current review shows that DHS has not 
completed the latest biennial reports for 50 percent, or 18 of the 36 
VWP countries in a timely manner. Also, over half of those reports are 
more than 1 year overdue. In the case of two countries, DHS was unable 
to demonstrate that they had completed reports in over 4 years. 
[Footnote 31] Further, according to the evidence supplied by DHS, of 
the 17 reports completed since the beginning of 2009, over 25 percent 
were transmitted to Congress 3 or more months after report completion, 
and 2 of those after more than 6 months. DHS cited a number of reasons 
for the reporting delays, including a lack of resources needed to 
complete timely reports. In addition, DHS officials said that they 
sometimes intentionally delayed report completion for two reasons: (1) 
because they frequently did not receive DNI intelligence assessments 
in a timely manner and needed to review these before completing VWP 
country biennial reports or (2) in order to incorporate anticipated 
developments in the status of information-sharing agreement 
negotiations with a VWP country. Further, DHS officials cited lengthy 
internal review as the primary reason for delays in submitting the 
formal summary reports to Congress. Without timely reports, it is not 
clear to Congress whether vulnerabilities exist that jeopardize 
continued participation in the VWP. 

Conclusions: 

The VWP facilitates travel for nationals from qualifying countries, 
removing the requirement that they apply in-person at a U.S. embassy 
for a nonimmigrant visa for business or pleasure travel of 90 days or 
less. In an attempt to facilitate visa-free travel without sacrificing 
travel security, Congress has mandated security measures such as ESTA, 
information-sharing requirements, and VWP country biennial reviews. 
While ESTA has added a fee and a new pretravel requirement that place 
additional burdens on the VWP traveler, it has reduced the burden on 
VWP travelers in several other ways. DHS does not fully know the 
extent to which ESTA has mitigated VWP risks, however, because its 
review of cases of passengers being permitted to travel without 
verified ESTA approval is not yet complete. Although the percentage of 
VWP travelers without verified ESTA approval is very small, DHS 
oversight of noncompliant travelers may reduce the risk that an 
individual that poses a security risk to the United States could board 
a plane or ship traveling to the United States. Even if DHS has 
authority to deny individuals entry to the United States in such 
cases, ESTA was designed to screen such individuals before they embark 
on travel to the United States. Moreover, with only half of the 
countries participating in the VWP in full compliance with the 
requirement to enter into information-sharing agreements with the 
United States, DHS may not have sufficient information to deny 
participation in the VWP to individuals who pose a security risk to 
the United States. In addition, the congressional mandate requiring 
VWP country biennial reports provides important information to 
Congress on security measures in place in VWP countries but also on 
potential vulnerabilities that could affect the countries' future 
participation in the program. Because DHS has not consistently 
submitted the reports in a timely manner since the legal requirement 
was imposed in 2002, Congress does not have the assurance that DHS 
efforts to require program countries to minimize vulnerabilities and 
its recommendations for continued status in the VWP are based on up-to-
date assessments. 

Recommendations for Executive Action: 

To ensure that DHS can identify and mitigate potential security risks 
associated with the VWP, we recommend that the Secretary of Homeland 
Security take the following two actions: 

* establish time frames for the regular review and documentation of 
cases of VWP passengers traveling to a U.S. port of entry without 
verified ESTA approval, and: 

* take steps to address delays in the biennial country review process 
so that the mandated country reports can be completed on time. 

Agency Comments and Our Evaluation: 

DHS provided written comments on a draft of this report. These 
comments are reprinted in appendix III. DHS, State, and Justice 
provided technical comments that we have incorporated into this 
report, as appropriate. In commenting on the draft, DHS stated that it 
concurred with GAO's recommendations and expects to be able to 
implement them. DHS provided additional information on its efforts to 
ensure that VWP countries remain compliant with program requirements 
and to monitor and assess issues that may pose a risk to U.S. 
interests. DHS also provided information on actions it is taking to 
resolve the issues identified in the audit. For example, DHS stated it 
will have established procedures by the end of May 2011 to perform 
quarterly reviews of a representative sample of VWP passengers who do 
not comply with the ESTA requirement. 

As agreed with your offices, unless you publicly announce the contents 
of this report earlier, we plan no further distribution until 30 days 
from the report date. At that time, we will send copies of this report 
to the appropriate congressional committees, the Secretary of Homeland 
Security, the Secretary of State, the Attorney General, and other 
interested parties. The report also will be available on the GAO Web 
site at no charge at [hyperlink, http://www.gao.gov]. 

If you or your staff members have any questions about this report, 
please contact me at (202) 512-4268 or fordj@gao.gov. Contact points 
for our Offices of Congressional Relations and Public Affairs may be 
found on the last page of this report. Key contributors are listed in 
appendix IV. 

Signed by: 

Jess T. Ford: 
Director, International Affairs and Trade: 

[End of section] 

Appendix I: Scope and Methodology: 

To assess the implementation of the Electronic System for Travel 
Authorization (ESTA), we reviewed relevant documentation, including 
2006 and 2008 GAO reports evaluating the Visa Waiver Program (VWP) and 
statistics on program applicants and travelers. Between June and 
September 2010, we interviewed consular, public diplomacy, and law 
enforcement officials at U.S. embassies in six VWP countries: France, 
Ireland, Japan, South Korea, Spain, and the United Kingdom. We also 
interviewed political and commercial officers at embassies in five of 
these countries. While the results of our site visits are not 
generalizable, they provided perspectives on VWP and ESTA 
implementation. We met with travel industry officials, including 
airline representatives, and foreign government officials in the six 
countries we visited to discuss ESTA implementation. We selected the 
countries we visited so that we could interview officials from VWP 
countries in diverse geographic regions that varied in terms of 
information-sharing signature status, number of travelers to the 
United States, and the existence in-country of potential program 
security risks. We met with officials from the Department of Homeland 
Security (DHS) in Washington, D.C. We used data provided by DHS from 
the ESTA database to assess the usage of the program and airline 
compliance with the ESTA requirements and determined that the data was 
sufficiently reliable for our purposes. 

To evaluate the status of information sharing, we analyzed data 
regarding which countries had signed the agreements and interviewed 
DHS, Department of State (State), and Department of Justice (Justice) 
officials in Washington, D.C., and International Criminal Police 
Organization (Interpol) officials in Lyon, France. We reviewed the 
Implementing Recommendations of the 9/11 Commission Act of 2007, which 
contained the information-sharing requirement. We received and 
reviewed copies of many Preventing and Combating Serious Crime and 
Lost and Stolen Passport agreements. While conducting our fieldwork, 
we confirmed the status of the agreements in each of the countries we 
visited. We determined that the data on the status of information 
sharing were sufficiently reliable for our purposes. However, we were 
unable to view the signed Homeland Security Presidential Directive 6 
agreements, because Justice's Terrorist Screening Center declined to 
provide us requested access to the agreements. We also met with 
foreign government officials from agencies involved with VWP 
information-sharing agreement negotiations in the six countries we 
visited to discuss their views regarding VWP information-sharing 
negotiations with U.S. officials. In addition, with Interpol officials 
in France, we discussed the status of the sharing of information on 
lost and stolen passports. Interpol officials were unable to provide 
country-specific statistics regarding sharing of lost and stolen 
passport information due to its data privacy policy. 

To assess DHS efforts to complete timely biennial reviews of each VWP 
country, we reviewed DHS documents, as well as the links to completed 
reviews on the DHS intranet Web site to determine whether the reviews 
were completed in a timely manner. We also reviewed a 2006 GAO report 
that recommended improvements to the timeliness of DHS's biennial 
reporting process. 

We conducted this performance audit from January 2010 to May 2011, in 
accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our 
findings and conclusions based on our audit objectives. 

[End of section] 

Appendix II: How to Apply for ESTA Approval: 

The official ESTA application can be completed online at [hyperlink, 
https://esta.cbp.dhs.gov/esta/]. (See fig 5.) DHS officials told us 
they actively publicize the official Web site, because many unofficial 
Web sites exist that charge an additional fee to fill out an 
application for an individual. They said the unofficial Web sites are 
not fraudulent if they do not use the official DHS or ESTA logos and 
provide the service they promise. 

Figure 5: The ESTA Application Welcome Page: 

[Refer to PDF for image: web page illustration] 

U.S. Customs and Border Protection: 

ESTA:
Electronic System for Travel Authorization: 
U.S. Department of Homeland Security: 

Welcome to the Electronic System for Travel Authorization Web Site. 

International travelers who are seeking to travel to the United States 
under the Visa Waiver Program (AYP) are now subject to enhanced 
security requirements and win be required to pay an administrative 
fee. At eligible travelers who wish to travel to the U.S. under the 
Visa Waiver Program must apply for authorization and then pay the fee 
using the following process: 
									
Step 1: Complete your application. 
Step 2: Submit your application. 
Step 3: Record your application number. 
Step 4: Make payment. 
Step 5: View your application status. 

Please refer to the Help link at the top of each Web page if you have 
questions.	 

Before you begin this application, make sure that you have a valid 
passport and credit card available. This application will only accept 
the following credit cards: MasterCard, VISA, American Express, and 
Discover (JCB, Diners Club). 

Please provide at responses in English. Mandatory fields are indicated 
by a red asterisk. 

Apply for an Authorization to Travel to the United States: 

Select this option if:	 

* You are a citizen or eligible national of a Visa Waiver Program 
country; 

* You are currently not in possession of a visitor's visa; 

* Your travel is for 90 days or	less; 

* You plan to travel to the United States for business or pleasure. 

Apply: 

Update or Check the Status of a Previously Submitted Authorization to 
Travel to the United States: 

Select this option if:	 

* You previously submitted an application for an electronic travel 
authorization and you want to perform one of the following: 

- Determine the status of your travel authorization application; 

- Update your travel authorization application; 

- You saved your application information and want to return to it to 
pay the fee.	 

Please provide the following information about your application: 
* Application Number: 
* Birth Date: 
* Passport Number. 

If you are missing your Application Number, please click here. 
					
Update or Check Status: 

Paperwork Reduction Act Statement: an agency may not conduct or 
sponsor an information collection and a person is not required to 
respond to this	information unless it displays a current valid OMB 
control number. The control number for this collection is 1651-0111. 
The estimated average time to complete this submission is 15 minutes 
per respondent. If you have any comments regarding the burden estimate 
you can write to U.S. Customs and Border Protection, 1300 Pennsylvania 
Avenue, Room 3.2.C., Washington DC 20229. Exp. Mar 31, 2011. 
										
The ESTA logo is a registered trademark of the U.S. Department of 
homeland Security. Its use, without permission, is unauthorized and in 
violation of trademark law. For more information, or to request the 
use of the logo, please go to hetp.cbp.gov and submit a request by 
clicking on "Ask a Question." When selecting the Product (under 
Additional Information) use "ESTA" and the sub-product "Logo 
Assistance" to expedite handling of your request.										 

For inquiries or questions regarding this application, please click 
here. 

Source: DHS. 

[End of figure] 

[End of section] 

Appendix III: Comments from the Department of Homeland Security: 

U.S. Department of Homeland Security: 
Washington, DC 20528: 

April 25, 2011: 

Jess T. Ford: 
Director, International Affairs and Trade: 
U.S. Government Accountability Office: 
441 G Street, N.W. 
Washington, D.C. 20548: 

Re: GA0-11-335, Visa Waiver Program: DHS Has Implemented Electronic 
System for Travel Authorization but Further Steps Needed to Address 
Potential Program Risks. 

Dear Mr. Ford: 

Introduction: 

The Department of Homeland Security (DHS) appreciates the opportunity 
to review and provide comments on draft report number GA0-11-335 by 
the Government Accountability Office (GAO) titled "Visa Waiver 
Program: DHS Has Implemented Electronic System for Travel 
Authorization but Further Steps Needed to Address Potential Program 
Risks." The Department is actively resolving the issues identified in 
the audit. 

Context: 

The draft report is broadly supportive of the Department's efforts to 
date to enhance the security requirements of the U.S. Visa Waiver 
Program (VWP). It recognizes that DHS has implemented the Electronic 
System for Travel Authorization (ESTA) to conduct pre-travel screening 
for VWP travelers, and that the Department has minimized the burden of 
this requirement on VWP travelers and carriers. The draft report also 
concludes that DHS and the Departments of State and Justice have made 
progress in completing information sharing agreements with VWP 
countries, as required by the Implementing Recommendations of the 9/11 
Commission Act of 2007, Pub. L. No. 110-53 (9/11 Act). Moreover, the 
two report recommendations arc consistent with the Department's 
current approach, and we expect to be able to implement them. 

Nonetheless, the Department finds that the report does not fully take 
into account important initiatives DHS undertakes outside of our 
continuing eligibility reviews of VWP countries to ensure that these 
countries remain compliant with the program's requirements and to 
monitor and assess issues that may pose a risk to U.S. interests. 

I am confident that the steps DHS and its interagency partners have 
taken to implement the security-related provisions of the 9/11 Act and 
other VWP-related legislation continue to reduce program risks. In 
addition, the Department regularly monitors VWP countries, regardless 
of where they are in the eligibility review process. This also reduces 
program risks. 

The following describes more fully the Department's response to issues 
raised by GAO's report: 

1. GAO States: 

DHS has implemented ESTA to meet the 9/11 Act requirement intended to 
enhance program security and has taken steps to minimize the burden on 
travelers to the United States added by the new requirement, but has 
not fully analyzed the risks of carrier and passenger noncompliance 
with the requirement... DHS does not have a target completion date for 
a review to identify potential security risks associated with the 
small percentage of cases of traveler and carrier noncompliance with 
the ESTA requirement... Without a completed analysis of noncompliance 
with ESTA requirements, DHS is unable to determine the level of risk 
that noncompliance poses to VWP security and to identify improvements 
needed to minimize noncompliance. 

DHS has been reviewing and evaluating ESTA non-compliance since the 
system's inception. By the end of May 2011, DHS will have established 
procedures to review quarterly a representative sample of non-
compliant passengers to evaluate, identify, and mitigate potential 
security risks associated with the ESTA program. 

2. GAO States: 

DHS conducts reviews to determine whether issues of security, law 
enforcement, or immigration affect VWP country participation in the 
program; however, the agency has not completed half of the mandated 
biennial reports resulting from these reviews in a timely manner. In 
2002, Congress mandated that, at least once every two years, DHS 
evaluate the effect of each country's participation in the program on 
the law enforcement, immigration and security interests of the United 
States...In conjunction with DIN 's reviews, the Director of National
Intelligence (DNI) produces intelligence assessments, that DHS reviews 
prior to finalizing the VWP reports... 

As noted by GAO, DHS has protocols in place that are intended to meet 
the goal of completing all VWP continuing eligibility reviews in the 
statutorily prescribed period. DHS has made significant improvements 
since the establishment of these protocols, but the Department does 
acknowledge that the reports to Congress associated with VWP 
countries' continuing eligibility reviews are still not always 
finalized within this period. The Department discussed with GAO 
several impediments to completing all continuing eligibility reviews 
and reports within the 2-year period, which are addressed in more 
detail below. 

3. GAO States: 

DHS cited a number of reasons for the reporting delays, including a 
lack of resources. In addition, DHS officials said that they sometimes 
intentionally delayed report completion for two reasons: (1) Because 
they frequently did not receive DNI intelligence assessments in a 
timely manner and needed to review these before completing VWP country 
biennial reports; or (2) In order to incorporate anticipated 
developments in the status of information sharing agreement 
negotiations with a VWP country. 

DHS informed GAO that the process of receiving DNI's independent 
intelligence assessments--which arc drafted by the DHS Office of 
Intelligence and Analysis (I&A) on behalf of DNI and by law are to be 
completed in conjunction with the continuing eligibility reviews—
caused DHS to postpone finalizing a number of VWP reviews and reports 
in fiscal years 2009, 2010, and 2011. As noted by GAO, in several 
instances, the Department chose to postpone finalizing reviews and 
reports beyond the 2-year time period so that up-to-date information 
on VWP countries' compliance with the 9/11 Act information sharing 
requirements could be documented. Given congressional interest in VWP 
countries' compliance with the 9/11 Act, DHS felt it necessary to 
provide current information on this important issue. 

Over the past year, the DHS Visa Waiver Program Office (VWPO) has 
worked with DES ISLA to address the timeliness of the intelligence 
assessments. Since 2008, DHS I&A has drafted independent intelligence 
assessments on each VWP country, as required by law. These assessments 
have established an analytical base line on a range of security 
issues. Now that an analytical baseline has been established, a new 
format for the intelligence assessment has been adopted that focuses 
on key security issues that may have shifted since the previous 
assessment. With the new format, DNI assessments are expected to be 
finalized more expeditiously. Additionally, DHS VWPO is considering 
process changes to address GAO concerns with the timeliness of 
continuing eligibility VWP reports. 

4. GAO States: 

According to VWP officials, they also regularly monitor VWP country 
efforts to stay informed about emerging issues that may affect the 
countries' VWP status. 

DHS uses both the statutorily required eligibility reviews and a 
continuous monitoring process to ensure that VWP countries remain 
compliant with the program's requirements and to monitor and assess 
issues that may pose a risk to U.S. interests. For example, on a daily 
basis DHS VWPO monitors and assesses available information to ensure 
awareness of changing conditions in VWP countries so as to verify that 
these countries' participation in the VWP do not pose a risk to U.S. 
security and law enforcement interests (including immigration 
enforcement interests). VWPO has established points of contact at U.S. 
Embassies and Consulates with law enforcement, security, and consular 
officials in the 36 participating VWP countries as well as with the 
Departments of State and Justice and the Intelligence Community. This 
network of contacts allows for continuous and substantive information 
exchange between VWPO and diplomatic posts, as well as VWPO and its 
Washington-based partners. 

During the GAO audit, DHS discussed its regular monitoring process for 
VWP countries in detail and provided specific examples where the 
Department detected issues of concern outside of countries' formal 
continuing eligibility reviews. Through engagement with its contacts, 
DHS worked with the VWP countries to remedy issues of concern before 
they threatened the countries' VWP statuses and/or U.S. interests. 

5. GAO States: 

Without timely reports, it is not clear to Congress whether 
vulnerabilities exist that jeopardize continued participation in the 
VWP... Because DHS has not consistently submitted the reports in a 
timely manner since the legal requirement was imposed in 2002, 
Congress does not have the assurance that DHS efforts to require 
program countries to minimize vulnerabilities and its recommendations 
for continued status in the VWP are based on up-to-date assessments. 

DHS uses both the statutorily required eligibility reviews and a 
continuous monitoring process to ensure that VWP countries remain 
compliant with the program's requirements and to monitor and assess 
issues that may pose a risk to U.S. interests. The Department 
recognizes that timely reports provide Congress with information on a 
country's VWP status. Therefore, DHS VWPO is considering process 
changes to address GAO concerns with the timeliness of continuing 
eligibility VWP reports. However, DHS informed GAO that if a 
significant issue and/or vulnerability were detected during or outside 
of a continuing eligibility review, DHS, in consultation with its 
interagency partners, would take the appropriate steps to notify 
Congress expeditiously. 

Recommendations: 

Recommendation #1: Establish timeframes for the regular review and 
documentation of cases of VWP passengers traveling to a U.S. port of 
entry without verified ESTA approval. 

DHS concurs with the recommendation. DHS has been reviewing and 
evaluating ESTA noncompliance since the system's inception. By the end 
of May 2011, DHS will have established procedures to review quarterly 
a representative sample of non-compliant passengers to evaluate, 
identify, and mitigate potential security risks associated with the 
ESTA program. 

Recommendation #2: Take steps to address delays in the biennial 
country review process so that the mandated country reports can be 
completed on time. 

DHS concurs with the recommendation. DHS VWPO is considering process 
changes to address GAO concerns with the timeliness of continuing 
eligibility VWP reports. Additionally, over the past year, DHS VWPO 
has worked with DHS I&A to address the timeliness of the intelligence 
assessments. Since 2008, DHS I&A has drafted independent intelligence 
assessments on each VWP country, as required by law. These assessments 
have established an analytical baseline on a range of security issues. 
Now that an analytical baseline has been established, a new format for 
the intelligence assessment has been adopted that focuses on key 
security issues that may have shifted since the previous assessment. 
With the new format, DNI assessments are expected to be finalized more 
expeditiously. 

Conclusion: 

In summary, the Department concurs with the recommendations of the 
draft report. Once again, thank you for the opportunity to comment on 
the draft report. The Department looks forward to working with you on 
future Homeland Security engagements. 

Sincerely, 

Signed by: 

Jim H. Crumpacker: 
Director: 
Departmental GAO/OIG Liaison Office: 

[End of section] 

Appendix IV: GAO Contact and Staff Acknowledgments: 

GAO Contact: 

Jess T. Ford, (202) 512-4268, or fordj@gao.gov: 

Staff Acknowledgments: 

In addition to the individual named above, Anthony Moran, Assistant 
Director; Jeffrey Baldwin-Bott; Mattias Fenton; Reid Lowe; and John F. 
Miller made key contributions to this report. Martin DeAlteriis, Joyce 
Evans, Etana Finkler, Richard Hung, Mary Moutsos, Jena Sinkfield, and 
Cynthia S. Taylor also provided technical assistance. 

[End of section] 

Footnotes: 

[1] Pub. L. No. 110-53 (Aug. 3, 2007). 

[2] See GAO, Border Security: Stronger Actions Needed to Assess and 
Mitigate Risks of the Visa Waiver Program, [hyperlink, 
http://www.gao.gov/products/GAO-06-854] (Washington, D.C.: July 28, 
2006). 

[3] See GAO, Visa Waiver Program: Actions Are Needed to Improve 
Management of the Expansion Process, and to Assess and Mitigate 
Program Risks, [hyperlink, http://www.gao.gov/products/GAO-08-967] 
(Washington, D.C.: Sept. 15, 2008). 

[4] Pub. L. No. 99-603 (Nov. 6, 1986). 

[5] Pub. L. No. 106-396 (Oct. 30, 2000). 

[6] Pub. L. No. 107-296 (Nov. 25, 2002). 

[7] Pub. L. No. 107-173 (May 14, 2002). 

[8] The Visa Waiver Permanent Program Act mandated that the U.S. 
government conduct VWP country reviews at least every 5 years. 

[9] The Immigration Act of 1990 (Pub. L. No. 101-649) removed the 
limit on the number of countries that could participate in the program. 

[10] In general, e-passports contain a chip embedded in the passport 
that stores the same information that is printed on the data page of 
the passport, such as the name, date of birth, gender, place of birth, 
dates of passport issuance and expiration, place of issuance, passport 
number, and a photo image of the bearer. In addition, e-passports hold 
a unique identification number and a digital signature to protect the 
stored data from alteration. E-passports provide two key pieces of 
information: the digital signature and the digital image of the 
passport holder. Digital signatures provide a higher level of security 
for the passport by providing a means to electronically verify the 
authenticity of the data on the chip, including the traveler's 
photograph and biographical information. 

[11] In addition to ESTA, Secure Flight and the Advanced Passenger 
Information System also provide data on passengers that DHS uses to 
determine whether any passenger poses a security risk. 

[12] Although DHS officials said that most applicants receive 
notification of ESTA approval or denial within seconds of submitting 
the online application, DHS reserves the right to do manual checks 
that may take up to 72 hours before making a final decision on an ESTA 
application. 

[13] A denied ESTA application means the applicant may not travel to 
the United States under the VWP. Travel to the United States is still 
possible if the applicant successfully applies for and obtains a visa 
for travel. State consular officers at five of the six U.S. embassies 
we visited in VWP countries said that people whose ESTA applications 
are denied frequently obtain a visa to travel to the United States 
after undergoing a full visa interview by a consular officer. State 
officials said they did not maintain statistics on how many visa 
applicants had been denied an ESTA or how many applicants who had been 
denied an ESTA were successful in obtaining a visa to visit the United 
States. Consular officers in the countries we visited said that they 
interviewed visa applicants every week who had been denied an ESTA. 

[14] ESTA approval does not guarantee an applicant the right to enter 
the United States. It means that the applicant can board a U.S. bound 
airplane or ship without a visa if the passport presented at the port 
of departure matches the information provided in the approved ESTA 
application. 

[15] Some of the travel officials said, however, that initial efforts 
to publicize ESTA were confusing and that U.S. government officials 
could not answer some of their questions. 

[16] GAO did not independently verify the results or methodology of 
this study. The study was completed by RTR Technologies, LLC, at three 
high-volume ports of entry. According to the study, RTR chose a sample 
size to ensure results at a 95 percent confidence level and compared 
the baseline data collected in 2008 with a control group in 2010 to 
ensure that the results were not attributable to factors other than 
ESTA. 

[17] Pub. L. No. 111-145, 124 Stat. 49, 56 (Mar. 4, 2010). 

[18] The law requires that the fee be the sum of $10 per travel 
authorization and an amount that will at least ensure recovery of the 
full cost of providing and administering the system. DHS may only 
collect the $10 fee until September 30, 2015. See 8 U.S.C. § 
1187(h)(3)(B). According to DHS officials, the $4 fee is paid for each 
application submitted and the $10 TPA fee is only paid if the ESTA 
application is approved. The TPA fee is not for DHS use. 

[19] DHS received an appropriation of $36 million for ESTA in fiscal 
year 2008. It carried over $11 million of that into fiscal year 2009. 
DHS officials said that because no funding was appropriated to the 
ESTA office in fiscal year 2010, DHS had to reallocate funds from 
other DHS components to cover ESTA operations. DHS completed a study 
to determine the fee amount that would cover its costs and, according 
to a DHS official, DHS policy allows for reevaluation of the fee 
amount as necessary. 

[20] DHS began enforcing carrier compliance with ESTA requirements in 
March 2010, exercising the right to fine a carrier $3,300 for each 
passenger boarded under the VWP on a U.S. bound carrier without an 
approved ESTA application or to rescind the carrier's VWP signatory 
status for failure to comply with the ESTA requirement. 

[21] Representatives of 17 airlines with whom we met told us that they 
did not track the number of passengers not permitted to board because 
of a denied VWP application or failure to apply through ESTA. However, 
the officials said that at least a few such passengers were denied 
permission to board each day. DHS officials said that they had no way 
of tracking the number of passengers that airlines refused to board 
due to lack of ESTA approval. 

[22] DHS officials reported that CBP does not typically deny VWP 
travelers admission to the United States solely for lack of an 
approved ESTA. Most of those denied entry are deemed inadmissible for 
other reasons. 

[23] For the HSPD-6 and PCSC agreements, DHS made the determination in 
consultation with State and Justice. For the LASP agreement, DHS made 
the determination in consultation with State alone. 

[24] HSPD-6 agreements are not exclusive to VWP countries and can be 
signed with any countries with the approval of the interagency working 
group. As of January 2011, in addition to the 19 VWP countries, 3 non- 
VWP countries have signed HSPD-6 agreements. 

[25] TSC defines an encounter as an authorized official contact with a 
person, such as when an individual attempts to board an aircraft or 
apply for a passport or visa, enter a country at a port of entry, etc. 

[26] See [hyperlink, http://www.gao.gov/products/GAO-06-854]. 

[27] According to DHS, LASP agreements took the form of either 
Memorandums of Understanding (MOU) or diplomatic notes, declaring the 
countries' intent to comply with the information-sharing requirement. 
Countries that joined the VWP between 2008 and 2010 each signed an MOU 
prior to their designation. These MOUs contain language on the 
exchange of LASP data, and therefore these countries were not also 
required to exchange diplomatic notes. 

[28] DHS drafted this classified document in coordination with State 
and Justice. It was submitted to the National Security Staff in 
January 2010 and subsequently approved. 

[29] See the Enhanced Border Security and Visa Entry Reform Act of 
2002. Prior to this change, DHS was required to report at least once 
every 5 years. 

[30] The 9/11 Act requires the DNI to conduct an independent 
intelligence assessment of countries prior to their admission to the 
VWP and for all VWP countries in conjunction with the VWP biennial 
reports and to submit them to, among others, the Secretary of Homeland 
Security. 

[31] In our review of DHS biennial reports, we identified 
inconsistencies in DHS recordkeeping. For example, as evidence of all 
completed biennial reports, DHS provided access to an internal DHS Web 
site that contained links to many, but not all completed reports. 
Further, DHS was unable to provide documentation of two reports that 
they said had been completed. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s Web site, 
[hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 
information. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: