Border Security: US-VISIT Program Faces Strategic, Operational, and Technological Challenges at Land Ports of Entry

We found that United States Customs and Border Protection (CBP) and US-VISIT did not have adequate management controls for identifying and reporting computer processing and other operational problems at land ports of entry (POE). CBP and US-VISIT, by putting these controls in place, would be better positioned to avoid delays that could negatively impact land POE facilities' abilities to handle vehicular and pedestrian traffic and decrease the likelihood that incidents would arise that require CBP officials to turn visitors away. Further, these controls would better enable CBP supervisors and officers to report and resolve disruptions to US-VISIT computer operations helping to ensure that a critical US-VISIT function-the ability use biometric information to confirm visitors'identities-would remain functional. We recommended that the US-VISIT Program Director, in collaboration with the Commissioner of CBP, improve existing management controls for identifying and reporting computer processing and other operational problems as they arise at land POEs and that they ensure these controls are consistently administered. In November 2007, in response to our report, CBP issued a directive that applies to all POEs (air, land, and sea) and explicitly addresses US-VISIT. The directive establishes controls that assign roles and responsibilities to CBP staff for reporting computer processing problems and monitoring operations. One section of the directive lists protocols for land POEs that address how CBP officials should identify and report computer processing and other operational problems as they arise. Another section requires that field office managers monitor application of these controls to ensure that they are consistently administered. As a result, CBP and US-VISIT demonstrated that there is a policy in place establishing management controls for identifying, reporting, and resolving computer processing and operational problems at land POEs and for monitoring the application of these controls.

In fiscal year 2007, we analyzed how the U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) program implemented technologies used to screen persons against watch lists at land port of entry (POE) facilities. We found that US-VISIT and U.S. Customs and Border Protection (CBP) had not established performance measures to help them identify problems, trends, and areas needing improvement with regard to operating the US-VISIT screening technology at land POEs. US-VISIT officials reported taking actions to develop new performance measures since our report was issued. For example, in May 2008, US-VISIT published a 10-Print Initial Deployment Performance Evaluation Report which, among other things, focused on fingerprinting capability and discussed 45 performance measures intended to quantify system performance in four different areas. This evaluation assessed system functionality but did not (1) provide discrete information about the impact these systems are having on operations at land POEs and (2) address land POES, but rather focused on data obtained from 10 commercial airports, which differ operationally from land POEs. Since then, US-VISIT has begun to use measures of the timeliness of searches at all ports, including land ports. On June 6, 2011, the US-VISIT audit liaison provided a spreadsheet with processing times for 148 land ports of entry for the month of April 2011. US-VISIT officials said that these statistics are collected on a daily basis; the standard that POEs must meet, 10 seconds per entry, is detailed in the Service Level Agreement between US-VISIT and CBP. The ten second requirement was devised by CBP and US-VISIT as the maximum allowable time to complete a search of an individual's biometric data via US-VISIT's automated systems. According to US-VISIT, if the response times become slow at any POEs and exceeds 10 seconds, the CBP port experiencing the slowdown is to contact a help desk so that the problem can be identified and a resolution can be formulated and executed. CBP officials confirmed this and said if a POE encountered an instance where the 10 second standard was exceeded, the POE is to contact the help desk to check if there are any identifiable reasons why cycle time is over 10 seconds. In response, the help desk is to provide a best estimate for the duration of the problem (minutes or hours) and that information is used to determine whether the POE has to institute mitigation procedures. Whereas short interruptions may only result in a slowdown entering data requests, a long-term outage would prompt a POE to revert to the manual process wherein persons of interest (high risk) are delayed until the biometrically-based US-VISIT system was back on line. CBP officials also said that it has issued instructions for POEs regarding mitigation procedures when the US-VISIT 10-second standard is not being met. Based on the measures created by US-VISIT and CBP and the actions taken by CBP, this recommendation has been implemented and is considered closed.