Security Gaps Still Present in Visa Waiver Program

discloses a fairly lackluster implementation of security enhancements to the Visa Waiver Program (VWP) by the Department of Homeland Security. The report reinforces the reputation that DHS has for putting travel facilitation above security considerations. Proponents of VWP expansion often tout the security enhancements as a justification for extending visa waiver privileges to more countries, but these GAO findings provide no support for this perennial proposal.

The GAO was asked to evaluate the implementation of the Electronic System for Travel Authorization (ESTA), which was mandated by Congress after 9/11. As a result, VWP travelers must now submit an electronic application so that their biographical information can be screened electronically through various watchlists and databases prior to travel. Travelers who do not receive electronic approval must apply for a visa. Airlines are required to verify that travelers have been approved through ESTA before being allowed to board. Good idea. Before, VWP travelers usually were not screened until they reached the U.S. port of entry and, occasionally, someone would try to blow up a plane en route (such as Richard Reid, the 2001 shoe bomber).

But the GAO found that some passengers are being allowed to board planes even if they do not have an ESTA approval, defeating the purpose. In 2010, airlines allowed 364,000 people to travel to the United States who had not been approved in advance, about two percent of the total number of VWP visitors. Most had never even submitted the electronic application, but 648 had been denied and referred to the U.S. consulate for an interview. While the regulations provide for the airlines to be fined for allowing a non-approved VWP traveler to board, DHS did so only five times in 2010.

What generates an ESTA denial? A number of observers, including me, have long been concerned about the standards DHS would set for ESTA approval; if too many people were approved automatically, that would provide little added security, and if too few people were approved, that could unnecessarily disrupt legitimate travel. The GAO report includes some statistics. From 2008-2010, DHS denied 77,132 ESTA applications, or less than one percent. The 2010 denial rate is 0.24 percent.

According to the report, nearly 20,000 of those denied ESTA approval were denied because of a disqualifying answer to one of the ESTA application questions on prior deportations or visa refusals, communicable diseases, criminal convictions, ties to terrorism, or involvement in Nazi persecutions. Another 15,000 had problems related to a lost or stolen passport. Nearly 37,000 were denied after a manual review of their application, turning up God knows what derogatory information.

In addition to the ESTA screening, in 2007 Congress directed DHS to negotiate three kinds of information-sharing agreements with the 36 VWP countries as a condition of their participation. The GAO auditors found that few of these had been implemented. Most countries had implemented information-sharing on lost and stolen passports, but only one-third had done so on terrorists, and none had done so on serious criminals. Further, GAO reported that while it has a "contingency plan" for non-compliance, DHS has no intention of barring these countries from the VWP if they do not implement the information-sharing agreements.

Moreover, DHS has not kept up with the statutory requirements to review each country's suitability for participation in the VWP every two years. Half of the 36 countries are overdue for review. The GAO report did not name the countries that were up for review, but certainly a number of them, including Greece and Portugal, have experienced economic difficulties that could have caused visa refusals to increase above the three percent threshold for VWP participation. And, since DHS still refuses to release information on the estimated number of overstays from these countries, Congress and the public have no other measure of whether visitors from these countries should still be allowed to travel visa-free.

Speaking of overstays, when does DHS intend to implement the biometric exit tracking program that Congress has demanded since the mid-1990s? Nearly a year ago, CIS held a symposium highlighting the urgent need for this system, exploring a number of viable options, and discussing the Obama administration's lack of action. If the administration would put half the amount of energy it has dedicated to pushing amnesty into implementing this common sense program, we would have at least part of it by now, and maybe our borders would be more secure.