oversight

Homeland Security: Risks Facing Key Border and Transportation Security Program Need to Be Addressed

Published by the Government Accountability Office on 2003-09-19.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                 United States General Accounting Office

GAO              Report to Congressional Committees




September 2003
                 HOMELAND
                 SECURITY
                 Risks Facing Key
                 Border and
                 Transportation
                 Security Program
                 Need to Be Addressed




GAO-03-1083
                 a
                                                September 2003


                                                HOMELAND SECURITY

                                                Risks Facing Key Border and
Highlights of GAO-03-1083, a report to          Transportation Security Program Need to
Subcommittees on Homeland Security,
Senate and House Committees on                  Be Addressed
Appropriations




The Department of Homeland                      DHS’s fiscal year 2003 US-VISIT expenditure plan and related documentation
Security (DHS) plans to establish a             partially satisfied the conditions imposed by the Congress, which include
program to strengthen                           meeting the capital planning and investment control review requirements of
management of the pre-entry,                    the Office of Management and Budget (OMB). For example, DHS fulfilled the
entry, status, and exit of foreign              OMB requirement that agencies state whether projects are approved by
nationals who travel to the United
States. The goals of the program,
                                                investment review boards and reviewed by Chief Financial and Procurement
known as the United States Visitor              Officers; the plan was conditionally approved by DHS’s review board, which
and Immigrant Status Indicator                  includes DHS’s Chief Financial and Procurement Officers. On the other
Technology (US-VISIT), are to                   hand, OMB guidance requires that agency plans summarize life cycle costs
facilitate legitimate trade and                 and include a cost/benefit analysis that covers return on investment. DHS
travel, enhance national security,              has not yet established a date and plan for developing these for US-VISIT,
and adhere to U.S. privacy laws and             although program officials stated that they intend to do so.
policies. By congressional
mandate, DHS is to develop and                  GAO also identified 10 factors (see figure) affecting US-VISIT and concluded
submit for approval an expenditure              that the program is a very risky endeavor. Some risk factors are inherent to
plan for US-VISIT that satisfies                the program, such as its mission criticality, its size and complexity, and its
certain conditions, including being
reviewed by GAO. GAO was asked
                                                enormous potential costs. Others, however, arise from the program’s
to determine, among other things,               relatively immature state of governance and management. For example,
whether the plan satisfies these                although the program has governmentwide scope, an accountable
conditions and to provide                       governance structure to direct and oversee the program that reflects this
observations about the plan and                 scope is not yet established. In addition, a US-VISIT program management
DHS’s management of the program.                capability has yet to be established, important aspects defining the
                                                program’s operating environment are not decided, facility needs are unclear
                                                and challenging, and the mission value to be derived from the program’s
                                                initial operating capability is unknown. Because of the risk factors, GAO
GAO is making a number of
recommendations to the Secretary                concluded that it is uncertain that US-VISIT will be able to measurably and
of DHS aimed at minimizing the                  appreciably achieve DHS’s stated goals for the program. Further, DHS’s
risks facing US-VISIT, including                near-term investment in the program is at risk of not delivering promised
(1) establishing an executive body,             capabilities on time and within budget and not producing mission value
composed of appropriate                         commensurate with investment costs.
stakeholder representatives, to
guide and direct the program, be                Factors That Collectively Make US-VISIT a Risky Endeavor
held accountable for the program’s
progress and outcomes, and
address key program issues and
make associated decisions and
(2) taking steps to establish an
effective program management
capability. DHS concurred with our
recommendations and stated that it
has made progress toward
addressing them.
www.gao.gov/cgi-bin/getrpt?GAO-03-1083

To view the full product, including the scope
and methodology, click on the link above.
For more information, contact Randolph C.
Hite at (202) 512-3439 or hiter@gao.gov.
Contents



Letter                                                                                              1
                            Recommendations for Executive Action                                    6
                            Agency Comments                                                         7


Appendixes
             Appendix I:    Briefing to the Staffs of the Subcommittees on Homeland
                            Security, Senate and House Committees on Appropriations                 9
             Appendix II:   Comments from the Department of Homeland Security                      97




                            Abbreviations

                            ADIS       Arrival Departure Information System
                            APIS       Advance Passenger Information System
                            CCD        Consular Consolidated Database
                            CLAIMS 3   Computer Linked Application Information Management
                                       System 3
                            CLASS      Consular Lookout and Support System
                            DHS        Department of Homeland Security
                            EA         enterprise architecture
                            IBIS       Interagency Border Inspection System
                            IDENT      Automated Biometric Identification System
                            INS        Immigration and Naturalization Service
                            IRB        Investment Review Board
                            IT         information technology
                            NIIS       Non-Immigrant Information System
                            NSEERS     National Security Entry-Exit Registration System
                            OMB        Office of Management and Budget
                            POE        port of entry
                            SA-CMM®    Software Acquisition Capability Maturity Model®
                            SEI        Software Engineering Institute
                            SEVIS      Student Exchange Visitor Information System
                            US-VISIT   U.S. Visitor and Immigrant Status Indicator Technology


                            Page i                                       GAO-03-1083 Homeland Security
Contents




 This is a work of the U.S. government and is not subject to copyright protection in the
 United States. It may be reproduced and distributed in its entirety without further
 permission from GAO. However, because this work may contain copyrighted images or
 other material, permission from the copyright holder may be necessary if you wish to
 reproduce this material separately.




Page ii                                                   GAO-03-1083 Homeland Security
A
United States General Accounting Office
Washington, D.C. 20548



                                    September 19, 2003                                                              Leter




                                    The Honorable Thad Cochran
                                    Chairman
                                    The Honorable Robert C. Byrd
                                    Ranking Minority Member
                                    Subcommittee on Homeland Security
                                    Committee on Appropriations
                                    United States Senate

                                    The Honorable Harold Rogers
                                    Chairman
                                    The Honorable Martin Olav Sabo
                                    Ranking Minority Member
                                    Subcommittee on Homeland Security
                                    Committee on Appropriations
                                    House of Representatives

                                    Pursuant to the Consolidated Appropriations Resolution, 2003,1 the
                                    Department of Homeland Security (DHS) submitted to Congress in June
                                    2003 its fiscal year 2003 expenditure plan for the United States Visitor and
                                    Immigrant Status Indicator Technology (US-VISIT) program. US-VISIT is a
                                    governmentwide program intended to improve the nation’s capacity for
                                    collecting information on foreign nationals who travel to the United States,
                                    as well as control the pre-entry, entry, status, and exit of these travelers.
                                    The goals for US-VISIT are to facilitate legitimate travel and trade, enhance
                                    national security, and adhere to U.S. privacy laws and policies. As also
                                    required by the Consolidated Appropriations Resolution, 2003, we
                                    reviewed the expenditure plan. Our objectives were to (1) determine
                                    whether the US-VISIT fiscal year 2003 expenditure plan satisfies certain
                                    legislative conditions specified in the Consolidated Appropriations
                                    Resolution, 2003; (2) determine the status of our US-VISIT open
                                    recommendations; and (3) provide any other observations about the
                                    expenditure plan and DHS’s management of US-VISIT. The specified
                                    legislative conditions are that the plan meet the capital planning and
                                    investment control review requirements established by the Office of
                                    Management and Budget (OMB), including OMB Circular A-11, part 3; that
                                    it comply with the acquisition rules, requirements, guidelines, and systems



                                    1
                                     P.L. 108-7 (Feb. 20, 2003).




                                    Page 1                                            GAO-03-1083 Homeland Security
acquisition management practices of the federal government; and that it be
reviewed by GAO.

On July 18, 2003, we provided your offices a written briefing detailing the
results of our review. This report summarizes and transmits this briefing.
The full briefing, including our scope and methodology, is reprinted as
appendix I.

Concerning our first objective, DHS partially satisfied those legislative
conditions specified in the Consolidated Appropriations Resolution, 2003,
that are applicable to it. That is, the plan, including related program
documentation and program officials’ statements, satisfied or provided for
satisfying many, but not all of the key aspects of (1) OMB’s capital planning
and investment control review requirements; and (2) federal acquisition
rules, requirements, guidelines, and systems acquisition management
practices. For example, DHS fulfilled the OMB requirement that agencies
state whether projects are approved by investment review boards and
reviewed by Chief Financial and Procurement Officers; the plan was
conditionally approved by DHS’s review board, which includes DHS’s Chief
Financial and Procurement Officers. On the other hand, OMB guidance
requires that agency plans summarize life cycle costs and include a
cost/benefit analysis that covers return on investment. DHS has not yet
established a date and plan for developing a current life cycle cost and a
cost/benefit analysis for US-VISIT, although program officials stated that
they intend to do so.

Concerning our second objective, DHS has initiated action to implement or
has partially implemented most, but not all of the recommendations
contained in our report on the fiscal year 2002 expenditure plan.2 Each
recommendation, along with the status of each, is summarized below.

• We recommended that DHS develop a system security plan and privacy
  impact assessment. The department has action under way to address
  this recommendation. Specifically, DHS reported that it has defined
  security and privacy requirements and has drafted a security plan and a
  privacy impact assessment.



2
 U.S. General Accounting Office, Information Technology: Homeland Security Needs to
Improve Entry Exit System Expenditure Planning, GAO-03-563 (Washington, D.C.: June 9,
2003).




Page 2                                                 GAO-03-1083 Homeland Security
• We recommended that DHS ensure that controls in the area of
  acquisition planning, solicitation, requirements management, program
  management, contract tracking and oversight, and evaluation are
  implemented in accordance with the Software Engineering Institute’s
  (SEI) guidance.3 The department plans to implement this
  recommendation. Specifically, DHS has recently approved a program
  management structure that includes functions consistent with these
  controls; however, it has not yet developed explicit plans or time frames
  for defining and implementing them.

• We recommended that DHS ensure that future expenditure plans are
  provided to the department’s House and Senate Appropriations
  Subcommittees in advance of US-VISIT funds being obligated. With
  respect to the fiscal year 2003 expenditure plan, DHS partially satisfied
  this recommendation. Specifically, it provided this plan to the Senate
  and House Appropriations Subcommittees on Homeland Security in
  June 2003. However, following DHS’s request for use of $5 to $7 million
  in March 2003, the April 2003 House Conference Report4 recommended
  that DHS use $5 million for US-VISIT. DHS subsequently allocated the $5
  million to the US-VISIT program.

• We recommended that DHS ensure that future expenditure plans fully
  disclose US-VISIT system capabilities, schedule, cost, and benefits. With
  respect to the fiscal year 2003 expenditure plan, DHS has partially
  satisfied this recommendation. Specifically, this plan describes high-
  level capabilities by increment, high-level schedule estimates, and
  categories of expenditures. However, the plan does not associate these
  categories of expenditure to incremental capabilities, time frames, and
  benefits. Moreover, the plan does not identify expected benefits in
  tangible, measurable, and meaningful terms, nor does it associate
  benefits with increments.

Finally, we identified 10 factors that make US-VISIT a risky endeavor. Some
of these risk factors are inherent to the program, and others are a product
of the program’s relatively immature state of governance and management.
The specific risk factors that we identified are as follows:

3
 Carnegie Mellon Software Engineering Institute, Software Acquisition Capability
Maturity Model, Version 1.03 (March 2002) defines acquisition process management
controls for planning, managing, and controlling software-intensive system acquisitions.
4
H.R. Conf. Rep. No. 108-76, at 80 (2003).




Page 3                                                     GAO-03-1083 Homeland Security
• US-VISIT is critical to the department’s mission in preventing the entry
  of persons who pose a threat to our nation into the United States. The
  missed entry of just one of these persons could have severe
  consequences.

• US-VISIT is large in scope and complex. For example, the program is to
  (1) support a large governmentwide process involving multiple
  departments and agencies, (2) modify and expand facilities at over 150
  land ports of entry, and (3) interconnect about 20 existing systems.

• To meet US-VISIT’s daunting milestones,5 DHS has chosen to implement
  temporary solutions, largely because over the last 7 years, limited
  progress has been made in addressing key legislative requirements. For
  example, to meet deadlines at land ports of entry, DHS plans to develop
  and implement interim, or temporary, system and facility solutions.

• The program will be a costly undertaking. In February 2003, DHS
  estimated that the program would cost about $7.2 billion through fiscal
  year 2014. However, this estimate is outdated and does not include, for
  example, the State Department’s cost to implement visas with
  biometrics, which we previously estimated could add as much as $15
  billion to the program’s cost through 2014.6

• The performance of initial increments of the US-VISIT system depends
  on the performance of existing systems that are to be interfaced. Some
  of these systems, such as the Student and Exchange Visitor Information
  System7 and the Computer Linked Application Information Management
  System 3,8 have known system availability problems that could limit US-
  VISIT system performance.


5
 For example, the Immigration and Naturalization Service Data Management Improvement
Act of 2000 (P.L. 106-215, June 15, 2000) requires that US-VISIT be implemented at all air and
sea ports of entry by December 31, 2003; at the 50 highest volume land ports of entry by
December 31, 2004; and at all remaining ports of entry by December 31, 2005.
6
 U.S. General Accounting Office, Technology Assessment: Using Biometrics for Border
Security, GAO-03-174 (Washington, D.C.: Nov. 15, 2002).
7
 The Student and Exchange Visitor Information System contains information on foreign
students.
8
 The Computer Linked Application Information Management System 3 contains information
on foreign nationals who request benefits, such as change of status or extension of stay.




Page 4                                                       GAO-03-1083 Homeland Security
• US-VISIT is not currently directed and overseen by an accountable
  governance structure that reflects the program’s governmentwide scope
  and that includes the appropriate leaders from each stakeholder
  organization, that is, those who can make and enforce decisions and
  commit resources.

• The US-VISIT program office does not have the capabilities (people,
  processes, and tools) to effectively manage the program. For example,
  this office has not yet been adequately staffed, specific roles and
  responsibilities have not been defined, and acquisition management
  process controls have not been developed and implemented. Moreover,
  DHS has not defined specific plans and time frames for doing so.

• Key information about the operational context surrounding US-VISIT
  that is necessary to effectively define, establish, and implement the
  program is not yet available. As a result, DHS is making certain
  assumptions and decisions in order to meet near-term deadlines, such as
  the use of a two-fingerprint biometric; these assumptions and decisions
  would require system rework if they prove inconsistent with subsequent
  operational context policy or standards decisions.

• Construction of US-VISIT facility solutions, both interim and permanent,
  pose serious challenges for a number of reasons. For example, existing
  facilities do not support existing entry and exit processes at a number of
  land ports of entry, border crossing wait times are very sensitive to very
  small increases in processing times at certain high-volume land ports of
  entry, and interim facility solutions must satisfy yet-to-be defined
  program requirements.

• The mission value to be gained from the initial US-VISIT operational
  capability planned for December 31, 2003, is not currently known. In
  particular, DHS has not defined specific, measurable benefits expected
  from this initial operating capability, in large part because it has yet to
  define the processes that will govern how entry and exit activities will
  be performed. This uncertainty is compounded by the fact that this
  initial operating capability is to be constrained by existing facilities and
  personnel and it is not to result in increases in border crossing wait
  times.

In conclusion, US-VISIT is a risky undertaking because it is to support a
critical mission, its scope is large and complex, it must meet a demanding
implementation schedule, and its potential cost is enormous. Generally,



Page 5                                            GAO-03-1083 Homeland Security
                      these risk factors are inherent to the program and cannot be easily
                      changed. However, compounding these inherent risk factors are a number
                      of others that are attributable to the program’s current state of governance
                      and management and its acquisition approach, as described above. Further,
                      DHS did not fully satisfy the legislative conditions imposed by the Congress
                      and has yet to fully implement our previous recommendations, both of
                      which were aimed at reducing risk. Because of all these risk factors, it is
                      uncertain that US-VISIT will be able to measurably and appreciably achieve
                      DHS’s stated goals of facilitating legitimate travel and trade, enhancing
                      national security, and adhering to U.S. privacy laws and policies. Moreover,
                      DHS’s near-term investment in the program is at risk of not delivering
                      promised capabilities on time and within budget, and not producing
                      mission value commensurate with investment costs. Thus, it is imperative
                      that the factors that contribute to this level of risk be addressed thoroughly
                      and expeditiously.



Recommendations for   To address US-VISIT as a governmentwide program and to minimize the
                      risks facing the program, we recommend that the Secretary of Homeland
Executive Action      Security, in collaboration with cabinet officials from US-VISIT stakeholder
                      departments and agencies,

                      • establish and charter an executive body, chaired by the Secretary’s
                        designee, potentially co-chaired by the leadership from key stakeholder
                        departments and agencies, and composed of appropriate senior-level
                        representatives from DHS and each stakeholder organization, to guide
                        and direct the US-VISIT program; and

                      • direct this executive body to immediately take steps to (1) ensure that
                        the human capital and financial resources are expeditiously provided to
                        establish a fully functional and effective US-VISIT program office and
                        associated management capability, (2) clarify the operational context
                        within which US-VISIT must operate, and (3) decide whether proposed
                        US-VISIT increments will produce mission value commensurate with
                        costs and risks and disclose to the Congress planned actions based on
                        this body’s decisions.

                      Further, we recommend that the Secretary, through the Under Secretary for
                      Border and Transportation Security, direct the US-VISIT Program Director
                      to expeditiously establish an effective program management capability,
                      including immediately




                      Page 6                                            GAO-03-1083 Homeland Security
                  • defining program office positional roles, responsibilities, and
                    relationships;

                  • developing and implementing a human capital strategy that provides for
                    staffing these positions with individuals who have the requisite core
                    competencies (knowledge, skills, and abilities);

                  • developing and implementing a plan for satisfying key SEI acquisition
                    management controls, to include acquisition planning, solicitation,
                    requirements development and management, project management,
                    contractor tracking and oversight, evaluation, and transition to support;

                  • developing and implementing a risk management plan and ensuring that
                    all high risks and their status are reported regularly to the executive
                    body;

                  • defining performance standards for each US-VISIT system increment
                    that are measurable and reflect the limitations imposed by relying on
                    existing systems for these system increments; and

                  • developing an analysis of incremental program costs, benefits, and risks,
                    and providing this analysis to the executive body, to assist it in the
                    body’s deliberations and decision making.



Agency Comments   In written comments on a draft of this report signed by the Director, US-
                  VISIT, DHS concurred with our recommendations and stated that it has
                  recently made progress toward addressing them. In particular, DHS stated
                  that it has approved the proposed US-VISIT organizational structure and
                  identified necessary staff positions, and that it is working with the Office of
                  Personnel Management to draft position descriptions and prepare for
                  recruitment. Also, it stated that the US-VISIT program office is staffed with
                  51 detailees from various DHS components and agencies. Last, it stated
                  that it has in place an Investment Review Board that has twice reviewed
                  US-VISIT, has established a DHS framework for addressing policy
                  questions, and has plans to establish a US-VISIT Advisory Council. DHS’s
                  comments are reprinted in appendix II.


                  We are sending copies of this report to the Chairmen and Ranking Minority
                  Members of other Senate and House committees and subcommittees that



                  Page 7                                             GAO-03-1083 Homeland Security
have authorization and oversight responsibilities for homeland security. We
are also sending copies to the Secretary of State and the Director of OMB.
We also will make copies available to others upon request. In addition, the
report will be available at no charge on the GAO Web site at
http://www.gao.gov.

Should you or your staff have any questions on matters discussed in this
report, please contact me at (202) 512-3439. I can also be reached by E-mail
at Hiter@gao.gov. Key contributors to this report were Seto Bagdoyan,
Barbara Collier, Deborah Davis, Neil Doherty, Rebecca Gambler, Tamra
Goldstein, James Houtz, Richard Hung, Tammi Nguyen, and Mark Tremba.




Randolph C. Hite
Director, Information Technology Architecture
  and Systems Issues




Page 8                                           GAO-03-1083 Homeland Security
Appendix I

Briefing to the Staffs of the Subcommittees on                                 Appendx
                                                                                     ies




Homeland Security, Senate and House
Committees on Appropriations                                                    Append
                                                                                     x
                                                                                     Ii




    Information Technology: Risks Facing Key
    Homeland Security Program Need to Be
    Addressed
    Briefing to the Staffs of the
    Subcommittees on Homeland Security
    Senate and House Committee on Appropriations


    July 18, 2003




                                                                          1




                            Page 9                 GAO-03-1083 Homeland Security
                         Appendix I
                         Briefing to the Staffs of the Subcommittees
                         on Homeland Security, Senate and House
                         Committees on Appropriations




                                                                       Briefing Overview


• Introduction
• Objectives
• Results in Brief
• Background
• Results
    • Legislative Conditions
    • Status of Recommendations
    • Observations
• Conclusions
• Recommendations
• Agency Comments
• Attachment I. Legislative History
• Attachment II. Scope and Methodology

                                                                                               2




                         Page 10                                        GAO-03-1083 Homeland Security
                                        Appendix I
                                        Briefing to the Staffs of the Subcommittees
                                        on Homeland Security, Senate and House
                                        Committees on Appropriations




                                                                                            Introduction


Seven years ago, the Congress passed legislation that directed the former
Immigration and Naturalization Service (INS) to develop an entry exit system.
Pursuant to this and related legislative direction,1 INS established the entry exit
program about 16 months ago. Subsequently, INS was merged into the
Department of Homeland Security (DHS), and the entry exit program was renamed
the United States Visitor and Immigrant Status Indicator Technology (US-VISIT).
US-VISIT is a governmentwide program that is to improve the processes, policies,
and systems used to collect information on foreign nationals who travel to the
United States, and to track entries, exits, and stays of travelers.
DHS’s stated goals for US-VISIT are to
 • facilitate legitimate travel and trade,
 • enhance national security, and
 • adhere to U.S. privacy laws and policies.


1 See   attachment I for a listing of relevant legislation.

                                                                                                             3




                                        Page 11                                       GAO-03-1083 Homeland Security
                                        Appendix I
                                        Briefing to the Staffs of the Subcommittees
                                        on Homeland Security, Senate and House
                                        Committees on Appropriations




                                                                                            Introduction


The US-VISIT program involves the interdependent application of people, processes,
technology, and facilities.




Note: GAO analysis based on DHS data.

                                                                                                             4




                                        Page 12                                       GAO-03-1083 Homeland Security
                                  Appendix I
                                  Briefing to the Staffs of the Subcommittees
                                  on Homeland Security, Senate and House
                                  Committees on Appropriations




                                                                                         Introduction


The Consolidated Appropriations Resolution, 2003,1 prohibits DHS from obligating
any funds appropriated in the act for the entry exit system (now US-VISIT), until it
submits a plan for expenditure that satisfies the following legislative conditions.
    • It meets the capital planning and investment control review requirements
      established by the Office of Management and Budget (OMB), including OMB
      Circular A-11, part 3.2
    • It complies with the acquisition rules, requirements, guidelines, and systems
      acquisition management practices of the federal government.
    • It is reviewed by GAO.




1 P.L.   108-7 (Feb. 20, 2003).
2OMB Circular A-11 establishes policy for planning, budgeting, acquisition, and management of federal
capital assets.

                                                                                                          5




                                  Page 13                                          GAO-03-1083 Homeland Security
                                     Appendix I
                                     Briefing to the Staffs of the Subcommittees
                                     on Homeland Security, Senate and House
                                     Committees on Appropriations




                                                                                         Introduction


In fiscal year 2003, Justice requested $380 million for the entry exit program (now
US-VISIT)—$362 million in new funding and $18 million in fiscal year 2003 base
resources.
  • In conjunction with the Consolidated Appropriations Resolution, 2003, the
    conference report1 recommended $362 million for the entry exit system (now
    US-VISIT) and related information technology (IT) infrastructure upgrades.
  • According to DHS officials, the $18 million in base resources was to come from
    a user fee account. However, according to these officials, given the decrease
    in user fee receipts since September 11, 2001, it is unclear whether the $18
    million will be available for the US VISIT program.
DHS submitted its fiscal year 2003 expenditure plan for $375 million2 on June 5,
2003, to its House and Senate Appropriations Subcommittees on Homeland
Security.
1 H.R.   Conf. Rep. No. 108-10, at 623 (2003).
2 In April 2003, H.R. Conf. Rep. No. 108-76 at 80 (2003), recommended that DHS use $5 million for US-

VISIT. The $5 million was not included in the expenditure plan submitted to the Appropriations
Subcommittees in June 2003.

                                                                                                          6




                                     Page 14                                       GAO-03-1083 Homeland Security
                           Appendix I
                           Briefing to the Staffs of the Subcommittees
                           on Homeland Security, Senate and House
                           Committees on Appropriations




                                                                                 Objectives


As agreed, our objectives were to
 1. determine whether the US-VISIT fiscal year 2003 expenditure plan satisfies the
    legislative conditions,
 2. determine the status of our US-VISIT open recommendations, and
 3. provide any other observations about the expenditure plan and DHS’s
    management of US-VISIT.


We conducted our work at DHS headquarters in Washington, D.C., from April
through July 2003 in accordance with generally accepted government auditing
standards. Details of our scope and methodology are given in attachment II.




                                                                                                7




                           Page 15                                       GAO-03-1083 Homeland Security
                                       Appendix I
                                       Briefing to the Staffs of the Subcommittees
                                       on Homeland Security, Senate and House
                                       Committees on Appropriations




                                                                              Results in Brief: Objective 1
                                                                                 Legislative Conditions

DHS’s expenditure plan partially satisfies the legislative conditions.


    Legislative conditions                             Fully satisfies1     Partially satisfies2       Does not satisfy3


    1. Meets the capital planning and
       investment control review                                                     √
       requirements established by OMB,
       including OMB Circular A-11, part 3.

    2. Complies with the acquisition rules,
       requirements, guidelines, and                                                 √
       systems acquisition management
       practices of the federal government.

    3. Is reviewed by GAO.                                    √

1   Satisfies or provides for satisfying every aspect of the condition that we reviewed.
2   Satisfies or provides for satisfying many, but not all, key aspects of the condition that we reviewed.
3   Satisfies or provides for satisfying few, if any, of the key aspects of the condition that we reviewed.


                                                                                                                           8




                                       Page 16                                                     GAO-03-1083 Homeland Security
                                  Appendix I
                                  Briefing to the Staffs of the Subcommittees
                                  on Homeland Security, Senate and House
                                  Committees on Appropriations




                                                                         Results in Brief: Objective 2
                                                                          Open Recommendations

Status of DHS actions to implement our open recommendations.


                                                                                   Status
GAO open recommendations                            Complete        Partially complete    In progress   Planned

    1. Develop a system security plan and
                                                                                              √
       privacy impact assessment.

    2. Ensure that controls in the area of
       acquisition planning, solicitation,
       requirements management, project
       management, contract tracking and                                                                   √
       oversight, and evaluation are
       implemented in accordance with SEI1
       guidance.
                                                                                         (continued next slide)
1 The Software Acquisition Capability Maturity Model® developed by Carnegie Mellon University’s Software
Engineering Institute (SEI) defines acquisition process management controls for planning, managing, and
controlling software-intensive system acquisitions.

                                                                                                                  9




                                  Page 17                                                 GAO-03-1083 Homeland Security
                                      Appendix I
                                      Briefing to the Staffs of the Subcommittees
                                      on Homeland Security, Senate and House
                                      Committees on Appropriations




                                                                             Results in Brief: Objective 2
                                                                              Open Recommendations
                                                                                       Status
GAO open recommendations                                Complete        Partially complete   In progress   Planned

    3. Ensure that future expenditure plans
       are provided to DHS’s House and                                        √1
       Senate Appropriations
       Subcommittees in advance of US-
       VISIT funds being obligated.

    4. Ensure that future expenditure plans
       fully disclose what US-VISIT system                                     √1
       capabilities and benefits are to be
       delivered, by when, and at what cost.


1   With respect to the fiscal year 2003 expenditure plan.




                                                                                                                  10




                                      Page 18                                                GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                 Results in Brief: Objective 3
                                                                Observations: Risk Factors

US-VISIT is a high risk endeavor. We have identified 10 risk factors affecting US-
VISIT:
 • Mission is critical. The missed entry of one person who poses a threat to the
   United States could have severe consequences.
 • Scope is large and complex. Controlling the pre-entry, entry, status, and exit
   of millions of travelers is a large and complex process.
 • Milestones are challenging. Progress and current status of the program
   makes satisfying legislatively mandated milestones difficult.
 • Potential cost is significant. DHS has estimated that the program will cost
   $7.2 billion through fiscal year 2014, and this estimate does not include all
   costs and may underestimate some others.
 • Existing systems have known problems. The program is to initially rely on
   existing systems with known problems that could limit US-VISIT performance.




                                                                                                  11




                            Page 19                                          GAO-03-1083 Homeland Security
                           Appendix I
                           Briefing to the Staffs of the Subcommittees
                           on Homeland Security, Senate and House
                           Committees on Appropriations




                                                                Results in Brief: Objective 3
                                                               Observations: Risk Factors

• Governance structure is not established. The program is not currently
  governed by an accountable body that reflects its governmentwide scope and
  that can make and enforce decisions and commit resources for all program
  stakeholders.
• Program management capability is not implemented. The program office is
  not yet adequately staffed, roles and responsibilities are not yet clearly defined,
  and acquisition management processes are not yet established.
• Operational context is unsettled. Operational issues have not been decided,
  such as which rules and standards will govern implementation of biometrics
  technology.
• Near-term facilities solutions pose challenges. Interim facility planning for
  high-volume land ports of entry (POEs) must satisfy demanding as well as yet-
  to-be defined requirements.
• Mission value of first increment is currently unknown. The benefits versus
  costs of the first increment are not yet known.


                                                                                                 12




                           Page 20                                          GAO-03-1083 Homeland Security
                             Appendix I
                             Briefing to the Staffs of the Subcommittees
                             on Homeland Security, Senate and House
                             Committees on Appropriations




                                                                    Results in Brief: Objective 3
                                                                                   Observation

Risk Factors Affecting US-VISIT




Unless these risk factors are effectively addressed, US-VISIT is likely to fall short of
envisioned expectations.
                                                                                                     13




                             Page 21                                            GAO-03-1083 Homeland Security
                           Appendix I
                           Briefing to the Staffs of the Subcommittees
                           on Homeland Security, Senate and House
                           Committees on Appropriations




                                                                          Results in Brief


To address these risk factors, we are making recommendations to the Secretary of
Homeland Security.
We provided DHS a draft of this briefing. In its oral comments, DHS agreed with
our findings, conclusions, and recommendations.




                                                                                              14




                           Page 22                                       GAO-03-1083 Homeland Security
                                Appendix I
                                Briefing to the Staffs of the Subcommittees
                                on Homeland Security, Senate and House
                                Committees on Appropriations




                                                                                     Background
                                                                       Border Inspection by POE

All persons that legally enter the United States must pass through one of more than
300 land, sea, or air ports of entry (POEs), and must undergo a primary inspection.
In fiscal year 2002, about 440 million primary inspections were conducted on
foreign nationals and U.S. citizens.



                         Number of                              Number of             Percentage of
Type of POEs                POEs                               inspections              inspections

Land                             165                           358,373,569                           81

Air                              123                            69,679,190                           16

Sea                                42                           12,369,035                            3

Total                            330                           440,421,794                         100
Source: DHS.
Note: GAO analysis based on DHS data.

                                                                                                      15




                                Page 23                                          GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                                 Background
                                                                          US-VISIT Overview

US-VISIT is a governmentwide endeavor intended to facilitate legitimate travel and
trade, enhance national security, and adhere to U.S. privacy laws and policies by
 • collecting, maintaining, and sharing information on individuals who enter and
   exit the United States;
 • identifying individuals who (1) have overstayed or violated the terms of their
   visit; (2) can receive, extend, or adjust their immigration status; and (3) should
   be apprehended or detained by law enforcement officials;
 • detecting fraudulent travel documents, verifying traveler identity, and
   determining traveler admissibility through the use of biometrics; and
 • facilitating information sharing and coordination within the border management
   community.




                                                                                                  16




                            Page 24                                          GAO-03-1083 Homeland Security
                                    Appendix I
                                    Briefing to the Staffs of the Subcommittees
                                    on Homeland Security, Senate and House
                                    Committees on Appropriations




                                                                                            Background
                                                                                  US-VISIT Organization

 Within DHS,1 organizational responsibility for the US-VISIT program is within the
 Border and Transportation Security Directorate.
 In June 2003, DHS established a US-VISIT program office with responsibility for
 managing the acquisition, deployment, operation, and sustainment of the US-VISIT
 system and supporting people (e.g., inspectors), processes (e.g., entry exit policies
 and procedures), and facilities (e.g., inspection booths) associated with the
 program.
 The following graphic shows the organizational ownership for the US-VISIT
 program.




1 InJanuary 2003, we designated the implementation and transformation of DHS as a high risk program for
the following three reasons: (1) the size and complexity of the undertaking, (2) the wide array of existing
challenges of the component agencies being merged within DHS, and (3) the potentially serious
consequences of DHS’s failure to effectively carry out its mission. (U.S. General Accounting Office, Major
Management Challenges and Program Risks: Department of Homeland Security, GAO-03-102 (Washington,
D.C.: January 2003)).

                                                                                                             17




                                    Page 25                                             GAO-03-1083 Homeland Security
                                  Appendix I
                                  Briefing to the Staffs of the Subcommittees
                                  on Homeland Security, Senate and House
                                  Committees on Appropriations




                                                                                          Background
                                                                                US-VISIT Organization

Organizational Placement of US-VISIT Program (partial DHS organization chart)




Note: GAO analysis based on DHS data. As of May 2003, the US-VISIT program office reports directly to
the Under Secretary for Border and Transportation Security.
                                                                                                           18




                                  Page 26                                             GAO-03-1083 Homeland Security
                                    Appendix I
                                    Briefing to the Staffs of the Subcommittees
                                    on Homeland Security, Senate and House
                                    Committees on Appropriations




                                                                                           Background
                                                                                  Acquisition Strategy

Acquisition Strategy
DHS plans to deliver US-VISIT capability incrementally. Currently DHS has defined
four increments, with Increments 1 through 3 being interim, or temporary, solutions,
and increment 4 being the strategic solution and consisting of a series of
increments. Increments 1 through 3 include the interfacing and enhancement of
existing system capabilities and the deployment of these capabilities at air, sea,
and land POEs; the design and construction of interim facilities1 at land POEs; and
the development and implementation of revised border inspection procedures.




1DHS is planning to construct interim, or temporary, facilities at land POEs to meet established milestones,
while concurrently developing permanent solutions at these POEs.

                                                                                                            19




                                    Page 27                                            GAO-03-1083 Homeland Security
                             Appendix I
                             Briefing to the Staffs of the Subcommittees
                             on Homeland Security, Senate and House
                             Committees on Appropriations




                                                                                    Background
                                                                           Acquisition Strategy

According to DHS, Increment 1 is to deliver an initial system operating capability to
all air and sea POEs by December 31, 2003, that includes
 • recording the arrival and departure of foreign nationals using passenger and
   crew manifest data,
 • identifying travelers who have overstayed their visits or changed their visitor
   status, and
 • interfacing seven existing systems that contain data about foreign nationals.
Increment 1 is to also verify travelers’ identities upon entry into the United States
through the use of biometrics and checks against watch lists (e.g., the Interagency
Border Inspection System—IBIS) at air POEs and 13 of 42 sea POEs, but only for
those cruise lines that currently have inspections stations.
Increment 1 is also to include developing policies and procedures and providing the
associated training for an interim inspection process.
Increment 1 may include an exit capability beyond the capture of the manifest data.


                                                                                                     20




                             Page 28                                            GAO-03-1083 Homeland Security
                                   Appendix I
                                   Briefing to the Staffs of the Subcommittees
                                   on Homeland Security, Senate and House
                                   Committees on Appropriations




                                                                                          Background
                                                                                 Acquisition Strategy

Increment 1 is not intended to include the installation or acquisition of additional
facilities at air and sea POEs, or employment of additional inspectors.
Increment 2 is to deploy Increment 1 system capability and design and construct
interim facilities (e.g., additional inspection booths) at the 50 highest volume land
POEs by December 31, 2004. It is also to include
  • the use of radio frequency technology1 for vehicles and pedestrians that are
    pre-cleared, and
  • the use of technology to read travel documents with biometrics.2
Increment 3 is to deploy Increment 2 system capability and design and construct
interim facilities at all remaining land POEs by December 31, 2005.
Increment 4 is to deliver a new, yet-to-be-defined, integrated system solution to a
yet-to-be-defined number of POEs by December 31, 2006.

1 DHS plans to issue radio frequency-enabled proximity cards. As the person or vehicle passes through the
inspection lane, the data on the card are read by an antenna and displayed on the inspector’s screen.
2 By   October 26, 2004.
                                                                                                           21




                                   Page 29                                            GAO-03-1083 Homeland Security
                                      Appendix I
                                      Briefing to the Staffs of the Subcommittees
                                      on Homeland Security, Senate and House
                                      Committees on Appropriations




                                                                                             Background
                                                                                    Acquisition Strategy

For the system, DHS plans are to award a single, indefinite-delivery/indefinite-
quantity (IDIQ)1 type contract to a prime contractor capable of integrating existing
and new business processes and technologies. DHS plans to issue a request for
proposal for the prime contractor in November 2003. The prime contractor is to be
responsible for Increment 4 and is to assist in the deployment of Increments 2 and
3. DHS plans to use existing contractors to interface and enhance the existing
systems for Increment 1.
For facilities, the department plans to award contracts for the design and
construction of interim facilities at each land POE through the General Services
Administration (GSA). DHS is working with GSA to obligate $17 million for the
award of interim facilities design contracts beginning in August 2003. DHS plans to
award interim facilities construction contracts for the 50 highest volume land POEs
through GSA beginning in February 2004 using anticipated fiscal year 2004 funds.


1 An IDIQ contract is a flexible contract that provides for an indefinite quantity, within stated limits, of supplies
or services during a fixed period of time. The government schedules deliveries or performance by placing
orders with the contractor.

                                                                                                                  22




                                      Page 30                                               GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                                   Background
                                                                          Acquisition Strategy

For human capital, DHS has not yet defined its strategy. However, for Increment 1,
it does not plan to acquire any additional inspection staff. According to program
officials, the department is developing a training plan for inspectors for Increment 1,
and it expects to complete training by the end of December 2003.
DHS is currently developing the policies, procedures, and guidance for
implementing Increment 1. It expects to complete development by the end of
October 2003.




                                                                                                    23




                            Page 31                                            GAO-03-1083 Homeland Security
                           Appendix I
                           Briefing to the Staffs of the Subcommittees
                           on Homeland Security, Senate and House
                           Committees on Appropriations




                                                                                Background
                                                                         Component Systems

Component Systems
US-VISIT (Increments 1 through 4) is to include the interfacing and integration of
over 20 existing systems. For example, Increment 1 includes the following existing
systems:
 • Arrival Departure Information System (ADIS), a database that stores traveler
   arrival and departure data and can perform query functions;
 • Advance Passenger Information System (APIS), a system that captures arrival
   and departure manifest information;
 • Interagency Border Inspection System (IBIS), a system that maintains lookout
   data and interfaces with other agencies databases, and is currently used by
   inspectors at POEs to verify traveler information and modify data;
 • Automated Biometric Identification System (IDENT), a system that collects and
   stores biometric data for foreign visitors;




                                                                                                  24




                           Page 32                                           GAO-03-1083 Homeland Security
                         Appendix I
                         Briefing to the Staffs of the Subcommittees
                         on Homeland Security, Senate and House
                         Committees on Appropriations




                                                                              Background
                                                                       Component Systems

• Student Exchange Visitor Information System (SEVIS), a system that contains
  information on foreign students; and
• Computer Linked Application Information Management System (CLAIMS 3), a
  system that contains information on foreign nationals who request benefits,
  such as change of status or extension of stay.
• Consular Consolidated Database (CCD), a system that includes information on
  whether a visa applicant has previously applied for a visa or currently has a
  valid U.S. visa.




                                                                                                25




                         Page 33                                           GAO-03-1083 Homeland Security
                                  Appendix I
                                  Briefing to the Staffs of the Subcommittees
                                  on Homeland Security, Senate and House
                                  Committees on Appropriations




                                                                                 Background
                                                            Review of Prior Expenditure Plan

GAO’s Review of Fiscal Year 2002 Expenditure Plan
In our report on the fiscal year 2002 expenditure plan,1 we concluded that
 • the plan partially satisfied the legislative conditions;
 • INS intended to acquire and deploy a system with functional and performance
   capabilities consistent with the general scope of capabilities under various
   laws; and
 • the plan did not provide sufficient information to allow Congress to oversee the
   program.




1 U.S. General Accounting Office, Information Technology: Homeland Security Needs to Improve Entry Exit
System Expenditure Planning, GAO-03-563 (Washington, D.C.: June 9, 2003).

                                                                                                       26




                                  Page 34                                         GAO-03-1083 Homeland Security
                          Appendix I
                          Briefing to the Staffs of the Subcommittees
                          on Homeland Security, Senate and House
                          Committees on Appropriations




                                                                         Background
                                                    Review of Prior Expenditure Plan

Accordingly, we made recommendations, including
 • developing a system security plan and privacy impact assessment;
 • ensuring that controls in the area of acquisition planning, solicitation,
   requirements development and management, project management, contract
   tracking and oversight, and evaluation be implemented in accordance with SEI
   guidance;
 • ensuring that future expenditure plans be provided to the department’s House
   and Senate Appropriations Subcommittees in advance of US-VISIT funds
   being obligated; and
 • ensuring that future expenditure plans fully disclose US-VISIT system
   capabilities, schedule, cost, and benefits to be delivered.




                                                                                             27




                          Page 35                                       GAO-03-1083 Homeland Security
                                 Appendix I
                                 Briefing to the Staffs of the Subcommittees
                                 on Homeland Security, Senate and House
                                 Committees on Appropriations




                                                                             Background
                                                      Review of Current Expenditure Plan

Fiscal Year 2003 Expenditure Plan Summary (see next slides for descriptions)

    Areas of expenditure                                                                       Amount

    Proof of Concept Demonstrations: NSEERS reimbursement                                $ 10,500,000
                                        NSEERS                                              9,500,000
                                        Facial Verification Test                            1,500,000
    System Enhancement & Infrastructure Upgrades                                         155,000,000
    POE IT and Communication Upgrades                                                      85,000,000
    Facilities Planning, Analysis, & Design                                                60,000,000
    Training                                                                                3,500,000
    Program Management Support                                                             30,000,000
    Operations & Systems Sustainment                                                       20,000,000

    Total                                                                               $ 375,000,0001

Source: DHS.
1
 In April 2003, H.R. Conf. Rep. No. 108-76 at 80 (2003), recommended that DHS use $5 million for US-
VISIT. The $5 million was not included in the expenditure plan submitted to the Appropriations
Subcommittees in June 2003.

                                                                                                       28




                                 Page 36                                         GAO-03-1083 Homeland Security
                                   Appendix I
                                   Briefing to the Staffs of the Subcommittees
                                   on Homeland Security, Senate and House
                                   Committees on Appropriations




                                                                                        Background
                                                                           Current Expenditure Plan

Descriptions
Proof of Concept Demonstrations: This area includes reimbursement to DHS’s
Bureau of Citizenship and Immigration Services for previously conducted
registration activities associated with the National Security Entry-Exit Registration
System (NSEERS).1 Costs in this area also include those for software changes
made to IDENT to accommodate NSEERS, for the purchase and deployment of
additional IDENT/ENFORCE workstations to POEs and district offices, and for
training staff on these system changes. In addition, this area includes a pilot with
the Australian government to test facial recognition, in which the Australian
government will provide a select group of commercial pilots traveling between
Australia and the United States with passports that have biometrics encoded on a
chip; these passports will allow DHS to test the reading of the biometric information
and to conduct facial verification matching tests.

1 NSEERS     consists of (1) a modified version of the Enforcement Case Tracking System (ENFORCE),
(2) deployments of the Automated Biometric Identification System (IDENT), and (3) updated polices and
procedures covering the registration of certain nonimmigrants. ENFORCE is a case management system
that supports the apprehension and booking process for illegal aliens. IDENT is a database of more than
4.5 million foreign visitors’ fingerprints (two prints) and photos.

                                                                                                          29




                                   Page 37                                          GAO-03-1083 Homeland Security
                           Appendix I
                           Briefing to the Staffs of the Subcommittees
                           on Homeland Security, Senate and House
                           Committees on Appropriations




                                                                                Background
                                                                   Current Expenditure Plan

System Enhancement & Infrastructure Upgrades: This area includes the
enhancement of existing information systems, telecommunications upgrades
between the Justice and Customs data centers, an additional server to
accommodate increased workload, and wide-area network upgrades to support
additional processing and bandwidth requirements relative to the transmission of
biometrics data.
POE IT and Communication Upgrades: This area includes upgrades to the
hardware (e.g., desktop computers, scanners, biometric devices) and
communications infrastructure at the POEs.




                                                                                                 30




                           Page 38                                          GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                                 Background
                                                                    Current Expenditure Plan

Facilities Planning, Analysis, & Design: This area includes modeling air, sea,
and the 50 highest volume land POEs for interim facilities and planning for
permanent facilities; conducting environmental assessments; acquiring space for
US-VISIT enrollment centers at the 50 highest volume land POEs; developing site
plans; awarding design contracts for interim facilities at the 50 highest volume land
POEs; conducting feasibility studies and developing master plans to begin
collecting data and coordinating existing activities and projects for future
requirements; and providing facility-related program and project management
support.
Training: This area includes initial training for personnel to use the US-VISIT
system.
Program Management Support: This area includes establishing a program
management office to manage the US-VISIT program and engaging program
management support contractors.
Operations & Systems Sustainment: This area includes increased maintenance
and technical support to meet the system performance requirements.


                                                                                                  31




                            Page 39                                          GAO-03-1083 Homeland Security
                                   Appendix I
                                   Briefing to the Staffs of the Subcommittees
                                   on Homeland Security, Senate and House
                                   Committees on Appropriations




                                                                                           Background
                                                                                             Funding

US-VISIT Available Appropriations, DHS Allocations, and Obligations for
Fiscal Year 2002 and 2003

                        Available                     DHS allocations
Fiscal year     appropriations (millions) 1             (millions)               Obligated (millions)2

FY 2003                 $ 380.0                             $ 52.53                      $ 4.2
FY 2002                    13.3                                —4                          3.24

Total                   $ 393.3                                                          $ 7.4

Source: DHS.
1 Of the $449.8 million lump sum appropriated for Enforcement and Border Affairs in the Department of
Defense and Emergency Supplemental Appropriations for Recovery from and Response to Terrorist Attacks
on the United States Act, 2002 (P.L.107-117), the conference report (H.R. Conf. Rep. No. 107-350, at 416
(2001)) recommended that INS use $13.3 million in appropriations for the entry exit system (now US-
VISIT). This amount is available until expended. Of the $2.8 billion lump sum appropriated for Immigration
Enforcement and Border Affairs for fiscal year 2003, the conference report (H.R. Conf. Rep. No. 108-10, at
623 (2003)) recommended that INS use $362 million for what is now US-VISIT. These funds expire at the
end of fiscal year 2003. According to DHS officials, an additional $18 million in base resources was to be
available from a user fee account. Given the decrease in user fee receipts since September 11, 2001, these
officials stated that the $18 million may not be available for the US-VISIT program.

                                                                                                          32




                                   Page 40                                           GAO-03-1083 Homeland Security
                                    Appendix I
                                    Briefing to the Staffs of the Subcommittees
                                    on Homeland Security, Senate and House
                                    Committees on Appropriations




                                                                                         Background
                                                                                  Funding Approvals
2 As   of June 12, 2003.
3 In
   April 2003, H.R. Conf. Rep. No. 108-76, at 80 (2003), recommended that DHS use $5 million for US-
VISIT. DHS allocated this $5 million to the US-VISIT program. After submitting the expenditure plan to its
appropriations subcommittees in June, DHS allocated $47.5 million to the US-VISIT program.
4On August 2, 2002, the Congress enacted the 2002 Supplemental Appropriations Act for Further
Recovery From and Response to Terrorist Attacks on the United States (P.L.107-206, Aug. 2, 2002), which
prohibited INS from obligating funds for the entry exit system (from either of the two supplemental
appropriations) until the agency submitted an expenditure plan to the appropriations committees that
satisfied certain legislative conditions imposed by the act. Before August 2, 2002, the former INS had
obligated $3.2 million.




                                                                                                             33




                                    Page 41                                           GAO-03-1083 Homeland Security
                                        Appendix I
                                        Briefing to the Staffs of the Subcommittees
                                        on Homeland Security, Senate and House
                                        Committees on Appropriations




                                                                                                 Background
                                                                                           US-VISIT Timeline

US-VISIT Timeline




Note: GAO analysis of DHS data.
1
 The Visa Waiver System electronically collects arrival and departure information for all passengers and crew members who
are provided a waiver and who arrive and depart U.S. airports and seaports.




                                                                                                                        34




                                        Page 42                                                  GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                              Objective 1 Results
                                                                          Legislative Conditions

US-VISIT expenditure plan partially satisfies the legislative conditions.
Condition 1 partially met. The plan, including related program documentation and
program officials’ statements, partially meets the capital planning and investment
control review requirements established by OMB, including OMB Circular A-11,
part 3, which establishes policy for planning, budgeting, acquisition, and
management of federal capital assets.
Details of our analysis are shown on the table that follows.




                                                                                                      35




                            Page 43                                              GAO-03-1083 Homeland Security
                                          Appendix I
                                          Briefing to the Staffs of the Subcommittees
                                          on Homeland Security, Senate and House
                                          Committees on Appropriations




                                                                                            Objective 1 Results
                                                                                        Legislative Conditions
Examples of A-11 conditions                         Results of our analysis
Indicate whether the project was                    The plan was conditionally approved by DHS’s IRB, which is
approved by Investment Review Board                 chaired by the Deputy Secretary and composed of department
(IRB) and reviewed by Chief Financial               executives, including DHS’s Chief Financial and Procurement
and Procurement Officers.                           Officers.
Provide justification and describe                  The plan provides a high-level justification and description of
acquisition strategy.                               the acquisition strategy for Increment 1. DHS plans to use
                                                    existing contracts to interface and enhance existing systems
                                                    for Increment 1.
Summarize life cycle costs and                      DHS does not have current life cycle costs nor a current
cost/benefit analysis, including the                cost/benefit analysis for US-VISIT, but plans to develop these.
return on investment.                               However, a date and plan for doing so have not been
                                                    established.1
Address enterprise architecture.                    The plan states that US-VISIT is identified in DHS’s enterprise
                                                    architecture (EA), but it does not explain how this project
                                                    conforms to DHS’s EA, which is currently under development.
                                                    Further, DHS officials could not provide evidence of US-
                                                    VISIT’s alignment with DHS’s EA activities.1
Address security and privacy.                       According to program officials, security and privacy
                                                    requirements have been defined, and a draft security plan and
                                                    privacy assessment is currently under review.
1
    These areas are more fully discussed in the observation section of the briefing.



                                                                                                                    36




                                          Page 44                                              GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                              Objective 1 Results
                                                                          Legislative Conditions

Condition 2 partially met. The plan, including related program documentation and
program officials’ statements, partially complies with the acquisition rules,
requirements, guidelines, and systems acquisition management practices of the
federal government. These provide a management framework based on the use of
rigorous and disciplined processes for planning, managing, and controlling the
acquisition of IT resources, including acquisition planning, solicitation, requirements
development and management, project management, contract tracking and
oversight, and evaluation.
Details of our analysis are shown on the table that follows.




                                                                                                      37




                            Page 45                                              GAO-03-1083 Homeland Security
                                           Appendix I
                                           Briefing to the Staffs of the Subcommittees
                                           on Homeland Security, Senate and House
                                           Committees on Appropriations




                                                                                                Objective 1 Results
                                                                                            Legislative Conditions
Examples of practices           Results of our analysis
Acquisition planning.1          For various reasons, including the recent transition to DHS, many of the
Ensures that reasonable         acquisition planning documents that had been prepared for the former entry exit
planning for the                system are outdated. For example, INS had developed an acquisition plan, as
acquisition is conducted,       required by INS acquisition policies and procedures that outlined its approach and
including, among other          strategy for acquiring the entry exit system. According to DHS officials, the plan is
things, developing an           no longer current.
acquisition strategy and        DHS officials stated that they have updated some of these acquisition planning
plan, determining the cost
                                documents, submitted them to the IRB on June 30, 2003, and plan to meet with
and schedule, identifying       the IRB on July 17, 2003. DHS plans to update additional planning documents by
risks, and defining
                                August 7, 2003. For example, DHS plans to update its acquisition plan and
requirements.                   develop a life cycle cost estimate and risk management plan for Increment 1.
Project management.1            According to US-VISIT program officials, interfacing and enhancing existing
Provides for the                systems under Increment 1 are being managed according to the former INS’s
management of activities        SDLC.2 However, they could not provide evidence to support this statement;
within the project office       because of time constraints, we did not verify whether these contractors and
and supporting                  associated DHS acquisition entities were following the SDLC.
contractors to ensure a         These officials also stated that US-VISIT will transition to DHS’s SDLC when it is
timely, efficient, and cost-    completed. However, they did not know when the DHS SDLC would be complete,
effective acquisition.
                                and therefore when US-VISIT will transition.
1
  These practices are addressed in our observations section.
2
  An SDLC (Systems Development Life Cycle) is a management process that specifies, for a series of “cradle to grave” phases,
the development activities to be performed, products to be generated, and the decision points to determine whether the project is
ready for the next phase.




                                                                                                                                    38




                                           Page 46                                                        GAO-03-1083 Homeland Security
                           Appendix I
                           Briefing to the Staffs of the Subcommittees
                           on Homeland Security, Senate and House
                           Committees on Appropriations




                                                                             Objective 1 Results
                                                                         Legislative Conditions

Condition 3 met. The plan satisfies the requirement that it be reviewed by GAO.
Our review was completed on July 18, 2003.




                                                                                                     39




                           Page 47                                              GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                          Objective 2 Results
                                                                     Open Recommendations

Open Recommendation 1: Develop a system security plan and privacy impact
assessment.
Status: In progress
The expenditure plan states that adequate security and privacy related measures
are to be built into the US-VISIT system and that these measures will comply with
emerging DHS security policies, relevant security-related laws, OMB circulars, and
privacy guidelines of the federal Chief Information Officer Council’s best practices.
According to program officials, system security and privacy requirements have
been defined, and a draft security plan and privacy assessment is currently under
review.




                                                                                                   40




                            Page 48                                           GAO-03-1083 Homeland Security
                          Appendix I
                          Briefing to the Staffs of the Subcommittees
                          on Homeland Security, Senate and House
                          Committees on Appropriations




                                                                        Objective 2 Results
                                                                   Open Recommendations

Open Recommendation 2: Ensure that controls in the area of acquisition
planning, solicitation, requirements development and management, project
management, contract tracking and oversight, and evaluation be implemented in
accordance with SEI guidance.
Status: Planned
DHS has recently approved a program management structure that includes
functions consistent with these acquisition management controls: acquisition
planning, solicitation, requirements development and management, project
management, contract tracking and oversight, and evaluation. According to the US-
VISIT Program Director, these functions will be performed consistent with SEI’s
guidance. However, the department does not currently have explicit plans and
associated time frames for developing and implementing these acquisition
management controls.




                                                                                                 41




                          Page 49                                           GAO-03-1083 Homeland Security
                                      Appendix I
                                      Briefing to the Staffs of the Subcommittees
                                      on Homeland Security, Senate and House
                                      Committees on Appropriations




                                                                                    Objective 2 Results
                                                                               Open Recommendations

 Open Recommendation 3: Ensure that future expenditure plans be provided to
 the Department’s House and Senate Appropriations Subcommittees in advance of
 US-VISIT funds being obligated.
 Status: Partially complete
 In fiscal year 2003, Justice requested $380 million for the entry exit program (now
 US-VISIT)—$362 million in new funding and $18 million in fiscal year 2003 base
 resources.1 In conjunction with the Consolidated Appropriations Resolution, 2003,
 the conference report2 recommended $362 million for the entry exit system (now
 US-VISIT) and related IT infrastructure upgrades.
 In June 2003, DHS provided its fiscal year 2003 expenditure plan to the Senate
 and House Appropriations Subcommittees on Homeland Security. In April 2003,
 H.R. Conf. Rep. No. 108-76, at 80 (2003), recommended that DHS use $5 million
 for US-VISIT. DHS allocated this $5 million to the US-VISIT program.
1 According to DHS officials, the $18 million in base resources was to come from the user fee account.

However, according to these officials, given the decrease in user fee receipts since September 11, 2001, it is
unclear whether that $18 million will be available for the US-VISIT program.
2 H.R.   Conf. Rep. No. 108-10, at 623 (2003).

                                                                                                             42




                                      Page 50                                           GAO-03-1083 Homeland Security
                             Appendix I
                             Briefing to the Staffs of the Subcommittees
                             on Homeland Security, Senate and House
                             Committees on Appropriations




                                                                           Objective 2 Results
                                                                      Open Recommendations

Open Recommendation 4: Ensure that future expenditure plans fully disclose US-
VISIT system capabilities, schedule, cost, and benefits to be delivered.
Status: Partially complete
The expenditure plan identifies high-level capabilities by increment, such as
 • recording the arrival and departure of foreign nationals using passenger and
   crew manifest data,
 • implementing biometrics, and
 • being interoperable with other entities, including law enforcement and
   intelligence agencies.
The plan also identifies a high-level schedule for implementing the system. For
example, Increment 1 is to be implemented by December 31, 2003; Increment 2 by
December 31, 2004; and Increment 3 by December 31, 2005.




                                                                                                    43




                             Page 51                                           GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                          Objective 2 Results
                                                                     Open Recommendations

The plan also includes categories of expenditures, such as system enhancements
and infrastructure upgrades, facilities planning, analysis and design, and POE IT
and communications upgrades. However, the plan does not explicitly associate
costs with incremental capabilities, time frames, and benefits. For example, the
plan does not state how much of the $85 million for POE IT and communications
upgrades DHS plans to use for Increment 1 or for other increments.
The plan identifies high-level goals for Increment 1 (i.e., positively impact national
security and overall efforts in the war against terrorism). However, it does not
identify expected benefits in tangible, measurable, and thus meaningful terms, nor
does it associate benefits with increments. Therefore, it does not provide the basic
data needed to measure return on investment. US-VISIT program officials stated
that they intend to estimate program costs and benefits, but they did not have time
frames for doing so.




                                                                                                   44




                            Page 52                                           GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                          Objective 3 Results
                                                                              Observations

Observation: US-VISIT is a high risk endeavor.
Ten separate factors collectively expose the US-VISIT program to a high level of
risk. Some of these risk factors are inherent to the program, such as those
associated with its mission criticality and complexity. Others are a product of the
program’s relatively immature state of governance and management. Unless these
risk factors are effectively addressed, US-VISIT is likely to fall short of envisioned
expectations.




                                                                                                  45




                            Page 53                                          GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                           Objective 3 Results
                                                                      Observations: Criticality

a. Mission is critical.
 • In fiscal year 2002, there were about 279 million inspections of foreign
   nationals at U.S. POEs. The missed entry of just one person who poses a
   threat to the United States can have severe consequences. One of DHS’s
   critical missions is to prevent such an entry, and it intends to rely heavily on
   US-VISIT to help it do so.
 • Additionally, the US-VISIT system is to assist law enforcement in identifying
   those visitors who overstay or otherwise violate the terms of their visas.
 • Further, in announcing the US-VISIT system, the Under Secretary stated that
   the system would “give America a 21st Century ‘smart border’—one that
   speeds through legitimate trade and travel, but stops terrorists in their tracks.”




                                                                                                    46




                            Page 54                                            GAO-03-1083 Homeland Security
                           Appendix I
                           Briefing to the Staffs of the Subcommittees
                           on Homeland Security, Senate and House
                           Committees on Appropriations




                                                                         Objective 3 Results
                                                                  Observations: Complexity

b. Scope is large and complex.
• US-VISIT is to support and refine a large and complex governmentwide
  process involving multiple departments and agencies. This process is to
  control the pre-entry, entry, status, and exit of hundreds of millions of foreign
  national travelers to and from the United States at over 300 air, sea, and land
  POEs. It also requires the modification and expansion of facilities at over 150
  land POEs. The graphic below depicts the high-level border security
  processes. The following graphics depict the subprocesses.




                                                                                                 47




                           Page 55                                          GAO-03-1083 Homeland Security
                                      Appendix I
                                      Briefing to the Staffs of the Subcommittees
                                      on Homeland Security, Senate and House
                                      Committees on Appropriations




                                                                                    Objective 3 Results
                                                                             Observations: Complexity

Simplified Diagram of Current Pre-entry Process




1
  The Consular Lookout and Support System (CLASS) is a name check system that contains records of people who may be
ineligible to receive a passport or visa.

                                                                                                                      48




                                      Page 56                                                GAO-03-1083 Homeland Security
                                 Appendix I
                                 Briefing to the Staffs of the Subcommittees
                                 on Homeland Security, Senate and House
                                 Committees on Appropriations




                                                                               Objective 3 Results
                                                                        Observations: Complexity

Simplified Diagram of
Current Entry Process




1
  The Non-Immigrant
Information System (NIIS)
collects arrival and departure
Form I-94 data and reports
information on overstays.


                                                                                                       49




                                 Page 57                                          GAO-03-1083 Homeland Security
                                           Appendix I
                                           Briefing to the Staffs of the Subcommittees
                                           on Homeland Security, Senate and House
                                           Committees on Appropriations




                                                                                         Objective 3 Results
                                                                                  Observations: Complexity

Simplified Diagram of the Current Status Process




1
    The National Crime Information Center (NCIC) provides information on wanted persons and criminal histories.


                                                                                                                         50




                                           Page 58                                                  GAO-03-1083 Homeland Security
                         Appendix I
                         Briefing to the Staffs of the Subcommittees
                         on Homeland Security, Senate and House
                         Committees on Appropriations




                                                                       Objective 3 Results
                                                                Observations: Complexity

Simplified Diagram of the Current Exit Process




                                                                                               51




                         Page 59                                          GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                          Objective 3 Results
                                                                   Observations: Complexity

As mentioned previously, US-VISIT (Increments 1 through 4) is to include the
interfacing and integration of over 20 existing systems. Increment 1 includes the
following seven existing systems:
 • Arrival Departure Information System,
 • Advance Passenger Information System,
 • Interagency Border Inspection System,
 • Automated Biometric Identification System,
 • Student Exchange Visitor Information System,
 • Computer Linked Application Information Management System, and
 • Consular Consolidated Database.
 The following graphic shows the systems and their relationships.




                                                                                                  52




                            Page 60                                          GAO-03-1083 Homeland Security
                                         Appendix I
                                         Briefing to the Staffs of the Subcommittees
                                         on Homeland Security, Senate and House
                                         Committees on Appropriations




                                                                                       Objective 3 Results
                                                                                Observations: Complexity

Simplified Diagram of US-VISIT Increment 1 Component Systems and
Relationships




1
    Fingerprint Identification Number.

                                                                                                               53




                                         Page 61                                          GAO-03-1083 Homeland Security
                                    Appendix I
                                    Briefing to the Staffs of the Subcommittees
                                    on Homeland Security, Senate and House
                                    Committees on Appropriations




                                                                        Objective 3 Results
                                                     Observations: Challenging Milestones

c. Milestones are challenging.
Key US-VISIT milestones are legislatively mandated. For example, the Immigration
and Naturalization Service Data Management Improvement Act of 20001 requires
that US-VISIT be implemented at all air and sea POEs by December 31, 2003; at
the 50 highest volume land POEs by December 31, 2004; and at all remaining
POEs by December 31, 2005.
Because of limited progress over the last 7 years in addressing entry exit legislative
requirements, including the above cited milestones, DHS acknowledges that it
cannot complete permanent solutions in these time frames and thus now plans to
implement interim, or temporary solutions. For example, as previously described,
Increments 1 through 3 include the interfacing of existing systems and the design
and construction of interim facilities at land POEs. Further, DHS officials have
stated that it will be difficult to develop and implement even the interim solutions at
some of the highest volume land POEs (such as San Ysidro, CA; Otay Mesa, CA;
and Laredo, TX) by December 31, 2004, because even minor changes in the
inspection time can greatly impact the average wait time at these high-volume
POEs.
1 P.L.   106-215 (June 15, 2000).
                                                                                                       54




                                    Page 62                                       GAO-03-1083 Homeland Security
                              Appendix I
                              Briefing to the Staffs of the Subcommittees
                              on Homeland Security, Senate and House
                              Committees on Appropriations




                                                                             Objective 3 Results
                                                                            Observations: Cost

d. Potential cost is significant.
The potential governmentwide cost of US-VISIT over just a 10-year period will likely
be in the tens of billions of dollars.
In February 2003, DHS estimated the total overall cost of the US-VISIT program to
be about $7.2 billion through fiscal year 2014. This estimate includes system
investment costs, such as IT hardware and communications infrastructure,
software enhancements and interfaces, as well as the cost of facilities and
additional inspectors. It also includes system and facilities operation and
maintenance costs.




                                                                                                     55




                              Page 63                                           GAO-03-1083 Homeland Security
                                  Appendix I
                                  Briefing to the Staffs of the Subcommittees
                                  on Homeland Security, Senate and House
                                  Committees on Appropriations




                                                                                 Objective 3 Results
                                                                                Observations: Cost

 • The estimate does include the cost of planning, designing, and constructing
   permanent facilities, which according to DHS is about $2.9 billion.1 This
   estimate is based on the assumptions that (1) no additional traffic lanes will be
   required to support the entry processes and (2) exit facilities will mirror entry
   facilities (i.e., that a land POE with 10 entry traffic lanes will require 10 exit
   traffic lanes). The estimate includes the costs to design and construct building
   space to house additional computer equipment and inspectors, as well as the
   costs for highway reconfiguration at land POEs.
    The estimate does not include the costs to design and construct interim
    facilities at land POEs. DHS officials estimate that the cost of constructing the
    interim facilities at the 50 highest volume POEs is about $218 million.



1 The $2.9 billion is a parametric cost estimate. Parametric cost estimating is a technique used in the
planning, budgeting, and conceptual stages of projects. This technique expedites the development of order
of magnitude benchmark estimates when discrete estimating techniques are not possible or would require
inordinate amounts of time and resources to produce similar results. Estimates such as this can vary ±30
to 50 percent.

                                                                                                         56




                                  Page 64                                           GAO-03-1083 Homeland Security
                                 Appendix I
                                 Briefing to the Staffs of the Subcommittees
                                 on Homeland Security, Senate and House
                                 Committees on Appropriations




                                                                                Objective 3 Results
                                                                               Observations: Cost

  • The estimate does include the cost of implementing biometrics. However,
    these costs may be understated because it does not include, for example,
    State Department costs. Specifically, in November 2002,1 we reported that a
    rough order of magnitude estimate of the cost to implement visas with
    biometrics would be between $1.3 billion and $2.9 billion initially and between
    $0.7 and $1.5 billion annually thereafter. This estimate is based on certain
    assumptions, including that all current visa-issuing embassies and consulates
    will be equipped to collect biometrics from visa applicants. Assuming that
    biometrics are implemented by December 2004, this means that the recurring
    cost of having biometric visas through DHS’s fiscal year 2014 life cycle period
    would be between $7 and $15 billion; in contrast, DHS has estimated a cost of
    about $7.2 billion for the entire program through fiscal year 2014.




1 U.S. General
             Accounting Office, Technology Assessment: Using Biometrics for Border Security, GAO-03-
174 (Washington, D.C.: Nov. 15, 2002).

                                                                                                        57




                                 Page 65                                           GAO-03-1083 Homeland Security
                                   Appendix I
                                   Briefing to the Staffs of the Subcommittees
                                   on Homeland Security, Senate and House
                                   Committees on Appropriations




                                                                           Objective 3 Results
                                                             Observations: Existing Problems

e. Existing systems have known problems.
The system performance of US-VISIT Increments 1, 2, and 3 is largely dependent
on the performance of the existing systems that are to be interfaced to form it. For
example, US-VISIT system availability and associated downtime will be
constrained by the availability of the interfaced systems. In this regard, some of the
existing systems have known problems that could limit US-VISIT performance. For
example:
 • Recent reports have identified problems with the availability and reliability of
   SEVIS, which is the Internet-based system designed to manage and monitor
   foreign students in the United States. For example, in April 2003, the Justice
   Inspector General reported that many users had difficulty logging on to the
   system, and that as the volume of users grew, the system became increasingly
   sluggish.1 Other reports indicated that university representatives complained that
   it was taking hours to log on to the system and to enter a single record, or
   worse, that the system accepted the record and later deleted it.
1 Statement of Glenn A. Fine, Inspector General, U.S. Department of Justice, “Implementation of the Student
and Exchange Visitor Information System (SEVIS)” (Apr. 2, 2003).

                                                                                                         58




                                   Page 66                                          GAO-03-1083 Homeland Security
                                   Appendix I
                                   Briefing to the Staffs of the Subcommittees
                                   on Homeland Security, Senate and House
                                   Committees on Appropriations




                                                                           Objective 3 Results
                                                             Observations: Existing Problems

 • Similarly, we reported in May 20011 that CLAIMS 3 is unreliable; this system
   contains information on foreign nationals who request benefits and is used to
   process benefit applications other than naturalization. Specifically, we reported
   that INS officials stated that CLAIMS 3 was frequently unavailable and did not
   always update and store important case data when field offices transferred
   data from the local CLAIMS 3 system to the mainframe computer.




1 U.S. General Accounting Office, Immigration Benefits: Several Factors Impede Timeliness of Application
Processing, GAO-01-488 (Washington, D.C.: May 4, 2001).

                                                                                                           59




                                   Page 67                                          GAO-03-1083 Homeland Security
                           Appendix I
                           Briefing to the Staffs of the Subcommittees
                           on Homeland Security, Senate and House
                           Committees on Appropriations




                                                                       Objective 3 Results
                                                                Observations: Governance

f. Governance structure is not established.
Our experience shows that one key to successfully implementing large and
complex modernization programs that involve multiple organizations, such as US-
VISIT, is to have an executive body, composed of representatives from each
stakeholder organization, to guide and direct the program. Among other things, this
body should (1) be formally chartered, (2) include representatives that are
empowered to make and enforce decisions and commit resources for their
respective organizations, and (3) be responsible and accountable for the program
progress and outcomes.
The US-VISIT program is governmentwide in scope, involving multiple departments
and agencies. However, it is not currently being guided and directed by a
governance structure that reflects this program scope. Instead, the program relies
on a combination of
 • the DHS Investment Review Board (IRB), which is the department’s chartered
   investment decisionmaking body, made up of senior leadership from the
   department, and


                                                                                                60




                           Page 68                                         GAO-03-1083 Homeland Security
                           Appendix I
                           Briefing to the Staffs of the Subcommittees
                           on Homeland Security, Senate and House
                           Committees on Appropriations




                                                                       Objective 3 Results
                                                                Observations: Governance

 • an integrated project team representing many US-VISIT stakeholder
   organizations (e.g., Customs and Border Protection, the Transportation
   Security Administration, and the State Department).
However, the IRB’s chartered mission and authority governs only DHS activities,
and does not govern non-DHS, stakeholder activities, such as issuing visas and
passports, and the integrated project team does not include stakeholder
representatives who can personally commit resources and make and enforce
decisions for their respective organizations. Moreover, according to the US-VISIT
Program Director, who heads the integrated project team, the integrated project
team’s role is basically to advise the US-VISIT program office.
The Under Secretary for Transportation and Border Security, who is a member of
the department’s IRB, is assigned responsibility and accountability for program
governance. However, the Program Director stated that a governance body with
appropriate representation from all relevant program stakeholder organizations
would benefit the program. Until such a body is established to address important
crosscutting issues, such as operational decisions and resource needs, US-VISIT
is at risk of not delivering promised system capabilities and benefits on time and
within budget.
                                                                                                61




                           Page 69                                         GAO-03-1083 Homeland Security
                                       Appendix I
                                       Briefing to the Staffs of the Subcommittees
                                       on Homeland Security, Senate and House
                                       Committees on Appropriations




                                                                           Objective 3 Results
                                                          Observations: Program Management

g. Program management capability is not implemented.
Our experience with major modernization programs, like US-VISIT, shows that they
should be managed as a formal program, which includes establishing a program
office that is (1) adequately staffed (numbers and skill levels), (2) grounded in
clearly defined roles and responsibilities, and (3) supported by rigorous and
disciplined acquisition management processes.
DHS established a US-VISIT program office in June 2003,1 and recently
determined this office’s staffing needs to be 115 government and 117 contractor
personnel (in all) to perform key acquisition management functions. The Software
Engineering Institute’s Software Acquisition Capability Maturity Model (SA-CMM®)2
has defined a suite of key acquisition process areas that are necessary to manage
the system acquisition program in a rigorous and disciplined fashion. These
process areas include acquisition planning, requirements development and
management, project management, solicitation, contract tracking and oversight,
evaluation, and transition to support.
1 The   predecessor program office for the entry exit program was established within the former INS in March 2002.
2 Carnegie Mellon Software Engineering Institute, Software Acquisition Capability Maturity Model, Version 1.03

(March 2002).

                                                                                                                     62




                                       Page 70                                              GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                Objective 3 Results
                                               Observations: Program Management

As of July 10, 2003, the US-VISIT program’s staffing levels were far below DHS’s
stated needs. Specifically, the US-VISIT program officials stated that the program
office has 10 staff within the program office and another 6 staff that are working
closely with them. Moreover, specific roles and responsibilities have not been
defined beyond general statements. Further, plans and associated time frames for
achieving needed staffing levels and defining roles, responsibilities, and
relationships have not yet been defined. According to the Program Director,
positions are to be filled with detailees from various DHS component organizations.
Positions are also to be filled with full-time equivalent slots from other DHS
components that are not currently filled.
Additionally, while the approved program office structure (see slide 65) provides for
positions to perform the SA-CMM® key process areas, including acquisition
planning, requirements development and management, project management, and
contract tracking and oversight, none of the process areas have been defined and
implemented. In the interim, the program office is relying on the knowledge and
skills of existing program office staff to execute these important acquisition
functions.


                                                                                               63




                            Page 71                                       GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                Objective 3 Results
                                               Observations: Program Management

According to the Program Director, needed program staffing and key process areas
are not yet in place because the program is only now getting off the ground, and it
will take time to establish a fully functioning and capable program management
capability. Until the program office is adequately staffed, positional roles and
responsibilities are clearly defined and understood, and rigorous and disciplined
acquisition process controls are defined, understood, and followed, DHS’s ongoing
efforts to acquire, deploy, operate, and maintain system capabilities will be at risk
of not producing promised performance levels, functionality, and associated
benefits on time and within budget.
The graphic on the next page shows the US VISIT program management structure.




                                                                                               64




                            Page 72                                       GAO-03-1083 Homeland Security
                                               Appendix I
                                               Briefing to the Staffs of the Subcommittees
                                               on Homeland Security, Senate and House
                                               Committees on Appropriations




                                                                                       Objective 3 Results
                                                                      Observations: Program Management

Approved US-VISIT Program Management Structure




1 A geographic information system (GIS) is a system of computer software, hardware, and data used to manipulate, analyze, and graphically present

a potentially wide array of information associated with geographic locations.


                                                                                                                                                65




                                               Page 73                                                              GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                  Objective 3 Results
                                                   Observations: Operational Context

h. Operational context is unsettled.
To effectively define, establish, and implement a program (particularly one that
involves restructuring and reengineering the use of people, processes, technology,
and facilities from physically and culturally divergent organizations), it is essential
that the program be aligned with a common blueprint, or frame of reference,
governing key aspects of program operations—e.g., what functions are to be
performed by whom, when and where they are to be performed, what information is
to be used to perform them, and what rules and standards will govern the
application of technology to support them. Such a frame of reference is referred to
as an enterprise architecture (EA). In brief, an EA defines the operations of an
enterprise, such as DHS, in both business terms (e.g., policies, processes,
information, locations) and technical terms (e.g., hardware and software
standards). It also provides these operational definitions for both the “as is” state
and the “to be” state, and it includes a transition plan for moving between the two.




                                                                                               66




                            Page 74                                       GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                  Objective 3 Results
                                                   Observations: Operational Context
The operational context, or EA, within which US-VISIT is to exist has not been
defined. Currently, DHS is developing an EA and reports that it is to be completed
by October 2003. If developed effectively, the department’s EA should provide the
operational context necessary to effectively define, establish, and make operational
US VISIT.
In the absence of an EA, certain policy and standards information that is necessary
to effectively define, establish, and implement the US-VISIT program is not yet
available. In particular, policy decisions have not been made governing (1) whether
official travel documents will be required for all persons who enter and exit the
country, including U.S. and Canadian citizens, and (2) whether biometrics will be
captured and used for all persons entering and exiting the country, including U.S.
and Canadian citizens. Some of these policy decisions may necessitate changes to
existing laws and regulations.
Similarly, certain technology standards, such as the number of fingerprints to be
collected, are only now emerging, with a tentative agreement to use two
fingerprints and plans to migrate to eight prints for enrollment. Also, the specific
processes have yet to be defined (e.g., entry and exit procedures and border
personnel roles and responsibilities relative to implementation of the procedures).
                                                                                               67




                            Page 75                                       GAO-03-1083 Homeland Security
                           Appendix I
                           Briefing to the Staffs of the Subcommittees
                           on Homeland Security, Senate and House
                           Committees on Appropriations




                                                                 Objective 3 Results
                                                  Observations: Operational Context

Because this operational context is unsettled and unclear, the program office is
making certain assumptions and decisions necessary to meet near-term deadlines,
such as the use of a two-fingerprint biometric, and adoption of border crossing
processes that will implement planned system capabilities in whatever way needed
to avoid (1) requiring additional facilities and personnel for Increment 1 and
(2) increasing wait times for traffic crossings. If these assumptions and decisions
are not aligned with DHS’s EA, then near-term investments in systems and
associated process will need to be reworked or replaced. Moreover, the mission
value of the planned system capabilities that are actually implemented (made
operational) at the border could be minimal. For example, inspectors may have to
limit their use of installed system capabilities (such as those for capturing
biometrics) to prevent traffic delays.
Unless DHS can coordinate its plans for developing its EA (and thus providing a
clear operational context) with its near-term implementation plans for US VISIT, the
department is increasing its near-term risk of defining, establishing, and
implementing a program and supporting system that will not cost-effectively meet
mission needs.


                                                                                              68




                           Page 76                                       GAO-03-1083 Homeland Security
                               Appendix I
                               Briefing to the Staffs of the Subcommittees
                               on Homeland Security, Senate and House
                               Committees on Appropriations




                                                                     Objective 3 Results
                                                      Observations: Near-Term Facilities

I. Near-term facilities solutions pose challenges.
According to DHS officials, DHS’s existing facilities do not adequately support the
current entry exit process at land POEs. In particular, more than 100 land POEs
have less than 50 percent of the required capacity to support current inspection
processes and traffic levels.1 As a result, as part of US VISIT (increment 2), DHS
plans to construct interim facilities at about 40 of the 50 highest volume land POEs
by December 31, 2004, and construct interim facilities at the remaining portion of
the 50 by February 2005. To accomplish this, DHS plans to begin awarding design
contracts in August 2003, and construction contracts in February 2004.




1 Data
     Management Improvement Act Task Force, First Annual Report to Congress (Washington, D.C.:
December 2002).
                                                                                                  69




                               Page 77                                       GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                  Objective 3 Results
                                                   Observations: Near-Term Facilities

According to DHS officials, the department plans to design and construct interim
facilities to (1) support the US-VISIT inspection process, technology, and staff
requirements; and (2) meet current traffic wait time requirements at each land POE.
To plan for the design and construction of interim facilities that meet these
requirements, DHS is modeling various inspection process and facilities scenarios
to define what inspection process to follow and what interim facilities to construct.
DHS officials told us that preliminary modeling exercises show that 3-, 6-, and 9-
second incremental increases in average inspection times at some high volume
land POEs can significantly increase average wait times at these POEs. For
example, peak wait time at the Blaine Peace Arch POE in Washington could
increase by more than 11 hours if the average inspection increased by 9 seconds.
The modeling exercise was based on two key assumptions: (1) the current staffing
level and (2) the current number of inspection booths staffed for each POE. (see
figure on next slide for modeling results at six POEs).




                                                                                               70




                            Page 78                                       GAO-03-1083 Homeland Security
                       Appendix I
                       Briefing to the Staffs of the Subcommittees
                       on Homeland Security, Senate and House
                       Committees on Appropriations




                                                             Objective 3 Results
                                              Observations: Near-Term Facilities

High-Volume Ports Maximum Vehicle Wait Time as a Function of Added
Inspection Time




                                                                                          71




                       Page 79                                       GAO-03-1083 Homeland Security
                                        Appendix I
                                        Briefing to the Staffs of the Subcommittees
                                        on Homeland Security, Senate and House
                                        Committees on Appropriations




                                                                              Objective 3 Results
                                                               Observations: Near-Term Facilities

 At this point, DHS officials told us that they are planning to satisfy interim facilities
constraints and requirements by installing temporary booths on existing traffic lanes
and employing additional inspectors at some of the highest volume land POEs.1
However, they also stated that the high traffic volumes and urban locations of some
land POEs will make meeting US-VISIT constraints and requirements challenging,
even on an interim basis. Moreover, given existing facilities constraints, developing
interim facilities plans without defined inspection process, staff, and technology
requirements introduces considerable uncertainty and risk that resources invested
in interim facilities may not fully satisfy constraints and requirements and may not
be useful in the design and construction of permanent facilities.




1At   this point, DHS is not planning to acquire additional land for interim facilities at land ports of entry.

                                                                                                                   72




                                        Page 80                                               GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                               Objective 3 Results
                                            Observations: Value of First Increment

j. Mission value of first increment is currently unknown.
OMB Circular Number A-11, part 3, requires that investments in major systems be
implemented incrementally, with each increment delivering tangible and
measurable benefits. Incremental investment involves justifying investment in each
increment on the basis of benefits, costs, and risks.
DHS is pursuing US-VISIT incrementally, but it has not defined the specific benefits
to be provided by Increment 1.
 • The expenditure plan states that Increment 1 will provide “immediate benefits,”
   but it does not describe them. Instead, it describes capabilities to be provided,
   such as the ability to determine whether a foreign national should be admitted
   and perform checks against watch lists. It does not describe in meaningful
   terms the benefits that are to result from implementation of these capabilities
   (e.g., X percent reduction in inspection times or Y percent reduction in false
   positive matches against watch lists).




                                                                                               73




                            Page 81                                       GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                               Objective 3 Results
                                            Observations: Value of First Increment

 • In fact, because DHS has not yet defined the processes that are to govern the
   extent to which planned Increment 1 system capabilities will be implemented
   (as discussed previously), and because these processes are to be constrained
   by existing facilities and personnel and are not to result in increases in wait
   times for traffic crossings, it is not possible at this point to reliably project
   tangible and measurable Increment 1 mission benefits.
The expenditure plan also does not identify the estimated cost of Increment 1. The
Program Director told us that the $375 million requested in the plan includes not
only all the funding required for Increment 1, but also funding for later increments.
However, the plan does not separate the funds by increment, and program officials
did not provide this information.
To DHS’s credit, the expenditure plan does identify certain program risks, such as
not having established clear decision authorities for policy and other operational
questions and schedule slippage due to the aggressive milestones. However, it has
yet to address how these risks will be mitigated, and the extent to which the status
of program risks that are deemed “high impact/high probability of occurrence” will
be disclosed to program executives.

                                                                                               74




                            Page 82                                       GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                               Objective 3 Results
                                            Observations: Value of First Increment

In February 2003, DHS developed a benefits and cost analysis for the former entry
exit program. However, this analysis had limitations, such as an absence of
meaningful benefit descriptions, and program officials acknowledged that it is out of
date and is not reflective of current US-VISIT plans. According to these officials, an
updated analysis will be prepared; however, a date and plan for doing so has not
been set.
Without a reliable understanding of whether Increment 1 will produce mission value
commensurate with costs and whether known risks can be effectively mitigated,
DHS is investing in and implementing a near-term solution that is not adequately
justified.




                                                                                               75




                            Page 83                                       GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                               Conclusions


The fiscal year 2003 US-VISIT expenditure plan (with related program office
documentation and representations) either partially satisfies or provides for
satisfying the legislative conditions imposed by Congress.
The US-VISIT program leadership has expressly committed to developing and
implementing the program acquisition management capabilities and the
expenditure plan content described in our open recommendations. However, much
remains to be accomplished before these recommendations are fully implemented.
By definition, US-VISIT is a risky undertaking because it is to perform a critical
mission, its scope is large and complex, it must meet a demanding implementation
schedule, and its potential cost is enormous. Generally, these risk factors are
inherent to the program and cannot be easily changed.




                                                                                               76




                            Page 84                                       GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                               Conclusions


However, compounding these inherent risk factors are a number of others that are
attributable to the program’s current state of governance and management and its
acquisition approach. These include relying on existing systems to provide the
foundation for the first three program increments (and thus having to accept the
performance limitations of these existing systems), not having a governance
structure to guide and direct the program office, not having a mature program
management capability, not having stabilized the operational context within which
the program is to operate (and thus having to make assumptions about this
context), not having fully defined near-term facilities solutions, and not knowing the
mission value that is to be derived from the first US-VISIT increment.
Because of all these risk factors, the ability of US-VISIT to measurably and
appreciably achieve DHS’s stated goals of facilitate legitimate travel and trade,
enhance national security, and adhere to U.S. privacy laws and policies is
uncertain. Moreover, DHS’s near-term investment in the program is at risk of not
delivering promised capabilities on time and within budget, and not producing
mission value commensurate with investment costs. Thus, it is imperative that the
factors that contribute to this level of risk are addressed thoroughly and
expeditiously.
                                                                                               77




                            Page 85                                       GAO-03-1083 Homeland Security
                           Appendix I
                           Briefing to the Staffs of the Subcommittees
                           on Homeland Security, Senate and House
                           Committees on Appropriations




                                              Recommendations for Executive Action


To address US-VISIT as a governmentwide program and to minimize the risks
facing the program, we recommend that the Secretary of Homeland Security, in
collaboration with cabinet officials from US-VISIT stakeholder departments and
agencies,
 • establish and charter an executive body, chaired by the Secretary’s designee,
   potentially co-chaired by the leadership from key stakeholder departments and
   agencies, and composed of appropriate senior-level representatives from DHS
   and each stakeholder organization, to guide and direct the US-VISIT program;
   and
 • direct this executive body to immediately take steps to (1) ensure that the
   human capital and financial resources are expeditiously provided to establish a
   fully functional and effective US-VISIT program office and associated
   management capability, (2) clarify the operational context within which US-
   VISIT must operate, and (3) decide whether proposed US-VISIT increments
   will produce mission value commensurate with costs and risks and disclose to
   the Congress planned actions based on this body’s decisions.


                                                                                              78




                           Page 86                                       GAO-03-1083 Homeland Security
                            Appendix I
                            Briefing to the Staffs of the Subcommittees
                            on Homeland Security, Senate and House
                            Committees on Appropriations




                                                                          Recommendations


Further, we recommend that the Secretary, through the Under Secretary for Border
and Transportation Security, direct the US-VISIT Program Director to expeditiously
establish an effective program management capability, including immediately
 • defining program office positional roles, responsibilities, and relationships;
 • developing and implementing a human capital strategy that provides for
   staffing these positions with individuals who have the requisite core
   competencies (knowledge, skills, and abilities);
 • developing and implementing a plan for satisfying key SEI acquisition
   management controls, to include acquisition planning, solicitation,
   requirements development and management, project management, contractor
   tracking and oversight, evaluation, and transition to support;
 • developing and implementing a risk management plan and ensuring that all
   high risks and their status are reported regularly to the executive body;




                                                                                                 79




                            Page 87                                         GAO-03-1083 Homeland Security
                         Appendix I
                         Briefing to the Staffs of the Subcommittees
                         on Homeland Security, Senate and House
                         Committees on Appropriations




                                                                       Recommendations


• defining performance standards for each US-VISIT system increment that are
  measurable and reflect the limitations imposed by relying on existing systems
  to form these system increments; and
• developing an analysis of incremental program cost, benefits, and risks, and
  providing this analysis to the executive body, to assist it in the body’s
  deliberations and decision-making.




                                                                                              80




                         Page 88                                         GAO-03-1083 Homeland Security
                           Appendix I
                           Briefing to the Staffs of the Subcommittees
                           on Homeland Security, Senate and House
                           Committees on Appropriations




                                                                         Agency Comments


We provided DHS a draft of this briefing and discussed its contents with the US-
VISIT Program Director and Deputy Director. In its oral comments, DHS agreed
with our findings, conclusions, and recommendations. The department also
provided some technical comments, which we have incorporated into the briefing,
as appropriate. Further, the US-VISIT Program Director stated that our work was
very helpful to him and to the program.




                                                                                                81




                           Page 89                                         GAO-03-1083 Homeland Security
                                     Appendix I
                                     Briefing to the Staffs of the Subcommittees
                                     on Homeland Security, Senate and House
                                     Committees on Appropriations




                                                                                                 Attachment I
                                                                                          Legislative History
Legislation             Key requirements
Illegal Immigration     By September 30, 1998, the Attorney General shall develop an automated entry exit control
Reform and Immigrant    system that—
Responsibility Act of   (1) collects a record of departure for every alien departing the United States and matches it with
1996                        the corresponding arrival record and
P.L. 104-208            (2) identifies, through on-line searching procedures, lawfully admitted aliens who overstay their
                            visas.
September 30, 1996
                        Overstay information identified through the system shall be integrated into appropriate
                        databases of the Immigration and Naturalization Service (INS) and the Department of State,
                        including those used at ports of entry and at consular offices.
                        Notwithstanding any other provision of federal, state, or local law, a federal, state, or local
                        government entity or official may not prohibit or in any way restrict any government entity or
                        official from sending to or receiving from INS information regarding the citizenship or
                        immigration status, lawful or unlawful, of any individual.
INS Data Management     For the purposes of this section, the term “integrated entry and exit data system” means an
Improvement Act of      electronic system that—
2000                    (1) provides access to, and integrates, alien arrival and departure data that are (a) authorized or
P.L. 106-215            required to be created or collected under law; (b) in an electronic format; and (c) in a database
                        of the Department of Justice or the Department of State, including those created or used at
June 15, 2000           ports of entry and at consular offices;
                        (2) uses available data described above to produce a report of arriving and departing aliens by
                        country of nationality, classification as an immigrant or nonimmigrant, and date of arrival in and
                        departure from the United States;
                        (3) matches an alien’s available arrival data with the alien’s available departure data;
                        (4) identifies, through on-line searching procedures, lawfully admitted nonimmigrants who may
                        have remained in the United States beyond the period authorized by the Attorney General; and



                                                                                                                          82




                                     Page 90                                                     GAO-03-1083 Homeland Security
                                   Appendix I
                                   Briefing to the Staffs of the Subcommittees
                                   on Homeland Security, Senate and House
                                   Committees on Appropriations




                                                                                              Attachment I
                                                                                       Legislative History
Legislation           Key requirements
INS Data Management   (5) otherwise uses available alien arrival and departure data described in paragraph (1) above
Improvement Act of    to permit the Attorney General to make the reports required under 8 U.S.C. section 1365a(e):
2000                  • Number of departure records collected, with an accounting by nationality.
P.L. 106-215          • Number of departure records that were successfully matched to records of arrival, with an
June 15, 2000            accounting by nationality and classification as an immigrant or nonimmigrant.
                      • Number of aliens who arrived pursuant to a nonimmigrant visa, or the Visa Waiver Program,
(cont’d)
                         for whom no matching departure data have been obtained through the system or by other
                         means as of the end of the alien’s authorized period of stay, with an accounting by nationality
                         and arrival date in the United States.
                      • Number of lawfully admitted nonimmigrants identified as visa overstays, with an accounting by
                         nationality.
                      The Attorney General shall implement the integrated entry exit system at airports and seaports
                      by December 31, 2003. System requirements:
                      • include available arrival/departure data,
                      • ensure that the arrival/departure data, when collected or created by an immigration officer, are
                         entered into the system and can be accessed by other officers at other air/seaports.
                      The Attorney General must implement the system at the 50 busiest land border ports of entry by
                      December 31, 2004. System requirements:
                      • Same as specified above
                      • Arrival/departure data on aliens shall be accessible at other high-traffic land border ports of
                         entry.
                      The system shall be fully implemented at all remaining ports of entry by December 31, 2005.




                                                                                                                      83




                                   Page 91                                                    GAO-03-1083 Homeland Security
                                        Appendix I
                                        Briefing to the Staffs of the Subcommittees
                                        on Homeland Security, Senate and House
                                        Committees on Appropriations




                                                                                                    Attachment I
                                                                                             Legislative History
Legislation               Key requirements
Visa Waiver Permanent Not later than October 1, 2001, the Attorney General shall develop and implement a fully automated
Program Act           entry exit control system that will collect a record of arrival and departure for every alien who arrives
P.L. 106-396          and departs by sea or air at a port of entry in the United States and is provided a waiver. Not later
                      than October 1, 2002, the system shall enable immigration officers conducting inspections at ports
October 30, 2000      of entry to obtain from the system, with respect to aliens seeking a waiver, (1) any photograph of
                      the alien that may be contained in the records of the State Department or INS; and (2) information
                      on whether the alien has ever been determined to be ineligible to receive a visa or be admitted to
                      the United States.
                      The system shall maintain, for a minimum of 10 years, information about each application for
                      admission made by an alien seeking a waiver.
                      On and after October 1, 2007, the alien at the time of application for admission must have a valid
                      unexpired machine-readable passport that satisfies the internationally accepted standard for
                      machine readability.
                      Countries designated to participate before May 1, 2000, shall issue machine-readable passports no
                      later than October 1, 2003.
                      All Visa Waiver Program (VWP) applicants are to be checked against lookout systems. By October
                      1, 2002, no waiver may be provided to an alien arriving by air or sea at a port of entry on a carrier
                      unless the carrier is electronically transmitting passenger data to the entry exit system.
                      Not less than 1 hour before arrival at port of entry, signatory aircraft transporting VWP aliens must
                      electronically furnish the passenger data required by the Attorney General in regulations.
                      The system shall contain sufficient data to permit the Attorney General to calculate, for each
                      program country and each fiscal year, the portion of nationals of that country who arrive under VWP
                      at air and sea ports of entry but for whom no record of departure exists, expressed as a percentage
                      of the total number of such VWP aliens for the particular country.




                                                                                                                           84




                                        Page 92                                                    GAO-03-1083 Homeland Security
                                         Appendix I
                                         Briefing to the Staffs of the Subcommittees
                                         on Homeland Security, Senate and House
                                         Committees on Appropriations




                                                                                                     Attachment I
                                                                                              Legislative History
Legislation               Key requirements
USA PATRIOT ACT           Focus of system development shall be on (a) utilization of biometric technology and (b) tamper-
P.L. 107-56               resistant documents readable at ports of entry.
                          The system must be accessible to (a) all consular officers responsible for visa issuance, (b) all
October 26, 2001          federal inspection agents at all U.S. border inspection points, and (c) all law enforcement and
                          intelligence officers responsible for investigation or identification of aliens.
                          The entry exit system must be able to interface with law enforcement databases to be used by
                          federal law enforcement to identify and detain individuals who pose a threat to the national security
                          of the United States.
Aviation and              (1) Not later than 60 days after the date of enactment, each air carrier and foreign air carrier
Transportation Security   operating a passenger flight in foreign air transportation to the United States shall provide to the
Act                       Commissioner of Customs by electronic transmission a passenger and crew manifest containing
P.L. 107-71               the following information:
November 19, 2001         • The full name of each passenger and crew member.
                          • The date of birth and citizenship of each passenger and crew member.
                          • The sex of each passenger and crew member.
                          • The passport number and country of issuance of each passenger and crew member if required
                            for travel.
                          • The U.S. visa number or resident alien card number of each passenger and crew member, as
                            applicable.
                          • Such other information as the Under Secretary of Transportation for Security, in consultation with
                            the Commissioner of Customs, determines is reasonably necessary to ensure aviation safety.
                          Carriers may use the advanced passenger information system established under section 431 of the
                          Tariff Act of 1930 (19 U.S.C. 1431) to provide the information required by the preceding sentence.




                                                                                                                              85




                                         Page 93                                                     GAO-03-1083 Homeland Security
                                         Appendix I
                                         Briefing to the Staffs of the Subcommittees
                                         on Homeland Security, Senate and House
                                         Committees on Appropriations




                                                                                                     Attachment I
                                                                                              Legislative History
Legislation               Key requirements
Aviation and              (2) Passenger name records—The carriers shall make passenger name record information
Transportation Security   available to the Customs Service upon request.
Act                       (3) Transmission of manifest—a passenger and crew manifest required for a flight under paragraph
P.L. 107-71               (1) above shall be transmitted to the Customs Service in advance of the aircraft landing in the
November 19, 2001         United States in such manner, time, and form as the Customs Service prescribes.
(cont’d)                  (4)Transmission of manifests to other federal agencies—Upon request, information provided to the
                          Under Secretary or the Customs Service under this subsection may be shared with other federal
                          agencies for the purpose of protecting national security.
Enhanced Border           No later than October 26, 2004, the Secretary of State and the Attorney General shall issue to
Security and Visa Entry   aliens only machine-readable, tamper-resistant visas and other travel and entry documents that use
Reform Act of 2002        biometrics. In addition to the requirement for biometric identifiers, name-search capacity and
P.L. 107-173              support must also be implemented between 18 months and 4.5 years after the date of enactment.
May 14, 2002              Not later than October 26, 2004, the Attorney General and Secretary of State shall install at all U.S.
                          ports of entry equipment and software to allow biometric comparison and authentication of all U.S.
                          visas and other travel and entry documents issued to aliens.
                          Not later than January 1, 2003, arrival and departure manifests must be electronically provided to
                          appropriate immigration officers for each passenger (including crew members and any other
                          occupants) of air and sea carriers at port of entry.
                          The information to be provided with respect to each person listed on a manifest shall include
                          (1) complete name; (2) date of birth; (3) citizenship; (4) sex; (5) passport number and country of
                          issuance; (6) country of residence; (7) U.S. visa number, date, and place of issuance, where
                          applicable; (8) alien registration number, where applicable; (9) U.S. address while in the United
                          States; and (10) such other information that the Attorney General, in consultation with the
                          Secretaries of State and the Treasury, determines as being necessary for the identification of the
                          persons transported and for the enforcement of the immigration laws and to protect safety and
                          national security.



                                                                                                                              86




                                         Page 94                                                     GAO-03-1083 Homeland Security
                           Appendix I
                           Briefing to the Staffs of the Subcommittees
                           on Homeland Security, Senate and House
                           Committees on Appropriations




                                                                               Attachment II
                                                                     Scope and Methodology

To accomplish our objectives, we
 • analyzed the expenditure plan against legislative conditions and other relevant
   federal requirements, guidance, and best practices to determine the extent to
   which the conditions were met;
 • analyzed supporting documentation and interviewed program officials to
   determine capabilities in key program management areas, such as acquisition
   planning, enterprise architecture, and project management;
 • analyzed key acquisition management controls documentation and interviewed
   program officials to determine the status of our open recommendations;
 • attended program working group meetings; and
 • assessed DHS’s plans and ongoing and completed actions to establish and
   implement the US-VISIT program (including acquiring the US-VISIT system,
   expanding and modifying existing port of entry facilities, and developing and
   implementing policies and procedures) and compared them to existing
   guidance to assess risks.


                                                                                                  87




                           Page 95                                           GAO-03-1083 Homeland Security
                          Appendix I
                          Briefing to the Staffs of the Subcommittees
                          on Homeland Security, Senate and House
                          Committees on Appropriations




                                                                              Attachment II
                                                                    Scope and Methodology

We did not independently validate DHS’s provided information.
We conducted our work at DHS headquarters in Washington, D.C., from April
through July 2003 in accordance with generally accepted government auditing
standards.




                                                                                                 88




                          Page 96                                           GAO-03-1083 Homeland Security
Appendix II

Comments from the Department of Homeland
Security                                                   Appendx
                                                                 Ii




              Page 97          GAO-03-1083 Homeland Security
           Appendix II
           Comments from the Department of Homeland
           Security




(310266)   Page 98                                    GAO-03-1083 Homeland Security
GAO’s Mission            The General Accounting Office, the audit, evaluation and investigative arm of
                         Congress, exists to support Congress in meeting its constitutional responsibilities
                         and to help improve the performance and accountability of the federal government
                         for the American people. GAO examines the use of public funds; evaluates federal
                         programs and policies; and provides analyses, recommendations, and other
                         assistance to help Congress make informed oversight, policy, and funding
                         decisions. GAO’s commitment to good government is reflected in its core values of
                         accountability, integrity, and reliability.


Obtaining Copies of      The fastest and easiest way to obtain copies of GAO documents at no cost is
                         through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full-
GAO Reports and          text files of current reports and testimony and an expanding archive of older
                         products. The Web site features a search engine to help you locate documents
Testimony                using key words and phrases. You can print these documents in their entirety,
                         including charts and other graphics.
                         Each day, GAO issues a list of newly released reports, testimony, and
                         correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site
                         daily. The list contains links to the full-text document files. To have GAO e-mail this
                         list to you every afternoon, go to www.gao.gov and select “Subscribe to
                         e-mail alerts” under the “Order GAO Products” heading.


Order by Mail or Phone   The first copy of each printed report is free. Additional copies are $2 each. A check
                         or money order should be made out to the Superintendent of Documents. GAO
                         also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single
                         address are discounted 25 percent. Orders should be sent to:
                         U.S. General Accounting Office
                         441 G Street NW, Room LM
                         Washington, D.C. 20548
                         To order by Phone:     Voice: (202) 512-6000
                                                TDD: (202) 512-2537
                                                Fax: (202) 512-6061


To Report Fraud,         Contact:
                         Web site: www.gao.gov/fraudnet/fraudnet.htm
Waste, and Abuse in      E-mail: fraudnet@gao.gov
Federal Programs         Automated answering system: (800) 424-5454 or (202) 512-7470



Public Affairs           Jeff Nelligan, Managing Director, NelliganJ@gao.gov (202) 512-4800
                         U.S. General Accounting Office, 441 G Street NW, Room 7149
                         Washington, D.C. 20548
United States                  Presorted Standard
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. GI00
Official Business
Penalty for Private Use $300
Address Service Requested