GAO: US-VISIT lacks controls

First Phase of Visitor and Immigration Status Program Operating, but Improvements Needed

Despite the successful launch of the first phase of the foreign visitor tracking system earlier this year, Homeland Security Department officials didn't implement rigorous management and testing controls in a timely manner, congressional auditors said.

That is critical as the size, scope and complexity of the U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT), which will collect, maintain and share biometric and other data on foreign visitors to the United States, continues to grow, according to a General Accounting Office report released today.

GAO said the first phase, or increment, of the tracking system at 115 airports and 14 seaports was largely on time, on budget and successful.

"However, DHS has not employed rigorous management controls typically associated with successful programs, such as test management, and its plans for implementing other controls, such as independent verification and validation, may not prove effective," the report stated.

The report added that testing of the implemented system wasn't well managed and was completed after the system became operational. Now that the second phase of the system is under way, such management controls still haven't been established.

"These controls, while significant for the initial phases of US-VISIT, are even more critical for the later phases, because the size and complexity of the program will only increase, and the later that problems are found, the harder and more costly they are to fix," the report stated.

The program, which DHS officials are introducing in various phases, could eventually take 10 years to complete and cost about $10 billion. DHS officials are expected to pick a prime integrator for the system in late May.

GAO officials recommended that DHS address the program management weaknesses sooner rather than later otherwise the risk will increase. In the report, DHS officials responded that they agreed with most of the GAO recommendations and observations but not all.

DHS officials said they had completed a security plan and a privacy impact assessment, contrary to what GAO officials reported. They also disputed the GAO conclusion that DHS officials developed a test plan for the first phase after it became operational.