Homeland Security
Key US-VISIT Components at Varying Stages of Completion, but Integrated and Reliable Schedule Needed Gao ID: GAO-10-13 November 19, 2009The Department of Homeland Security's (DHS) U.S. Visitor and Immigrant Status Indicator Technology (US-VISIT) program stores and processes biometric and biographic information to, among other things, control and monitor the entry and exit of foreign visitors. Currently, an entry capability is operating at almost 300 U.S. ports of entry, but an exit capability is not. The Government Accountability Office (GAO) has previously reported on limitations in DHS's efforts to plan and execute its efforts to deliver US-VISIT exit, and made recommendations to improve these areas. GAO was asked to determine (1) the status of DHS's efforts to deliver a comprehensive exit solution and (2) to what extent DHS is applying an integrated approach to managing its comprehensive exit solution. To accomplish this, GAO assessed US-VISIT exit project plans, schedules, and other management documentation against relevant criteria, and it observed exit pilots.
DHS has established a Comprehensive Exit project within its US-VISIT program that consists of six components that are at varying stages of completion. To DHS's credit, the US-VISIT program office has established integrated project management plans for, and has adopted an integrated approach to, interacting with and involving stakeholders in its Comprehensive Exit project. However, it has not adopted an integrated approach to scheduling, executing, and tracking the work that needs to be accomplished to deliver a comprehensive exit solution. Rather, it is relying on several separate and distinct schedules to manage individual components and the US-VISIT prime contractor's work that supports these components. Moreover, neither of the two component schedules that GAO reviewed are reliable because they have not been derived in accordance with relevant guidance. Specifically, both the Air Exit Pilots schedule and the Temporary Worker Visa Exit Pilot schedule only fully meet one of nine key schedule estimating practices, and either partially, minimally, or do not meet the remaining eight. In contrast, the prime contractor's schedule is largely reliable, as it fully or substantially meets all nine practices. Without a master schedule for the Comprehensive Exit project that is integrated and derived in accordance with relevant guidance, DHS cannot reliably commit to when and how the work will be accomplished to deliver a comprehensive exit solution to its almost 300 ports of entry, and it cannot adequately monitor and manage its progress toward this end.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-10-13, Homeland Security: Key US-VISIT Components at Varying Stages of Completion, but Integrated and Reliable Schedule Needed
This is the accessible text file for GAO report number GAO-10-13
entitled 'Homeland Security: Key US-VISIT Components at Varying Stages
of Completion, but Integrated and Reliable Schedule Needed' which was
released on November 19, 2009.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to Congressional Requesters:
United States Government Accountability Office:
GAO:
November 2009:
Homeland Security:
Key US-VISIT Components at Varying Stages of Completion, but Integrated
and Reliable Schedule Needed:
GAO-10-13:
GAO Highlights:
Highlights of GAO-10-13, a report to congressional requesters.
Why GAO Did This Study:
The Department of Homeland Security‘s (DHS) U.S. Visitor and Immigrant
Status Indicator Technology (US-VISIT) program stores and processes
biometric and biographic information to, among other things, control
and monitor the entry and exit of foreign visitors. Currently, an entry
capability is operating at almost 300 U.S. ports of entry, but an exit
capability is not. GAO has previously reported on limitations in DHS‘s
efforts to plan and execute its efforts to deliver US-VISIT exit, and
made recommendations to improve these areas. GAO was asked to determine
(1) the status of DHS‘s efforts to deliver a comprehensive exit
solution and (2) to what extent DHS is applying an integrated approach
to managing its comprehensive exit solution. To accomplish this, GAO
assessed US-VISIT exit project plans, schedules, and other management
documentation against relevant criteria, and it observed exit pilots.
What GAO Found:
DHS has established a Comprehensive Exit project within its US-VISIT
program that consists of six components that are at varying stages of
completion. These components and the status of each according to the
project execution process of US-VISIT‘s system life cycle management
methodology are summarized in the figure below.
Figure: Comprehensive Exit Components and Status:
[Refer to PDF for image: illustrated table]
Component: Air/Sea Biometric Release 1;
Project execution life cycle phase: Plan: Complete;
Project execution life cycle phase: Analyze: Complete;
Project execution life cycle phase: Design: Complete;
Project execution life cycle phase: Build: Complete;
Project execution life cycle phase: Test: In progress;
Project execution life cycle phase: Deploy: Not yet started;
Project execution life cycle phase: Transition: Not yet started.
Component: Reporting Phase 1;
Project execution life cycle phase: Plan: Complete;
Project execution life cycle phase: Analyze: Complete;
Project execution life cycle phase: Design: Complete;
Project execution life cycle phase: Build: Complete;
Project execution life cycle phase: Test: Complete;
Project execution life cycle phase: Deploy: Complete;
Project execution life cycle phase: Transition: Complete.
Component: Air Exit Pilots;
Project execution life cycle phase: Plan: Complete;
Project execution life cycle phase: Analyze: Complete;
Project execution life cycle phase: Design: Complete;
Project execution life cycle phase: Build: Complete;
Project execution life cycle phase: Test: Complete;
Project execution life cycle phase: Deploy: Complete;
Project execution life cycle phase: Transition: N/A.
Component: Long-term Air/Sea;
Project execution life cycle phase: Plan: Not yet started;
Project execution life cycle phase: Analyze: Not yet started;
Project execution life cycle phase: Design: Not yet started;
Project execution life cycle phase: Build: Not yet started;
Project execution life cycle phase: Test: Not yet started;
Project execution life cycle phase: Deploy: Not yet started;
Project execution life cycle phase: Transition: Not yet started.
Component: Temporary Worker Visa Exit Pilot;
Project execution life cycle phase: Plan: Complete;
Project execution life cycle phase: Analyze: Complete;
Project execution life cycle phase: Design: Complete;
Project execution life cycle phase: Build: Complete;
Project execution life cycle phase: Test: In progress;
Project execution life cycle phase: Deploy: Not yet started;
Project execution life cycle phase: Transition: Not yet started;.
Component: Long-term Land;
Project execution life cycle phase: Plan: Not yet started;
Project execution life cycle phase: Analyze: Not yet started;
Project execution life cycle phase: Design: Not yet started;
Project execution life cycle phase: Build: Not yet started;
Project execution life cycle phase: Test: Not yet started;
Project execution life cycle phase: Deploy: Not yet started;
Project execution life cycle phase: Transition: Not yet started.
Sources: GAO analysis of DHS data and information from program
officials.
Note: Because the Air Exit Pilots were decommissioned upon completion,
they were not transitioned beyond the project execution process.
[End of figure]
To DHS‘s credit, the US-VISIT program office has established integrated
project management plans for, and has adopted an integrated approach
to, interacting with and involving stakeholders in its Comprehensive
Exit project. However, it has not adopted an integrated approach to
scheduling, executing, and tracking the work that needs to be
accomplished to deliver a comprehensive exit solution. Rather, it is
relying on several separate and distinct schedules to manage individual
components and the US-VISIT prime contractor‘s work that supports these
components. Moreover, neither of the two component schedules that GAO
reviewed are reliable because they have not been derived in accordance
with relevant guidance. Specifically, both the Air Exit Pilots schedule
and the Temporary Worker Visa Exit Pilot schedule only fully meet one
of nine key schedule estimating practices, and either partially,
minimally, or do not meet the remaining eight. In contrast, the prime
contractor‘s schedule is largely reliable, as it fully or substantially
meets all nine practices.
Without a master schedule for the Comprehensive Exit project that is
integrated and derived in accordance with relevant guidance, DHS cannot
reliably commit to when and how the work will be accomplished to
deliver a comprehensive exit solution to its almost 300 ports of entry,
and it cannot
What GAO Recommends:
GAO is augmenting its prior recommendations to the Secretary of
Homeland Security aimed at strengthening US-VISIT exit planning and
execution by recommending that the Secretary ensure that an integrated
master schedule for the department‘s Comprehensive Exit project be
developed and maintained in accordance with the key practices embodied
in relevant guidance. DHS concurred with GAO‘s recommendation.
View [hyperlink, http://www.gao.gov/products/GAO-10-13] or key
components. For more information, contact Randolph C. Hite at (202) 512-
3439 or hiter@gao.gov.
[End of section]
Contents:
Letter:
Background:
Comprehensive Exit Project Consists of Six Components That Are in
Various Phases of Delivery:
DHS Approach to Managing Comprehensive Exit Project Is Not Fully
Integrated:
Conclusions:
Recommendation for Executive Action:
Agency Comments and Our Evaluation:
Appendix I: Objectives, Scope, and Methodology:
Appendix II: Detailed Results of GAO Assessment of Schedules for
Ongoing Comprehensive Exit Components and Prime Contractor Schedule:
Appendix III: Comments from the Department of Homeland Security:
Appendix IV: GAO Contact and Staff Acknowledgments:
Tables:
Table 1: Component and Contractor Schedules Satisfaction of GAO
Schedule Estimating Best Practices:
Table 2: US-VISIT Air Exit Pilots Schedule Compared to Best Practices:
Table 3: US-VISIT Temporary Worker Visa Exit Pilot Schedule Compared to
Best Practices:
Table 4: US-VISIT Contractor Schedule Compared to Best Practices:
Figures:
Figure 1: Mission Processes Supported by US-VISIT:
Figure 2: Timeline of Incremental US-VISIT Capabilities:
Figure 3: Comprehensive Exit Components and Status:
Figure 4: Illustration of Air Exit Pilots Biometric Data Collection and
Transmission Process:
Abbreviations:
CBP: U.S. Customs and Border Protection:
DHS: Department of Homeland Security:
DMIA: Immigration and Naturalization Service Data Management
Improvement Act of 2000:
ELCM: Enterprise Life Cycle Methodology:
FBI: Federal Bureau of Investigation:
IDENT: Automated Biometric Identification System:
IIRIRA: Illegal Immigration Reform and Immigrant Responsibility Act of
1996:
POE: port of entry:
RFID: radio frequency identification:
TSA: Transportation Security Administration:
US-VISIT: U.S. Visitor and Immigrant Status Indicator Technology:
WBS: work breakdown structure:
[End of section]
United States Government Accountability Office:
Washington, DC 20548:
November 19, 2009:
The Honorable Bennie G. Thompson:
Chairman:
Committee on Homeland Security:
House of Representatives:
The Honorable Loretta Sanchez:
Chairwoman:
Subcommittee on Border, Maritime and Global Counterterrorism:
Committee on Homeland Security:
House of Representatives:
For many years, Congress and the executive branch have sought better
ways to record and track the arrival and departure of foreign travelers
through U.S. air, sea, and land ports of entry (POE). Pursuant to a
series of statutory mandates, the Department of Homeland Security
(DHS), in coordination with the Department of State, established a
program to use biometric and biographic information to control and
monitor the pre-entry, entry, status, and exit of certain foreign
visitors and immigrants.
This program, which is called the U.S. Visitor and Immigrant Status
Indicator Technology (US-VISIT) program,[Footnote 1] is intended to
enhance the security of U.S. citizens and visitors, facilitate
legitimate travel and trade, ensure the integrity of the U.S.
immigration system, and protect the privacy of visitors to the United
States. Since 2006, DHS has been operating a US-VISIT entry capability
at about 300 air, sea, and land POEs, and has conducted evaluations and
proof-of-concept experiments relative to a US-VISIT exit capability.
However, it has yet to develop and deploy an operational exit solution
at U.S. POEs. The program's current efforts to develop an exit
capability are collectively referred to as the Comprehensive Exit
project.
Because of the strategic importance of a US-VISIT exit capability to
our nation's evolving immigration and border management missions, you
asked us to determine (1) the status of DHS's efforts to deliver a
comprehensive exit solution and (2) to what extent DHS is employing an
integrated approach to managing its Comprehensive Exit solution. To
accomplish our objectives, we reviewed key program documentation,
including plans and schedules, to determine the composition of the
Comprehensive Exit project and the status of its components. We also
reviewed key Comprehensive Exit project management documentation and
compared it with guidance relevant to the management of interrelated
initiatives.
We conducted this performance audit at the US-VISIT Program Office in
Arlington, Virginia; U.S. Customs and Border Protection (CBP)
headquarters offices in Washington, D.C.; Transportation Security
Administration (TSA) headquarters offices in Arlington, Virginia;
Detroit Metropolitan Wayne County Airport in Detroit, Michigan; and
Hartsfield-Jackson Atlanta International Airport in Atlanta, Georgia,
from January 2009 to November 2009 in accordance with generally
accepted government auditing standards. Those standards require that we
plan and perform the audit to obtain sufficient, appropriate evidence
to provide a reasonable basis for our findings and conclusions based on
our audit objectives. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit
objectives. For more details on our objectives, scope, and methodology,
see appendix I.
Background:
US-VISIT's goals are to (1) enhance the security of U.S. citizens and
visitors, (2) facilitate legitimate travel and trade, (3) ensure the
integrity of the U.S. immigration system, and (4) protect the privacy
of visitors.[Footnote 2] The program is to achieve these goals by:
* collecting, maintaining, and sharing information on certain foreign
nationals who enter and exit the United States;
* identifying foreign nationals who (1) have overstayed or violated the
terms of their visit; (2) can receive, extend, or adjust their
immigration status; or (3) should be apprehended or detained by law
enforcement officials;
* detecting fraudulent travel documents, verifying visitor identity,
and determining visitor admissibility through the use of biometrics
(digital fingerprints and a digital photograph); and:
* facilitating information sharing and coordination within the
immigration and border management community.
Federal Statutes Provide a Strategic Framework for US-VISIT:
A series of statutes that date back more than a decade have provided a
framework for developing and deploying US-VISIT entry and exit
capabilities. The Illegal Immigration Reform and Immigrant
Responsibility Act of 1996 (IIRIRA)[Footnote 3] required the Attorney
General to develop an automated system to record the departure of every
foreign national from the United States and then match it to the
individual's arrival record. Subsequently, section 2(a) of the
Immigration and Naturalization Service Data Management Improvement Act
(DMIA) of 2000[Footnote 4] amended the original entry-exit provisions
of IIRIRA and required the Attorney General[Footnote 5] to implement an
integrated entry and exit data system for foreign nationals.[Footnote
6] More specifically, DMIA required an electronic system that would
provide access to and integrate foreign national arrival and departure
data that are authorized or required to be created or collected under
law and are in an electronic format in Department of Justice or
Department of State databases, such as those used at POEs and consular
offices. The system, as described in DMIA, is to compare available
arrival records with available departure records, allow online search
procedures to identify foreign nationals who may have overstayed their
authorized period of admission, and use available data to produce a
report of arriving and departing foreign nationals. DMIA also required
the implementation of the system at airports and seaports by December
31, 2003, at the 50 highest-volume land POEs by December 31, 2004, and
at all remaining POEs by December 31, 2005.
Subsequent laws added specific biometric requirements. The USA PATRIOT
Act of 2001,[Footnote 7] as amended, required the development and
certification of a technology standard by January 26, 2003, including
appropriate biometric identifiers that can be used to verify the
identity of persons applying for a U.S. visa or seeking to enter the
United States pursuant to a visa, for the purposes of conducting
background checks, confirming identity, and ensuring that a person has
not received a visa under a different name. The act also required DHS
and the Department of State to focus on the utilization of biometric
technology and the development of tamper-resistant documents readable
at POEs for the integrated entry and exit data system.
The Visa Waiver Permanent Program Act[Footnote 8] required DHS to
develop and implement a fully automated system to control entry and
exit of aliens at airports and seaports who enter the United States
under the Visa Waiver Program. The act was subsequently amended to
require, not later than August 3, 2008, an exit system that uses
biometric information and records every alien participating in the Visa
Waiver Program that departs the United States by air.[Footnote 9]
The Intelligence Reform and Terrorism Prevention Act of 2004[Footnote
10] requires the collection of biometric exit data for all categories
of individuals required to provide biometric entry data under US-VISIT,
regardless of the POE where they entered the United States. The law
also required DHS to develop a plan to accelerate the full
implementation of the program.
The Implementing Recommendations of the 9/11 Commission Act of 2007
[Footnote 11] further addressed the Visa Waiver Program by restricting
DHS's authority to admit additional countries into the Visa Waiver
Program until the department, among other things, was able to certify
that it could verify the departure of not less than 97 percent of
foreign nationals who exit from U.S. airports and had incorporated
biometric indicators (such as fingerprints) into the air exit system by
June 30, 2009.
Overview of US-VISIT Scope and Systems Environment:
US-VISIT supports a series of homeland security-related mission
processes that cover hundreds of millions of foreign national travelers
who enter and leave the United States at about 300 air, sea, and land
POEs. These five processes are described in the next section and
depicted in figure 1.
Figure 1: Mission Processes Supported by US-VISIT:
[Refer to PDF for image: illustration]
Pre-entry;
Entry;
Status;
Exit.
Analysis occurs during the entire process.
Sources: GAO analysis of US-VISIT data; Nova Development Corp.
(clipart).
[End of figure]
* Pre-entry: the process of evaluating a traveler's eligibility for
required travel documents, enrolling travelers in automated inspection
programs, and prescreening travelers entering the United States.
* Entry: the process of determining a traveler's admissibility into the
United States at air, sea, or land POEs.
* Status management: the process of managing and monitoring the changes
and extensions of the visits of lawfully admitted nonimmigrant foreign
nationals to ensure that they adhere to the terms of their admission
and that they notify appropriate government entities when they do not.
* Exit: the process of collecting information on travelers departing
the United States.
* Analysis: the process of continuously screening against watch lists
of individuals enrolled in US-VISIT for appropriate reporting and
action.
To support these processes, US-VISIT systems and equipment must
exchange data with a variety of other systems, some of which are owned
by other agencies. For example, US-VISIT's Automated Biometric
Identification System (IDENT) collects and stores biometric data about
foreign visitors, including information from the Federal Bureau of
Investigation (FBI), U.S. Immigration and Customs Enforcement
information on deported felons and sexual offender registrants, and DHS
information on previous criminal histories and previous IDENT
enrollments. IDENT connects to a number of different systems, some of
which are described here.
* Arrival and Departure Information System is owned by US-VISIT and
stores noncitizen traveler arrival and departure biographic data
received from air and sea carrier manifests. It matches entry,
immigration status updates, and departure data to provide immigration
status, including whether the individual has overstayed his or her
authorized period of stay.
* Consular Consolidated Database is owned by the Department of State
and includes information on visa applicants.
* TECS, formerly known as the Treasury Enforcement Communications
System, is owned by CBP and maintains lookout (i.e., watch list) data,
interfaces with other agencies' databases, and is currently used by CBP
officers at POEs to verify traveler information and update traveler
data.
* U.S. Coast Guard's Mona Pass Proof-of-Concept is determining the
feasibility of deploying a mobile biometrics identification capability
on Coast Guard cutters in the Mona Passage[Footnote 12] and in the
Coast Guard's South Florida patrol area.
* Integrated Automated Fingerprint Identification System is owned by
FBI and is the bureau's automated 10-fingerprint matching system and is
electronically connected to all 50 states, as well as some federal
agencies.
Overview of US-VISIT History, Organizational Placement, and Progress:
The US-VISIT program has roots in a program known as Entry Exit, which
was established by the former Immigration and Naturalization Service in
2002 in response to IIRIRA and other relevant legislation. Following
the merger of the functions of the Immigration and Naturalization
Service into DHS in 2003, the program was placed in DHS's Border and
Transportation Security Directorate and renamed US-VISIT. In 2007, US-
VISIT was moved to DHS's National Protection and Programs Directorate.
DHS has delivered US-VISIT entry, and evaluated exit, capabilities in a
series of increments. As a result, a biometrically enabled entry
capability has been fully operational at about 300 air, sea, and land
POEs since December 2006 (115 airports, 14 seaports, and 154 of 170
land ports[Footnote 13]), but an exit capability has yet to be fully
deployed.Increment 1 (air and sea entry), Increment 2B (land entry),
[Footnote 14] and Increment 3 (land entry) addressed the deployment of
an entry capability, while Increment 1B (air and sea exit) and
Increment 2C (land exit) evaluated different alternatives for
collecting exit information. The timing and purpose of each increment,
as well as the delivery of other significant US-VISIT capabilities, are
depicted in figure 2 and described after the figure.
Figure 2: Timeline of Incremental US-VISIT Capabilities:
[Refer to PDF for image: timeline]
Increment 1B air/sea exit pilots:
January 2004 through May 2007.
Increment 2C land entry/exit RFID proof-of-concept:
August 2005 through November 2006.
Increment 1 air/sea entry deployed: January 2004.
Increment 2B land entry deployed: December 2004.
Increment 3 land entry deployed: December 2005.
Comprehensive Exit chartered: August 2007.
Source: GAO analysis of DHS documentation.
[End of figure]
Increments 1, 2B, and 3, which largely involved building interfaces
among existing systems and enhancing the systems' capabilities and
supporting infrastructure, were delivered sequentially from January
2004 to December 2006. Specifically, in January 2004, the program
office began operating most aspects of its planned biometric entry
capability at 115 airports and 14 seaports for certain foreign
nationals, including those from visa waiver countries (Increment
1).[Footnote 15] This capability was expanded to the 50 busiest land
POEs by December 2004 (Increment 2B) and essentially deployed to 104
remaining land POEs by December 2005 (Increment 3).[Footnote 16] As of
December 2006, the program office was operating this entry capability
at 154 of 170 land POEs.
According to DHS, US-VISIT entry operations have produced mission
value. For example, as of June 2009, the program reported that it had
more than 150,000 biometric hits in entry resulting in more than 8,000
people having adverse actions, such as denial of entry, taken against
them. Further, about 43,000 leads were referred to the U.S. Immigration
and Customs Enforcement immigration enforcement unit, resulting in
1,691 arrests.[Footnote 17] Although difficult to demonstrate,
officials have also cited the possible deterrence of terrorist entry
due to the program's publicized capability to verify visitor identity
at U.S. borders during entry and to match visitors against watch lists
of known and suspected terrorists.
In parallel with the delivery of entry capabilities, DHS examined the
use of technology for recording the exit of travelers in the air, sea,
and land environments.
* Increment 1B consisted of a series of air and sea biometric exit
pilots that operated from January 2004 to May 2007 at 14 U.S. POEs. The
purpose of these pilots was to evaluate three different types of
technology solutions: self-service kiosk, mobile device, and a
combination of the two. All three solutions involved capturing a
traveler's digital photograph and fingerprint. The pilots established
the technical feasibility of a biometric exit solution at air and sea
POEs. They also identified issues that limited the operational
effectiveness of the solution (e.g., unacceptably low traveler
compliance rates).
* Increment 2C, land entry/exit proof-of-concept demonstrations,
operated at five ports of entry from August 2005 to November 2006. The
purpose of these demonstrations was to examine the feasibility of using
passive radio frequency identification (RFID) technology[Footnote 18]
to record travelers' entry and exit via a unique ID number tag embedded
in the Form I-94 and to provide CBP officers in pedestrian lanes with
biographic, biometric, and watch list data. The demonstrations showed
that RFID technology was too immature to meet the requirements of a
land exit solution.
Currently, US-VISIT development and deployment efforts consist of two
ongoing projects: (1) Unique Identity and (2) Comprehensive Exit.
* Unique Identity is to establish a single identity for all individuals
encountered across the immigration and border mission area. This
project consists of developing and deploying three capabilities. First,
10-print identification is to provide the means for capturing 10
fingerprints and enables the other two Unique Identity components, and
increases the fingerprint matching accuracy in IDENT. DHS plans to
complete 10-print deployment to all POEs in the fall of 2009. Second,
enumeration is to associate the biometric and biographical data within
IDENT and FBI's fingerprint identification system with individuals
encountered by immigration and border management entities. DHS reports
that enumeration is being used by DHS's U.S. Citizenship and
Immigration Services. Third, IDENT interoperability with FBI's
fingerprint identification system is to enable DHS and FBI to share
biometric and related biographic, criminal history, and immigration
history data. DHS reports the development of this interoperability is
in the second of three phases, each of which expands the types and
amount of data shared between DHS and FBI, and that planning has begun
for the third phase. In 2007, DHS estimated that Unique Identity would
cost the department about $5.7 billion to acquire, and about $40.1
billion to operate and maintain through the year 2020.
* Comprehensive Exit was chartered in August 2007 to develop and deploy
air and sea exit capability and to plan for a land exit solution.
Project stakeholders include U.S. Immigration and Customs Enforcement,
the Office of Screening Coordination and Operations, CBP, air and sea
carriers, port authorities, TSA, and the U.S. Coast Guard.
In April 2008, DHS issued a Notice of Proposed Rule Making[Footnote 19]
to announce the intent to implement biometric exit verification at air
and sea POEs. Under this notice, commercial air and sea carriers would
be responsible for developing and deploying the capability to collect
the biometrics from departing travelers and transmit them to DHS.
According to program planning documents, US-VISIT originally planned to
publish a final rule in June 2008 and for an initial capability to be
deployed by December 2008. However, a final rule has yet to be
published and, according to US-VISIT program officials, an official
date for doing so has not been established.
Subsequent to the rule making notice, the Consolidated Security,
Disaster Assistance, and Continuing Appropriations Act, 2009[Footnote
20] mandated that no US-VISIT fiscal year 2009 appropriations be used
for the implementation of an air exit solution pursuant to the rule
making notice until DHS reported to the Senate and House Committees on
Appropriations on pilot tests that had been conducted for at least two
scenarios: (1) airline collection and transmission of biometric exit
data, as proposed in the rule making notice and (2) CBP collection of
such information at the departure gate.
Through fiscal year 2009, DHS had been appropriated about $2.5 billion
for US-VISIT. As of July 2009, the program reported that about $186
million of that amount had been obligated to develop air/sea and land
exit solutions since 2002.[Footnote 21] The department requested about
$356 million for US-VISIT in fiscal year 2010 and was appropriated
about $374 million.
Prior GAO Reviews of US-VISIT Exit Have Raised Challenges and Issues:
Since 2004, we have identified a range of management challenges and
issues associated with DHS efforts to develop and deploy an exit
solution. For example, we reported in May 2004[Footnote 22] that a
limited exit portion of US-VISIT had deployed to only two POEs. In
February 2005,[Footnote 23] we reported that the ongoing air and sea
exit pilot faced a compressed timeline, had missed milestones, and
potentially was to be reduced in scope and that the changing facts and
circumstances surrounding the exit pilot had introduced additional
risk. In December 2006,[Footnote 24] we reported that DHS could not
implement a biometric exit capability without incurring a major impact
on land POE facilities. In February and August 2007,[Footnote 25] we
found that DHS had not adequately defined and justified its proposed
expenditures for exit pilots and demonstration projects and that it had
not developed a complete schedule for biometric exit implementation.
In February 2008,[Footnote 26] we reported that the Comprehensive Exit
project had not been adequately defined, citing its lack of appropriate
analysis to support established high-level project milestones.
Accordingly, we recommended that DHS develop a plan for delivering a
comprehensive exit capability that included, among other things, key
milestones and performance measures. In September 2008,[Footnote 27] we
further reported that DHS was unlikely to meet its timeline for
implementing an air exit system with biometric indicators, such as
fingerprints, by July 1, 2009, due to several unresolved issues, such
as opposition to the department's published plan by the airline
industry. Most recently, in December 2008,[Footnote 28] we reported
that DHS still had not developed a schedule for the full implementation
of a comprehensive exit solution. In each of these reports, we made
recommendations to ensure that US-VISIT exit was planned, designed,
developed, and implemented in an effective and efficient manner. DHS
generally agreed with our recommendations.
US-VISIT Projects Governed by Life Cycle Development Methodology:
The US-VISIT Enterprise Life Cycle Methodology (ELCM) is a framework
for planning, managing, and implementing capabilities program-wide that
applies to all US-VISIT program increments, task orders, mission
capability enhancements, projects, components, acquisitions, and all
agreements with partner/stakeholder and contractor organizations. Among
other things, the ELCM provides guidance for managing related US-VISIT
projects that have distinct cost, schedule, scope, and risk components,
and that may be at different project phases at a given time.
The ELCM consists of several process areas, such as program management,
project execution, and operations and maintenance. The project
execution process area includes seven subprocesses, or phases. The
subprocesses are:
* plan, which focuses on project-level planning for individual
initiatives and builds on the strategic planning that occurs in the
program planning process area;
* analyze, which includes the gathering, identification, refinement,
analysis, and management of requirements;
* design, which includes designing the applications, technical
architecture, technical infrastructure, and application training;
* build, which includes the development of the application, technical
architecture, and technical infrastructure;
* test, which includes testing the components built and validating the
solution with users;
* deploy, which includes rolling out the application, technical
architecture, technical infrastructure, and training to the
organization; and:
* transition, which includes ensuring that all identified transition
tasks are carried out and any open issues from deployment are
documented and addressed.
The operations and maintenance process provides for ongoing support of
a deployed system solution. A typical project will be planned,
developed, and deployed during project execution and sustained as part
of operations and maintenance.
Within each subprocess, the ELCM specifies certain activities that are
to be performed. For example, the test subprocess defines a series of
nine tests that are to be conducted, including user acceptance testing,
which verifies that the system meets user requirements, and operational
readiness testing, which ensures the operational environment's
readiness to accept the new system.
Comprehensive Exit Project Consists of Six Components That Are in
Various Phases of Delivery:
Comprehensive Exit was initiated to develop and implement a means to
capture biometric information from travelers who are subject to US-
VISIT as they exit the United States, and to do so in a way that
integrates biometrics collection into existing exit procedures at air,
sea, and land POEs and enables the matching of biometric exit and entry
records to determine which travelers have left the country. According
to DHS, this capability will allow the department to confirm the
identity of a person leaving the country, and thereby (1) maximize
investigative resources by preventing searches for travelers who have
already left the country; and (2) identify overstays by country and by
visa category, to better inform policy decision makers.
DHS is pursuing the Comprehensive Exit project through six component
efforts, each of which addresses either the air/sea or land
environments:
* The air/sea environment is being addressed through Air/Sea Biometric
Exit Release 1, Reporting Phase 1, the Air Exit Pilots, and Long-term
Air/Sea Exit.
* The land environment is being addressed through the Temporary Worker
Visa Exit Pilot and Long-term Land Exit.
The two long-term components for Air/Sea and Land have yet to begin.
They are to be informed or supported by the four other components.
According to program officials, planning for the two long-term
components is contingent upon departmental decisions that have not yet
been made.
DHS is employing the ELCM to manage each component. The status of each
exit component relative to the ELCM project execution subprocesses is
summarized in figure 3 and discussed in more detail after the figure.
Figure 3: Comprehensive Exit Components and Status:
[Refer to PDF for image: illustrated table]
Component: Air/Sea Biometric Release 1;
Project execution life cycle phase: Plan: Complete;
Project execution life cycle phase: Analyze: Complete;
Project execution life cycle phase: Design: Complete;
Project execution life cycle phase: Build: Complete;
Project execution life cycle phase: Test: In progress;
Project execution life cycle phase: Deploy: Not yet started;
Project execution life cycle phase: Transition: Not yet started.
Component: Reporting Phase 1;
Project execution life cycle phase: Plan: Complete;
Project execution life cycle phase: Analyze: Complete;
Project execution life cycle phase: Design: Complete;
Project execution life cycle phase: Build: Complete;
Project execution life cycle phase: Test: Complete;
Project execution life cycle phase: Deploy: Complete;
Project execution life cycle phase: Transition: Complete.
Component: Air Exit Pilots;
Project execution life cycle phase: Plan: Complete;
Project execution life cycle phase: Analyze: Complete;
Project execution life cycle phase: Design: Complete;
Project execution life cycle phase: Build: Complete;
Project execution life cycle phase: Test: Complete;
Project execution life cycle phase: Deploy: Complete;
Project execution life cycle phase: Transition: N/A.
Component: Long-term Air/Sea;
Project execution life cycle phase: Plan: Not yet started;
Project execution life cycle phase: Analyze: Not yet started;
Project execution life cycle phase: Design: Not yet started;
Project execution life cycle phase: Build: Not yet started;
Project execution life cycle phase: Test: Not yet started;
Project execution life cycle phase: Deploy: Not yet started;
Project execution life cycle phase: Transition: Not yet started.
Component: Temporary Worker Visa Exit Pilot;
Project execution life cycle phase: Plan: Complete;
Project execution life cycle phase: Analyze: Complete;
Project execution life cycle phase: Design: Complete;
Project execution life cycle phase: Build: Complete;
Project execution life cycle phase: Test: In progress;
Project execution life cycle phase: Deploy: Not yet started;
Project execution life cycle phase: Transition: Not yet started;.
Component: Long-term Land;
Project execution life cycle phase: Plan: Not yet started;
Project execution life cycle phase: Analyze: Not yet started;
Project execution life cycle phase: Design: Not yet started;
Project execution life cycle phase: Build: Not yet started;
Project execution life cycle phase: Test: Not yet started;
Project execution life cycle phase: Deploy: Not yet started;
Project execution life cycle phase: Transition: Not yet started.
Sources: GAO analysis of DHS data and information from program
officials.
Note: Because the Air Exit Pilots were decommissioned upon completion,
they were not transitioned beyond the project execution process.
[End of figure]
Air/Sea Biometric Exit Release 1:
The purpose of Air/Sea Biometric Exit Release 1 is to modify IDENT to
collect, validate, and store the biometric and biographic data for
travelers who are subject to US-VISIT and exiting the United States via
the air or sea environments. For example, this component allows for the
biographic and biometric information provided by a departing passenger
to be matched against a watch list and, if a hit is found, the
passenger's IDENT record is annotated to make the information available
for any future encounters between that individual and other agencies,
such as CBP, U.S. Immigration and Customs Enforcement, or local law
enforcement. According to program officials, Release 1 was initiated to
support the Long-term Air/Sea Exit solution, but it will also allow
IDENT to process land POE exit-related data.
Testing for this component is in progress, and its completion depends
upon the completion of another component. Requirement validation
testing of Release 1 was completed in October 2008, with all planned
test cases executed. According to program officials, final testing of
the release will not occur until data from the Long-term Air/Sea Exit
solution are available.
Reporting Phase 1:
The purpose of Reporting Phase 1 is to enhance IDENT's reporting
capabilities in order to support the information needs of a wide range
of US-VISIT users, including the analysis and evaluation of the Air
Exit Pilot results.[Footnote 29] Additional phases are envisioned to
deliver other US-VISIT reporting capabilities, such as text-based
reporting, charts and graphs, spreadsheet downloading to authorized
users' workstations, on-demand reporting, and near real-time reporting.
However, these additional phases have yet to be defined.
Final testing of Phase 1 was completed in April 2009, with all planned
requirements and test cases executed and five problems of low and
medium severity detected. All five were addressed during final testing.
Phase 1 was deployed in April 2009 and has transitioned to the
operations and maintenance process area.
Air Exit Pilots:
The purpose of the Air Exit Pilots was to evaluate the impact on
airport exit operations of identifying, verifying, and collecting
information from passengers who were subject to US-VISIT and leaving
the United States. More specifically, the pilots are to:
* evaluate identity verification and exit-recording capabilities when
used with existing POE operations and infrastructure and:
* biometrically and biographically verify the identity, record the
exit, and update the IDENT and Arrival and Departure Information System
records of each subject traveler departing the United States at the
pilot locations.
DHS originally announced the purpose and conditions of an air exit
capability in the Notice of Proposed Rulemaking[Footnote 30] published
by DHS in April 2008. As noted earlier, the Consolidated Security,
Disaster Assistance, and Continuing Appropriations Act, 2009[Footnote
31] subsequently required DHS to pilot the two exit operational
scenarios described in the notice: airline collection and transmission
of biometric exit data and CBP collection of such information at the
departure gate. DHS decided to pilot two government alternatives:
passenger screening by CBP officers at the departure gate (as required
by the act) and passenger screening by TSA officials at the TSA
security checkpoint. DHS did not pilot the airline alternative because
the airlines decided not to participate.
The CBP alternative was piloted at Detroit Metropolitan Wayne County
Airport and the TSA alternative at Hartsfield-Jackson Atlanta
International Airport. Pilot testing at both locations was completed in
May 2009, using biographic and biometric data collected from a sampling
of travelers who were subject to US-VISIT. Although one system problem
was found (collected fingerprint images appeared upside down and
mirrored), it was corrected and all planned requirements and test cases
successfully executed. The pilots began in May 2009, and they operated
until July 2009, as planned. The US-VISIT Comprehensive Exit project
manager told us that the pilots have been decommissioned. According to
the Air Exit Pilots schedule, the only remaining activity for this
component is developing and issuing the final rule for the Long-term
Air/Sea Exit component.
The Air Exit Pilots used two types of portable biometric collection
devices: (1) a hand-held device ("mobile device") that scanned
information on travel documents and collected biometrics one
fingerprint at a time and (2) a small suitcase ("portable device") that
contained a laptop computer, document scanning device, and a biometric
scanner that collected a four-print slap. (See figure 4.) The Detroit
pilot used both devices. According to a TSA official, only mobile
devices were used in Atlanta because of the limited space available
within the checkpoint area.
Figure 4: Illustration of Air Exit Pilots Biometric Data Collection and
Transmission Process:
[Refer to PDF for image: illustration]
Detroit air exit pilot(CBP officer):
Mobile and portable devices; sent to:
US-VISIT staff;
Dedicated workstation.
Atlanta air exit pilot (Transportation Security Officer):
Mobile device; sent to:
US-VISIT staff:
Dedicated workstation.
Data from both the sent through secure computer connection: sent to:
IDENT.
Source: GAO analysis of agency data.
[End of figure]
The pilots consisted of these four steps:
* Identification. For the CBP pilot, CBP officers prescreened
passengers after they provided their boarding passes to airline
employees to identify passengers who were subject to US-VISIT and to
then direct them to a CBP processing station in the jetway. For the TSA
pilot, a TSA Ticket Document Checker prescreened every passenger
entering the checkpoint to identify subject passengers[Footnote 32] who
were escorted to a processing station manned by Transportation Security
Officers equipped with mobile devices.
* Collection. Both CBP and TSA officers scanned a machine-readable
travel document presented by a passenger to collect biographic data. If
the document did not scan correctly, the officers were instructed to
enter the biographic data manually into the device. The officers then
used the mobile or portable device to collect an index and middle
fingerprint or a four-print image, respectively.
* Processing. Once the device indicated that the collected prints were
of sufficient quality, the CBP and TSA officers directed the passenger
to continue onto the departing aircraft or through the normal
checkpoint security screening.
* Transmission. US-VISIT staff uploaded the information from the
devices to a dedicated workstation and transmitted the data to IDENT
via a secure network connection. Once transmitted, the data were
matched to existing records.
DHS approved a report on the pilot results in October 2009. We are
statutorily required to review this report.[Footnote 33]
Long-term Air/Sea Exit:
According to program officials, planning for a target solution for air
and sea POEs will begin once the pilots have been completed and after
the final rule has been published. According to the US-VISIT Deputy
Director, an official date for publishing the final rule has not been
established. In general, program officials said that the final rule is
to specify how and when an operational air/sea exit solution will be
implemented.
Temporary Worker Visa Exit Pilot:
The purpose of the Temporary Worker Visa Exit Pilot is to capture the
final departure of certain H2 visa temporary workers at two land border
crossings. The pilot is to use kiosks adapted for outdoor use to record
the exit of H-2A and H-2B visa holders[Footnote 34] who (1) previously
entered and are now departing the United States through either San
Luis, Arizona, or Douglas, Arizona, and (2) are required to record
their final departure with CBP. In December 2008, DHS issued two
Federal Register notices announcing the implementation of the
pilot,[Footnote 35] one addressing H-2A visa holders and one addressing
H-2B visa holders. According to the notices, the pilot was to be
deployed in August 2009. However, according to the US-VISIT
Comprehensive Exit Project Manager, the pilot was suspended during the
testing subprocess due to lack of CBP funding. The CBP Program Manager
for Admissibility and Passenger Programs told us that the pilot is now
scheduled for deployment in December 2009.
Both the US-VISIT program office and CBP are involved in the pilot. The
program office is responsible for project management and kiosk design,
development, and operations and maintenance. CBP is to support the
development and deployment of the kiosks, and is to operate the pilot.
As with the Air Exit Pilots, exit information collected from departing
travelers is to be transmitted to IDENT, where it is to be matched
against existing records. Assembly testing was completed in May 2009,
with all planned requirements and test cases executed.
The pilot was originally planned to run for 1 year, after which its
effectiveness and feasibility as a potential part of Comprehensive Exit
was to be analyzed. However, according to the CBP Program Manager for
Admissibility and Passenger Programs, CBP intends to assess the pilot
after 6 months of deployment to determine whether to continue it.
According to US-VISIT and CBP officials, the pilot results will help
inform future decisions on the pedestrian component of the Long-term
Land Exit component.
Long-term Land Exit:
According to the US-VISIT Program Director and program documentation, a
land exit strategy for recording biometric exit at land POEs was
completed in November 2008 as planned, and is currently being reviewed
by DHS leadership. The Program Director further told us that until the
strategy is approved, no other Land Exit activities will be initiated.
As a result, this component has yet to begin the first ELCM project
execution subprocess.
DHS Approach to Managing Comprehensive Exit Project Is Not Fully
Integrated:
Given that the Comprehensive Exit project is part of the larger US-
VISIT program and consists of multiple components involving several DHS
component organizations, it is important for the project to be planned
and executed in an integrated fashion. To this end, the US-VISIT
program office has established integrated project management plans, and
has adopted an integrated approach to interacting with and involving
project stakeholders, both of which are important ingredients to
project success. However, US-VISIT has not developed and employed an
integrated approach to scheduling, executing, and tracking the work
that needs to be accomplished to deliver the Comprehensive Exit
solution. Rather, it is relying on several separate and distinct
schedules to manage individual aspects of the project. Moreover, not
all of these individual schedules are reliable because they have not
been derived in accordance with relevant schedule estimating guidance.
Without a Comprehensive Exit integrated master schedule that is derived
in accordance with relevant guidance, the program office cannot
reliably commit to when and how the work needed to deliver the
Comprehensive Exit solution will be performed, and it cannot adequately
manage and measure its progress in executing the work needed to deliver
it.
Comprehensive Exit Project Management Plans Are Integrated:
According to relevant guidance,[Footnote 36] a key to project success
is a well-defined project management plan that provides a complete and
integrated view of how the project is being managed. Among other
things, the project management plan should (1) define or reference key
project management processes, (2) be integrated with other plans that
affect project management, and (3) reflect the current and complete
scope of the project.
The US-VISIT program has developed a plan for managing Comprehensive
Exit that is largely well defined. Specifically, the project management
plan calls for tailoring the ELCM framework, which defines a standard
set of project management processes. Further, the program office has
applied this tailored approach to individual Comprehensive Exit
components (e.g, Release 1, Reporting Phase 1, and Air Exit Pilots). In
addition, the project management plan is aligned with relevant US-VISIT
program plans and procedures, as well as individual Comprehensive Exit
component plans. For example, it incorporates by reference a number of
key management processes defined in the US-VISIT program-level
management plan, such as risk management, configuration management,
requirements management, and schedule management. Also, it is
referenced in, and aligned with, the component management plan for the
Air Exit Pilots. Further, the project management plan has recently been
revised, as called for in the plan, to define a more current and
complete scope of the project, and to incorporate actual and planned
project changes.[Footnote 37]
By having a Comprehensive Exit management plan that reflects an
integrated approach to project management, the US-VISIT program office
has established an important means for managing project activities in a
standard and consistent manner.
DHS Stakeholders Have Been Integrated into Comprehensive Exit Pilots:
Relevant system acquisition guidance recognizes that collaboration
among relevant stakeholders is an important part of an integrated
project management approach.[Footnote 38] We have reported that such
collaboration can produce better results and outcomes than could be
achieved when stakeholders do not act in an integrated and coordinated
manner.[Footnote 39] In this regard, our research shows that effective
collaborative activities involve the following practices.
* Establishing common outcomes: defining and articulating a shared or
common outcome(s) or purpose(s) that organizations or programs are
mutually seeking to achieve and that are consistent with their
respective goals and missions.
* Establishing mutually reinforcing or joint strategies: creating
strategies that work in concert with those of partner organizations or
programs, or that are joint in nature.
* Leveraging resources: identifying the human, technological, physical,
and financial resources needed to initiate or sustain the collaborative
effort.
* Agreeing on roles and responsibilities: working together to define
and agree on partners' respective roles and responsibilities, including
how the collaboration efforts will be led.
* Establishing a compatible means to operate across organizational
boundaries: creating compatible standards, policies, procedures, and
data systems that will be used in the collaborative effort.
* Developing mechanisms to monitor, evaluate, and report on results:
putting in place the means to monitor, evaluate, and report on the
collaborative effort to identify areas for improvement.
As previously discussed, the Comprehensive Exit project's pilot
components involve multiple stakeholders, including the US-VISIT
program office, CBP, and TSA. To their credit, these stakeholders have
collaborated in a manner that is consistent with these practices. As a
result, they have established the means to align their activities,
processes, and resources to accomplish the objectives of the
Comprehensive Exit project pilots.
Establishing Common Outcomes:
Within DHS, the US-VISIT program office, along with CBP and TSA, share
a common mission to secure our nation's borders. Consistent with this
shared mission, these organizations have defined a common purpose for
both the Air Exit Pilots and the Temporary Worker Visa Exit Pilot.
Specifically, the shared purpose of the Air Exit Pilots was to evaluate
the operational impact of collecting biometric exit data from travelers
near the departure gate and at the TSA security checkpoint, and thereby
help inform the implementation of the Air Exit solution. The shared
purpose of the Temporary Worker Visa Exit Pilot is to ensure that
temporary guest workers depart the United States at the completion of
their work authorizations and to analyze the effectiveness and
feasibility of one part of the overall Land Exit solution.
Establishing Mutually Reinforcing or Joint Strategies:
The US-VISIT program office, CBP, and TSA have established joint
management strategies for executing the Air Exit Pilots and the
Temporary Worker Visa Exit Pilot. Specifically, an Integrated Project
Team, which is led by the program office and includes representatives
from CBP and TSA, was assigned responsibility for planning, execution,
and control of both pilots. In addition, the program office developed
an Air Exit Pilots Management Plan that defines the project management
approach for implementing the Air Exit Pilots. While the program office
did not establish a comparable management plan for the Temporary Worker
Visa Exit Pilot, it developed a business concept of operations that
documents the proposed business process and operational changes needed
to implement the Temporary Worker Visa Exit Pilot. Both documents were
reviewed by relevant stakeholders.
Leveraging Resources:
As previously noted, an Integrated Project Team was assigned
responsibility for planning, execution, and control of both pilots.
This team has leveraged human, technological, physical, and financial
resources provided by the program office, CBP, and TSA. Specifically,
key personnel from each organization are members of the Integrated
Project Team, and are involved in supporting the execution of the
pilots. For example, CBP and TSA provided or plan to provide personnel
for collecting biometrics during the pilots, and the program office
provided or plans to provide on-site technical support during the
pilots. In addition, the program office and CBP have funded their
respective efforts, while an interagency agreement has been executed
for the program office to fund TSA personnel needed for pilot
operations. Also, the program office provided or plans to provide the
technology (e.g., mobile and portable devices and kiosks for collecting
biometrics and the IDENT system to process and store the biometric data
received). Further, CBP and TSA leveraged their physical presence at
the Detroit Metropolitan Wayne County Airport and the Hartsfield-
Jackson Atlanta International Airport. Also, CBP is leveraging and
augmenting its physical infrastructure at the San Luis and Douglas POEs
in Arizona. For example, it is ensuring that proper network
connectivity exists from the kiosks to IDENT and that needed electrical
and facility modifications are made at the sites.
Agreeing on Roles and Responsibilities:
The program office, CBP, and TSA have defined and agreed on roles and
responsibilities for the Air Exit Pilots and the Temporary Worker Visa
Exit Pilot. Specifically, the Air Exit Pilots Management Plan and
business concept of operations documents define roles and
responsibilities for the program office, CBP, and TSA, and these
documents were reviewed or approved by all relevant parties. For
example, the Air Exit Pilots Business Concept of Operations states that
the program office is to evaluate and determine which biometric data
collection devices will be used and provide these devices, as well as
the necessary training, to CBP and TSA, while CBP and TSA are to
collect the biometric exit data from travelers who were subject to US-
VISIT during the pilot. Also, the Air Exit Pilots Management Plan
identifies individual roles and responsibilities for key program
personnel providing direct support to the project. Further, the
Temporary Worker Visa Exit Pilot business concept of operations states
that the program office is to serve as the overall project manager and
acquire the kiosks, while CBP is to serve as the operational manager
and perform the day-to-day maintenance and operation of the kiosks once
they have been deployed to the sites. It also defines more detailed
roles and responsibilities for specific groups within the program
office and CBP, such as US-VISIT Project Management, US-VISIT
Information Technology Management, CBP Office of Field Operations, and
CBP Office of Information Technology.
Establishing a Compatible Means to Operate Across Organizational
Boundaries:
As the overall project management lead for both pilots, the program
office established an Integrated Project Team that includes CBP and TSA
and has aligned the pilots with the ELCM and other project management
procedures to ensure they are managed consistently. For example, CBP
and the program office were both involved in developing requirements
for the Temporary Worker Visa Exit Pilot. As another example, when CBP
officials identified a lack of CBP funding for the Temporary Worker
Visa Exit Pilot, they reported this to the program office as a risk.
The risk was subsequently tracked through the risk management process.
As another example, CBP required a change in the kiosk solution for the
Temporary Worker Visa Exit Pilot to allow it to withstand outdoor use,
and submitted a change request through the established change
management process to "ruggedize" the kiosks.
Developing Mechanisms to Monitor, Evaluate, and Report on Results:
The Comprehensive Exit project management approach includes mechanisms
for monitoring, evaluating, and reporting on the results of project
efforts. For example, the project management plan discusses quality
assurance activities, such as peer review of project artifacts and
deliverables, and testing and evaluation of hardware and software. As
another example, the project management plan identifies status
reporting requirements, such as quarterly program management reviews,
which provide an overview of the project's status, budget, resource
levels, and any outstanding issues. In addition, the program office has
applied pilot-specific mechanisms for monitoring, evaluating, and
reporting on results. For example, the Air Exit Pilots Management Plan
describes a five-step process improvement model for identifying,
implementing, and evaluating solutions to problems during the execution
of the pilots. Also, this plan establishes a stakeholder communication
matrix, which documents the activities and reports for intra/inter-
agency communication throughout different phases of the pilot (e.g.,
ongoing, predeployment, deployment, pilot operations, and disposition
and analysis). Further, the program office defined performance metrics
for the evaluation of the Air Exit Pilots, and it involved CBP and TSA
in doing so.
Comprehensive Exit Schedules Are Not Integrated and Reliable:
The success of a project depends in part on having an integrated and
reliable master schedule that defines, among other things, when work
activities will occur, how long they will take, and how they are
related to one another. As such, the project schedule not only provides
a road map for systematic project execution, but also provides the
means by which to gauge progress, identify and address potential
problems, and promote accountability. In addition, US-VISIT's program
and project management guidance and plans recognize that schedule
management plays a critical role in the success of its activities. For
example, the program management plan requires a tiered and integrated
master schedule that includes contractor schedules for each task order
and a project level schedule. Further, US-VISIT's program guidance
states that the integrated master schedule provides a means to ensure
attainability of program objectives and evaluate the project's progress
in doing so.
Program officials told us they do not have an integrated master
schedule for the Comprehensive Exit project. Instead, each ongoing
project component[Footnote 40] has its own separate schedule. In
addition, the US-VISIT prime contractor has its own schedule to support
the project components, although program officials said that the work
in this schedule is manually incorporated into each component schedule.
However, our analysis of the schedules for ongoing Comprehensive Exit
components, as well as the contractor's schedule, did not show any
evidence of this, and the program office provided no other
documentation to demonstrate that the manual incorporation exists.
According to program officials, DHS cannot develop a complete schedule
for the Comprehensive Exit project until decisions have been made on
the direction and scope of the Air/Sea and Land exit solutions.
However, relevant guidance[Footnote 41] states that a comprehensive
schedule should reflect all activities for a project and recognizes
that there can be uncertainties and unknown factors in schedule
estimates due to, among other things, limited data. In light of such
uncertainties and unknowns, the guidance discusses the need to perform
a schedule risk analysis to determine the level of uncertainty and to
help identify and mitigate the risks.
As a result, DHS does not have a comprehensive project view of the work
that must be, among other things, sequenced, timed, resourced, and risk-
adjusted to deliver the Comprehensive Exit solution. Without such a
view, a sound basis does not exist for knowing with any degree of
confidence when and how the project will be completed.
The lack of an integrated master schedule is compounded by the fact
that the individual component schedules are not reliable. Our research
has identified nine practices associated with developing and
maintaining a reliable schedule.[Footnote 42] These practices are (1)
capturing all activities, (2) sequencing all activities, (3) assigning
resources to all activities, (4) establishing the duration of all
activities, (5) integrating schedule activities horizontally and
vertically, (6) establishing the critical path for all activities, (7)
identifying float[Footnote 43] between activities, (8) conducting a
schedule risk analysis, and (9) updating the schedule using logic and
durations to determine the dates. In addition, the project management
plan states that a project schedule should reflect the work breakdown
structure for the project as well as ELCM required artifacts. The plan
also requires that the project schedule be horizontally and vertically
integrated, that all scheduled milestones and tasks be linked
logically, and that schedule status be captured on a regular basis.
Both the Air Exit Pilots schedule and the Temporary Worker Visa Exit
Pilot schedule only fully meet one of the nine key schedule estimating
practices, and either partially, minimally, or do not meet the
remaining eight. In contrast, the prime contractor's schedule is
largely reliable, as it fully or substantially meets all nine
practices. To be considered reliable, relevant guidance states that a
schedule needs to fully meet all nine practices. The extent to which
the two component schedules and contractor's schedule meet the nine
practices are summarized below and in table 1. A detailed discussion of
the extent to which each schedule meets the nine practices is in
appendix II.
* Component schedules: Both the Air Exit Pilots and Temporary Worker
Visa Exit Pilot schedules establish the duration of time planned for
executing key activities, and they detail work activities that are
integrated with higher-level milestones and summary activities.
However, neither schedule reflects a valid critical path due to a high
number of missing dependencies and rigid schedule constraints. For
example, the schedule contains 16 remaining activities that identify
dates when the activities must begin. These are rigid schedule
constraints and such dates remain fixed regardless of the allocation of
resources or predecessor activities finishing on time, earlier, or
later. This is important because the critical path represents the
longest chain of activities through the network and determines the
length of the project. Thus, delays in an activity that is on the
critical path would cause the entire component effort to slip. Without
a valid critical path, the program office cannot accurately determine
the amount of time required to complete the project component and
assess how delays impact the projected completion date. According to
program officials, they manage each exit component to a critical path
that is calculated by the scheduling software on a weekly basis.
However, as noted above, the critical paths are not valid due to
missing dependencies and rigid schedule constraints.
In addition, neither schedule is based on a schedule risk analysis. A
schedule risk analysis is important because it allows high-priority
risks to be identified and mitigated, and the level of confidence in
meeting projected completion dates to be predicted. Also, officials
stated they do not perform regular, electronic checks on the schedules
to know the true status of the components and thus ensure the integrity
of the schedules' logic. Furthermore, neither schedule assigns
resources to activities, which limits insight into current or projected
resource allocation issues. Without assigning resources, the risk of
the projected completion date slipping is increased.
* Contractor schedule: The prime contractor's schedule reflects a
number of best practices. For example, this schedule can be traced to
the contractor's work breakdown structure, activities have appropriate
logical sequencing, and resources are assigned to activities. In
addition, contractor representatives stated they have performed a risk
assessment of the schedule and regularly update the status and perform
tests to ensure the integrity of schedule logic. However, the schedule
does not reflect a valid critical path because it contains two separate
critical paths that are not linked. By definition, the critical path
must run from the first event to the last event without a break in
continuity. As stated previously, without a valid critical path, the
contractor cannot accurately determine the amount of time required to
complete scheduled work.
Table 1: Component and Contractor Schedules Satisfaction of GAO
Schedule Estimating Best Practices:
Practice: Capturing all activities; Air Exit Pilots: Partially;
Temporary Worker Visa Exit Pilot: Partially;
Contractor schedule: Met.
Practice: Sequencing all activities;
Air Exit Pilots: Partially;
Temporary Worker Visa Exit Pilot: Minimally;
Contractor schedule: Met.
Practice: Assigning resources to all activities;
Air Exit Pilots: Minimally;
Temporary Worker Visa Exit Pilot: Minimally;
Contractor schedule: Met.
Practice: Establishing the duration of all activities;
Air Exit Pilots: Met;
Temporary Worker Visa Exit Pilot: Met;
Contractor schedule: Met.
Practice: Integrating schedule activities horizontally and vertically;
Air Exit Pilots: Partially;
Temporary Worker Visa Exit Pilot: Partially;
Contractor schedule: Substantially.
Practice: Establishing the critical path for all activities;
Air Exit Pilots: Minimally;
Temporary Worker Visa Exit Pilot: Minimally;
Contractor schedule: Substantially.
Practice: Identifying float between activities;
Air Exit Pilots: Minimally;
Temporary Worker Visa Exit Pilot: Minimally;
Contractor schedule: Met.
Practice: Conducting a schedule risk analysis;
Air Exit Pilots: Not Met;
Temporary Worker Visa Exit Pilot: Not Met;
Contractor schedule: Met.
Practice: Updating the schedule using logic and durations to determine
the dates;
Air Exit Pilots: Partially;
Temporary Worker Visa Exit Pilot: Partially;
Contractor schedule: Met.
Source: GAO analysis of US-VISIT data.
Notes: "Met" means the program provided complete evidence that
satisfies the entire criterion. "Substantially" means the program
provided evidence that satisfies a large portion of the criterion.
"Partially" means the program provided evidence that satisfies about
half of the criterion. "Minimally" means the program provided evidence
that satisfies a small portion of the criterion. "Not met" means the
program provided no evidence that satisfies any of the criterion.
[End of table]
Without a fully integrated and reliably derived schedule for the entire
Comprehensive Exit project, the program office cannot identify when and
how a full exit capability will be delivered, and it cannot adequately
manage and measure its progress in executing the work needed to deliver
it.
Conclusions:
To DHS's credit, it has completed or has under way five of six
components that fall under the auspices of its US-VISIT Comprehensive
Exit project, the status of which range from preplanning to
transitioning to operations and maintenance, and it is managing some
aspects of these various project components in an integrated manner.
For example, each component is being governed by a defined and
standardized US-VISIT project execution methodology, and each component
is subject to the management processes, such as processes managing
project risks. Further, those components that involve multiple
organizational stakeholders are being executed to ensure that
stakeholders interact in an integrated and coordinated manner.
Nevertheless, if and when Comprehensive Exit will be operational
remains unclear, in part because DHS still does not have an integrated
master schedule defining the timing and sequencing of the work and
events needed to deliver US-VISIT exit capabilities to its air, sea,
and land ports of entry. Instead, it has separate schedules for
managing individual components, as well as the prime contractor's
schedule that supports all the components, that do not collectively
provide a road map for delivering a comprehensive exit solution,
including things such as the sequencing and timing of the work needed
to produce the solution, a realistic target date for doing so, and the
resources associated with executing the work. Moreover, even the
individual schedules governing the execution of what DHS described as
unrelated components are not sufficiently reliable as standalone
schedules. For the Comprehensive Exit project to be managed in a fully
integrated manner, it is important for DHS to develop and implement an
integrated master schedule. If it does not, it will not be able to
commit to when and how the exit side of US-VISIT will become
operational, and it will not have a key aspect of the means by which to
get there and to measure its progress in doing so.
Recommendation for Executive Action:
To better ensure the successful delivery of a comprehensive US-VISIT
exit solution, we are augmenting our prior recommendations aimed at
strengthening Comprehensive Exit project planning. Specifically, we
recommend that the Secretary of Homeland Security direct the
Undersecretary for National Protection and Programs to have the US-
VISIT Program Director develop and maintain an integrated master
schedule for the Comprehensive Exit project in accordance with the nine
practices discussed in this report.
Agency Comments and Our Evaluation:
In written comments on a draft of this report, signed by the Director,
Departmental GAO/Office of the Inspector General Liaison Office and
reprinted in appendix III, the department stated that it concurred with
our recommendation.
DHS also provided technical comments, which we have incorporated into
this report as appropriate.
We will send copies of this report to the Chairman and Ranking Member
of the Senate Committee on Homeland Security and Governmental Affairs,
the Chairmen and Ranking Members of the Senate and House Appropriations
Committees, and other Senate and House committees and subcommittees
that have authorization and oversight responsibilities for homeland
security. We will also send copies to the Secretary of Homeland
Security and the Director of the Office of Management and Budget. In
addition, this report will be available at no charge on the GAO Web
site at [hyperlink, http://www.gao.gov].
Should you or your offices have any questions on matters discussed in
this report, please contact me at (202) 512-3439 or at hiter@gao.gov.
Contact points for our Offices of Congressional Relations and Public
Affairs may be found on the last page of this report. Key contributors
to this report are listed in appendix IV.
Signed by:
Randolph C. Hite:
Director, Information Technology Architecture and Systems Issues:
[End of section]
Appendix I: Objectives, Scope, and Methodology:
Our objectives were to determine (1) the status of the Department of
Homeland Security's (DHS) efforts to deliver a comprehensive exit
solution for the United States Visitor and Immigrant Status Indicator
Technology (US-VISIT) program and (2) the extent to which DHS is
applying an integrated approach to managing its comprehensive exit
solution.
To determine the status of efforts to deliver a comprehensive exit
solution, we first identified the component efforts which constitute
the Comprehensive Exit project, and then we identified the status of
each relative to the phases in the US-VISIT Enterprise Life Cycle
Methodology (ELCM). We reviewed key program documentation, such as the
US-VISIT Comprehensive Exit Project Plan and Comprehensive Exit project
documentation (e.g., concepts of operation, design documents, project
schedules, requirements documentation, and test plans). In doing so, we
focused on determining such key factors as what project activities were
planned, when and how they were to be accomplished, and whether
activities were completed as planned. We also interviewed officials
from the US-VISIT program office, U.S. Customs and Border Protection
(CBP), and the Transportation Security Administration (TSA) to
determine how the comprehensive exit solution is being designed and
implemented, and what future plans for the project have been developed.
Finally, we visited the Detroit Metropolitan Wayne County Airport and
the Hartsfield-Jackson Atlanta International Airport to observe the
operation of the Air Exit Pilots and interviewed officials from US-
VISIT (both locations), CBP (Detroit), and TSA (Atlanta) to obtain
details as to how the pilots were operating.
To determine the extent to which DHS is applying an integrated approach
to managing the Comprehensive Exit Project, we assessed project
planning, stakeholder coordination, and schedule estimation efforts
against relevant best practices. Specifically,
* To identify the extent to which DHS is applying an integrated
approach to project planning, we reviewed key project planning
documentation, such as the US-VISIT Comprehensive Exit Project Plan and
Air Exit Pilots Management Plan, and compared it with relevant best
practices for integrated project management.[Footnote 44]
* To establish the extent to which DHS is applying key stakeholder
coordination and collaboration practices to the Comprehensive Exit
project, we reviewed key project planning documentation (e.g.,
Comprehensive Exit Project Plan, Air Exit Pilots Management Plan,
concepts of operation, and project tailoring plans) and compared it
with relevant best practices.[Footnote 45]
* To determine the extent to which DHS is applying key schedule
estimating practices to the Exit Project, we reviewed schedule
estimates for ongoing exit work[Footnote 46] (Air Exit Pilots schedule,
Temporary Worker Visa Exit Pilot schedule, contractor schedule) and
compared them with relevant best practices.[Footnote 47] In doing so,
we categorized our determinations as either met, substantially,
partially, minimally, and not met.[Footnote 48] Our determinations were
also based on interviews with knowledgeable US-VISIT, CBP, and TSA
officials.
We conducted this performance audit at the US-VISIT Program Office in
Arlington, Virginia; CBP headquarters offices in Washington, D.C.; TSA
headquarters offices in Arlington, Virginia; Detroit Metropolitan Wayne
County Airport in Detroit, Michigan; and Hartsfield-Jackson Atlanta
International Airport in Atlanta, Georgia, from January 2009 to
November 2009 in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit
to obtain sufficient, appropriate evidence to provide a reasonable
basis for our findings and conclusions based on our audit objectives.
We believe that the evidence obtained provides a reasonable basis for
our findings and conclusions based on our audit objectives.
[End of section]
Appendix II: Detailed Results of GAO Assessment of Schedules for
Ongoing Comprehensive Exit Components and Prime Contractor Schedule:
Our research has identified nine practices associated with effective
schedule estimating:[Footnote 49] (1) capturing all activities, (2)
sequencing all activities, (3) assigning resources to all activities,
(4) establishing the duration of all activities, (5) integrating
schedule activities horizontally and vertically, (6) establishing the
critical path for all activities,
(7) identifying float[Footnote 50] between activities, (8) conducting a
schedule risk analysis, and (9) updating the schedule using logic and
durations to determine the dates.
For the Comprehensive Exit project, we analyzed schedules representing
ongoing work, which included the Air Exit Pilots component schedule,
the Temporary Worker Visa Exit Pilot component schedule, and the prime
contractor schedule,[Footnote 51] against the nine best practices.
Tables 2, 3, and 4 provide the detailed results of our analyses of
these schedules.
Table 2: US-VISIT Air Exit Pilots Schedule Compared to Best Practices:
Practice: Capturing all activities;
Explanation: The schedule should reflect all activities (e.g., steps,
events, outcomes, etc.) as defined in the program's work breakdown
structure (WBS), to include activities to be performed by both the
government and its contractors;
Criterion met[A]: Partially;
GAO analysis: While officials stated that the schedule is built from
the bottom up by subject matter experts on integrated project teams
consisting of both government and contractor staff, and that the
schedule is linked to a statement of work via activity identification
numbers, the Air Exit Pilots schedule contains neither activity
identification information, nor unique WBS elements that would link to
an overarching WBS.
Practice: Sequencing all activities;
Explanation: The schedule should be planned so that it can meet program-
critical dates. To meet this objective, key activities need to be
logically sequenced in the order that they are to be carried out. In
particular, activities that must finish prior to the start of other
activities (i.e., predecessor activities) as well as activities that
cannot begin until other activities are completed (i.e., successor
activities) should be identified. By doing so, interdependencies among
activities that collectively lead to the accomplishment of events or
milestones can be established and used as a basis for guiding work and
measuring progress;
Criterion met[A]: Partially;
GAO analysis: The Air Exit Pilots schedule does not adequately sequence
activities due to a high number of missing dependencies and the use of
"hard" constraints. While the schedule contains some logically
sequenced activities, 26 percent of remaining activities[B] are missing
dependencies (i.e., predecessor or successor activities). The majority
of these activities are missing successor activities. If an activity
that has no logical successor slips, the schedule will not reflect the
effect on the critical path, float, or scheduled start dates of
downstream activities. In addition, the schedule contains 10 "dangling"
activities, which are activities that have no link from their finish
date. These tasks can continue indefinitely without disrupting any
other activity, including the finish milestone date. Further, 10
percent of the remaining activities (16 activities) identify dates that
the activities must start on. These are considered "hard" constraints
because they are inflexible. Such dates remain fixed regardless of the
allocation of resources or predecessor activities finishing on time,
earlier, or later. Officials told us these constraints reflect
congressionally mandated dates. However, a schedule should serve as a
proactive, dynamic management tool that reflects the current reality of
the effort and accurately projects remaining duration, rather than a
calendar of proposed dates. Also, the schedule may be misconstrued when
reported to higher levels of management if senior management is not
aware of the number of days behind schedule.
Practice: Assigning resources to all activities;
Explanation: The schedule should reflect what resources (i.e., labor,
material, and overhead) are needed to do the work, whether all required
resources will be available when they are needed, and whether any
funding or time constraints exist;
Criterion met[A]: Minimally;
GAO analysis: Labor, material costs, other direct charges, and
resources (such as testing facilities or other equipment) are not
reflected in the schedule. Instead, groups are assigned to activities
at the organization level (e.g., Information and Technology
Management). Officials confirmed they do not assign resources in their
schedules beyond the organization level. It is important that the
program office gain an understanding of resources needed to complete
the work. This information would assist US-VISIT in forecasting the
likelihood of activities being completed based on their projected end
dates. The current schedule does not allow for insight into current or
projected overallocation of resources, thus significantly increasing
the risk of the component effort slipping.
Practice: Establishing the duration of all activities;
Explanation: The schedule should realistically reflect how long each
activity will take to execute. In determining the duration of each
activity, the same rationale, data, and assumptions used for cost
estimating should be used for schedule estimating. Further, these
durations should be as short as possible and they should have specific
start and end dates. Excessively long periods needed to execute an
activity should prompt further decomposition of the activity so that
shorter execution durations will result;
Criterion met[A]: Met;
GAO analysis: Durations of key activities in the schedule reflect
scheduling best practices, and officials stated that activity durations
are based on government and contractor expert opinions, as well as
historical data.
Practice: Integrating schedule activities horizontally and vertically;
Explanation: The schedule should be horizontally integrated, meaning
that it should link the products and outcomes associated with already
sequenced activities. These links are commonly referred to as handoffs
and serve to verify that activities are arranged in the right order to
achieve aggregated products or outcomes. The schedule should also be
vertically integrated, meaning that traceability exists among varying
levels of activities and supporting tasks and subtasks. Such mapping or
alignment among levels enables different groups to work to the same
master schedule;
Criterion met[A]: Partially;
GAO analysis: The schedule is mostly vertically integrated with the
majority of milestones and detail activities being subsumed by higher
summary milestones and activities. In addition, the Air Exit Pilots
schedule is not horizontally integrated, meaning that the activities
across the multiple teams are not arranged in the right order to
achieve aggregated products or outcomes. It is not possible to
accurately trace the network from beginning to end because the schedule
does not reflect a valid critical path. In addition, program officials
stated that the schedule reflects all government and contractor
activities for the component, and that integration of the schedule with
the prime contractor's schedule is addressed through a manual process
performed on a weekly basis. However, we did not receive evidence
demonstrating that the Air Exit Pilots schedule and prime contractor
schedule were integrated.
Practice: Establishing the critical path for all activities;
Explanation: Using scheduling software, the critical path--the longest
duration path through the sequenced list of key activities--should be
identified. The establishment of a program's critical path is necessary
for examining the effects of any activity slipping along this path.
Potential problems that may occur on or near the critical path should
also be identified and reflected in the scheduling of the time for high-
risk activities;
Criterion met[A]: Minimally;
GAO analysis: Officials told us they manage to the critical path, as
defined by the scheduling software, on a weekly basis. However, the Air
Exit Pilots schedule does not exhibit a valid critical path. A valid
critical path represents the longest chain of activities through the
schedule and determines the length of the component effort. By managing
to the hard constraints rather than the true critical path, management
does not have a clear picture of available float that would mitigate
the risks associated with slipping tasks. Furthermore, removing all
hard constraints will not identify the true critical path within the
schedule because of the high number of missing dependencies.
Practice: Identifying float between activities;
Explanation: The schedule should identify float--the time that a
predecessor activity can slip before the delay affects successor
activities--so that schedule flexibility can be determined. As a
general rule, activities along the critical path typically have the
least amount of float;
Criterion met[A]: Minimally;
GAO analysis: The Air Exit Pilots schedule displays an unrealistic
amount of float. Specifically, 49 activities have greater than 100 days
of float. Officials told us they were aware of the float and are
satisfied that the float reflects reality because of unique
circumstances. However, 17 of the activities with high float times
(between 97 to 236 days) are missing successor activities. A missing
successor link will cause excessive float because the activities can
essentially slip or carry on for months without affecting the finish
date. Total float cannot be truly determined unless all activities have
at least one predecessor link and one successor link. However, as
stated previously, 26 percent of the remaining activities are missing
such links.
Practice: Conducting a schedule risk analysis;
Explanation: A schedule risk analysis uses a good critical path method
schedule and data about project schedule risks as well as Monte Carlo
simulation techniques to predict the level of confidence in meeting a
program's completion date, the amount of time contingency needed for a
level of confidence, and the identification of high-priority risks.
This analysis focuses not only on critical path activities but also on
other schedule paths that may become critical. A schedule/cost risk
assessment recognizes the interrelationship between schedule and cost
and captures the risk that schedule durations and cost estimates may
vary because of, among other things, limited data, optimistic
estimating, technical challenges, and lack of qualified personnel. As a
result, the baseline schedule should include a buffer or a reserve of
extra time. Schedule reserve for contingencies should be calculated by
performing a schedule risk analysis. As a general rule, the reserve
should be held by the project manager and applied as needed to those
activities that take longer than scheduled because of the identified
risks. Reserves of time should not be apportioned in advance to any
specific activity since the risks that will actually occur and the
magnitude of their impact is not known in advance;
Criterion met[A]: Not met;
GAO analysis: The program office has not performed a schedule risk
analysis. Thus, it is not possible to determine a level of confidence
in meeting the projected completion date or whether proper reserves
have been incorporated into the schedule. A schedule risk analysis will
calculate schedule reserve, which can be set aside for those activities
identified as high risk. Without this reserve, the program office faces
the risk of delays to the scheduled completion date if any delays were
to occur on critical path activities.
Practice: Updating the schedule using logic and durations to determine
the dates;
Explanation: The schedule should use logic and durations in order to
reflect realistic start and completion dates for program activities.
The schedule should be continually monitored to determine when
forecasted completion dates differ from the planned dates, which can be
used to determine whether schedule variances will affect downstream
work. Maintaining the integrity of the schedule logic is not only
necessary to reflect true status, but is also required before
conducting a schedule risk analysis. The schedule should avoid logic
overrides and artificial constraint dates that are chosen to create a
certain result on paper. To ensure that the schedule is properly
updated, individuals trained in critical path method scheduling should
be responsible for updating the schedule status;
Criterion met[A]: Partially;
GAO analysis: Program officials told us they use the schedule in weekly
management and risk meetings. However, according to the schedule's
status date, there are eight activities that should have started but do
not have an actual start date; nine activities that should have
finished but do not have an actual finish date; and two activities that
have an actual start date 1 week in the future. These anomalies
indicate the presence of questionable logic in the schedule, suggesting
that management may need to re-evaluate the process for correctly
updating the schedule. In addition, the manual process for updating the
progress of contractor activities in the component schedule may lead to
errors, especially without unique WBS elements assigned to the
activities to assist schedulers in the process. Furthermore, program
officials stated they do not routinely verify the validity of the
schedule logic using scheduling software diagnostic reports. Assessing
the health of the schedule after updating its status is encouraged, as
actual progress typically overrides scheduled logic.
Source: GAO analysis of US-VISIT data.
[A] "Met" means the program provided complete evidence that satisfies
the entire criterion. "Substantially" means the program provided
evidence that satisfies a large portion of the criterion. "Partially"
means the program provided evidence that satisfies about half of the
criterion. "Minimally" means the program provided evidence that
satisfies a small portion of the criterion. "Not met" means the program
provided no evidence that satisfies any of the criterion.
[B] An activity that is less than 100 percent complete is considered a
"remaining activity."
[End of table]
Table 3: US-VISIT Temporary Worker Visa Exit Pilot Schedule Compared to
Best Practices:
Practice: Capturing all activities;
Explanation: The schedule should reflect all activities (e.g., steps,
events, outcomes, etc.) as defined in the program's WBS, to include
activities to be performed by both the government and its contractors;
Criterion met[A]: Partially;
GAO analysis: While officials stated that the schedule is built from
the bottom up by subject matter experts on integrated project teams
consisting of both government and contractor staff, and that the
schedule is linked to a statement of work via activity identification
numbers, the Temporary Worker Visa Exit Pilot schedule does not contain
activity identification information. In addition, the WBS for
Comprehensive Exit does not include tasks for the effort and therefore
cannot be mapped to the pilot's schedule.
Practice: Sequencing all activities;
Explanation: The schedule should be planned so that it can meet program-
critical dates. To meet this objective, key activities need to be
logically sequenced in the order that they are to be carried out. In
particular, activities that must finish prior to the start of other
activities (i.e., predecessor activities) as well as activities that
cannot begin until other activities are completed (i.e., successor
activities) should be identified. By doing so, interdependencies among
activities that collectively lead to the accomplishment of events or
milestones can be established and used as a basis for guiding work and
measuring progress;
Criterion met[A]: Minimally;
GAO analysis: The Temporary Worker Visa Exit Pilot schedule does not
adequately sequence activities due to a high number of missing
dependencies. Specifically, 42 percent of the remaining activities have
missing dependencies (i.e., predecessor or successor activities). The
majority of these activities are missing successor activities. If an
activity that has no logical successor slips, the schedule will not
reflect the effect on the critical path, float, or scheduled start
dates of downstream activities. In addition, we identified five
"dangling" activities, meaning they do not have proper links to
logically determine their start or finish dates. Further, 13 percent of
the remaining activities identify dates for which the activity may not
start earlier than. These are considered "soft" constraints, in that
they are past-limiting, not future-limiting. This means that if
predecessor tasks slip, the constrained task will slip if properly
sequenced. While not necessarily a poor scheduling practice, the use of
this many soft constraints does limit the ability of the schedule to
dynamically respond to changes. If predecessor tasks are completed
earlier than scheduled, these downstream tasks will not shift to take
advantage of time savings.
Practice: Assigning resources to all activities;
Explanation: The schedule should reflect what resources (i.e., labor,
material, and overhead) are needed to do the work, whether all required
resources will be available when they are needed, and whether any
funding or time constraints exist;
Criterion met[A]: Minimally;
GAO analysis: Labor, material costs, other direct charges, and
resources (such as testing facilities or other equipment) are not
reflected in the schedule. Instead, groups are assigned to activities
at the organization level (e.g., Information and Technology
Management). Program officials confirmed they do not assign resources
in their schedules beyond the organization level. It is important that
the program office gain an understanding of resources needed to
complete the work. This information would assist the program office in
forecasting the likelihood of activities being completed based on their
projected end dates. The current schedule does not allow for insight
into current or projected overallocation of resources, thus
significantly increasing the risk of the component effort slipping.
Practice: Establishing the duration of all activities;
Explanation: The schedule should realistically reflect how long each
activity will take to execute. In determining the duration of each
activity, the same rationale, data, and assumptions used for cost
estimating should be used for schedule estimating. Further, these
durations should be as short as possible and they should have specific
start and end dates. Excessively long periods needed to execute an
activity should prompt further decomposition of the activity so that
shorter execution durations will result;
Criterion met[A]: Met;
GAO analysis: Durations of key activities in the schedule reflect
scheduling best practices. Further, officials stated that activity
durations are based on government and contractor expert opinions, as
well as historical data.
Practice: Integrating schedule activities horizontally and vertically;
Explanation: The schedule should be horizontally integrated, meaning
that it should link the products and outcomes associated with already
sequenced activities. These links are commonly referred to as handoffs
and serve to verify that activities are arranged in the right order to
achieve aggregated products or outcomes. The schedule should also be
vertically integrated, meaning that traceability exists among varying
levels of activities and supporting tasks and subtasks. Such mapping or
alignment among levels enables different groups to work to the same
master schedule;
Criterion met[A]: Partially;
GAO analysis: The Temporary Worker Visa Exit Pilot schedule is mostly
vertically integrated, with the majority of milestones and detail
activities being subsumed by higher summary milestones and activities.
In addition, the Temporary Worker Visa Exit Pilot schedule is not
horizontally integrated, meaning that the activities across the
multiple teams are not arranged in the right order to achieve
aggregated products or outcomes. It is not possible to accurately trace
the schedule from beginning to end because of the number of missing
dependencies and the fact that the schedule does not reflect a valid
critical path. In addition, program officials stated that the schedule
reflects all government and contractor activities for the component,
and that integration of the schedule with the prime contractor's
schedule is addressed through a manual process performed on a weekly
basis. However, we did not receive evidence demonstrating that the
Temporary Worker Visa Exit Pilot schedule and prime contractor schedule
were integrated.
Practice: Establishing the critical path for all activities;
Explanation: Using scheduling software, the critical path--the longest
duration path through the sequenced list of key activities--should be
identified. The establishment of a program's critical path is necessary
for examining the effects of any activity slipping along this path.
Potential problems that may occur on or near the critical path should
also be identified and reflected in the scheduling of the time for high-
risk activities;
Criterion met[A]: Minimally;
GAO analysis: Officials told us they manage to the critical path, as
defined by the scheduling software, on a weekly basis. However, the
Temporary Worker Visa Exit Pilot schedule does not exhibit a valid
critical path. A valid critical path represents the longest chain of
activities through the schedule and determines the length of the
component effort. By definition, the critical path must run from the
first event to the last event without a break in continuity. Two
activities in the schedule, "Kiosk Early Start Go Live Date" and
"Removal of Equipment" are separated via a 225-day lag. Unrealistic
total float calculations due to this lag are creating an invalid
critical path throughout the network. Further, any critical path within
the schedule--with or without lags--will be invalid due to almost half
the activities missing dependencies.
Practice: Identifying float between activities;
Explanation: The schedule should identify float--the time that a
predecessor activity can slip before the delay affects successor
activities--so that schedule flexibility can be determined. As a
general rule, activities along the critical path typically have the
least amount of float;
Criterion met[A]: Minimally;
GAO analysis: The Temporary Worker Visa Exit Pilot schedule displays an
unrealistic amount of float. Specifically, 56 activities have greater
than 225 days of float. Officials told us they were aware of the float
and are satisfied that the float reflects reality because of unique
circumstances. However, 16 of the activities with high float times
(between 226 and 306 days) are missing successor activities. A missing
successor link will cause excessive float because the activities can
essentially slip or carry on for months without affecting the finish
date. The majority of excessive float is created due to the misuse of
lags. The finish milestone of the project is separated from its
predecessor via a 225-day lag. Program officials told us this lag
represents operations and maintenance activity. Operations and
maintenance is typically a level of effort type of task and as such is
not usually captured in a schedule. However, there are three activities
scheduled beyond the lag, which is having an adverse effect on the
schedule's total float. This is because preceding tasks not tied
directly to operations and maintenance are able to slip at least 225
days with no effect on the network. These excessive float values are
responsible for the invalid critical path.
Practice: Conducting a schedule risk analysis;
Explanation: A schedule risk analysis uses a good critical path method
schedule and data about project schedule risks as well as Monte Carlo
simulation techniques to predict the level of confidence in meeting a
program's completion date, the amount of time contingency needed for a
level of confidence, and the identification of high-priority risks.
This analysis focuses not only on critical path activities but also on
other schedule paths that may become critical. A schedule/cost risk
assessment recognizes the interrelationship between schedule and cost
and captures the risk that schedule durations and cost estimates may
vary because of, among other things, limited data, optimistic
estimating, technical challenges, and lack of qualified personnel. As a
result, the baseline schedule should include a buffer or a reserve of
extra time. Schedule reserve for contingencies should be calculated by
performing a schedule risk analysis. As a general rule, the reserve
should be held by the project manager and applied as needed to those
activities that take longer than scheduled because of the identified
risks. Reserves of time should not be apportioned in advance to any
specific activity since the risks that will actually occur and the
magnitude of their impact is not known in advance;
Criterion met[A]: Not met;
GAO analysis: The program office has not performed a schedule risk
analysis. Thus, it is not possible to determine a level of confidence
in meeting the projected completion date or whether proper reserves
have been incorporated into the schedule. A schedule risk analysis will
calculate schedule reserve, which can be set aside for those activities
identified as high risk. Without this reserve, the program office faces
the risk of delays to the scheduled completion date if any delays were
to occur on critical path activities.
Practice: Updating the schedule using logic and durations to determine
the dates;
Explanation: The schedule should use logic and durations in order to
reflect realistic start and completion dates for program activities.
The schedule should be continually monitored to determine when
forecasted completion dates differ from the planned dates, which can be
used to determine whether schedule variances will affect downstream
work. Maintaining the integrity of the schedule logic is not only
necessary to reflect true status, but is also required before
conducting a schedule risk analysis. The schedule should avoid logic
overrides and artificial constraint dates that are chosen to create a
certain result on paper. To ensure that the schedule is properly
updated, individuals trained in critical path method scheduling should
be responsible for updating the schedule status;
Criterion met[A]: Partially;
GAO analysis: Program officials told us they use the schedule in weekly
management and risk meetings. There were no anomalies in the schedule's
start or finish dates, or tasks that had begun out of sequence.
However, the manual process for updating the progress of contractor
activities in the component schedule may lead to errors, especially
without unique WBS elements assigned to the activities to assist
schedulers in the process. Furthermore, program officials stated they
do not routinely verify the validity of the schedule logic using
scheduling software diagnostic reports. Assessing the health of the
schedule after updating its status is encouraged, as actual progress
typically overrides scheduled logic.
Source: GAO analysis of US-VISIT data.
[A] "Met" means the program provided complete evidence that satisfies
the entire criterion. "Substantially" means the program provided
evidence that satisfies a large portion of the criterion. "Partially"
means the program provided evidence that satisfies about half of the
criterion. "Minimally" means the program provided evidence that
satisfies a small portion of the criterion. "Not met" means the program
provided no evidence that satisfies any of the criterion.
[End of table]
Table 4: US-VISIT Contractor Schedule Compared to Best Practices:
Practice: Capturing all activities;
Explanation: The schedule should reflect all activities (e.g., steps,
events, outcomes, etc.) as defined in the program's WBS, to include
activities to be performed by both the government and its contractors;
Criterion met[A]: Met;
GAO analysis: Officials stated that the schedule includes all prime
contractor effort related to the US-VISIT Comprehensive Exit project,
and that the scope captured in this schedule was reviewed and approved
in the Integrated Baseline Review conducted in November 2008. The prime
contractor also noted that the schedule is vertically integrated into
an internal integrated master schedule that captures all prime
contractor effort associated with US-VISIT.
Practice: Sequencing all activities;
Explanation: The schedule should be planned so that it can meet program-
critical dates. To meet this objective, key activities need to be
logically sequenced in the order that they are to be carried out. In
particular, activities that must finish prior to the start of other
activities (i.e., predecessor activities) as well as activities that
cannot begin until other activities are completed (i.e., successor
activities) should be identified. By doing so, interdependencies among
activities that collectively lead to the accomplishment of events or
milestones can be established and used as a basis for guiding work and
measuring progress;
Criterion met[A]: Met;
GAO analysis: The majority of remaining activities within the schedule
are logically sequenced, by defining predecessor and successor
activities, and containing a small amount of constraints, several of
which are due to external dependencies outside of the control of the
prime contractor.
Practice: Assigning resources to all activities;
Explanation: The schedule should reflect what resources (i.e., labor,
material, and overhead) are needed to do the work, whether all required
resources will be available when they are needed, and whether any
funding or time constraints exist;
Criterion met[A]: Met;
GAO analysis: According to officials, resources are fully loaded into
the schedule until it is formally baselined. Once the schedule is
baselined, the resource information is moved to software more conducive
to managing and updating resource information.
Practice: Establishing the duration of all activities;
Explanation: The schedule should realistically reflect how long each
activity will take to execute. In determining the duration of each
activity, the same rationale, data, and assumptions used for cost
estimating should be used for schedule estimating. Further, these
durations should be as short as possible and they should have specific
start and end dates. Excessively long periods needed to execute an
activity should prompt further decomposition of the activity so that
shorter execution durations will result;
Criterion met[A]: Met;
GAO analysis: Durations of key activities in the schedule reflect
scheduling best practices. Further, officials stated that activity
durations are based on historical data on projects performed by the
prime contractor.
Practice: Integrating schedule activities horizontally and vertically;
Explanation: The schedule should be horizontally integrated, meaning
that it should link the products and outcomes associated with already
sequenced activities. These links are commonly referred to as handoffs
and serve to verify that activities are arranged in the right order to
achieve aggregated products or outcomes. The schedule should also be
vertically integrated, meaning that traceability exists among varying
levels of activities and supporting tasks and subtasks. Such mapping or
alignment among levels enables different groups to work to the same
master schedule;
Criterion met[A]: Substantially;
GAO analysis: The prime contractor schedule is vertically integrated,
with all major milestones and lower level tasks associated with summary
tasks. In addition, the schedule is mostly horizontally integrated.
Specifically, external dependencies show connections with other
scheduled effort, and the majority of activities are linked to
predecessors and successors with no hard constraints. However, the
critical path does not span the entire project. As such, predetermined
milestones and calendar dates appear to dictate the length of the
schedule rather than the critical path.
Practice: Establishing the critical path for all activities;
Explanation: Using scheduling software the critical path--the longest
duration path through the sequenced list of key activities--should be
identified. The establishment of a program's critical path is necessary
for examining the effects of any activity slipping along this path.
Potential problems that may occur on or near the critical path should
also be identified and reflected in the scheduling of the time for high-
risk activities;
Criterion met[A]: Substantially;
GAO analysis: Contractor officials told us they manage to the critical
path as defined by the scheduling software. However, the contractor
schedule does not exhibit a valid critical path. Specifically, we found
two separate critical paths in the contractor schedule: one related to
the Air Exit Pilots and another related to the Temporary Worker Visa
Exit Pilot. A valid critical path represents the longest chain of
activities through the schedule and determines the length of the
effort. By definition, the critical path must run from the first event
to the last event without a break in continuity.
Practice: Identifying float between activities;
Explanation: The schedule should identify float--the time that a
predecessor activity can slip before the delay affects successor
activities--so that schedule flexibility can be determined. As a
general rule, activities along the critical path typically have the
least amount of float;
Criterion met[A]: Met;
GAO analysis: The contractor schedule displays a realistic amount of
float for its efforts.
Practice: Conducting a schedule risk analysis;
Explanation: A schedule risk analysis uses a good critical path method
schedule and data about project schedule risks as well as Monte Carlo
simulation techniques to predict the level of confidence in meeting a
program's completion date, the amount of time contingency needed for a
level of confidence, and the identification of high-priority risks.
This analysis focuses not only on critical path activities but also on
other schedule paths that may become critical. A schedule/cost risk
assessment recognizes the interrelationship between schedule and cost
and captures the risk that schedule durations and cost estimates may
vary because of, among other things, limited data, optimistic
estimating, technical challenges, and lack of qualified personnel. As a
result, the baseline schedule should include a buffer or a reserve of
extra time. Schedule reserve for contingencies should be calculated by
performing a schedule risk analysis. As a general rule, the reserve
should be held by the project manager and applied as needed to those
activities that take longer than scheduled because of the identified
risks. Reserves of time should not be apportioned in advance to any
specific activity since the risks that will actually occur and the
magnitude of their impact is not known in advance;
Criterion met[A]: Met;
GAO analysis: Contractor officials stated that they use schedule risk
analysis software, and that a schedule risk analysis was performed
prior to establishing its baseline schedule for Comprehensive Exit.
Officials further stated that the results of the baseline risk analysis
were provided to the US-VISIT program office during the initial
baseline review.
Practice: Updating the schedule using logic and durations to determine
the dates;
Explanation: The schedule should use logic and durations in order to
reflect realistic start and completion dates for program activities.
The schedule should be continually monitored to determine when
forecasted completion dates differ from the planned dates, which can be
used to determine whether schedule variances will affect downstream
work. Maintaining the integrity of the schedule logic is not only
necessary to reflect true status, but is also required before
conducting a schedule risk analysis. The schedule should avoid logic
overrides and artificial constraint dates that are chosen to create a
certain result on paper. To ensure that the schedule is properly
updated, individuals trained in critical path method scheduling should
be responsible for updating the schedule status;
Criterion met[A]: Met;
GAO analysis: Contractor officials stated that Control Account Managers
are responsible for updating the status of the schedule on a weekly
basis, which includes updating the progress of their tasks and ensuring
actual start and actual finish dates are accurate. Officials also
stated they perform diagnostic tests on the schedule periodically to
ensure the schedule is sequenced logically.
Source: GAO analysis of US-VISIT data.
[A] "Met" means the program provided complete evidence that satisfies
the entire criterion. "Substantially" means the program provided
evidence that satisfies a large portion of the criterion. "Partially"
means the program provided evidence that satisfies about half of the
criterion. "Minimally" means the program provided evidence that
satisfies a small portion of the criterion. "Not met" means the program
provided no evidence that satisfies any of the criterion.
[End of table]
[End of section]
Appendix III: Comments from the Department of Homeland Security:
U.S. Department of Homeland Security:
Office of GAO/OIG Audit Liaison:
Washington, DC 20628:
November 12, 2009:
Mr. Randolph C. Hite:
Director:
Information Technology Architecture and Systems Issues:
U.S. Government Accountability Office:
441 G Street, NW:
Washington, DC 20548:
Subject: GAO 10-13, Homeland Security: Key US-VISIT Initiatives at
Varying Stages of Completion, but Integrated and Reliable Schedule
Needed:
Dear Mr. Hite:
The Department of Homeland Security (DHS) appreciates the opportunity
to review and comment on the U.S. Government Accountability Office's
(GAO) draft report referenced above. GAO provided several conclusions
and made one recommendation with regard to the current state of the
Comprehensive Exit project. The Department concurs with the
recommendation as referenced below.
Recommendation: "To better ensure the successful delivery of a
comprehensive US-VISIT exit solution, we are augmenting our prior
recommendations aimed at strengthening Comprehensive Exit project
planning Specifically, we recommend that the Secretary of Homeland
Security direct the Undersecretary for National Protection and Programs
to have the US-VISIT Program Director develop and maintain an
integrated master schedule for the Comprehensive Exit project in
accordance with the nine practices discussed in this report.
Response: Concur. The report states: "...., if and when Comprehensive
Exit will be operational remains unclear, in part, because DHS still
does not have an integrated master schedule...." In this context, it is
important to point out that the operational date will be set once key
decisions about critical details of Exit are finalized. Once key
decisions are made, US-VISIT will develop and maintain an integrated
master schedule according to GAO's delineated best practices that will
capture the sequencing and timing of the activities and events
necessary to meet the requirement of this project in a timely and cost-
effective manner.
GAO acknowledges in the report that each initiative under the
Comprehensive Exit project umbrella is already governed by a defined
and standardized US-VISIT project execution methodology, and that each
is subject to management processes, including managing project risks.
Additionally, the initiatives that involve multiple organizational
stakeholders are executed to ensure that stakeholders interact in an
integrated and coordinated manner.
We appreciate the opportunity to comment on this Draft Report and we
look forward to working with you on future homeland security issues.
Sincerely,
Signed by:
Jerald E. Levine:
Director:
Departmental GAO/OIG Liaison Office:
[End of section]
Appendix IV: GAO Contact and Staff Acknowledgments:
GAO Contact:
Randolph C. Hite, (202) 512-3439, or hiter@gao.gov:
Staff Acknowledgments:
In addition to the individual named above, Paula Moore, Assistant
Director; Justin Booth; Neil Doherty; Rebecca Eyler; Nancy Glover;
Richard Hagerman; Dave Hinchman; Jason Lee; Karen Richey; and Jeanne
Sung made key contributions to this report.
[End of section]
Footnotes:
[1] US-VISIT currently applies to a certain group of foreign nationals--
nonimmigrants from countries whose residents are required to obtain
nonimmigrant visas before entering the United States and residents of
certain countries who are exempt from U.S. visa requirements when they
apply for admission to the United States for up to 90 days for tourism
or business purposes under the Visa Waiver Program. US-VISIT also
applies to (1) lawful permanent residents; (2) Mexican nonimmigrants
traveling with a Border Crossing Card, who wish to remain in the United
States longer than 30 days, or who declare that they intend to travel
more than 25 miles into the country from the border; and (3) Canadians
traveling to the United States for certain specialized reasons. See 8
C.F.R. § 235.1(f).
[2] US-VISIT program documentation now refers to these as "principles."
[3] Pub. L. No. 104-208, div. C, § 110 (Sept. 30, 1996).
[4] 8 U.S.C. § 1365a.
[5] Effective March 1, 2003, the functions of the Immigration and
Naturalization Service moved from the Department of Justice to DHS.
[6] On April 29, 2003, the Secretary of DHS renamed the entry-exit
system the US-VISIT system.
[7] 8 U.S.C. § 1379. USA PATRIOT Act stands for the Uniting and
Strengthening America by Providing Appropriate Tools Required to
Intercept and Obstruct Terrorism Act of 2001. As applicable here, the
act's requirements for the Immigration and Naturalization Service were
taken over by DHS.
[8] 8 U.S.C. § 1187(h).
[9] 8 U.S.C. § 1187(i).
[10] 8 U.S.C. § 1365b(d).
[11] 8 U.S.C. § 1187(c)(8).
[12] The Mona Passage is located between the Dominican Republic and
Puerto Rico. The objective of the U.S. Coast Guard's effort is to
demonstrate the feasibility of using biometric data (fingerprints) to
identify and support prosecution of interdicted individuals. Using real-
time satellite connectivity, interdicted individuals are enrolled in US-
VISIT's IDENT database and are biometrically checked against known and
suspected terrorists, aggravated felons, previous deportees, and
recidivists.
[13] According to program officials, 14 of the remaining 16 POEs do not
have an operational need to deploy US-VISIT because visitors subject to
US-VISIT are, by regulation, not authorized to enter the United States
at these locations, with the exception of lawful permanent residents
who are allowed to enter the United States at any POE. The other two
POEs do not have the necessary transmission lines to operate US-VISIT,
and thus they process visitors manually.
[14] Increment 2A enhanced existing entry capability at land, sea, and
air POEs to biometrically authenticate machine-readable visas and other
travel and entry documents issued by the Department of State and DHS to
foreign nationals. These capabilities were deployed to all POEs by
October 23, 2005, except for e-Passports, which were deployed to 33
POEs by November 14, 2006. These 33 POEs account for 97 percent of all
travelers entering with e-Passports.
[15] On September 30, 2004, US-VISIT expanded biometric entry
procedures to include individuals from visa waiver countries applying
for admission.
[16] At one POE, these capabilities were deployed by December 19, 2005,
but were not fully operational until January 7, 2006, because of a
telephone company strike that prevented the installation of a T-1 line.
[17] We did not verify this information.
[18] Radio frequency technology relies on proximity cards and card
readers. Radio frequency devices read the information contained on the
card when the card is passed near the device. The information can
contain personal identification of the cardholder.
[19] 73 Fed. Reg. 22065 (Apr. 24, 2008).
[20] Consolidated Security, Disaster Assistance, and Continuing
Appropriations Act, 2009, Pub. L. No. 110-329, 122 Stat. 3574, 3668-70
(Sept. 30, 2008).
[21] We did not independently verify the accuracy of this information.
[22] GAO, Homeland Security: First Phase of Visitor and Immigration
Status Program Operating, but Improvements Needed, [hyperlink,
http://www.gao.gov/products/GAO-04-586] (Washington, D.C.: May 11,
2004).
[23] GAO, Homeland Security: Some Progress Made, but Many Challenges
Remain on U.S. Visitor and Immigrant Status Indicator Technology
Program, [hyperlink, http://www.gao.gov/products/GAO-05-202]
(Washington, D.C.: Feb. 23, 2005).
[24] GAO, Border Security: US-VISIT Program Faces Strategic,
Operational, and Technological Challenges at Land Ports of Entry,
[hyperlink, http://www.gao.gov/products/GAO-07-248] (Washington, D.C.:
Dec. 6, 2006).
[25] GAO, Homeland Security: Planned Expenditures for U.S. Visitor and
Immigrant Status Program Need to Be Adequately Defined and Justified,
[hyperlink, http://www.gao.gov/products/GAO-07-278] (Washington, D.C.:
Feb. 14, 2007) and Homeland Security: U.S. Visitor and Immigrant Status
Program's Long-standing Lack of Strategic Direction and Management
Controls Needs to Be Addressed, [hyperlink,
http://www.gao.gov/products/GAO-07-1065] (Washington, D.C.: Aug. 31,
2007).
[26] [hyperlink, http://www.gao.gov/products/GAO-08-361].
[27] GAO, Visa Waiver Program: Actions Are Needed to Improve Management
of the Expansion Process, and to Assess and Mitigate Program Risks,
[hyperlink, http://www.gao.gov/products/GAO-08-967] (Washington, D.C.:
Sept. 15, 2008).
[28] GAO, Homeland Security: U.S. Visitor and Immigrant Status
Indicator Technology Program Planning and Execution Improvements
Needed, [hyperlink, http://www.gao.gov/products/GAO-09-96] (Washington,
D.C.: Dec. 12, 2008).
[29] Exit-related reporting capabilities were originally managed under
the Comprehensive Exit project but were later moved to the Unique
Identity project. This component is also known as US-VISIT Integrated
Enterprise Web-based Reporting, which was originally called Enterprise
Reporting Services.
[30] 73 Fed. Reg. 22065 (Apr. 24, 2008).
[31] Pub. L. No. 110-329 (Sept. 30, 2008).
[32] This was accomplished by determining several basic flyer
characteristics, including whether the passenger was a U.S. citizen
and, if not, whether the passenger was flying to a foreign destination.
[33] Pub. L. No. 110-329, 122 Stat. 3669-3670 (Sept. 30, 2008).
[34] H-2A visas are issued to temporary agricultural workers and H-2B
visas are issued to temporary nonagricultural workers.
[35] 73 Fed. Reg. 77049 (Dec. 18, 2008) and 73 Fed. Reg. 77817 (Dec.
19, 2008).
[36] Carnegie Mellon University Software Engineering Institute, CMMI
for Acquisition, version 1.2 (November 2007).
[37] The revision is dated May 2009 and, according to the Comprehensive
Exit Project Manager, it will not be completed until a decision on Air
Exit has been reached. This revision does not yet include the Temporary
Worker Visa Exit Pilot.
[38] CMMI for Acquisition.
[39] GAO, Results-Oriented Government: Practices That Can Help Enhance
and Sustain Collaboration among Federal Agencies, [hyperlink,
http://www.gao.gov/products/GAO-06-15] (Washington, D.C.: Oct. 21,
2005).
[40] At the time of our review, the Air Exit Pilots were ongoing. As
discussed earlier in this report, the pilots have since been completed.
[41] GAO, Cost Estimating and Assessment Guide, [hyperlink,
http://www.gao.gov/products/GAO-09-3SP] (Washington, D.C.: March 2009).
[42] [hyperlink, http://www.gao.gov/products/GAO-09-3SP].
[43] Float is the amount of time an activity can slip before affecting
the critical path. The critical path is the longest path through the
schedule. If an activity on the critical path slips, the entire project
will be delayed.
[44] Carnegie Mellon University Software Engineering Institute, CMMI
for Acquisition, version 1.2 (November 2007).
[45] GAO, Results-Oriented Government: Practices That Can Help Enhance
and Sustain Collaboration among Federal Agencies, [hyperlink,
http://www.gao.gov/products/GAO-06-15] (Washington, D.C.: Oct. 21,
2005).
[46] At the time of our review, the Air Exit Pilots were ongoing. As
discussed earlier in this report, the pilots have since been completed.
[47] GAO, GAO Cost Estimating and Assessment Guide, [hyperlink,
http://www.gao.gov/products/GAO-09-3SP] (Washington, D.C.: March 2009).
[48] "Met" means the program provided complete evidence that satisfies
the entire criterion. "Substantially" means the program provided
evidence that satisfies a large portion of the criterion. "Partially"
means the program provided evidence that satisfies about half of the
criterion. "Minimally" means the program provided evidence that
satisfies a small portion of the criterion. "Not met" means the program
provided no evidence that satisfies any of the criterion.
[49] [hyperlink, http://www.gao.gov/products/GAO-09-3SP].
[50] Float is the amount of time an activity can slip before affecting
the critical path.
[51] The prime contractor schedule contains activities for the task
order covering its support of Comprehensive Exit.
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
