The Visa Waiver Program and Its National Security Consequences

January 2022 | Click here for PDF version

Topline Summary

The recent hostage crisis at Congregation Beth Israel in Colleyville, Texas is yet another reminder that the Visa Waiver Program (VWP) remains one of our greatest national security vulnerabilities.

The terrorist who carried out the attack, Malik Faisal Akram, had an extensive criminal record and was previously investigated by MI5, the British intelligence service, for possible jihadi radicalization. Yet he did not appear on any U.S. terror watch lists and appears to have sailed right through the lax VWP.

As the 9/11 Commission wrote back in 2004: “It is perhaps obvious to state that terrorists cannot plan and carry out attacks in the United States if they are unable to enter the country … Indeed, even after 19 hijackers demonstrated the relative ease of obtaining a U.S. visa and gaining admission into the United States, border security still is not considered a cornerstone of national security policy.”

The fact is this: Simply because a person lives in an allied country with a low rate of visa refusals does not mean that they present no risk to the United States or that they are visitors who will not remain in the United States illegally.

The VWP is in desperate need of reform.

Background

Most classes of nonimmigrants are required to obtain a visa to visit the United States. In these cases, foreign nationals must fill out an Online Nonimmigrant Visa Application, Form DS-160, or a Nonimmigrant Visa Application, Form DS-156. In addition, applicants aged 14 to 79 years are generally required to visit a U.S. embassy or consulate and be interviewed by a consular official to confirm the identity and veracity of claims made on their visa application. Consular officers are also able to check the applicant’s information across electronic systems in order to identify a security or public safety risk the alien might pose.

The Visa Waiver Program (VWP) provides a rare exception to this general rule. FAIR has consistently questioned both the need for and the advisability of the VWP, which was adopted as a pilot project at the urging of the tourist industry in 1986 and became operational in 1988. After numerous extensions, the VWP was made permanent in 2000 despite expressions of concern not just by FAIR, but also by the Justice Department’s Inspector General, Federal Bureau of Investigation (FBI) Director Louis Freeh, and other immigration and national security experts.

The VWP allows visitors from participating countries to be admitted to the United States without applying for a U.S. visa or undergoing an in-person interview. Foreign travelers may enter the United States without a visa if they:

• Claim to be visiting for business or tourism for 90 days or less (or have a return ticket for the same timeframe if traveling by air or sea);
  
   
• Have not violated the terms of any previous admission to the United States;
  
   
• Obtain an authorization through the Electronic System for Travel Authorization (“ESTA”), an automated system that determines the eligibility of visitors to travel to the United States under the VWP; and
  
   
• Present a machine-readable passport issued from a VWP country at the U.S. port of entry.

A country is able to participate in the VWP if the Secretary of Homeland Security determines, within their discretion, that the country meets at least the following conditions: 

• Have had a nonimmigrant visitor visa refusal rate of less than 3% for the previous year or a lower average percentage over the previous two fiscal years;
  
   
• Issue electronic and machine-readable passports that contain a biometric identifier;
  
   
• Issue tamper-resistant, machine-readable visa documents that incorporate biometric identifiers;
  
   
• Certify that it has mechanisms implemented to validate machine-readable passports and e-passports at each port of entry;
  
   
• Enter into an information-sharing agreement with the United States or make available through INTERPOL information about the theft or loss of passports no later than 24 hours after a theft or loss is reported to the country;
  
   
• Screen each foreign national who is admitted or departs, if the country has an international airport, using relevant International Criminal Police Organization (“INTERPOL”) databases and notices, or other means designated by the Secretary of Homeland Security;
  
   
• Accept the repatriation of any citizen, former citizen, or national against whom a final order of removal from the United States is issued no later than three weeks after the order is issued;
  
   
• Enter into an information sharing agreement with the United States to share information regarding whether a national traveling to the United States represents a threat to U.S. security or welfare; and
  
   
• Be determined, by the Secretary of Homeland Security, in consultation with the Secretary of State, not to undermine the law enforcement or security interests of the United States by its inclusion in the program.[1]

Additionally, countries participating in the VWP must make travel benefits reciprocally available to U.S. Citizens and nationals.[2] As of January 2022, 40 countries participate in the VWP.[3]

The Secretary of Homeland Security may terminate a country’s VWP designation if the Secretary determines, in consultation with the Secretary of State, that the country’s inclusion undermines the law enforcement or security interests of the United States.[4] For example, two countries, Argentina and Uruguay, have been removed from the program since its creation. The U.S. Department of Homeland Security (DHS) terminated Argentina’s designation in 2002 and Uruguay’s designation in 2003 after it was determined that economic conditions in the countries led to an increase in illegal immigration from the countries by nationals who abused the VWP.[5]

Visa Waiver Program Benefits

While easing the red tape associated with international travel has undoubtedly facilitated tourism and brought economic gain to participating countries, the program has also provided the United States with limited national security benefits. Consistent with the terms of participating, VWP countries are required to provide the U.S. Government intelligence regarding travelers who may pose a security threat to the United States.

The VWP also gives the U.S. Government a foot-in-the-door to inspect and monitor participating countries’ border security systems.  Federal law requires DHS to assess VWP countries’ compliance with VWP requirements every two years.[6] Thus, designated countries are subject to audits of their security operations, which include inspection of each country’s ports of entries and its passport production and issuance facilities.[7]

Proponents of the VWP also acknowledge that the VWP has encouraged countries to utilize more secure identification, immigration, and travel documents by setting minimum standards. Moreover, DHS has reported that numerous non-VWP countries have implemented many of the security benchmarks required for VWP participation in hopes to one day gain eligibility.[8]

National Security Vulnerabilities

Despite the limited security improvements associated with the widespread use of the program, the VWP remains one of the United States’ greatest security vulnerabilities. Simply because a person lives in a country with a low rate of visa refusals does not mean that they present no risk to the United States or that they are bona fide visitors who will not remain in the United States illegally.

As noted above, VWP travelers must apply for authorization to travel using ESTA before traveling to the United States. To do this, a VWP traveler must submit biographical information through the web-based system, which screens the information against relevant law enforcement and security databases.[9] ESTA authorization is generally valid for two years, and the system screens the biographical information provided by traveler on a daily basis throughout the validity period. According to DHS, 99 percent of all ESTA applications are approved within five seconds after submission.[10]

Despite VWP’s safeguards, a VWP traveler still bypasses the normal human-to-human consular scrutiny that is intended to deny entry to persons who represent a threat to the country for health, criminal, or security reasons, as well as those who have no intention of returning to their country after their visit.[11] The ESTA verification process is only able to screen out visitors who are already in some terrorist or criminal databases.[12]

Additionally, because VWP travelers do not have to provide their biometric data, such as fingerprints, facial scans, or retina scans taken in advance of travel, that information cannot be run against DHS’s Automated Biometric Identification System or the FBI’s Next Generation Identification system. Instead, their biographical information is checked against other biographical databases. Aliens who lie on their ESTA application may be able to enter the country despite their VWP ineligibility. Further troubling, ESTA authorization required only for visitors arriving in the United States by air or by sea. It is not required for VWP passport holders who enter by land.[13]

While all VWP countries have entered into information sharing agreements with the United States, not all countries have fully complied with or implemented these agreements. A 2016 Government Accountability Office (GAO) report uncovered that about a third of VWP countries failed to share identity information about known or suspected terrorists and a third failed to share criminal history information with the United States through the agreements.[14] The GAO noted that since the report’s publication, DHS has reported progress towards implementing the required agreements with VWP countries.[15] Full compliance, however, is yet to be achieved.

Need for In-Person Interviews

By eliminating consular screening, the VWP shifts the burden to verify travelers’ claims and identities to airlines and immigration inspectors.  National security officials cannot expect airlines with commercial interests to manage matters of national security. Further, under this process, immigration inspectors remain under pressure to quickly process incoming passengers after cursory examinations of their travel documents. 

However, even this human element that has served as a second line of defense is also being phased out. Many travelers avoid U.S. Customs and Border Protection (CBP) officials by using Automated Passport Control (APC) kiosks that have been set up at a growing number of airports.[16] According to CBP’s website, as of December 2021, APC kiosks were operational at 18 domestic and international airports.

Finally, while Congress mandated that DHS implement biometric exit and overstay reporting under the Visa Waiver Permanent Program Act in 2007, the U.S. Government still does not have a biometric exit system at our air, sea, and land ports of entry to track overstays as required as part of the Visa Waiver Program. As important as it is to know when foreign nationals arrive, it is also important to know when they leave. 

Recent Terror Attacks

The VWP has come under significant scrutiny at numerous occasions since its creation, but most compellingly in light of the rise of “homegrown” terrorism in VWP countries. As recurring high-profile terror attacks have demonstrated, no country is immune to terrorism and nationals from WVP participating countries may pose serious national security concerns. 

It also received severe scrutiny following the terrorist attacks in Paris, France in November 2015.[17] At least five of the attackers were French nationals, two of whom were living in Belgium, and one was a Belgium national. Nationals of both France and Belgium are able to enter the United States under the VWP. Accordingly, at least six of the Paris attackers could have attempted to enter the United States under the program.[18]

Reacting to security concerns following the Paris attacks, Congress imposed additional to VWP participation through the Visa Waiver Program Improvement and Terrorist Travel Prevention Act, enacted as part of the Fiscal Year 2016 Consolidated Appropriations Act.[19] Notably, the Act restricts VWP eligibility from individuals who are dual nationals of the Democratic People’s Republic of Korea, Iran, Iraq, Sudan, or Syria or had been present in any of those countries, or in Libya, Somalia, or Yemen, at any time on or after March 1, 2011 (with limited exceptions).[20] These individuals are still able to apply for a visa to travel to the United States.[21]

Most recently, the terrorist that is responsible for the Texas Synagogue hostage-taking on January 15, 2022 is a national of the United Kingdom, a participating VWP country.[22] The suspect, Malik Faisal Akram, entered the United States on the VWP just weeks before carrying out the attack, despite having a criminal record and terrorist ties.[23]

FAIR’s Recommendations:

• National security is best served with a screening rather than categorical approach;
  
   
• Remove countries from the VWP that fail to or delay to provide terrorism and criminal history information to the United States;
  
   
• Close loopholes in federal law that allow aliens who arrive to the United States via the VWP to obtain firearms;
  
   
• Suspend the VWP until DHS fully implements a biometric exit system. Currently, there is only a biometric entry program;
  
   
• Rescind DHS’s non-enforcement policies. Without vigorous interior enforcement, the VWP will remain vulnerable to abuse. The Biden administration’s failure to adequately enforce immigration law in the interior of the United States compounds the risks posed by the VWP to national security and the general integrity of the immigration system.