Summary
The Department of Homeland Security (DHS) has established a program--the United States Visitor and Immigrant Status Indicator Technology (US-VISIT)--to collect, maintain, and share information, including biometric identifiers, on selected foreign nationals who travel to the United States. By congressional mandate, DHS is to develop and submit for approval an expenditure plan for US-VISIT that satisfies certain conditions, including being reviewed by GAO. Among other things, GAO was asked to determine whether the plan satisfied these conditions, and to provide observations on the plan and DHS's program management.
DHS's fiscal year 2004 US-VISIT expenditure plan and related documentation at least partially satisfies all conditions imposed by the Congress, including meeting the capital planning and investment control review requirements of the Office of Management and Budget (OMB). DHS developed a draft risk management plan and a process to implement and manage risks. However, DHS does not have a current life cycle cost estimate or a cost/benefit analysis for US-VISIT. The US-VISIT program merges four components into one integrated whole to carry out its mission. GAO also developed a number of observations about the expenditure plan and DHS's management of the program. These generally recognize accomplishments to date and address the need for rigorous and disciplined program practices. US-VISIT largely met its commitments for implementing an initial operating capability, known as Increment 1, in early January 2004, including the deployment of entry capability to 115 air and 14 sea ports of entry. However, DHS has not employed rigorous, disciplined management controls typically associated with successful programs, such as test management, and its plans for implementing other controls, such as independent verification and validation, may not prove effective. More specifically, testing of the initial phase of the implemented system was not well managed and was completed after the system became operational. In addition, multiple test plans were developed during testing, and only the final test plan, completed after testing, included all required content, such as describing tests to be performed. Such controls, while significant for the initial phases of US-VISIT, are even more critical for the later phases, as the size and complexity of the program will only increase. Finally, DHS's plans for future US-VISIT resource needs at the land ports of entry, such as staff and facilities, are based on questionable assumptions, making future resource needs uncertain.
Recommendations
Our recommendations from this work are listed below with a Contact for more information. Status will change
from "In process" to "Implemented" or "Not implemented" based on our follow up work.
Director:
Team:
Phone:
Randolph C. Hite
Government Accountability Office: Information Technology
(202) 512-6256
Recommendations for Executive Action
Recommendation: To better ensure that the US-VISIT program is worthy of investment and is managed effectively, the Secretary of Homeland Security should direct the Under Secretary for Border and Transportation Security to ensure that the US-VISIT program director develops and approves complete test plans before testing begins. These plans, at a minimum, should (1) specify the test environment, including test equipment, software, material, and necessary training; (2) describe each test to be performed, including test controls, inputs, and expected outputs; (3) define the test procedures to be followed in conducting the tests; and (4) provide traceability between test cases and the requirements to be verified by the testing.
Agency Affected: Department of Homeland Security: Directorate of Border and Transportation Security
Status: Implemented
Comments: The program office has developed and approved test plans for various system components, such as the US-VISIT/IDENT Product Integration and the Unified IDENT Release 2 Component/Assembly. Our analysis of these plans shows that they (1) specified the test environment, including test equipment, software, material, and necessary training; (2) described each test to be performed, including test controls, inputs, and expected outputs; (3) defined test procedures to be followed in conducting tests; and (4) provided traceability between test cases and the requirements to be verified by the testing. Our analysis also shows that the plans were approved prior to the time the tests were executed and completed.
Recommendation: To better ensure that the US-VISIT program is worthy of investment and is managed effectively, the Secretary of Homeland Security should direct the Under Secretary for Border and Transportation Security to ensure that the US-VISIT program director establishes processes for ensuring the independence of the IV&V contractor.
Agency Affected: Department of Homeland Security: Directorate of Border and Transportation Security
Status: Implemented
Comments: The program office issued a contract for independent verification and validation (IV&V) services. To ensure the contractor's independence, the program office (1) required that IV&V contract bidders be independent of the development and integration contractors; (2) reviewed each of the bidder's affiliations with the US-VISIT prime contract; (3) included provisions in the contract that prohibit the contractor from soliciting, proposing, or being awarded work (other than IV&V services) for the program; (4) required all contractor personnel to certify that they do not have any conflicts of interest; and (5) ensured that the contractor's management plan describes how the contractor will ensure technical, managerial, and financial independence.
Recommendation: To better ensure that the US-VISIT program is worthy of investment and is managed effectively, the Secretary of Homeland Security should direct the Under Secretary for Border and Transportation Security to ensure that the US-VISIT program director implements effective configuration management practices, including establishing a US-VISIT change control board to manage and oversee system changes.
Agency Affected: Department of Homeland Security: Directorate of Border and Transportation Security
Status: Implemented
Comments: The program office has developed a configuration control board that is responsible for, among other things, managing and overseeing system changes. Further, the program office has developed a configuration management plan and begun implementing it. For example, we verified that a change request for the Unique Identity project was submitted and approved by the board.
Recommendation: To better ensure that the US-VISIT program is worthy of investment and is managed effectively, the Secretary of Homeland Security should direct the Under Secretary for Border and Transportation Security to ensure that the US-VISIT program director identifies and discloses to the Appropriations Committees management reserve funding embedded in the fiscal year 2004 expenditure plan.
Agency Affected: Department of Homeland Security: Directorate of Border and Transportation Security
Status: Implemented
Comments: The US-VISIT Deputy Program Manager reported to House and Senate Appropriations Committee staff that management reserve funding in the fiscal year 2004 expenditure plan was $33 million.
Recommendation: To better ensure that the US-VISIT program is worthy of investment and is managed effectively, the Secretary of Homeland Security should direct the Under Secretary for Border and Transportation Security to ensure that the US-VISIT program director ensures that all future US-VISIT expenditure plans identify and disclose management reserve funding.
Agency Affected: Department of Homeland Security: Directorate of Border and Transportation Security
Status: Implemented
Comments: In February 2005, we reported that the US-VISIT program office disclosed management reserve funding of $33 million for fiscal year 2004 in a briefing to the Subcommittees on Homeland Security, Senate and House Committees on Appropriations. Also, in February 2005, we reported that the US-VISIT program office disclosed management reserve funding of $23 million in its fiscal year 2005 expenditure plan. In February 2007, we reported that the program office disclosed management reserve funding of $13 million in its fiscal year 2006 expenditure plan. In doing so, the program office has demonstrated a pattern of disclosing management reserve funding.
Recommendation: To better ensure that the US-VISIT program is worthy of investment and is managed effectively, the Secretary of Homeland Security should direct the Under Secretary for Border and Transportation Security to ensure that the US-VISIT program director assesses the full impact of a key future US-VISIT increment on land port of entry workforce levels and facilities, including performing appropriate modeling exercises.
Agency Affected: Department of Homeland Security: Directorate of Border and Transportation Security
Status: Implemented
Comments: The US-VISIT program office has evaluated Increment 2B operational performance, and according to program officials, the evaluations supported the workforce and facilities planning assumption that no additional staff were required to support deployment of Increment 2B, and that minimal modifications to interior workspace were required to accommodate biometric capture devices and printers and to install electrical circuits. Moreover, the program office has since discontinued it land ports of entry demonstration projects.
Recommendation: To ensure that our recommendations addressing fundamental program management weaknesses are addressed quickly and completely, the Secretary should direct the Under Secretary to have the program director develop a plan, including explicit tasks and milestones, for implementing all of our open recommendations, including those provided in this report. This plan should provide for periodic reporting to the Secretary and Under Secretary on progress in implementing this plan. Lastly, the Secretary should report this progress, including reasons for delays, in all future US-VISIT expenditure plans.
Agency Affected: Department of Homeland Security: Directorate of Border and Transportation Security
Status: Implemented
Comments: US-VISIT audit coordination and resolution is governed by formal audit guidance and coordinated through an Integrated Project Team. The team has developed a plan that includes tasks and milestones for implementing GAO recommendations. The plan also provides for the periodic reporting to the Under Secretary. Further, the status of efforts to address a number of GAO recommendations has been included in recent US-VISIT expenditure plans.
