Is the Visa Waiver Program as secure as it is supposed to be? By Nolan Rappaport


The Visa Waiver Program (VWP) began 28 years ago as the Visa Waiver Pilot Program.[i] It was established to promote the effective use of government resources and facilitate international travel without jeopardizing United States security. It appears to be facilitating international travel, but opinions differ on whether it is doing it without jeopardizing United States security.

The VWP allows nationals from designated countries to enter the United States and stay for up to 90 days without obtaining a visa. In FY2012, it allowed 19.1 million nonimmigrant visitors to enter the United States without visas.[ii] The following countries participate in the program.[iii]

Is VWP a gaping hole in United States border security?

Some people describe the VWP as a gaping hole in our border. They emphasize that the questions on the very short electronic application form that foreign visitors fill out to participate in the program just requires demographic and contact information. Once the applicant has completed this online application and received approval, he/she just needs a valid passport from one of the VWP countries. The only remaining barrier to entering the United States is the U.S Customs and Border Protection (CBP)[iv] officer at the port of entry who stamps the passport after asking a few questions.[v]

The CBP officer’s inspection of a VWP passenger is very brief. It usually lasts no longer than a minute. The officer makes a cursory check of the traveler’s documents, checks the Interagency Border Inspection System (IBIS), and enters the foreign visitor into the United States Visitor and Immigrant Status Indicator Technology (US-VISIT) system. The US-VISIT system uses biographical (e.g., passport information) and biometric identification (finger scans and digital photographs) to check the VWP alien’s identity. The CBP officers at the border collect the following information on aliens entering under the VWP: name, date of birth, nationality, gender, passport number, country of issuance, a digital photograph, and prints for both index finders. If the CBP officer is suspicious that the VWP alien may be inadmissible, he/she can refer the traveler for a secondary inspection. Secondary inspections are more thorough. Aliens in secondary inspections are questioned extensively, travel documents are further examined, and additional databases are queried.[vi]

Other people are not so concerned about the possibility that terrorists will use the VWP program to enter the United States. Janice Kephart, founder and CEO of the Secure Identity and Biometrics Association and former counsel to the 9/11 Commission thinks this is less likely because of reforms implemented on the recommendations of the 9/11 Commission. She says that if al-Qaeda or the Islamic State wants to enter the United States, they probably would choose a land border such as at the one with Mexico where they could cross anonymously and unofficially.[vii] Although an entry without inspection across the southwest border almost certainly would be preferred by a terrorist whose identity is known to American authorities, or one who is smuggling weapons or explosives into the country, it would be much easier, and certainly more pleasant, to enter at an official Port of Entry (POE) with a visa or through the VWP.

Would it be better to require every foreign visitor to have a visa?

Aliens who are not citizens or nationals of a VWP country generally need a visa to enter the United States temporarily for business or pleasure, and this is a more involved process than the one for alien visitors from a VWP country. First, the person seeking the visa must complete an online visa application, Form DS-160, which among other things requires the applicant to upload a photograph of himself/herself.[viii] If the applicant is between the ages of 14 and 79, an interview is required. In addition to bringing the required documentation (passport, Form DS-160 confirmation, and application fee payment receipt), additional documentation may be required to establish such things as the purpose of the trip, evidence of intent to depart the United States at the end of the trip, and evidence of ability to pay all costs of the trip. During the interview, a consular officer will determine whether the applicant is qualified to receive a visa, and, if so, which visa category is appropriate. Then the person’s fingerprints are taken with digital fingerprint scans. Other requirements may apply depending on the circumstances of the individual applicant and the requirements of the consulate office at which the interview is being conducted. This clearly has security advantages over the VWP program, but do these advantages make a difference? Maybe, but it is a certainty that just requiring every foreign visitor to have a visa will not prevent terrorists from getting into the United States. All of the 9/11 hijackers had visas, and they used them to enter at official POEs.[ix] In fact, they used these visas to enter the United States a total of 33 times.[x]

Modernizing the VWP

Section 711 of the Implementing Recommendations of the 9/11 Commission Act mandated modernization of the VWP. Section 711 begins by stating that it is the sense of Congress that the United States should modernize and strengthen the security of the VWP by extending visa-free travel privileges to nationals of foreign countries that are partners in our war against terrorism. This partnership should include bilateral cooperation on critical counterterrorism and information sharing initiatives. Section 711 also requires the development of an electronic system for travel authorization (ESTA) that would electronically collect the information necessary to determine in advance of departure whether the foreign travelers are eligible to participate in the VWP. It also would determine whether there would be law enforcement or security risks from permitting them to travel to the United States under the program. And it requires every VWP country to enter into information sharing agreements with the United States on whether its citizens and nationals who want to participate in the VWP would represent a threat to the security or welfare of the United States.[xi]


The Electronic System for Travel Authorization (ESTA) collects data and performs security checks on the data before passengers are permitted to board a United States bound carrier under the VWP.[xii] This data is used to determine whether foreign travelers are eligible for travel to the United States without a visa. But the VWP provisions in the Immigration and Nationality Act (INA) also require the following determination before foreign passengers are permitted to travel to the United States under the VWP:

NOT A SAFETY THREAT. -- The alien has been determined not to represent a threat to the welfare, health, safety, or security of the United States.[xiii]

It is not apparent how that determination can be made on the basis of the information provided on ESTA’s electronic application, which does not include biometric identifiers. The application collects the following information:

· Biographical information including name, birth date, country of citizenship, country of residence, and telephone number;

· Passport information including number, issuing country, issuance date, and expiration date; and

· Travel information including city where departing from, flight number, and address while in the United States.[xiv]

Moreover, ESTA approval is valid for two years or until the person’s passport expires and it can be used for multiple entries.[xv] If an ESTA application is denied, the foreign traveler has to apply for a nonimmigrant visa at a U.S. Embassy or Consulate.[xvi]

VWP Security Issues

Some carriers are not checking all of their VWP passengers for ESTA approval. A report from the U.S. Government Accountability Office (GAO) indicates that monitoring is needed to ensure that international airlines check for ESTA approval before boarding VWP travelers for a trip to the United States. GAO investigated airlines in 2010, and determined that they were confirming ESTA approval for 98% of their VWP passengers. The other 2% of their VWP passengers, which amounted to approximately 364,000 travelers, were flown to the United States without confirmed ESTA approval. Moreover, approximately 650 passengers who had been denied ESTA approval also were allowed to travel to the United States, and information was not available on whether they posed a risk to the security of the United States.[xvii]

Fines are available to encourage carriers to check their VWP passengers for ESTA approval. It is unlawful for a transportation company to bring an alien to the United States from any place outside thereof who does not have a valid passport and an unexpired visa, if a visa was required. The fine for each violation is $3,000.00.[xviii] The visa requirement, of course, is waived for VWP travelers, but only if they present confirmation of ESTA approval.

The ESTA application process does not satisfy the safety threat determination requirement. ESTA is an expedited, name-based clearance system. It cannot be used to run checks against databases that use biometrics, such as the Department of Homeland Security (DHS) Automated Biometric Identification System (IDENT) and FBI’s Integrated Automated Fingerprint Identification System (IAFIS).[xix] And very little time is spent reviewing the ESTA applications. In most cases, ESTA provides an almost immediate eligibility determination. Applicants who receive an Authorization Pending response instead of an approval or a denial can expect a final response within 72 hours.[xx]

At the very least, there should be a police check in the foreign traveler’s home country to determine whether he/she has a criminal record. Criminal aliens are not admissible to the United States. This exclusion ground applies to aliens who have been convicted of certain crimes, have multiple criminal convictions, are controlled substance traffickers, have engaged in prostitution or commercialized vices, and certain aliens who have been involved in serious criminal activity but have been given immunity from prosecution.[xxi] Applicants for ESTA approval could stop by a consulate office with their passports for identification purposes and have their fingerprints taken for the criminal record check.

A more thorough background check could be achieved by requiring the ESTA clearance process to include a search of the Consular Consolidated Database (CCD). Consular officers use the CCD, which is a biometric and biographic database, to screen all visa applicants. More than 143 million records of visa applications are now automated in the CCD. It links with other databases too, such as DHS’ Automated Biometric Identification System (IDENT) and the Federal Bureau of Investigation (FBI) Integrated Automated Fingerprint Identification System (IAFIS), and DHS’ Traveler Enforcement Compliance System (TECS).[xxii] If assistance is needed to evaluate this additional data expeditiously, the DHS Visa Security Program (VSP) could provide it. VSP agents have special training for reviewing applications to identify individuals who may present a security threat. They are deployed to diplomatic posts worldwide.[xxiii]

Information Sharing Agreements

Passenger Information Exchange. Every VWP country must enter into “an agreement with the United States to share information regarding whether citizens and nationals of that country traveling to the United States represent a threat to the security or welfare of the United States.”[xxiv]

The Homeland Security Presidential Directive 6 (HSPD-6). The stated objective of an HSPD-6 agreement reads as follows:

To protect against terrorism it is the policy of the United States to (1) develop, integrate, and maintain thorough, accurate, and current information about individuals known or appropriately suspected to be or have been engaged in conduct constituting, in preparation for, in aid of, or related to terrorism (Terrorist Information); and (2) use that information as appropriate and to the full extent permitted by law to support (a) Federal, State, local, territorial, tribal, foreign-government, and private-sector screening processes, and (b) diplomatic, military, intelligence, law enforcement, immigration, visa, and protective processes.[xxv]

As of January 2013, all VWP countries have completed the required arrangements for the sharing of information on known and suspected terrorists as required by HSPD-6.[xxvi]

Preventing and Combating Serious Crime (PCSC). The PCSC agreements establish a framework for law enforcement cooperation by providing each party with automated access to the other’s criminal databases that contain biographical, biometric, and criminal history data. As of January 2013, thirty-four of the VWP countries had signed PCSC Agreements or equivalent agreements with United States.[xxvii]

[i] Section 313 of the Immigration Reform and Control Act of 1986.

[ii] Congressional Research Service, Visa Waiver Program (February 12, 2014).

[iii] CBP Frequently Asked Questions about the Visa Waiver Program and the Electronic System for Travel Authorization, “Which countries participate in the Visa Waiver Program?”

[iv] U.S Customs and Border Protection (CBP).

[v] Georgianne Nienaber, “Is Visa Waiver Program a Pipeline for Terrorism?” (September 2, 2014),

[vi] Congressional Research Service, “Visa Waiver Program,” at p. 7 (February 12, 2014).

[vii] Ryan Lovelace, “How ISIS Would Get into the Homeland” (August 27, 2014),

[viii] Department of State, U.S. Visas, DS-160: Frequently Asked Questions,

[ix] Entry of the 9/11 Hijackers into the United States, Staff Statement No. 1,

[x] 9/11 Commission Staff Statements, “The September 11 Travel Operation,”

[xi] Implementing Recommendations of the 9/11 Commission Act of 2007, Public Law 110-53 (August 3, 2007),

[xii] 8 CFR § 217.5(a).

[xiii] Section 217(a)(6) of the Immigration and Nationality Act (INA), 8 U.S.C. § 1187(a)(6).

[xiv] Electronic System for Travel Authorization.

[xv] Welcome to the Electronic System for Travel Authorization,

[xvi] CBP Info Center: “ESTA application denied.”

[xvii] GAO, Visa Waiver Program: “Additional Actions Needed to Mitigate Risks and Strengthen Overstay Enforcement,” at p.5 (March 27, 2012),

[xviii] Section 273 of the INA,

[xix] Congressional Research Service, “Visa Waiver Program, Security,” at p. 10 (February 12, 2014).

[xx] CBP Info Center: “How do I know if my ESTA application was approved?”

[xxi] Section 212(a)(2) of the INA, 8 U.S.C. § 1181(a)(2).

[xxii] Congressional Research Service, Immigration: “Visa Security Policies, Consular Screening Procedures,” at p. 6 (June 9, 2014).

[xxiii] Visa Security Program.

[xxiv] Section 217(c)(2)(F) of the INA, 8 U.S.C. § 1187(a)(11).

[xxv] Homeland Security Presidential Directive/Hspd-6 (September 16, 2003).

[xxvi] Congressional Research Service, “Visa Waiver Program, Information Sharing,” at p. 12 (February 12, 2014).

[xxvii] Supra.


Reprinted with permission.

About The Author

Nolan Rappaport Nolan Rappaport was an immigration counsel on the House Judiciary Committee for seven years representing the Democrats on the Immigration, Border Security, and Claims Subcommittee. Prior to working on the Judiciary Committee, he wrote decisions for the Board of Immigration Appeals for more than 20 years. He also has been a policy advisor for the DHS Office of Information Sharing and Collaboration, and he has spent time in private practice doing visa petitions for the Catholic Church and international corporations at Steptoe Johnson. Although he presently is retired, he is thinking about going back to work.

The opinions expressed in this article do not necessarily reflect the opinion of ILW.COM.