[House Hearing, 115 Congress] [From the U.S. Government Publishing Office] IMMIGRATION BENEFITS VETTING: EXAMINING CRITICAL WEAKNESSES IN USCIS SYSTEMS ======================================================================= HEARING before the SUBCOMMITTEE ON OVERSIGHT AND MANAGEMENT EFFICIENCY of the COMMITTEE ON HOMELAND SECURITY HOUSE OF REPRESENTATIVES ONE HUNDRED FIFTEENTH CONGRESS FIRST SESSION __________ MARCH 16, 2017 __________ Serial No. 115-8 __________ Printed for the use of the Committee on Homeland Security [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT] Available via the World Wide Web: http://www.gpo.gov/fdsys/ _________ U.S. GOVERNMENT PUBLISHING OFFICE 26-906 PDF WASHINGTON : 2017 ____________________________________________________________________ For sale by the Superintendent of Documents, U.S. Government Publishing Office, Internet:bookstore.gpo.gov. Phone:toll free (866)512-1800;DC area (202)512-1800 Fax:(202) 512-2104 Mail:Stop IDCC,Washington,DC 20402-001 __________ COMMITTEE ON HOMELAND SECURITY Michael T. McCaul, Texas, Chairman Lamar Smith, Texas Bennie G. Thompson, Mississippi Peter T. King, New York Sheila Jackson Lee, Texas Mike Rogers, Alabama James R. Langevin, Rhode Island Jeff Duncan, South Carolina Cedric L. Richmond, Louisiana Tom Marino, Pennsylvania William R. Keating, Massachusetts Lou Barletta, Pennsylvania Donald M. Payne, Jr., New Jersey Scott Perry, Pennsylvania Filemon Vela, Texas John Katko, New York Bonnie Watson Coleman, New Jersey Will Hurd, Texas Kathleen M. Rice, New York Martha McSally, Arizona J. Luis Correa, California John Ratcliffe, Texas Val Butler Demings, Florida Daniel M. Donovan, Jr., New York Nanette Diaz Barragan, California Mike Gallagher, Wisconsin Clay Higgins, Louisiana John H. Rutherford, Florida Thomas A. Garrett, Jr., Virginia Brian K. Fitzpatrick, Pennsylvania Brendan P. Shields, Staff Director Kathleen Crooks Flynn, Deputy Chief Counsel Michael S. Twinchek, Chief Clerk Hope Goins, Minority Staff Director ------ SUBCOMMITTEE ON OVERSIGHT AND MANAGEMENT EFFICIENCY Scott Perry, Pennsylvania, Chairman Jeff Duncan, South Carolina J. Luis Correa, California Tom Marino, Pennsylvania Kathleen M. Rice, New York John Ratcliffe, Texas Nanette Diaz Barragan, California Clay Higgins, Louisiana Bennie G. Thompson, Mississippi Michael T. McCaul, Texas (ex (ex officio) officio) Ryan Consaul, Subcommittee Staff Director Erica D. Woods, Interim Subcommittee Minority Staff Director C O N T E N T S ---------- Page Statements The Honorable Scott Perry, a Representative in Congress From the State of Pennsylvania, and Chairman, Subcommittee on Oversight and Management Efficiency: Oral Statement................................................. 1 Prepared Statement............................................. 3 The Honorable J. Luis Correa, a Representative in Congress From the State of California, and Ranking Member, Subcommittee on Oversight and Management Efficiency: Oral Statement................................................. 4 Prepared Statement............................................. 6 The Honorable Bennie G. Thompson, a Representative in Congress From the State of Mississippi, and Ranking Member, Committee on Homeland Security: Prepared Statement............................................. 7 Witnesses Ms. Lori Scialabba, Acting Director, U.S. Citizenship and Immigration Services, U.S. Department of Homeland Security: Oral Statement................................................. 8 Prepared Statement............................................. 11 Ms. Carol C. Harris, Director, Information Technology Acquisition Management Issues, U.S. Government Accountability Office: Oral Statement................................................. 14 Prepared Statement............................................. 16 Mr. John Roth, Inspector General, U.S. Department of Homeland Security: Oral Statement................................................. 28 Prepared Statement............................................. 30 For the Record The Honorable Nanette Diaz Barragan, a Representative in Congress From the State of California: USCIS Will Temporarily Suspend Premium Processing for All H-1B Petitions.................................................... 46 Appendix Questions From Subcommittee Chairman Scott Perry for Lori Scialabba...................................................... 55 Questions From Ranking Member Bennie G. Thompson for Lori Scialabba...................................................... 56 Questions From Chairman Scott Perry for Carol C. Harris.......... 57 Questions From Ranking Member Bennie G. Thompson for Carol C. Harris......................................................... 61 Questions From Chairman Scott Perry for John Roth................ 67 Questions From Ranking Member Bennie G. Thompson for John Roth... 68 IMMIGRATION BENEFITS VETTING: EXAMINING CRITICAL WEAKNESSES IN USCIS SYSTEMS ---------- Thursday, March 16, 2017 U.S. House of Representatives, Committee on Homeland Security, Subcommittee on Oversight and Management Efficiency, Washington, DC. The subcommittee met, pursuant to notice, at 9:34 a.m., in room HVC-210, Capitol Visitors Center, Hon. Scott Perry (Chairman of the subcommittee) presiding. Present: Representatives Perry, Duncan, Ratcliffe, Higgins, Correa, Rice, and Barragan. Mr. Perry. The Committee on Homeland Security Subcommittee on Oversight and Management Efficiency will come to order. The purpose of this hearing is to examine weaknesses in critical systems and processes at the Department of Homeland Security, or DHS's U.S. Citizenship and Immigration Services, the USCIS, that vet and adjudicate immigrant and nonimmigrant applications. The Chair now recognizes himself for an opening statement. Last month this subcommittee held a hearing on the challenges faced by the Department of Homeland Security, DHS, in reining in--correction--bureaucratic waste, inefficiency, and mismanagement. In today's heightened threat environment DHS must have necessary systems in place to execute its mission, especially with regard to immigrant vetting. The United States Citizenship and Immigration Services plays an essential role in processing millions of applications each year for people requesting permanent or temporary entry into the United States. However, watch dogs repeatedly voice concerns about USCIS's management of the critical information technology systems used to process these applications and found instances of fraud in everything from asylum to immigration investor applications. Today's hearing will focus on findings from the DHS Office of Inspector General, the OIG; and the Government Accountability Office, the GAO; on USCIS's I.T. systems and the security risk from USCIS's failure to manage these efforts effectively. For example, in the last 6 months alone the OIG reported that USCIS should halt its plan to process naturalization applications through its primary system, the Electronic Immigration System, or ELIS, due to security concerns related to inadequate applicant background checks. I mean that is breathtaking: Told them to stop using its primary system for security concerns related to inadequate applicant background checks in this environment. USCIS erroneously issued about 20,000 green cards due to design and functionality problems with ELIS. USCIS granted citizenship to at least 858 individuals who had been ordered deported or removed under another identity because their digital fingerprint records were unavailable in the systems maintained by DHS and the FBI. Thing is on its own over here. Sorry. USCIS's ineptitude inadvertently may have granted illegal aliens, criminals, or even terrorists citizenship or permanent residency, thereby putting American lives directly at risk. But the problems don't end there. In 2015 the GAO reported that USCIS could not adequately detect fraud in asylum or immigration investor applications due to deficiencies in the ELIS system. GAO also reported that delayed implementation of an initiative aimed at automating paper-based application processes, called the Transformation Program, posed problems for identifying fraud. The GAO and the OIG further found that USCIS cannot ensure that applicants are vetted adequately. I mean, I just found that--I just find that astounding in the context that we currently live in regarding vetting--cannot ensure that applicants are vetted adequately because of the problems with the Transformation Program and related system. In fact, the GAO and the OIG collectively made over 54 recommendations in 12 separate reports to address significant challenges implementing the Transformation Program. Unfortunately, after investing 11 years and about $1.4 billion, USCIS has very little to show for its efforts. Taxpayers absolutely deserve more than a program that is a poster child for I.T. mismanagement and just waste. I mean, 11 years and $1.4 billion. I gotta tell you, I am just going to go off the script here a little bit. If we handed this issue to any--I really think any national company that we have in your town, you know, I can name a few but I don't want to in my own town, but just pick any big national company that you are familiar with their logo and said, ``We need an information system to track these individuals that we are involved with, whether it is customers, whether it is vendors, or whatever.'' It wouldn't take 11 years and $1.4 billion and still have nothing to show for it--nothing functional. If it did they wouldn't be in business anymore, right? Individually any of these reports would be alarming, but together they indicate systemic weaknesses in the way USCIS vets and processes immigrant application. The risks to National security are breathtaking and unacceptable. Perhaps equally concerning, however, is that USCIS at times has failed to take seriously these watch dog findings. In March 2016 the Inspector General Roth wrote the following to the director of USCIS with regard to the Transformation Program--I am going to read your statement: ``I would be remiss if I did not take this opportunity to express my disappointment at the tone and substance of your office's response to the audit report as well as audit staff efforts throughout this project. This is our sixth review of a deeply troubled program, which has, over its life, wasted hundreds of millions of dollars. ``USCIS has continually minimized the shortcomings of the program and resisted independent oversight. Non-concurrence of this nature with our recommendations does not appear rational. It is contrary to Department policy on audit resolution and suggests continued effort to promote disagreement for its own sake rather than collaboration toward the shared goal of promoting effectiveness and efficiency in Department operations.'' That ends the statement. Ineffective program management is one thing and has a clear solution. But altogether more concerning is a culture resistant to oversight and solutions, particularly when it provides a path forward and recommendations for improvements. Ms. Scialabba, I hope I have your commitment today and the commitment of your successor, when named, that the USCIS is willing to work constructively with the GAO, the OIG, and the Congress to correct long-standing deficiencies--long-standing deficiencies. Management malpractice is simply unacceptable, but especially when criminals and terrorists seek to exploit any vulnerability in our system. We are absolutely, as Americans, we are relying on USCIS to ensure these enemies aren't allowed into our country. The Chair now recognizes the Ranking Minority Member of the subcommittee, the gentleman from California, Mr. Correa, for his statement. [The statement of Chairman Perry follows:] Statement of Chairman Scott Perry March 16, 2017 Last month, this subcommittee held a hearing on the challenges faced by the Department of Homeland Security (DHS) in reining in bureaucratic waste, inefficiency, and mismanagement. In today's heightened threat environment, DHS must have necessary systems in place to execute its mission--especially with regard to immigrant vetting. The United States Citizenship and Immigration Services (USCIS) plays an essential role in processing millions of applications each year for people requesting permanent or temporary entry into the United States. However, watch dogs repeatedly voice concerns about USCIS management of the critical information technology (IT) systems used to process these applications, and found instances of fraud in everything from asylum to immigrant investor applications. Today's hearing will focus on findings from the DHS Office of Inspector General (OIG) and the Government Accountability Office (GAO) on USCIS's IT systems and the security risks from USCIS failure to manage these efforts effectively. For example, in the last 6 months alone, the OIG reported that:USCIS should halt its plans to process naturalization applications through its primary system, the Electronic Immigration System (ELIS), due to security concerns related to inadequate applicant background checks USCIS erroneously issued about 20,000 green cards due to design and functionality problems with ELIS, and USCIS granted citizenship to at least 858 individuals who had been ordered deported or removed under another identity because their digital fingerprint records were unavailable in systems maintained by DHS and the FBI. USCIS's ineptitude inadvertently may have granted illegal aliens, criminals, or even terrorists citizenship or permanent residency-- thereby putting American lives at risk. But the problems don't end there. In 2015, GAO reported that USCIS could not adequately detect fraud in asylum or immigrant investor applications due to deficiencies in the ELIS system. GAO also reported that delayed implementation of an initiative aimed at automating paper- based application processes, called the Transformation Program, posed problems for identifying fraud. The GAO and OIG further found that USCIS cannot ensure that applicants are vetted adequately because of the problems with the Transformation Program and related system. In fact, GAO and the OIG collectively made over 54 recommendations in 12 separate reports to address significant challenges implementing the Transformation Program. Unfortunately, after investing 11 years and about $1.4 billion, USCIS has very little to show for its efforts. Taxpayers deserve more than a program that's a poster child for IT mismanagement. Individually, any of these reports would be alarming; but together, they indicate systemic weaknesses in the way USCIS vets and processes immigrant applications. The risks to National security are breathtaking. Perhaps equally concerning, however, is that USCIS--at times--has failed to take seriously these watch dog findings. In March 2016, Inspector General Roth wrote the following to the Director of USCIS with regard to the Transformation Program: ``I would be remiss if I did not take this opportunity to express my disappointment at the tone and substance of your office's response to the audit report, as well as audit staff's efforts throughout this project. This is our sixth review of a deeply troubled program which has, over its life, wasted hundreds of millions of dollars . . . USCIS has continually minimized the shortcomings of the program and resisted independent oversight. Non-concurrence of this nature [with our recommendations] does not appear rational, is contrary to Department policy on audit resolution . . . and suggests continued effort to promote disagreement for its own sake rather than collaboration towards the shared goal of promoting effectiveness and efficiency in Department operations.'' Ineffective program management is one thing--and has a clear solution; but altogether more concerning is a culture resistant to oversight, particularly when it provides a path forward and recommendations for improvement. Ms. Scialabba, I hope I have your commitment today that USCIS is willing to work constructively with GAO, the OIG, and the Congress to correct long-standing deficiencies. Management malpractice is unacceptable, but especially when criminals and terrorists seek to exploit any vulnerability in our system. We're relying on USCIS to ensure these enemies aren't allowed into our country. Mr. Correa. Thank you very much, Chairman Perry, for holding this most important and timely hearing. Thank the witnesses for being here today. Good morning. Ms. Scialabba, I understand that you will be retiring at the end of this month after a 33-year career. On behalf of the folks--citizens of this great country, thank you very much for a career. Muchas gracias. Well done. While I appreciate your participation today in today's proceedings, I am disappointed that the Department did not send the USCIS chief information officer to provide the subcommittee with direct testimony about the agency's information challenges--I.T. challenges. Let me go off-script here and just say that my prior life as a California legislator I.T. was always a challenge, whether it was trying to fix the Department of Motor Vehicles or whatever it was. We always would contract with these companies that are always too big to fail, and they always failed. So I am hoping to hear your perspective and those of the panelists here as to maybe a different approach we might be taking in terms of purchasing our software, our information systems, that make sense as opposed to going with the one-fits- everything and end up with failure. Let me go back on script. President Trump is engaged in an active campaign at the present to change the paradigm of our Nation's immigration system from family unification, admitting skilled workers, protecting refugees, and promoting diversity to a merit-based approach where only individuals deemed as having potential to contribute to our economy would be admitted. So, given this paradigm, I am very surprised that the President wants to suspend the processing of the H-1B visas. I look forward to engaging you about this decision that no longer offers these applicants--very skilled applicants--a shorter wait time for their program in order to be admitted into the United States. I also would like to hear your comments and engage you on the Muslim ban order. Under the ban not only are individuals from six majority-Muslim nations prohibited from receiving visas to travel to the United States, but also all refugee processing has been suspended. Given the critical role the USCIS plays in refugee processing, which does include a vetting process, and which I believe is probably one of the best if not the best in the world, I would like to ask what else can we do to better vet these individuals, these refugees, as they come to the United States? One of my prior lives I did some work with the U.S. Department of State at Foggy Bottom, and I can tell you those people, when I worked with them, were some of the most qualified, most educated, most highly-skilled Federal workers that I have come across. So, given their qualifications, given our vetting process, what else can we do to further vet these individuals that we are not doing today? Also, I am very concerned with the President's proposed budget, which is expected to prioritize building a wall on our Southern Border. I am concerned not because of the wall itself but because of historical perspective. Twenty years ago our country was very successful in stopping the drug trade through the Caribbean; that only shifted the drugs and other negative elements through the inland. Now we are proposing to strengthen the Southern Border without looking at the Northern Border. In this committee--not this subcommittee, but in this committee--recently our admiral of the Coast Guard stated that last year the U.S. Coast Guard identified 500 special interest targets moving from South America into the United States. Of those 500 targets, none of them could be touched because the Coast Guard lacked the resources to stop them from coming to the United States. Yet, under our President's budget we are going to cut the Coast Guard's budget by 10 percent. Not quite sure how that helps stop drugs coming into this country. Next, as you know, in 2006 USCIS initiated an effort to modernize our paper-based immigration processing system via the Transformation Program. Again, I look forward to hearing from you how we can make this a smoother system. Personally, about 20 years ago I had the honor of processing my uncle--God rest in peace--his citizenship application. His attorney filled out the application once, filled it twice, and then a third time. Then on the third time, as an attorney I personally drove to the Los Angeles office to find out what was going on. A very nice immigration officer took me aside and said, ``Let's see if we can find that third application.'' They found half of it; the other half was missing. Literally they had taken my file that I put together and they had--somebody had torn it in half or half of it had been lost. Thank goodness that immigration officer said, ``Sir, step aside over here. Here is a new application. I am going to give you 3 hours. Go into the cafeteria, fill it out, then come back.'' So I think it is important that we go digital, that we streamline the application process. But again, coming back to my prior statements, which are how do we come up with a better purchasing plan for your Department in terms of I.T.? Instead of going out and signing these big contracts with these big firms that are too big to fail, how we can break it down into smaller pieces and be able to digest our needs in terms of your agency. With that being said, I look forward to hearing the testimony not only from you but from the other witnesses how we can make Government more effective, more efficient; make sure, as our Chairman has said, those individuals that are not-- should not be eligible to become citizens or residents don't become residents; and those that have worked hard to earn those privileges should have the right to have them as quickly as possible. Thank you very much. [The statement of Ranking Member Correa follows:] Statement of Ranking Member J. Luis Correa March 16, 2017 President Trump is engaged in an active campaign to flip the paradigm for our Nation's immigration system from family reunification, admitting skilled workers, protecting refugees, and promoting diversity to a merit-based approach where only individuals deemed as having potential to contribute to our economy would be admitted. Given where this President wants to take immigration, I was surprised and disappointed by the announcement earlier this month by the Trump administration that it was suspending premium processing of H-1B visas. I look forward to engaging with Ms. Scialabba about this decision to no longer offer applicants the option of shorter wait times for a program that helps bring in skilled foreign workers in a range of industries, from technology to health care. I also look forward to engaging the witnesses on the implementation of the proposed ``Muslim Ban'' Executive Order. The ``Muslim Ban,'' which was slated to begin today, was blocked by two Federal judges hours before its commencement. Under the ban, not only are individuals from six majority Muslim nations prohibited from receiving visas to travel to the United States, but also all refugee processing is suspended. Given the critical role that USCIS plays in refugee processing, which includes a vetting process that is arguably the most security- forward in the world--I look forward to engaging with Ms. Scialabba on the prospect of a refugee moratorium. It is not lost on me that even as the President looks to suspend visas to entire populations of people to keep his ``Muslim Ban'' campaign promise and promotes the idea that our immigration system should be merit-based only, the company that bears his name is seeking visas for seasonal low-skilled foreign workers from USCIS. I am concerned that the President's forthcoming budget, which is expected to prioritize building a border wall on the Southwest Border and covering immigration enforcement and detention costs for millions of undocumented immigrants will give USCIS--a largely fee-based agency--a short shrift. In 2006, USCIS initiated efforts to modernize its paper-based immigration processing system via the Transformation Program. The Transformation Program has been plagued with issues, including implementation schedule delays, system user errors, and increased costs due to strategy changes. A component of the Transformation Program, the Electronic Immigration System better known as ELIS, is the subject of much concern, after it was discovered by the DHS Inspector General that approximately 19,000 green cards had been issued in error, primarily due to technical and functional deficiencies. As a result, Inspector General Roth has advised USCIS to use its legacy system, not ELIS, until certain improvements and requirements have been met. In numerous reports, both the Government Accountability Office and the Inspector General have stated that USCIS needs better management, resources, and planning to get this program on track. Due to the nature and importance of this program, it is imperative that the Department prioritizes and improves the Transformation Program. I am concerned that policy changes advanced by this administration will result in reduced fees--fees that are essential to funding USCIS operation and cover its critical IT modernization efforts. The Department cannot achieve long-needed IT enhancement without necessary resources. In fact, in its High-Risk Update released last month, GAO acknowledged that DHS needs to ``make additional progress in allocating resources in certain areas, such as staffing for acquisition and information technology positions.'' This progress GAO speaks of simply cannot be accomplished when personnel are unavailable due to hiring freezes and resources are diverted for building walls. Further, USCIS uses carryover funds from premium processing fees to pay for the Transformation Program. These resources will undoubtedly be less given the suspension of H- 1B premium processing. I look forward to hearing from our witnesses today an updated status on the Transformation Program and the improvements that are needed to remedy this program, particularly as it relates to better management and necessary resources. Mr. Perry. Chair thanks the gentleman. Other Members of the subcommittee are reminded that opening statements may be submitted for the record. [The statement of Ranking Member Thompson follows:] Statement of Ranking Member Bennie G. Thompson March 16, 2017 Too often, this subcommittee convenes to discuss failures in IT modernization at the Department of Homeland Security. At some point, the Department must hold itself to a higher standard of performance and fix its inability to accurately deliver a program as promised, on time and on budget. Even today, the Department feels the need to not hold itself accountable. The Department chose not to send the USCIS Chief Information Officer, the exact individual responsible for IT functions at the component, to answer important questions on the status of IT at USCIS. It is my understanding that the subcommittee just learned of this decision this past Friday. Instead, representing USCIS today is Acting Director Lori Scialabba, who has provided her resignation to the Department. For over a decade, DHS has made attempts to modernize its paper- based immigration process by developing an on-line tool that allows applicants to apply and track their status on-line, known as the Transformation Program. Unfortunately, the program has experienced a range of issues, including increased costs, system outages, and application processing errors. As such, the Transformation Program has been the subject of countless GAO reports, Inspector General investigations, and even most recently, an Inspector General management alert. The Transformation Program's main component, ELIS, has been suspended due to system deficiencies, including an error that resulted in 175 cases moving forward for processing despite incomplete background and security checks. These are major errors that cannot be overlooked or avoided, especially at a time when this administration is forcing a range of changes in policies and priorities for USCIS. For instance, the President wants to shift our Nation's immigration system from family reunification and admitting skilled workers and protecting refugees to a merit-based approach. The President has suspended premium processing of H-1B visas, which offers a shorter wait time for foreign workers in a range of industries. The President, through his proposed ``Muslim Ban,'' looks to prohibit individuals from six majority Muslim nations from receiving visas to travel to the United States. Also, the President's ``Muslim Ban'' would suspend refugee processing, causing America to turn its back on the most vulnerable. Thankfully, yesterday evening and this morning two Federal judges ruled to freeze the Executive Order, stating the new order failed to pass legal muster at this stage. Interestingly, while the President tries to suspend visas to entire populations and attempts to stifle our economy by prohibiting foreign workers from getting visas quickly, companies that bear his name still seek visas for seasonal, low-skilled workers. Moreover, this administration's misplaced budgetary priorities focus on building a wall along the Southwest Border and heightened immigration enforcement and detention. Prioritizing a wall, which does not keep us more safe and secure, will undoubtedly divert resources away from IT at the Department. I am concerned that this administration's policies will result in reduced fees that are essential to funding USCIS operations. Therefore, keeping the Transformation Program on a lifeline. I look forward to hearing from our witnesses today on how this administration's ill-advised policies will ultimately affect USCIS. Mr. Perry. We are pleased to have a distinguished panel of witnesses before us today. The witnesses' entire written statements will appear in the record. The Chair will introduce the witnesses first and then recognize each of you for your testimony. Ms. Lori Scialabba is acting director at U.S. Citizen and-- Citizenship and Immigration Services, or USCIS. Previously she served as the USCIS deputy director since May 2011. Prior to USCIS, Ms. Scialabba was on the Board of Immigration Appeals in the Executive Office for Immigration Review, or the EOIR, in the Justice Department. Ms. Carol Harris is a director for information technology acquisition management issues with the Government Accountability Office, the GAO. Ms. Harris leads the GAO's work for I.T. across the Federal Government. Welcome. The Honorable John Roth assumed the post of inspector general for the Department of Homeland Security in March 2014. Previously Mr. Roth served as the director of the Office of Criminal Investigations at the Food and Drug Administration, and as an assistant U.S. attorney for the Eastern District of Michigan. He is here often. We welcome you all. Thanks for being here today. The Chair now recognizes Ms. Scialabba for an opening statement. Make sure you press--thank you, ma'am. STATEMENT OF LORI SCIALABBA, ACTING DIRECTOR, U.S. CITIZENSHIP AND IMMIGRATION SERVICES, U.S. DEPARTMENT OF HOMELAND SECURITY Ms. Scialabba. Thank you, Mr. Chairman. Chairman Perry, Ranking Member Correa, and Members of the subcommittee, thank you for this opportunity to discuss information technology systems at United States Citizenship and Immigration Services. As you said, my name is Lori Scialabba. I am the acting director of USCIS. I have almost 33 years of Government service, beginning with the Department of Justice in 1985. During my career at Justice I served in a number of capacities leading up to my appointment by Attorney General John Ashcroft in 2002 to chair the Department of Justice Board of Immigration Appeals. In 2006 I moved to USCIS within the Department of Homeland Security to serve as the associate director for refugee, asylum, and international operations. I also had served as the advisor to DHS Secretary Michael Chertoff, and more recently I served as the U.S. deputy director and twice as the acting director. In all of these roles I have gained a deeper appreciation for the complexity of the work accomplished by our employees and required by the immigration system. I have also seen how the right technology can help accomplish our mission. Yet, bringing our Nation's legacy paper-based immigration system into the digital age remains a substantial work in progress, and it is not simply an I.T. challenge. The United States has the largest immigration system in the world. In fiscal year 2016 alone USCIS received over 8 million applications filed for people wanting to live, work, invest, study, and seek protection in the United States. As a component of DHS we have a dual mission. That is to keep America safe and to ensure the integrity of the immigration system. I note that this hearing was called to focus on findings by the DHS's Office of Inspector General and the Government Accountability Office, including findings about our Transformation Program. The OIG and GAO reports have been helpful in providing USCIS with an independent assessment of our efforts and we have accepted recommendations that will improve the performance and efficiency of our systems. Indeed, in many cases we had already identified some of the improvements and begun implementation even before the reports were formally issued. It is no secret the transformation has not been easy. The program was launched in 2005, 2006 time frame with the goal of thoroughly modernizing decades of old I.T. systems. The effort began the same way as other large Government I.T. projects traditionally start, with a large contract awarded to a single system integrator to manage virtually everything within that project. It is known as the waterfall method. It is the method that the Government has used for quite some time, where all the improvements come all at once. However, before the contractor delivered the first release in May 2012, we realized it was not going to work. It was not going to address our agency's needs. It actually slowed our work down, what they rolled out. Given our experience with this first release of ELIS, the Electronic Immigration System, we changed our strategy. We brought in the same agile development that you mentioned that are methods that are used by leading companies in the private sector. Rather than investing years on a single contractor and building a monolithic system, we decided to move to smaller contractors and have the Government serve as the integrator and roll out small bits of code at a time more rapidly. We hired from the private sector a chief information officer who has a strong background in agile development, and we also developed a more standard approach that incorporates more open-source frameworks and nonproprietary software. Finally, we decided to move the public cloud, where we procure storage space and we serve on secure servers to store our data. These changes have enabled us to build more quickly, operate more efficiently, and detect and fix bugs along the way. Since 2016 we have added five product lines to ELIS. Of course, just like any other major I.T. launch, we anticipated that when we moved to this--when we moved last year to bring one of our most complicated products, the application for naturalization, the N-400, into the system that there may be issues. So USCIS leadership team was prepared to pause the roll-out if necessary, and that is exactly what we did when several problems surfaced with the N-400. I want you to understand, though, that the N-400 applications that were started in ELIS are not sitting idle. We continue to process them, and we are conducting 100 percent quality assurance reviews of the text background checks that we used to vet our applications. With regards to the OIG and GAO recommendations, I would like to provide some information on the actions that we are taking consistent with those findings. First, we incorporated the Transformation Program into our Office of Immigration Technology. This has allowed us to leverage the knowledge and talent of both of those offices. This is a better fit for oversight and for coordination purposes. We are also clarifying the scope of the program, especially when it overlaps with other agency initiatives. The goal is to focus on the benefit types that constitute the great majority of our work in order to be more responsive to the needs of our applicants, petitioners, and employees. We are working to fix the issues that prevented us from continuing to ingest the new naturalization cases into ELIS, and I am pleased with the progress that we are making. We are also working with USCIS leadership to clarify specific outcomes that we want to achieve with each process we bring into the electronic environment. I wanted to mention, too, that we have right now 25 percent of our caseload is actually in ELIS and is being processed in ELIS. We are continuing to devise metrics and monitoring tools that will allow us to measure our success in accomplishing these outcomes. Finally, we are establishing uniform standards for what constitutes a well-tested piece of code, and we are adopting more of the development tools used by major companies. As I prepare to conclude more than 3 decades of Government service, I am pleased and encouraged by the new direction that we are taking in building a system that can meet today's needs and risks and adapt enough to whatever lies ahead. We are fortunate that we have an extremely dedicated, extremely talented team addressing the issues raised by the inspector general and GAO. The American people deserve a 21st-Century immigration system that enables us to provide timely and accurate decisions while safeguarding the public and National security. Again, I want to thank you for the opportunity to appear today, and I look forward to addressing your questions. [The prepared statement of Ms. Scialabba follows:] Prepared Statement of Lori Scialabba March 16, 2017 Chairman Perry, Ranking Member Correa, and Members of the subcommittee, thank you for this opportunity to discuss information technology systems at U.S. Citizenship and Immigration Services (USCIS). I am Lori Scialabba, the acting director of USCIS. Bringing our Nation's legacy paper-based immigration system into the digital age remains a substantial work in progress. And it's not simply an IT challenge. The United States has the largest immigration system in the world. In fiscal year 2016 alone, USCIS received over 8 million petitions and applications filed for people wanting to live here, work here, study here, invest here, bring foreign relatives or adopted children here, or become citizens. As a component of the Department of Homeland Security (DHS), USCIS has a dual mission--to keep Americans safe and ensure the integrity of our immigration system as we fulfill our promise as a Nation of immigrants. Given today's threats, there is no higher priority for us than continuing to expand and integrate our fraud detection and National security operations into all areas of our work. Building a technically- reliable electronic case management system is not enough. It must safeguard against fraud and abuse, and ensure that immigration benefits are not provided to individuals who wish to do us harm. USCIS currently processes approximately 25 percent of casework through computer files rather than thick folders of paper. That's a significant accomplishment given our paper-bound history. We are committed to expanding our digital capabilities, and taking IT techniques from the private sector and adapting them to the immigration context wherever possible. Per your invitation letter, you have called this hearing to focus on findings by DHS's Office of Inspector General (OIG) and the Government Accountability Office (GAO), including findings about our Transformation program. I would like to note that 2 months ago, in January, the Transformation program became part of the USCIS Office of Information Technology (OIT), which means that our Chief Information Officer now has the responsibility to oversee its day-to-day operations to ensure it delivers value for our investment. And by that I mean the investment of fees paid by those seeking immigration benefits, as USCIS is almost entirely funded by fees. Over the last few months, the OIT team has conducted various internal assessments of the Transformation program's status, and have carefully reviewed the independent assessments that were conducted by the OIG and GAO. Based on the information gathered and knowledge of IT industry best practices, we have assembled a plan designed to improve the program's performance and ensure that it delivers on its intended outcomes. This approach will be discussed later in my testimony. Since initiating this effort USCIS has worked hard to bring contemporary IT practices into our environment, not just at USCIS, but around DHS and the rest of the Federal Government. The Transformation program is an excellent opportunity to take the current, most promising practices of industry and apply them to a large Government need. Transformation began in 2005-2006 as a USCIS program whose intention was to thoroughly modernize IT systems. The program was created to move the agency from a paper-based process to an electronic process, improve the efficiency of adjudication, provide better service to those seeking benefits, and adopt a person-centric view of our data. Such a modern and efficient system would ultimately help improve our National security. The original scope and purpose of the Transformation program was broad and vast. Unfortunately these broad intentions have made it difficult for the program to focus on specific business objectives, and to make good prioritization decisions about where to focus resources. The program began with a large contract to a single system integrator to manage virtually all aspects of the Transformation effort. In addition to building an extensive IT system, called the Electronic Immigration System, or ELIS, this contractor was tasked with leading business process re-engineering, stakeholder communications, training, requirements elicitation, and of course all of the development coding and testing. When the system integrator finally delivered the first release of the product, in May 2012, it was a radically scoped-down version of our intent and accomplished only a small subset of the work of a relatively narrow part of the agency's day-to-day mission. It actually slowed the agency's work. Given USCIS's negative experience with this first release of ELIS, we decided to make a number of changes to our strategy. First, we decided to replace the single large system integrator with several smaller contractors, and have the Government serve as the integrator. We devised a new contracting approach that encouraged good performance by the contractors through continual competition for additional work from us. Second, and very importantly, we changed to an agile development approach that allowed us to see frequent, finished work from the contractors, so we could make sure the project was always moving forward. With an agile approach, rather than waiting a long time for the product to be completely built and delivered before discovering if it works or satisfies the agency's needs, the system is constructed in pieces, with each part tested to make sure it works well with the other pieces. Third, we realized that the original design of the system was one of the reasons development was slow and problematic. It was based on integrating about 30 different proprietary products--and it turned out that they didn't work together very well. So we decided to switch to a more standard approach, based on open source frameworks based on non-proprietary software. Finally, we decided to move to the public cloud; in other words, procuring storage space on secure servers to store some of our data as many Federal agencies now do. These changes have enabled us to operate more efficiently, build more quickly, and detect and fix bugs along the way. It took several years to fully implement these changes, but with the new design, contracts, process, and the cloud environment, the program began to deliver new functionality on a regular cadence. In fact, it currently releases small pieces of new functionality approximately four times a week--a far cry from the old way of doing things, where releases came more on the order of annually--or in the case of Transformation, about 6 years for the first release. In November 2015, the program first launched its electronic version of the Application for Replacement Green Card (Form I-90) in the redesigned version of the system. This was a major milestone, as the green card replacement accounts for about 10 percent of the agency's workload. It was followed, in 2016, by electronic processing of Applications for Temporary Protected Status (Form I-821) and requests for Consideration of Deferred Action for Childhood Arrivals (Form I- 821D), as well as making the program the only source for collection of the required immigrant fee for green card processing. Altogether, these lines of business account for approximately 25 percent of the agency's workload. It is important to know that ``electronic processing'' does not mean that a computer makes the adjudication. It means that scanned versions of immigration applications and requests and supporting documents are ingested into our systems so an officer can view and process them on a computer. Our officers make the final decisions with the help of this electronic processing system. In 2016, we moved to take the next step and bring one of the agency's most important, but also most complicated, products into ELIS: The Application for Naturalization (Form N-400). We anticipated there could be issues, as there often are with any major IT launch. Our agency leadership was prepared to suspend the roll-out if necessary, and that is exactly what USCIS did when problems surfaced after the launch. In August 2016, we returned to ingesting newly filed N-400's into our legacy system, known as CLAIMS 4, to minimize any disruption in processing of naturalization applications while we corrected identified systems issues. As the Inspector General is aware, we continue to process the approximately 240,000 N-400 naturalization cases that were started in ELIS. They are not sitting idle while we await systems modifications. In order to ensure the integrity of the ELIS process, we are conducting 100 percent quality assurance checks of TECS background checks in two ways--once through ELIS and again outside of ELIS--and then comparing the results to ensure consistency. In addition, we continue to monitor all of the background check functionality, including FBI name checks, and resolve any anomalies as they occur. USCIS has also recently established a Background Check Working Group to continually evaluate security check procedures and to recommend optimal background check approaches to be adopted agency-wide. USCIS has been adamant that new work will not shift back into ELIS until improvements are made to how ELIS handles naturalization processing. These include streamlining the printing and scanning processes, establishing a ``contingency plan'' for continuing to conduct interviews even if there is an ELIS outage, and formalizing some measure of the above-described redundancy in our background checks. It should be noted that the Inspector General validated our internal recommendations in the January 19, 2017 management alert (``U.S. Citizenship and Immigration Services' Use of the Electronic Immigration System for Naturalization Benefits Processing''). Taking a wider view of building the infrastructure for a modern immigration system, USCIS agrees with the July 2016 GAO assessment that ``Regarding software development, the Transformation program has produced some software increments, but is not consistently following its own guidance and leading processes.'' GAO found that Transformation program practices were beginning to diverge from those used by leading companies. In my view, Transformation is one of the most advanced Government programs in using contemporary IT delivery practices. But this is not an area where you can go halfway and get good results. GAO recognized that Transformation's frequent use of automated testing, and continuous build and integration, were good practices that provided an ability to deliver quickly and consistently. The Transformation program, GAO also pointed out, ``has established an environment that allows for effective systems integration and testing and has planned for and performed some system testing. However, the program needs to improve its approach to system testing to ensure that USCIS ELIS meets its intended goals and is consistent with agency guidance and leading practices.'' GAO found discrepancies between some of the practices being used by the Transformation program and the guidance issued by OIT. Now that Transformation has been incorporated into OIT as of January of this year, we will ensure appropriate oversight of the program. As part of OIT, Transformation will be assisted by having full access to OIT's developers, applications, and systems already in existence within the agency. Although the GAO and OIG findings have been helpful to us in diagnosing issues in the program, I would like to update the subcommittee on two points. First, the Inspector General correctly pointed out a number of problems in the ELIS I-90 (replacement green card) release. However, the OIG study was conducted shortly after the launch of the electronic I-90, a time when it is typical for IT systems to have kinks that need to be worked out. Notably we implemented an asynchronous handoff process to handle potentially sporadic connectivity between ELIS and the Enterprise Service Bus (ESB) to ensure timeouts between the systems would not inadvertently result in duplicate cards being produced. Second, in regard to concerns about some green cards being mailed to wrong addresses, we are now implementing a fix to enable applicants to answer a series of questions to verify their identity in order to update their address on-line. This fix will help so that changes of address are made by the applicant as early in the process as possible in order to avoid instances of green cards being mailed to an applicant's prior address. Also, the OIG report provided data on three cost estimates which could be read to infer that the cost of the program has been increasing over time, beginning with $536 million in the original Acquisition Plan, $2.1 billion in the original life-cycle cost estimate, and finally $3.1 billion in the revised life-cycle cost estimate. It is important to clarify that the first cost estimate of $536 million was based on the original development and support contracts awarded for system development under the previous waterfall approach, and included a base contract period of performance of 4 months followed by five option periods covering a total of 5 years and 1 month. It was not an approved, finalized cost estimate that covered the traditional investment and operations and maintenance periods found in a life-cycle cost estimate. In contrast, the $2.1 billion cost estimate was based on a life-cycle cost estimate that included system development and maintenance costs covering a 16-year period from 2006 through 2022. Finally, the $3.1 billion cost estimate was based on an updated life- cycle cost estimate that also included system development and maintenance costs, but was expanded to cover a 27-year period from 2006 through 2033. Finally, I would like to report on some of the actions USCIS is taking that are consistent with the OIG and GAO findings to improve the performance of the program: USCIS recently incorporated the Transformation program into the Office of Information Technology and has made organizational changes so that we can bring the many technical skills and processes of OIT to bear on the program. USCIS is clarifying the scope of the program, especially where it overlaps with other agency initiatives. The program is focusing on the lines of business that will truly transform the agency. We are working to fix the five issues specifically identified by USCIS that prevented us from continuing to move forward with accepting new naturalization cases into ELIS. We are making good progress and expect those issues to be resolved in the near future. We are working with DHS to clarify the specific outcomes that we want to achieve with each process we bring into an electronic environment. And we are devising metrics and monitoring tools that will allow us to measure our success in accomplishing these outcomes. We are also establishing uniform standards for what constitutes a well-tested piece of code, and adopting more development processes similar to those used by major companies. We are fortunate to have an extremely dedicated, extremely talented team at work on the program. We hope that the changes we are making will address the important points raised by the Inspector General and GAO, so that the program can truly transform the way our agency processes immigration benefits and services. Again, thank you for this opportunity to discuss what USCIS is doing to support the mission of Homeland Security. I am happy to address your questions. Mr. Perry. Chair thanks Ms. Scialabba. The Chair now recognizes Ms. Harris for her opening statement. STATEMENT OF CAROL C. HARRIS, DIRECTOR, INFORMATION TECHNOLOGY ACQUISITION MANAGEMENT ISSUES, U.S. GOVERNMENT ACCOUNTABILITY OFFICE Ms. Harris. Chairman Perry, Ranking Member Correa, and Members of the subcommittee, thank you for inviting us to testify today on the U.S. Citizenship and Immigration Services Transformation Program. As requested, I will briefly summarize the findings from our most recent reports completed at your request on this important I.T. acquisition. Each year USCIS processes millions of mostly paper-based applications and petitions for more than 50 types of immigrant- and nonimmigrant-related benefits. According to DHS, on an average day USCIS completes 23,000 applications for various immigration benefits and conducts 148,000 National security background checks. Our past work has identified lengthy backlogs of pending applications and an inability to complete--and an inability to comprehensively identify fraud because of the reliance on paper files. The Transformation Program was initiated in 2006 to address processing inefficiencies and improve National security by transforming the current method into an electronic account- based system. Among other objectives, the program is to allow applicants to establish an account with USCIS to track and file the status of their applications on-line. The program's main component, the ELIS system, is to provide case management for adjudicating immigration benefits. ELIS relies on and interfaces with other systems that provide additional capabilities, such as user authentication and scheduling, to deliver end-to-end processing. Unfortunately, this program has faced severe management and system development challenges since its inception. This morning I would like to highlight two key points from our reports. First, the Transformation Program's deployment schedule is significantly delayed, causing missed savings and deferred mission benefits. After more than 8 years and roughly $475 million spent, USCIS abandoned the system they had initially been pursuing in May 2016 due to its instability. This largely occurred because the system was allowed to proceed through development despite challenges in program management and limited oversight. In response to various technical issues, USCIS shifted its acquisition approach, which resulted in the proposed development of a new ELIS system. In April 2015 DHS and USCIS approved the revised plan with full deployment of the new system planned for March 2019, a delay of more than 4 years from the initial approved baseline. However, the new system is experiencing technical issues and the March 2019 date is under review by USCIS and DHS and could be pushed out even further. These delays mean legacy systems must remain in operation until the new ELIS is available, and the cost of maintaining those systems as of fiscal year 2014 was about $71 million per year. In addition, USCIS's ability to realize operational improvements tied to the program have been deferred, including reducing the immigration benefit backlogs through business process change, and enhancing National security by better authenticating users and integrating with external agency databases. In addition, our work on immigration fraud has shown that USCIS's ability to systematically identify and address fraud risks on their asylum and immigrant investor programs will be deferred, in part because of their dependence on planned ELIS functionality that does not yet exist. My second point: On-going program challenges are increasing the likelihood that the new ELIS will continue to miss cost, schedule, and performance goals. In July 2016 we reported that the Transformation Program was not consistently following key practices in software development and testing, among other things. For example, while the program has established an environment and procedures for continuously integrating and testing code, it was not meeting benchmarks for functional tests and code inspection. In other words, Transformation risked poor system performance after being released to the public. At the time of our report this risk was already being realized. For example, in November and December 2015 the program's quality assurance team reported that code quality had become a major issue. Later, in March 2016, metrics maintained by the program indicated that issues being encountered on the system were increasing faster than they could be addressed. In May 2015 we also reported that while the program's two key governance bodies were taking actions to monitor progress and implement corrective actions, they were not relying on complete and accurate data to make decisions. In light of these and other issues, we have made a total of 30 recommendations to address the Transformation Program's poor progress and ineffective management. As of this morning, USCIS has fully addressed 17 of them, and it will be critical for the agency to effectively implement the remaining 13 in order to improve Transformation's outcomes and help achieve its goals of modernizing the paper-based immigration process, improving customer service, and enhancing National security. That concludes my statement, and I look forward to addressing your questions. [The prepared statement of Ms. Harris follows:] Prepared Statement of Carol C. Harris March 16, 2017 Chairman Perry, Ranking Member Correa, and Members of the subcommittee: I am pleased to be here today to discuss the challenges that U.S. Citizenship and Immigration Services (USCIS) has had in developing an electronic system to support and modernize the filing and processing of immigration and citizenship applications. As you know, each year, USCIS, an agency within the Department of Homeland Security (DHS), processes millions of mostly paper-based applications and petitions for more than 50 types of immigrant and nonimmigrant-related benefits. Having a seamless electronic system would assist the agency in accurately processing immigration and citizenship benefits in a timely manner to eligible applicants. Such a system would also assist in denying benefits to those who are ineligible. In addition, the system could help USCIS identify fraudulent and criminal activity, essential for ensuring the integrity of the immigration process. We have long recognized the need to improve the USCIS benefits application and adjudication processes and underlying technology infrastructure.\1\ For example, in May 2001, we reported that some applications and petitions--benefit applications--took 2 years or longer to process.\2\ This lengthy process resulted in backlogs of pending applications. More recently, in September 2016, we reported that USCIS was unable to comprehensively identify and address fraud trends across the immigrant investor program in part because of its reliance on paper-based documentation and limitations with using and collecting that data for the program.\3\ According to an official from USCIS's Fraud Detection and National Security Directorate, this supporting data could be an important source for fraud indicators. --------------------------------------------------------------------------- \1\ See appendix I for related GAO products. \2\ GAO, Immigration Benefits: Several Factors Impede Timeliness of Application Processing, GAO-01-488 (Washington, DC: May 4, 2001). \3\ GAO, Immigrant Investor Program: Progress Made to Detect and Prevent Fraud, but Additional Actions Could Further Agency Efforts, GAO-16-828 (Washington, DC: Sept. 13, 2016). --------------------------------------------------------------------------- In 2006, USCIS embarked on a major initiative, the Transformation Program, to address processing inefficiencies and transform its current paper-based system into an electronic account-based system. This system was expected to incorporate electronic adjudication and account-based case management tools, including tools that would allow applicants to apply on-line for benefits. However, since its inception, we have reported that the program has continually faced management and development challenges, limiting its progress and ability to achieve its goals of enhanced National security and system integrity, better customer service, and operational efficiency.\4\ Over the last 10 fiscal years, we have made 30 recommendations to address weaknesses in the program's acquisitions and operations. USCIS has fully addressed 17 of these 30 recommendations.\5\ Based in part on our concerns about the Transformation Program, we identified it as 1 of 10 investments in need of the most attention when we designated managing information technology (IT) acquisitions and operations across the Federal Government as high-risk in 2015.\6\ --------------------------------------------------------------------------- \4\ GAO, USCIS Transformation: Improvements to Performance, Human Capital, and Information Technology Management Needed as Modernization Proceeds, GAO-07-1013R (Washington, DC: July 17, 2007); Immigration Benefits: Consistent Adherence to DHS's Acquisition Policy Could Help Improve Transformation Program Outcomes, GAO-12-66 (Washington, DC: Nov. 22, 2011); Immigration Benefits System: Better Informed Decision Making Needed on Transformation Program, GAO-15-415 (Washington, DC: May 18, 2015); Immigration Benefits System: U.S. Citizenship and Immigration Services Can Improve Program Management, GAO-16-467 (Washington, DC: July 7, 2016). \5\ See appendix II for the status of prior recommendations. \6\ GAO, High-Risk Series: An Update, GAO-15-290 (Washington, DC: Feb. 11, 2015). --------------------------------------------------------------------------- My testimony today will focus on Transformation Program cost increases and schedule delays and program management challenges that have contributed to increasing risks to the new system. In developing this testimony, we relied on our previous reports, as well as information provided by the Department on its actions in response to our previous recommendations and on-going work. A more detailed discussion of the objectives, scope, and methodology for this work is included in each of the reports that are cited throughout this statement. All of the work on which this statement is based was conducted in accordance with generally-accepted Government auditing standards.\7\ Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. --------------------------------------------------------------------------- \7\ A more detailed discussion of the objectives, scope, and methodology of this work is included in each of the reports that are cited throughout this statement. See appendix I for related GAO products. --------------------------------------------------------------------------- background The goals of the Transformation Program are to modernize the paper- based immigration benefits process, enhance National security and system integrity, and improve customer service and operational efficiency. Established in 2006, the program comprises many systems, each of which provides a service to facilitate operations, such as identity management and risk and fraud analytics. The objectives of the Transformation Program are to allow: applicants to establish an account with USCIS to file and track the status of the application, petition, or request on- line; the USCIS Electronic Immigration System (USCIS ELIS), which is the main component of the program, to apply risk-based rules automatically to incoming applications, petitions, and requests to identify potentially fraudulent applications and National security risks; adjudicators to have electronic access to applications, petitions, and requests, relevant policies and procedures, and external databases; USCIS to have management information to track and allocate workload; and USCIS ELIS to have electronic linkages to other agencies, such as the Departments of Justice and State, for data-sharing and security purposes. As the main component of the program, USCIS ELIS is to provide case management for adjudicating immigration benefits. USCIS ELIS relies on and interfaces with other systems that provide additional capabilities, such as user authentication and scheduling, to deliver end-to-end processing. In particular, as of July 2016, the system was expected to interface with at least 30 other systems, ranging in function from fraud detection to law enforcement and to on-line payment. The program expects to achieve its goals and objectives through the delivery of five core operating requirements. These core requirements, which are expected to collectively deliver the program's mission needs, are: (1) Intake and account management; (2) benefits case management; (3) electronic content management; (4) agency and knowledge management; and (5) risk and fraud management. Table 1 describes the five core operational requirements. TABLE 1.--USCIS ELIS'S FIVE CORE OPERATIONAL REQUIREMENTS ------------------------------------------------------------------------ Core operational requirement Description ------------------------------------------------------------------------ Intake and PAccount PManagement.. Enable electronic submission of completed applications and fee payments. Enable benefit requests submitted by paper to be electronically transferred to USCIS ELIS for subsequent processing. Benefits Case Management......... Enable electronic application tracking, and facilitate adjudication of immigration benefits. Electronic Content Management.... Enable digitizing, managing, and sharing electronic content. Includes the feature for establishing and managing document libraries that support external customer needs. Agency and PKnowledge............ Enable the alignment of resources and tools to facilitate adjudication and supporting processes. Management includes features for generating management reports and facilitating the management of fees and customer inquiries. Risk and Fraud Management........ Provide the features that send, receive, and consolidate information required for processing and assessing background checks based on biographic and biometric information and support improvements for identifying potential fraud and National security. ------------------------------------------------------------------------ \1\ Source: GAO analysis of USCIS documentation. GAO-17-486T Program Governance and Oversight The USCIS Transformation Program is governed by multiple bodies within DHS and the program. Specifically, DHS governance bodies, such as the Acquisition Review Board and Executive Steering Committee, evaluate cost, schedule, and performance of a program and provide corrective actions when needed. In addition, the Department's Office of the Chief Information Officer and Office of Program Accountability and Risk Management conduct oversight of individual programs, which in turn, informs Congressional and Office of Management and Budget oversight. For example, the Office of Program Accountability and Risk Management develops periodic reports to ensure that various DHS programs and their components within the agency satisfy compliance- related mandates and improve investment management. In addition, the Office of the Chief Information Officer performs periodic reviews that serve as the basis for publicly-reported program ratings.\8\ --------------------------------------------------------------------------- \8\ These ratings are published on the Federal IT Dashboard. In June 2009, OMB deployed a public website known as the IT Dashboard to improve the transparency and oversight of agencies' IT investments. The IT Dashboard displays Federal agencies' cost, schedule, and performance data for major Federal IT investments at Federal agencies. For each major investment, the Dashboard provides performance ratings on cost and schedule, a chief information officer evaluation, and anoverall rating, which is based on the cost, schedule, and ratings. --------------------------------------------------------------------------- Within USCIS, directorates govern divisions and program offices govern specific functions, such as the Transformation Program. One program office, the Office of Transformation Coordination, has managed and overseen the development of USCIS ELIS. Other USCIS directorates and program offices, including the Office of Information Technology and the Customer Service and Public Engagement directorate, have supported the management and oversight of the larger USCIS Transformation Program. Software Development Approach In April 2015, USCIS officially changed its software development approach. In particular, USCIS transitioned from a waterfall approach to develop, test, and deliver USCIS ELIS functionality \9\ to an incremental approach. In an incremental approach, software is developed, tested, and delivered in smaller components or phases, rather than in the typically long, sequential phases of a traditional waterfall approach. Incremental software development is consistent with the Office of Management and Budget's IT Reform Plan \10\ and the law commonly referred to as the Federal Information Technology Acquisition Reform Act (FITARA).\11\ The incremental approach chosen by USCIS, called Agile, is intended to allow subject-matter experts to validate requirements, processes, and system functionality in increments, and deliver the functionality to users in short cycles. --------------------------------------------------------------------------- \9\ Waterfall development is an approach that uses long, sequential phases, resulting in product delivery years after program initiation. \10\ Office of Management and Budget, 25 Point Implementation Plan to Reform Federal Information Technology Management (Washington, DC: Dec. 9, 2010). \11\ 40 U.S.C. Sec. 11319(b)(1)(B)(ii). The Federal Information Technology Acquisition Reform provisions of the Carl Levin and Howard P. ``Buck'' McKeon National Defense Authorization Act for Fiscal Year 2015, Pub. L. No. 113-291, div. A, title VIII, subtitle D, 128 Stat. 3292, 3438-3450 (Dec. 19, 2014). --------------------------------------------------------------------------- transformation program has experienced significant cost increases and schedule delays Since USCIS began implementation of the Transformation Program in 2006, the effort has experienced significant cost increases and schedule delays. In particular, the program's most recent baseline, approved in April 2015, indicates that the Transformation Program will cost up to $3.1 billion and be fully deployed no later than March 2019. This is an increase of approximately $1 billion with a delay of more than 4 years from its initial July 2011 acquisition program baseline. In November 2008, USCIS awarded a solutions architect contract for approximately $500 million over a 5-year period to design, develop, test, deploy, and sustain the Transformation Program by November 2013. In July 2011, DHS officially approved the Transformation Program's acquisition program baseline and supporting operational requirements. This baseline estimate was for about $2.1 billion and the program was projected to reach full operating capability no later than June 2014. In May 2012, USCIS launched the first release of USCIS ELIS. This release included capabilities associated with all of the system's core operational requirements, such as on-line account setup, case management, case acceptance, applicant evidence intake, and notice generation. Subsequent to this first release, USCIS deployed additional releases to add functionality. This initial USCIS ELIS \12\ was used to process nonimmigrant requests to change or extend their status, USCIS immigrant fees, and immigrant petitions for foreign nationals who make investments in U.S. commercial enterprises. --------------------------------------------------------------------------- \12\ The initial USCIS ELIS was later replaced with a new system, also called USCIS ELIS, and the first system was decommissioned. More details on this are included after Table 2. --------------------------------------------------------------------------- Beginning in 2013, the program was operating beyond its approved baseline, a situation DHS referred to as being ``in breach.''\13\ As a result, we reported in 2015 that the program was not in compliance with DHS acquisition policies and procedures. To address the breach, DHS acquisition policies and procedures required that, within 90 days, a new baseline be approved or a program review be conducted to review the proposed baseline revisions. We reported that neither of these actions had taken place since 2013. --------------------------------------------------------------------------- \13\ DHS programs establish baselines for cost, schedule, and performance expectations. When these expectations are exceeded, such as a cost overrun or schedule delay, the program is considered in breach and required to re-baseline. --------------------------------------------------------------------------- However, despite exceeding its approved baseline and operating without a DHS-approved revised acquisition strategy and baseline, the Transformation program continued with its system development efforts. As part of the continued development, USCIS pursued a new acquisition approach. As we reported in May 2015,\14\ changes in its approach included changes to the software development methodology, contracting approach, and program architecture and were intended to help address concerns about delays and cost overruns. See Table 2 for a description of these changes. --------------------------------------------------------------------------- \14\ GAO-15-415. TABLE 2.--KEY CHANGES TO THE TRANSFORMATION PROGRAM'S ACQUISITION APPROACH ------------------------------------------------------------------------ Key change Previous approach New approach ------------------------------------------------------------------------ Contracting approach............ One contractor Multiple that served as contractors to the sole solution provide various architect and services, with system integrator. USCIS serving as the system integrator. Software development approach... Waterfall Agile software development, an development, an approach that approach that uses long, delivers software sequential in small, short phases, resulting increments, in product resulting in delivery years software released after program in phases. initiation. Program architecture............ Included a large Includes open- number of source software, proprietary which is publicly commercial off- available for the-shelf use, study, software reuse, products, which modification, are ready-made enhancement, and and available for redistribution by sale. the software's users. This software is to be used in combination with fewer commercial off-the-shelf products in a cloud computing environment. ------------------------------------------------------------------------ Source: GAO analysis of USCIS documentation. GAO-17-486T The shift in acquisition approach also resulted in the proposed development of a new USCIS ELIS system. The new system was to be a separate and distinct system from the previously developed USCIS ELIS. In November 2014, after a year-and-a-half of planning and development, USCIS deployed an initial version of the new USCIS ELIS system to allow for limited processing of permanent resident card renewals and replacements. This initial deployment also tested all core processing capabilities, such as the ability to electronically file or schedule appointments for collecting biometric information. Between November 2014 and February 2015, the functionality of the new USCIS ELIS was enhanced to allow full processing of permanent resident card renewals and replacements. Nevertheless, during this time, the Transformation Program continued to operate in breach status, without a DHS-approved revised acquisition strategy and baseline. In 2015, we reported\15\ that this breach had impacted DHS's ability to effectively oversee and govern the program because oversight was no longer being conducted relative to a current and approved program schedule. --------------------------------------------------------------------------- \15\ GAO-15-415. --------------------------------------------------------------------------- The program's revised acquisition baseline and strategy were formally approved in April 2015, over 2 years after the breach. Under its new acquisition baseline, USCIS estimated the program to cost up to $3.1 billion and to be fully deployed no later than March 2019. This was an increase of approximately $1 billion and a delay of over 4 years from the program's initial approved baseline in July 2011. The new acquisition strategy represented official DHS approval of the program's updated acquisition approach and also formally required that the old USCIS ELIS be decommissioned and that USCIS continue to pursue the new USCIS ELIS. In May 2015, we reported that changes in the Transformation Program acquisition strategy intended, in part, to address the breach had contributed to significant delays in the program's planned schedule.\16\ --------------------------------------------------------------------------- \16\ GAO-15-415. --------------------------------------------------------------------------- In July 2016, we once again expressed concerns over program performance, focusing on the reliability of the program's cost, schedule, and scope measurements.\17\ For example, we reported that delays in the schedule could increase the risk that the program would proceed with future USCIS ELIS development or deployment before it was ready in order to meet committed dates. In addition, we reported that the program was at risk of future schedule delays in later USCIS ELIS releases, which might result in the program exceeding its revised cost or schedule thresholds. We made 12 recommendations to improve the ability of USCIS to manage the program. USCIS concurred with our recommendations and has initiated work to implement them. --------------------------------------------------------------------------- \17\ GAO-16-467. --------------------------------------------------------------------------- USCIS continues to expand the ability of the new USCIS ELIS to process citizenship and immigration benefits. Specifically, after April 2016, USCIS deployed the additional capability to process applications for temporary protected status and additional naturalization forms. However, in August 2016, the program reverted back to the legacy system, called the Computer-Linked Application Information Management System 4, for processing the same naturalization form that had been deployed in the new USCIS ELIS only 4 months earlier. As a result of the switchover and other technical issues with the new system, the program did not complete deployment of system functionality associated with its Citizenship line of business by its September 2016 deadline, resulting in another schedule breach.\18\ --------------------------------------------------------------------------- \18\ The four lines of business associated with the Transformation program each represent a different set of system functionality. They are: (1) Non-immigrant, (2) immigrant, (3) humanitarian, and (4) citizenship. --------------------------------------------------------------------------- In November 2016, USCIS submitted a breach remediation plan to the Deputy Under Secretary for Management that identified several root causes for the breach. These causes included that: the program's schedule did not allow time to gather user feedback or address complexities discovered during development; new requirements were added; and, USCIS leadership did not provide any consistent performance requirements on what the program was supposed to accomplish for specific business lines. USCIS had planned to re-baseline the program in February 2017 to account for the September 2016 breach. However, in December 2016, DHS leadership directed USCIS to stop planning and development for new lines of business, update its breach remediation plan and acquisition documentation, and brief leadership on the program's revised approach by February 2017. The program submitted a revised remediation plan on February 1, 2017. The revised plan was subsequently accepted by the Acting Under Secretary for Management on February 14, 2017. The revised remediation plan set an expectation that the program would submit revised acquisition documentation for review including a new baseline by February 28, 2017. However, according to the deputy chief of the Resource Management Division within the USCIS Office of Information Technology, the program was granted an extension. According to this official, the program expects to discuss the revised acquisition documentation before the Acquisition Review Board in March 2017. Delays are Impacting the Ability of USCIS to Realize the Benefits of Transformation The Transformation Program's delays in delivering system functionality have limited USCIS's ability to realize its planned cost savings and operational improvements. With respect to cost savings, the program's business case highlighted cost savings that would be realized from decommissioning legacy systems on full deployment of USCIS ELIS. However, these legacy systems must remain operational to allow USCIS to perform its mission until an alternative option is available-- thus, preventing the associated savings from being realized. For example, in fiscal year 2014, the total cost of maintaining systems that could have been decommissioned if USCIS ELIS had been fully operational was approximately $71 million. Further, the business case for the Transformation Program identified anticipated cost savings from reducing data entry and mail handling costs. With the continuing delays, however, USCIS will continue to incur such costs while the program awaits full implementation. In addition, the schedule delays have deferred USCIS's ability to realize operational improvements tied to the program and intended to resolve issues we've previously reported.\19\ For example, the Transformation Program is expected to implement organizational and business process changes to better use the new electronic system. According to USCIS, this increased use of IT should help achieve goals such as reducing the immigration benefit backlogs through business process change, improving customer service through expanded electronic filing, and enhancing National security by authenticating users and integrating with external agency databases. However, once again, the delays in delivery of the program mean that these improvements have yet to be achieved. --------------------------------------------------------------------------- \19\ See appendix I for related GAO products. --------------------------------------------------------------------------- program management challenges contribute to system performance risks Prior to the Transformation Program's change in acquisition strategy, USCIS spent more than 8 years and approximately $475 million on developing the old USCIS ELIS. According to program officials, this system was decommissioned in April 2016 due to its instability. As we have reported,\20\ the old USCIS ELIS proceeded through development despite challenges in program management and limited oversight. Given this history and the subsequent commitment of additional resources for a new USCIS ELIS, it is more important than ever that USCIS consistently follow key practices associated with software development, systems integration and testing, and contract management \21\ and execute effective program oversight and governance. --------------------------------------------------------------------------- \20\ See, for example, GAO-15-415 and GAO-16-467. \21\ These key practices summarize practices that apply to the USCIS Transformation program and are based on leading practices and agency policy and guidance. These practices and their sources are described in more detail in GAO-16-467. --------------------------------------------------------------------------- Inconsistent Software Development Practices Risk Further Program Costs and Delays In July 2016, we reported that the program had at least partially adhered to 7 of 8 key practices \22\ for effectively managing Agile software development in producing USCIS ELIS.\23\ We reported that the program deviated from key software development practices for various reasons. For example, we reported that the program was not always completing planning for software releases prior to initiating development as required in agency policy. The USCIS Chief Information Officer explained that, although policy requires a program to obtain approval for the scope of each release prior to proceeding with development, this was no longer the practice for the Transformation Program. Instead, approval was granted for 6 months of development and the scope of that approval was revisited as needed. In contrast, time frames of individual releases were expected to vary depending on the scope of the release. --------------------------------------------------------------------------- \22\ These practices are described in Table 3. They are gathered from leading practices and agency policy and guidance. Leading practices were derived from various sources, including GAO, Software Development: Effective Practices and Federal Challenges in Applying Agile Methods, GAO-12-681 (Washington, DC: Jul. 27, 2012); Office of Management and Budget, U.S. Digital Services, Playbook (version pulled Dec. 18, 2015); TechFAR: Handbook for Procuring Digital Services Using Agile Processes (draft version pulled Nov. 6, 2014); Software Engineering Institute, Agile Metrics: Progress Monitoring of Agile Contractors, CMU/SEI-2013-TN-029 (Jan. 2014); CMMI for Development, Version 1.3, CMU/SEI-2010-TR-033 (Nov. 2010); MITRE, Defense Agile Acquisition Guide: Tailoring DoD IT Acquisition Program Structures and Processes to Rapidly Deliver Capabilities (March 2014); Handbook for Implementing Agile in Department of Defense Information Technology Acquisition (Dec. 15, 2010); ISO/IEC/IEEE, Systems and software engineering--Developing user documentation in an agile environment, Corrected Version, ISO/IEC/IEEE 26515:2012(E) (Mar. 15, 2012) (a full copy of the documents may be found at standards.ieee.org/store); http:/ /agilemanifesto.org.; Ken Schwaber and Jeff Sutherland, The Scrum Guide:TM The Definitive Guide to Scrum: The Rules of the Game (Jul. 2013). Applicable agency policy and guidance included U.S. Citizenship and Immigration Services, Management Instruction CIS-OIT- 001, Office of Information Technology: Agile Development Policy (Apr. 10, 2013); USCIS Agile Processes and Practices, Principles and Guidelines, version 4.0 (Dec. 6, 2013); USCIS Transformation Program: System Engineering Life Cycle Tailoring Plan, version 1.0 (March 2015); USCIS ELIS Team Process Agreement for the April 7, 2015 to September 30, 2015 Development Period; and USCIS ELIS Team Process Agreement for the July 22, 2015 to January 30, 2016 Development Period. \23\ GAO-16-467. --------------------------------------------------------------------------- We also found that the program was not consistently following other key practices and that controls were not always in place to ensure the program adhered to them. For example, with respect to monitoring and reporting on program performance through the collection of reliable metrics, we were unable to track monthly reports on program scope back to the associated software release backlog. In addressing this matter, the Business Integration Division within the Office of Transformation Coordination acknowledged issues regarding traceability. The division subsequently determined that its process for tracking monthly reports on program scope back to the associated software release backlog was not effective since it relied solely on the review of the user stories. The division acknowledged that requirements traceability is critical to avoid scope creep and to demonstrate that the features implemented addressed the mission needs. With respect to the practice of setting outcomes for Agile software development, which is the only key practice that the program did not fully or partially address, the program did not define Agile software development outcomes. The program provided various reasons for not addressing the practice. For example, the Chief of OTC Stated that the outcome or goal for the program is to deploy a product line within baseline cost, schedule, and performance parameters. Nevertheless, we reported that the program had not established a well-understood goal, or set of goals, for its transition to Agile development. Table 3 describes the program's satisfaction of key practices in developing USCIS ELIS. TABLE 3.--SATISFACTION OF KEY AGILE DEVELOPMENT MANAGEMENT PRACTICES ------------------------------------------------------------------------ Key practice Rating ------------------------------------------------------------------------ Completing planning for software releases prior to P initiating development and ensuring software meets business expectations prior to deployment................. Adhering to the principles of the framework adopted for P implementing Agile software development................... Defining and consistently executing appropriate roles and P responsibilities for individuals responsible for development activities.................................... Identifying users of the system and involving them in P release planning activities............................... Writing user stories that identify user roles, include P estimates of complexity, take no longer than one sprint to complete, and describe business value..................... Prioritizing user stories to maximize the value of each Y development cycle......................................... Setting outcomes for Agile software development............ N Monitoring and reporting on program performance through the P collection of reliable metrics............................ ------------------------------------------------------------------------ Source: GAO analysis of USCIS documentation. GAO-17-486T. Note: Y yes P partial N no. An element was determined to be a ``no'' if USCIS provided no evidence to satisfy any portion of the practice; ``partial'' if USCIS provided evidence that satisfied some, but not all, of the practice; and ``yes'' if USCIS provided evidence that it substantially satisfied all elements of the practice. In not addressing key practices for Agile software development, the program faces added risks in deploying a system that does not meet the cost, schedule, or the performance needs of USCIS. We recommended that the program, with assistance from the Department, take seven actions to provide reasonable assurance that it executes Agile software development for USCIS ELIS consistent with its own policies and guidance and follows applicable leading practices. At present, all of these recommendations remain open. Testing Practices Need Improvement to Address System Performance Risks In this same report,\24\ we found that the program was not consistently following key system integration and testing practices.\25\ Specifically, the program had fully implemented 1 and partially implemented 2 key practices. For example, the program had established an environment and procedures for continuous integration and was conducting unit and integration, functional acceptance, interoperability, and end-user tests, as well as performing code inspection. However, we also found that the program was not consistently adhering to its policies and guidance \26\ or meeting benchmarks for unit and integration, and functional acceptance tests, and code inspection. Moreover, test plans, cases, and results were not fully developed for interoperability and end-user testing. --------------------------------------------------------------------------- \24\ GAO-16-467. \25\ These practices are described in table 4. They are gathered from multiple sources, including leading practices and agency policy and guidance. Leading practices were derived from various sources, including ISO/IEC/IEEE, ISO/IECIEEE Standard 29119, Software and System Engineering--Software Testing, Part 1: Concepts and Definitions, Part 2: Test Process, Part 3: Test Documentation (New York, NY, September 2013) (a full copy of the documents may be found at standards.ieee.org/ store). Applicable agency policy and guidance included Department of Homeland Security, Pre-Decisional Draft, DHS Agile Development Guidebook (Sept. 2, 2014); U.S. Citizenship and Immigration Services, USCIS Test and Evaluation Master Plan: Electronic Immigration System, version 1.0 (February 2015); USCIS ELIS Team Process Agreement for the April 7, 2015 to September 30, 2015 Development Period; and USCIS ELIS Team Process Agreement for the July 22, 2015 to January 30, 2016 Development Period; Agile Processes and Practices Principles and Guidelines, version 4.0 (Dec. 6, 2013); USCIS Test Plan for Release 5.1-6.0 (10/15/2014-4/15/2015); USCIS Test Plan (updated July 2015). \26\ Department of Homeland Security, Pre-Decisional Draft, DHS Agile Development Guidebook (Sept. 2, 2014); U.S. Citizenship and Immigration Services, USCIS Test and Evaluation Master Plan: Electronic Immigration System, version 1.0 (February 2015); USCIS ELIS Team Process Agreement for the April 7, 2015 to September 30, 2015 Development Period; and USCIS ELIS Team Process Agreement for the July 22, 2015 to January 30, 2016 Development Period; USCIS Agile Processes and Practices Principles and Guidelines, version 4.0 (Dec. 6, 2013); USCIS Test Plan for Release 5.1-6.0 (10/15/2014-4/15/2015); USCIS Test Plan (updated July 2015). --------------------------------------------------------------------------- We reported that the implementation of systems integration and testing deviated from key practices in part because policy and guidance were not being updated to reflect changes in the approach. For example, with respect to performing continuous testing, the program did not meet its stated goals for continuous testing because, according to the USCIS Chief Information Officer, certain program goals were unrealistic. Table 4 describes the program's satisfaction of key practices in USCIS ELIS integration and testing. TABLE 4.--SATISFACTION OF KEY INTEGRATION AND TESTING PRACTICES ------------------------------------------------------------------------ Key practice Rating ------------------------------------------------------------------------ Establishing an environment and procedures for continuous Y integration and testing of code........................... Performing continuous testing through the use of unit and P integration tests, functional acceptance tests, and code inspection................................................ Developing complete test plans and cases for P interoperability and end-user testing and documenting those results............................................. ------------------------------------------------------------------------ \1\ Source: GAO analysis of USCIS documentation. GAO-17-486T \2\ Note: Y yes P partial N no. \3\ An element was determined to be a ``no'' if USCIS provided no evidence to satisfy any portion of the practice; ``partial'' if USCIS provided evidence that satisfied some, but not all, of the practice; and ``yes'' if USCIS provided evidence that it substantially satisfied all elements of the practice. In addition, program policy and guidance did not always align with key practices in systems integration and testing, nor were controls always in place to ensure adherence to policy and guidance. For example, before a developer could integrate code with that of other developers or development teams, peer inspection by another individual was expected to occur to help ensure that the code met program standards. However, the program had not established controls to monitor the extent to which peer inspection had occurred. As a result of these findings on systems integration and testing, we reported that the program risked poor system performance after being released to the public. At that time, this risk was already being realized. Specifically, the program had reported experiencing issues with USCIS ELIS as a result of deploying software that had not been fully tested. For example: In June 2015, the Quality Assurance Team reported that production issues, such as bugs and defects, had increased noticeably after the February 2015 deployment. In July 2015, the Quality Assurance Team reported that defects (originating from either production or development) were becoming a significant part of USCIS ELIS iteration work. On September 22, 2015, in addition to prior and subsequent outages of the system, the Quality Assurance Team reported that USCIS ELIS was unavailable for approximately 15 hours due to issues with code quality. On September 24, 2015, USCIS ELIS encountered performance problems that impacted nearly 5,000 cases. Approximately 2,600 of these cases had to be abandoned. In November and December 2015, the Quality Assurance Team reported that code quality had become a major issue. In January 2016, the program reported more than 800 minutes in unplanned network outages. In February 2016, the program reported missing the threshold for USCIS ELIS reliability (e.g. mean time between failure), for 2 straight months and 4 of the last 6 months. In March 2016, program metrics indicated that production tickets were increasing faster than they could be addressed. Based on these findings associated with systems integration and testing, we made two recommendations to the program. These recommendations were associated with updating existing policy and guidance for systems integration and testing and considering additional controls. At present, these recommendations remain open. Contract Oversight Practices Limit Contractor Accountability In the same report,\27\ based on a review of six contracts,\28\ we found that USCIS had mixed success in implementing selected key contract management internal controls.\29\ Specifically, we found that contracting officer representatives were meeting training requirements and USCIS had documented its rationale for not pursuing selected contracts as performance-based. However, we also reported that the program could improve contract monitoring to provide reasonable assurance that contractors were meeting program needs. For example, we reported that --------------------------------------------------------------------------- \27\ GAO-16-467. \28\ These six contracts were two firm, fixed-price contracts managed by the program office and four cost-plus-fixed-fee contracts managed by the Office of Information Technology. \29\ The key internal controls are described in GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1, (Washington, DC: November 1999); National Flood Insurance Program: Progress Made on Contract Management but Monitoring and Reporting Could be Improved, GAO-14-160 (Washington, DC: Jan. 15, 2014): Office of Federal Procurement Policy, A Guide to Best Practices for Contract Administration, (Washington, DC: October 1994); Department of Homeland Security, Federal Acquisition Certification for Contracting Officer's Representatives and Appointment and Revocation, Acquisition Workforce Policy Number 064-04-003, Revision 02 (Aug. 8, 2012); Contracting Officer's Representative (COR) Essential Element Guidebook, Spiral 1 (September 2012); and Office of Procurement Operations: Acquisition Manual, version 1.0 (May 1, 2015). --------------------------------------------------------------------------- The Agile development services contract contained appropriate performance criteria that linked to the program goals, but the program did not clearly define measures against which to analyze differences between services expected and those delivered. Because oversight of contractor performance resides with the Office of Transformation Coordination and management of the contract is the responsibility of the Office of Information Technology, we reported that the need for clearly-defined performance measures was particularly important. The program maintained some required documentation in contract files and used contractor performance assessments. However, more clearly-defined success measures and evaluation against those measures could have alerted the program to issues in systems integration and testing. Based on these findings, we reported that the agency lacked information for measuring contractor performance and determining if the Office of Information Technology was meeting its objectives in supporting the program. To help improve oversight of these selected contracts, we made three recommendations focused on contract administration and supporting controls. Since then, the agency has taken steps to close these recommendations, successfully closing two of the three. If effectively implemented, these actions should contribute to improved administration of the contracts that we assessed in our review. DHS Oversight Bodies Need to Improve Governance and Oversight of the Transformation Program We also reported in May 2015 \30\ that the program's two key governance bodies were mostly taking actions aligned with leading practices, but that their decisions were made based on unreliable information. For example, we reported that the Acquisition Review Board ensured that corrective actions were identified when cost, schedule, or performance issues arose. However, the board was not always monitoring performance and progress toward a predefined cost and schedule or ensuring that corrective actions were tracked until the desired outcomes were achieved. --------------------------------------------------------------------------- \30\ GAO-15-415. --------------------------------------------------------------------------- In addition, we found that two DHS offices assisting in overseeing the program--the Office of Program Accountability and Risk Management and the Office of the Chief Information Officer--developed program assessments that reflected unreliable and, in some cases, inaccurate information. For example, the Office of the Chief Information Officer performed four assessments of the Transformation Program from June 2013 through June 2014. The most recent assessment available at the time, from June 2014, Stated that the program underwent a re-baseline for release 5.0 and, as a result, reported an acceptable schedule variance and positive cost performance. However, at that time, the program had experienced over a 4-year delay in its schedule and had not performed a re-baseline to bring it back within cost and schedule thresholds. Based on these findings, we reported that the ability of governance bodies to make timely decisions and provide effective oversight was limited. To help improve program governance, we made four recommendations. Subsequently, the program addressed one recommendation by establishing a new baseline, although that baseline has again been breached. The program has taken steps to close the remaining recommendations, although the recommendations remain open. In summary, the USCIS Transformation Program began officially pursuing a new acquisition strategy in April 2015 to mitigate risks encountered in developing the original system. However, this new strategy reflects a higher cost estimate and a longer amount of time before the system is fully implemented than the program's previously approved strategy. In addition, the program is again encountering issues in development and production. If the agency does not address issues in its efforts to develop and test software, oversee contractors, and govern the program it risks additional cost increases, schedule delays, and performance shortfalls. In addition, continued delays limit the program's ability to achieve critical goals, such as delivering system functionality to enhance customer service and enhancing National security. Chairman Perry, Ranking Member Correa, and Members of the subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. Appendix I.--Related GAO Products Immigrant Investor Program: Progress Made to Detect and Prevent Fraud, but Additional Actions Could Further Agency Efforts, GAO-16-828 (Washington, DC: Sept. 13, 2016). Immigration Benefits System: U.S. Citizenship and Immigration Services Can Improve Program Management, GAO-16-467 (Washington, DC: July 7, 2016). Asylum: Additional Actions Needed to Assess and Address Fraud Risks, GAO-16-50 (Washington, DC: Dec. 2, 2015). Immigrant Investor Program: Additional Actions Needed to Better Assess Fraud Risks and Report Economic Benefits, GAO-15-696 (Washington, DC: Aug. 12, 2015). Immigration Benefits System: Better Informed Decision Making Needed on Transformation Program, GAO-15-415 (Washington, DC: May 18, 2015). H-2A and H-2B Visa Programs: Increased Protections Needed for Foreign Workers, GAO-15-154 (Washington, DC: Mar. 6, 2015). Immigration Benefits: Improvements Needed to Fully Implement the International Marriage Broker Regulation Act, GAO-15-3 (Washington, DC: Dec. 10, 2014). H-2A Visa Program: Modernization and Improved Guidance Could Reduce Employer Application Burden, GAO-12-706 (Washington, DC: Sept. 12, 2012). Immigration Benefits: Consistent Adherence to DHS's Acquisition Policy Could Help Improve Transformation Program Outcomes, GAO-12-66 (Washington, DC: Nov. 22, 2011). Department of Homeland Security: Progress Made and Work Remaining in Implementing Homeland Security Missions 10 Years after 9/11, GAO-11- 881 (Washington, DC: Sept. 7, 2011). Immigration Benefits: Actions Needed to Address Vulnerabilities in Process for Granting Permanent Residency, GAO-09-55 (Washington, DC: Dec. 5, 2008). USCIS Transformation: Improvements to Performance, Human Capital, and Information Technology Management Needed as Modernization Proceeds, GAO-07-1013R (Washington, DC: July 17, 2007). Appendix II.--Status of GAO Recommendations to Improve Transformation Program Performance TABLE 5.--SATISFACTION OF KEY INTEGRATION AND TESTING PRACTICES ------------------------------------------------------------------------ Recommendation Report Status ------------------------------------------------------------------------ 1. Document specific performance GAO-07-1013R...... Closed measures and targets for the pilots, increments, and the transformed organization that are outcome-oriented, objective, reliable, balanced, limited to the vital-few, measurable, and aligned with organizational goals. 2. Increase coordination between GAO-07-1013R...... Closed program office and the Office of Human Capital to ensure transformation and human capital change initiatives are aligned. 3. Plan for the number and types GAO-07-1013R...... Closed of human resources required in the program office to carry the transformation through 2012. 4. Plan for obtaining and GAO-07-1013R...... Closed developing the IT human capital necessary to support the transformation. 5. Determine the critical skills GAO-07-1013R...... Closed and competencies that will be needed to achieve future programmatic results as well as strategies to address gaps in employee numbers, deployment, and skills and competencies. 6. Address continuity in key GAO-07-1013R...... Closed transformation leadership positions and address impacts to time frames when key personnel leave. 7. Use performance expectations GAO-07-1013R...... Closed and competencies to hold USCIS executives and employees accountable for achieving the goals of the transformation. 8. Continue to develop an GAO-07-1013R...... Closed enterprise architecture that sufficiently guides and constrains the transformation plans, as DHS works to address limitations in its own enterprise architecture and alignment processes. 9. Complete a comprehensive GAO-07-1013R...... Closed communication strategy that involves communicating early and often to build trust, ensuring consistency of message, and encouraging two- way communication. Further, the communication strategy should address plans for communicating implementation goals and time lines to demonstrate progress. 10. Complete a comprehensive GAO-07-1013R...... Closed communication strategy that addresses plans for formally engaging internal and external stakeholders throughout the transformation, and tailors information to meet these stakeholders' specific needs. 11. Complete a comprehensive GAO-07-1013R...... Closed communication strategy that addresses plans for a long- term, detailed strategy to share information with employees and stakeholders over the course of the transformation. 12. Document specific GAO-07-1013R...... Closed performance measures and targets for the pilots, increments, and the transformed organization that are outcome- oriented, objective reliable, balanced, limited to the vital- few, measurable, and aligned with organizational goals. 13. Develop and maintain an GAO-12-66......... Closed Integrated Master Schedule consistent with these same best practices for the Transformation Program. 14. Ensure that the life-cycle GAO-12-66......... Closed cost estimate is informed by milestones and associated tasks from reliable schedules that are developed in accordance with the nine best practices we identified. 15. Re-baseline cost, schedule, GAO-15-415........ Closed and performance expectations for the remainder of the Transformation Program. 16. Ensure that the Acquisition GAO-15-415........ Open Review Board is effectively monitoring the Transformation Program's performance and progress toward a predefined cost and schedule; ensuring that corrective actions are tracked until the desired outcomes are achieved; and relying on complete and accurate program data to review the performance of the Transformation Program against stated expectations. 17. Ensure that the Executive GAO-15-415........ Open Steering Committee is effectively monitoring the Transformation Program's performance and progress toward a predefined cost and schedule and relying on complete and accurate program data to review the performance of the Transformation Program against stated expectations. 18. Direct the Department's GAO-15-415........ Open chief information officer to use accurate and reliable information, such as operational assessments of the new architecture and cost and schedule parameters approved by the under secretary of management. 19. Complete planning for GAO-16-467........ Open software releases prior to initiating development and ensure software meets business expectations prior to deployment. 20. Consistently implement the GAO-16-467........ Open principles of the framework adopted for Agile software development. 21. Define and consistently GAO-16-467........ Open execute appropriate roles and responsibilities for individuals responsible for development activities consistent with its selected development framework. 22. Identify all system users GAO-16-467........ Open and involve them in release planning activities. 23. Write user stories that GAO-16-467........ Open identify user roles, include estimates of complexity, take no longer than one sprint to complete, and describe business value. 24. Establish outcomes for Agile GAO-16-467........ Open software development. 25. Monitor program performance GAO-16-467........ Open and report to appropriate entities through the collection of reliable metrics. 26. Conduct unit and GAO-16-467........ Open integration, and functional acceptance tests, and code inspection consistent with stated program goals. 27. Develop complete test plans GAO-16-467........ Open and cases for interoperability and end-user testing, as defined in the USCIS Transformation Program Test and Evaluation Master Plan, and document the results. 28. Clearly define measures GAO-16-467........ Closed against which to analyze differences between services expected and those delivered. 29. Ensure contracting officer GAO-16-467........ Open representatives are maintaining complete contract files. 30. Ensure quality assurance GAO-16-467........ Closed surveillance plans are developed when appropriate. ------------------------------------------------------------------------ Source: GAO analysis of DHS and USCIS documentation GAO-17-486T. Mr. Perry. Chair thanks Ms. Harris. The Chair now recognizes Mr. Roth for his opening statement. STATEMENT OF JOHN ROTH, INSPECTOR GENERAL, U.S. DEPARTMENT OF HOMELAND SECURITY Mr. Roth. Thank you. Chairman Perry, Ranking Member Correa, and Members of subcommittee, thank you for inviting me to testify. For my oral testimony today I will focus on CIS information technology Transformation issues and DHS's ineffective use of fingerprint records in the naturalization process. First, with regard to Transformation, after 11 years CIS has made little progress in automating its paper-based procedures. Past automation attempts have been hampered by ineffective planning, multiple changes in direction, and inconsistent stakeholder involvement. After years of planning and delay, CIS began employing the Electronic Immigration System, which is known as--by its acronym as ELIS, in May 2012 to modernize the processing of approximately 90 different immigration benefit types. However, currently customers can only apply on-line for 2 of the 90 benefit types--benefits and services. As it struggles to address these system issues, CIS told us last March that it now estimates it will take 3 more years, which is over 4 years longer than estimated, and an additional billion dollars to automate all benefit types as expected. However, given past practice, we do not have confidence that CIS's estimations for completion are accurate. The inability to automate their paper-based systems has real-world consequences. According to agency-wide performance metrics, benefits processes in ELIS should take 65 days. However, we found that in May 2015 processing was taking an average of 112 days, which is almost twice the amount of time it should take. Likewise, in our 2014 audit we reported that although ELIS capabilities had been implemented, the anticipated efficiencies still had not yet been achieved. In fact, we reported that adjudicating benefits on paper was actually faster than adjudicating them in ELIS. That remains unchanged even today. The Transformation process has created considerable risk for the program and the Nation. For instance, in November 2016 we reported that the design and functionality problems in ELIS resulted in CIS in 3 years receiving over 200,000 reports from approved applicants about missing green cards--that is, cards that should have been mailed and received by the applicant but were not. We found such instances of missing or mis-delivered green cards had actually doubled in 2 years, between 2013 and 2016. Our work also revealed that during that time CIS produced at least 19,000 cards that included incorrect information or were issued in duplicate. The agency then appears to--excuse me, the agency appears unable to address the root cause of these problems, which is the design and functionality limitations of ELIS. Although CIS went to considerable effort to try to recover inappropriately used--issued cards, its efforts were not fully successful and lacked consistency and a sense of urgency. Notwithstanding our significant body of work highlighting the ELIS functionality and performance problems, in April of last year CIS decided to roll out ELIS under the N-400 Form, which is the application for citizenship and one of the highest-volume and most complex benefit types. The roll-out was plagued with significant technical and functional issues, prompting the CIS director in August 2016 to discontinue the use of ELIS and revert to the legacy system for all new N-400 applications. However, nearly 250,000 cases had already been adjusted between April and August and had to be completed in ELIS. As of February 24 of this year, more than 185,000 of those cases remain incomplete in ELIS. This is unsurprising, given how little progress CIS has made in addressing ELIS's core technical and functional issues. We have found other issues that highlight the challenges that CIS faces in immigration benefits processing. In September 2016 we issued a report that found that CIS granted citizenship to at least 858 individuals who may have been ineligible for citizenship because they had received deportation orders or removal orders under different identities in the past. The only fingerprint records that were available that linked these individuals to the deportation orders had been taken on old paper cards and simply stored in manually collected alien files under different names. When DHS decided to establish its electronic fingerprint repository it did not digitize and upload those fingerprint cards. Because they were not digitized, CIS could not match applicants for citizenship against those fingerprints. In addition, the report identified about 148,000 fingerprint cards linking individuals to deportation orders, fugitive status, and criminal histories that still had not been uploaded to the DHS fingerprint repository. Fortunately, DHS has taken significant steps toward fixing this problem. We will continue to exercise diligent oversight over CIS, paying particular attention to issues impacting National security. Consistent with our obligations under the Inspector General Act, we will keep Congress fully and currently informed of our findings and recommendations. Mr. Chairman, this completes my prepared statement. I am happy to answer any questions that you or other Members of the committee may have. [The prepared statement of Mr. Roth follows:] Prepared Statement of John Roth March 16, 2017 Chairman Perry, Ranking Member Correa, and Members of the committee, thank you for inviting me to discuss the Office of Inspector General's (OIG) work relating to weaknesses in U.S. Citizenship and Immigration Services (USCIS) systems for vetting immigration benefits. Today, I would like to focus on the findings of our work pertaining to a number of related issues, including USCIS information technology transformation issues, USCIS's ineffective use of fingerprint records in the naturalization process, and security weaknesses in USCIS's Systematic Alien Verification System for Entitlements (SAVE). issues with uscis information technology transformation Functionality Issues Continue to Plague ELIS After 11 years, USCIS has made little progress in automating its paper-based processes. Past automation attempts have been hampered by ineffective planning, multiple changes in direction, and inconsistent stakeholder involvement. After years of planning and delay, USCIS deployed the Electronic Immigration System (ELIS) in May 2012 to modernize processing of approximately 90 immigration benefits types. However, currently customers can apply on-line for only 2 of the 90 types of immigration benefits and services. ELIS was intended to provide integrated on-line case management to support end-to-end automated adjudication of immigration benefits. Once implemented, individuals seeking an immigration benefit should be able to establish on-line ELIS accounts to file and track their applications, petitions, or requests as they move through the immigration process. In March of last year, we issued a report that found that at the time of our field work, which ended in July 2015, little progress had been made.\1\ Specifically, we concluded: --------------------------------------------------------------------------- \1\ USCIS Automation of Immigration Benefits Processing Remains Ineffective, OIG-16-48 (March 2016). --------------------------------------------------------------------------- Although USCIS deployed ELIS in May 2012, only 2 of 90 types of immigration benefits were available for on-line customer filing, accounting for less than 10 percent of the agency's total workload. These two are the USCIS Immigrant Fee, which allows customers to submit electronic payment of the $165 processing fee for an immigrant visa packet, and the Application to Replace Permanent Resident Card (Form I-90). Among the limited number of USCIS employees using ELIS, personnel reported that the system was not user-friendly, was missing critical functionality, and had significant performance problems processing benefits cases. Some of those issues are set forth in this chart: USCIS ELIS User Feedback on I-90 Processing Need to manually refresh website often to see the most recent information. Difficulty navigating among multiple screens and web browsers. Inability to move browser windows to view case data. Cases getting stuck throughout the process and inability to move to the next step without intervention. Inability to undo a function or correct a data entry error. Inability to enter comments on actions taken after a case has been adjudicated. Card errors received when ``NMN'' is entered for applicants with no middle name. Failure to produce cards for approved cases. Inability to process benefits for military or homebound applicants. Errors in displaying customer date of birth. Scheduling applicants to submit biometrics (photo, signature, prints) that are not needed. Inability to create a case referral electronically once adjudication is complete. The limited ELIS deployment and current system performance problems may be attributed to some of the same deficiencies we reported regarding previous USCIS IT transformation attempts. Specifically, USCIS did not ensure sufficient stakeholder involvement in ELIS implementation activities and decisions for meeting field operational needs. Testing had not been conducted adequately to ensure end-to-end functionality prior to each ELIS release. Further, USCIS had not provided adequate post- implementation technical support for end-users, an issue that has been on-going since the first ELIS release in 2012. As it struggles to address these system issues, USCIS told us last March that it now estimates that it will take 3 more years--over 4 years longer than estimated--and an additional $1 billion to automate all benefit types as expected. Until USCIS fully implements ELIS with all the needed improvements, the agency will remain unable to achieve its workload processing, customer service, and National security goals. We do not have confidence in USCIS's estimates for completion, given past experience. Specifically, in 2011, USCIS established a plan to implement ELIS agency-wide by 2014. However, USCIS was not able to carry out this plan and the schedule was delayed by 4 years, causing a program breach. An updated baseline schedule for the Transformation Program was approved in April 2015 estimating all benefits and services would be automated by 2019; however, USCIS has shifted and delayed these release dates. Certain program goals have also not been met. According to agency-wide performance metrics, benefits processing in ELIS was to take less than 65 days. However, we found that in May 2015, processing was taking an average of 112 days, almost twice that amount of time. Previous results also were slower than their reported metric: 104 days in November 2014, 95 days in February 2015, and 112 days in May 2015. By slowing down the work of adjudicators, ELIS was resulting in less efficiency and productivity in processing benefits. Similarly, in 2014, we reported that although ELIS capabilities had been implemented, the anticipated efficiencies still had not been achieved.\2\ In fact, we reported that adjudicating benefits on paper was faster than adjudicating them in ELIS. This remains unchanged even today. Ensuring progress in operational efficiency was hampered by the fact that USCIS lacked an adequate methodology for assessing ELIS's impact on time and accuracy in benefits processing. Beyond obtaining feedback from personnel and customers using the system, the Transformation Program Office could not effectively gauge whether cases were being adjudicated more efficiently or accurately in ELIS. --------------------------------------------------------------------------- \2\ U.S. Citizenship and Immigration Services Information Technology Management Progress and Challenges, OIG-14-112 (July 2014). --------------------------------------------------------------------------- We made four recommendations to the USCIS Director to improve ELIS functionality. The USCIS Director concurred with only two of the four recommendations. USCIS's inability to implement ELIS with all needed improvements has continued to negatively affect USCIS's ability to deliver immigration and citizenship benefits, which raises security risks. Impact of ELIS Issues on Green Card Issuance Since May 2013, USCIS processing of new and replacement Permanent Resident Cards (commonly referred to as green cards) has been accomplished using ELIS. Yet the process has been fraught with issues, creating considerable security risk for the Nation. For instance, in March 2016, we reported that USCIS had sent potentially hundreds of green cards to the wrong addresses due to an ELIS limitation that prevented USCIS personnel from updating customer addresses.\3\ Additionally, in November 2016, we reported that design and functionality problems in ELIS resulted in USCIS receiving over 200,000 reports from approved applicants about missing green cards.\4\ Obviously, the possibility that some of these missing green cards may have fallen into the wrong hands raises significant security concerns. --------------------------------------------------------------------------- \3\ USCIS Automation of Immigration Benefits Processing Remains Ineffective, OIG-16-48 (March 2016). \4\ Better Safeguards Are Needed in USCIS Green Card Issuance, OIG- 17-11 (November 2016). --------------------------------------------------------------------------- Despite the risk posed by improperly issued green cards, however, USCIS has seen the number of cards sent to wrong addresses increase since 2013. For instance, service requests initiated by USCIS customers claiming they did not receive green cards increased from 44,519 in fiscal year 2013 to 92,645 in fiscal year--in other words, the error rate doubled in only 2 years. Our work also revealed that between 2013 and 2016, USCIS produced at least 19,000 cards that included incorrect information or were issued in duplicate. From March to May 2016 alone, USCIS issued at least 750 duplicate cards to its customers as a result of ELIS functionality or legacy data migration problems. In some cases, applicants paid the processing fee twice and received two cards. In another case, an applicant received green cards that belonged to two other applicants. And in several extreme cases, five cards were produced per customer over the course of a single month. The agency appears unable to address the root cause of these problems--design and functionality limitations of ELIS. Although USCIS went to considerable effort to try to recover the inappropriately- issued cards, its efforts were not fully successful and lacked consistency and a sense of urgency. Improperly-issued green cards can pose significant risks and burdens for the agency. For instance: Denied Benefits for Approved Applicants.--Green cards issued with incorrect personal information can have severe consequences for applicants who have become lawful permanent residents. For example, recipients possessing cards with errors could experience denial of benefits or possible card confiscation with accusations of fraudulent intent. This creates unnecessary hardship for the applicant who must reapply for a corrected card. Also, when cards are missing or not properly delivered, applicants may be unable to obtain or renew driver's licenses or Social Security cards, obtain employment without interruption, or gain authorization to exit and re- enter the United States. In such cases, approved applicants may not be able to exercise their rights as lawful immigrants. Additional Workload and Costs.--Responding to card issuance errors results in additional workload and costs. USCIS addresses thousands of customer inquiries every month regarding non-delivery of green cards. The associated cost of dealing with these customer inquiries has significantly increased over the last few years. Specifically, the cost to USCIS for receiving and responding to non-delivery service requests almost doubled from approximately $780,000 in fiscal year 2013 to nearly $1.5 million fiscal year 2015. National Security Risks.--Most concerning, thousands of cards issued with incorrect information or in duplicate remain unaccounted for, creating opportunities for exploitation by individuals with malicious intent. For instance, green cards that fall into the wrong hands may enable illegal immigrants to remain in the United States and demonstrate legal residence status to employers. Drivers' licenses, firearms, and concealed handgun licenses may be issued to card holders in certain States without restrictions. Officials within CBP's Fraudulent Document Analysis Unit confirmed that there is a huge black market demand for legal documentation such as green cards, as over 4,600 cases of imposter green cards were recorded between 2013 and 2015. Processing and issuing over 2 million green cards per year is a massive undertaking. USCIS must ensure that ELIS's design and functionality can be relied upon to accurately process green cards. Until USCIS takes the steps needed to prevent card issuance errors, the upward trend in agency costs, as well as the risks to applicants and National security, is only likely to continue. We made seven recommendations to the USCIS Director to improve ELIS functionality and develop internal controls to avoid inappropriate green card issuance, standardize card recovery and tracking efforts, prevent unrecoverable card use, and enable remote identity verification and more secure card delivery methods. The USCIS Director concurred with our recommendations, but it remains to be seen how and when USCIS will be able to address these issues. Impact of ELIS Issues on Naturalization Application Processing Given the ELIS functionality and performance problems identified in our earlier work, we began an assessment in December 2016 of USCIS's current efforts to automate processing of the N-400 Application for Naturalization in ELIS. The N-400 is a high-volume benefit type within the citizenship line of business, involving all field offices Nation- wide. On average, USCIS receives 66,000 N-400 applicants per month and naturalizes over 3,300 new U.S. citizens each day. N-400 is a key product line, as this is the ultimate immigration benefit for U.S. citizenship. Having electronic capabilities to support the end-to-end process is critical to enable efficiency and accuracy in conducting background checks, scheduling and conducting interviews, administering tests, scheduling oath ceremoneys, naturalization certificate printing, and sharing case data with Department of Homeland Security (DHS) partners once naturalization has taken place. Our on-going review has already uncovered significant operational and security issues that pose grave concern. Since the deployment of the N-400 in ELIS on April 13, 2016, the system has impaired the ability of USCIS Immigration Services Officers and field personnel to conduct naturalization processing. Through our preliminary work, we have identified a range of ELIS technical and functional issues that have slowed processing and productivity, including: Missing core ELIS functionality; Naturalization cases stuck in ELIS workflows, requiring manual intervention for case progression; Frequent ELIS and network outages; ELIS failure to connect with supporting systems; and Multiple or erroneous cancellation of applicant interviews. On-going USCIS efforts to correct technical deficiencies while concurrently continuing to develop system functionality have resulted in ELIS down time, instability, and repeated changes that interrupt processing and confuse system users. Moreover, the USCIS Field Operations Directorate identified significant challenges which are preventing effective naturalization processing. These deficiencies include incomplete or inaccurate background and security checks, which have National security implications, as well as wide-spread certificate printing problems that delayed numerous naturalization oathing ceremoneys. Given these issues, the USCIS Director in August 2016 discontinued the use of ELIS and reverted to the legacy system for all new N-400 applications received after that date. However, the 243,951 cases already ingested between April 2016 and August 2016 had to be completed in ELIS. As of February 24, 2017, 188,447 cases remained incomplete in ELIS. This is unsurprising given how little progress USCIS has made in addressing ELIS's core technical and functional issues. Early this year, in the midst of our assessment, we learned of an impending decision by USCIS leadership to return to processing new N- 400 applications in ELIS by late January 2017. Given the serious nature of the issues our review had already uncovered, we took the uncommon step of issuing a Management Alert on January 19, 2017 recommending that USCIS halt its plans to revert to using ELIS for N-400 application processing.\5\ We were concerned about the risk posed by such a move given the many unresolved problems with ELIS. --------------------------------------------------------------------------- \5\ Management Alert--U.S. Citizenship and Immigration Services' Use of the Electronic Immigration System for Naturalization Benefits Processing, OIG-17-26-MA (January 2017). --------------------------------------------------------------------------- In response to our Management Alert, USCIS initially agreed to delay the return to ELIS processing until all of the technical issues had been resolved. We know that the agency is continuing to assess when to return N-400 processing to the ELIS system. We continue to urge caution in resuming the program without thoroughly and carefully addressing the numerous design and functional limitations. USCIS's adherence to time tables at the expense of a properly functioning system would create unnecessary serious risk to the program goals and to National security. We are slated to complete our N-400 review later this spring, and will provide a report of our findings and recommendations to Congress to ensure that Congress remains fully and currently informed on this matter. uscis ineffective use of fingerprint records Information technology transformation problems are not the only issue USCIS faces with respect to its immigration benefits processing. In September 2016, we issued a report that identified vulnerabilities in the immigration system caused by incomplete records in the DHS fingerprint repository.\6\ We initiated the review after receiving a list of 1,029 individuals who allegedly were ineligible for naturalized citizenship, yet received it, because fingerprint records linking them to disqualifying facts were not available. --------------------------------------------------------------------------- \6\ Potentially Ineligible Individuals Have Been Granted Citizenship Because of Incomplete Fingerprint Records, OIG-16-130 (September 2016). --------------------------------------------------------------------------- Our report confirmed that USCIS granted citizenship to at least 858 individuals on the list who may have been ineligible for naturalized citizenship because they had received deportation orders under different identities in the past. The only fingerprint records available that linked the individuals to the deportation orders had been taken on old paper cards and stored in alien files under different names. When DHS established its electronic fingerprint repository, it did not digitize and upload those fingerprint cards. In addition, the report identified about 148,000 fingerprint cards linking individuals to deportation orders, fugitive status, and criminal histories that were not uploaded to the DHS fingerprint repository. Because those records are missing from the fingerprint repository, USCIS risks naturalizing additional individuals who may be ineligible for citizenship or who may be trying to obtain U.S. citizenship fraudulently. The report made two recommendations: (1) The Directors of USCIS, Immigration and Customs Enforcement (ICE), and DHS's Office of Operations Coordination (OPS) should establish a plan for evaluating the eligibility of each naturalized citizen whose fingerprint records reveal deportation orders under different identities; and (2) ICE should digitize and upload the 148,000 missing fingerprint records to the Department's electronic fingerprint repository. Although the recommendations are still open, DHS has taken significant steps toward closing them. For example, in December 2016, ICE reported that it awarded a contract to review and upload available data from the 148,000 missing fingerprint records with an estimated completion date of June 30, 2017. With regard to recommendation 1, as of early December 2016, ICE has reportedly completed a review of 96 percent of the reported 1,746 cases and has begun developing Affidavits of Good Cause for cases that will be referred for possible denaturalization. uscis systematic alien verification system for entitlements In December 2012, we reported on a serious security weakness in USCIS's Systematic Alien Verification System for Entitlements (SAVE).\7\ Federal, State, and local entities use SAVE to validate an individual's immigration status prior to granting benefits. In most cases, an error in SAVE verification means that a deportable individual can receive benefits ranging from public assistance to a driver's license. In some instances, the errors can have National security implications when erroneously cleared individuals receive credentials, such as a Transportation Worker Identification Card, which allows them unescorted access to secure areas of the Nation's vessels and maritime facilities. --------------------------------------------------------------------------- \7\ Improvements Needed for the SAVE to Accurately Determine Immigration Status of Individuals Ordered Deported, OIG-13-11 (December 2012). --------------------------------------------------------------------------- Through our work, we projected via sample testing that USCIS had failed to identify the deportable status of 12 percent of individuals submitted through SAVE. In these instances, SAVE reported that individuals still had legal status in the United States when in fact the U.S. Immigration Courts had ordered that they be deported. Many deportable individuals had felony convictions involving extortion, aggravated assault, burglary, or possession of dangerous drugs. Errors occurred because SAVE did not have a process to timely receive information from the U.S. Immigration Courts on the status of deportable individuals. To address this control weakness, we recommended that USCIS identify and build interfaces to appropriate systems so that it can receive up-to-date information on individuals in deportable status. However, despite the serious security implications, it took USCIS nearly 45 months to implement and begin using the system interface we recommended.\8\ --------------------------------------------------------------------------- \8\ Verification Review of USCIS's Progress in Implementing OIG Recommendations for SAVE to Accurately Determine Immigration Status of Individuals Ordered Deported, OIG-17-23-VR (January 2017). --------------------------------------------------------------------------- According to USCIS officials, the interface between SAVE and the Department of Justice system containing up-to-date information on deportable aliens did not become operational until August 2016. USCIS needs to accelerate its implementation of DHS OIG recommendations, particularly those designed to address National security gaps related to processes for verifying an immigrant's legal status. on-going audit work Our considerable workload includes a number of on-going and recently-completed matters involving USCIS, including: Review of USCIS's N-400 Automation.--Discussed above. Capabilities to Screen Social Media Use of Visa and Asylum Seekers.--DHS has established a task force for using social media to screen applicants for immigration benefits. In connection with that effort, USCIS began pilots to expand social media screening of immigration applicants. Additionally, ICE independently began a pilot to use social media screening during the visa issuance process. However, in an audit report released last week, we found that these pilots, on which DHS plans to base future Department-wide use of social media screening, lack criteria for measuring performance to ensure they meet their objectives. Although the pilots include some objectives, such as determining the effectiveness of an automated search tool and assessing data collection and dissemination procedures, it is not clear DHS is measuring and evaluating the pilots' results to determine how well they are performing against set criteria. Absent measurement criteria, the pilots may provide limited information for planning and implementing an effective, Department-wide future social media screening program.\9\ --------------------------------------------------------------------------- \9\ DHS's Pilots for Social Media Screening Need Increased Rigor to Ensure Scalability and Long-term Success (Redacted), OIG 17-40 (February 2017). --------------------------------------------------------------------------- H-2 Petition Fee Structure.--USCIS's H-2 program enables employers to petition to bring temporary non-immigrant workers into the United States. We performed this audit, released last week, to determine whether the fee structure associated with H- 2 petitions is equitable and effective. We found that the USCIS's H-2 petition fee structure is inequitable and contributes to processing errors. Federal guidelines indicate that beneficiaries should pay the cost of services from which they benefit. However, USCIS charged employers a flat fee regardless of whether it was to bring one or hundreds of temporary non-immigrant workers into the United States, creating greater hardship for smaller employers than larger ones. Moreover, each worker listed on a petition must be vetted through an extensive adjudication process, for the most part within 15 days. Large petitions are complex and error- prone when adjudicators rush to process them within required time frames.\10\ --------------------------------------------------------------------------- \9\ H-2 Petition Fee Structure is Inequitable and Contributes to Processing Errors, OIG-17-42 (March 2017). --------------------------------------------------------------------------- USCIS H-1B Visa Program Abuse.--The focus of this audit is to determine whether H-1B visa holders are actually working for the employer for which they were approved, and whether visa holders are being used to replace U.S. citizen workers. Historical Fingerprint Enrollment (HFE) Identity Fraud.--The focus of this audit is to determine how aliens whose fingerprints were uploaded into IDENT through the HFE received immigration benefits under another identity, the types of benefits they received, and their country of origin. Variations in Application Processing Times Among USCIS Field Offices.--The focus of this audit is to identify the reason(s) for variations in application processing times among USCIS field offices. Effectiveness of USCIS Medical Screening.--The focus of this audit is to assess USCIS effectiveness in screening foreign nationals to meet health-related standards of admissibility. We will continue to exercise diligent oversight over USCIS--paying particular attention to issues impacting National security--and, consistent with our obligations under the Inspector General Act of 1978, will keep Congress fully and currently informed of our findings and recommendations. Mr. Chairman, this concludes my prepared statement. I am happy to answer any questions you or other Members of the committee may have. Mr. Perry. Chair thanks Mr. Roth. The Chair now recognizes himself for 5 minutes of questions. Mr. Roth. I mean, you can hear in Ms. Scialabba's testimony that it is indeed a daunting task, right? I think about 23,000--is that what you said--23,000 applicants a day that you have to review? We accept that it is difficult and it is large, but it is a job that you have. In November the OIG found that USCIS issued at least 19,000 green cards that duplicated existing cards or that had incorrect information. Per your testimony, Mr. Roth, and I think you just mentioned it, that USCIS received over 200,000--200,000 reports for approved applicants about missing green cards. Mr. Roth, can you discuss the potential National security implications regarding a lack of management and attention to green card issuance and what the market may be for these green cards once they are out there? Mr. Roth. Certainly. It is an identity document that is issued by the Federal Government, so you can use that identity document for any one of a number of things. You can get a driver's license, for example; you can get public benefits, for example; you can get access to secure areas. For example, there is something called the TWIC card, which is the Transportation Worker Identity Card, that allows you to go into seaports and other sensitive areas if you have the proper Federal identification. So that worries us. We talked to CBP and they said that there is an on-going black market for those kinds of fraudulent green cards that are used for nefarious purposes. Mr. Perry. That sounds pretty significant. While in the scale of the amount of information that Ms. Scialabba's agency goes through maybe it is seen as minuscule or de minimis, but if you are somebody that is aggrieved by somebody that used them nefariously or, heaven forbid, there is an attack based on the use of them, it is not going to be de minimus at that point. Let's turn a little bit to asylum tracking and fraud. The GAO reported in 2015 that USCIS and the Department of Justice's Executive Office for Immigration Review had limited capabilities to detect asylum fraud, for which the GAO concluded may affect the integrity of this--the asylum system. The GAO also reported that neither DHS nor DOJ had assessed the risks across the asylum process. Ms. Scialabba, what are your plans to review these risks across the entire system? Ms. Scialabba. We are currently right now going through a process where we are reviewing all of the vetting that we do and all of the systems that we check, in terms of asylum and refugee processing. I am assuming when you say ``asylum'' you mean here in the United States. Mr. Perry. Correct. Ms. Scialabba. We are very careful with our asylum program. We do a lot of training. We do a lot of country condition training for asylum officers. We also look to check every system that we can find that we have access to in terms of data. As I said, we are currently in the process of reviewing that vetting process and what we are doing in the asylum program to make sure we are covering as much as we can in terms of trying to determine fraud. We are also looking at some additional tools that will help us identify schemes of fraud, where you have a situation where maybe you have used the same address a hundred different times to file asylum applications. In a paper-based system that is hard to find. Mr. Perry. Right. Ms. Scialabba. That is why we need to go to an electronic system. We need to be able---- Mr. Perry. Yes. There is an urgency---- Ms. Scialabba [continuing]. To analyze that---- Mr. Perry [continuing]. Connected with this. Ms. Scialabba [continuing]. And be able to see that. Right now we catch it sometimes. Most often it is an officer who will notice it and refer it to a Federal---- Mr. Perry. You would agree that relying on just catching it is not---- Ms. Scialabba. It is not sufficient. Mr. Perry [continuing]. Not optimal, right? Ms. Scialabba. It is not sufficient. Mr. Perry. Ms. Harris, since the review is not completed under the previous administration is it safe to say that those potentially wanting to do harm may have been granted asylum by providing fraudulent information to the U.S. Government? Ms. Harris. Mr. Chairman, I think you are raising a very good point in terms of the weaknesses associated with the current process that USCIS uses to identify fraud risks more strategically across the asylum program. I think the important thing to keep in mind here is that because of the deferral of the ELIS functionality, that USCIS is not in a position to systematically identify these fraud risks associated with the asylum applications. It is very difficult for them since it is all essentially paper-based. So, to the extent that that information can be captured electronically so that software tools and other types of automated tools can be used to identify systematically these types of risks, that will put USCIS in a better position to identify these types of risks as well as identify patterns and trends. Mr. Perry. All right. Just for clarification, when we talk about fraud risks in this regard I think maybe some people will assume that this has to do maybe with identity theft or maybe some sub-level crimes, infractions that maybe they won't find harmful to the general populace. But when we are talking about fraud risk we are talking about potential criminals and terrorists using this information to compromise our National security. So it is no small matter whatsoever. These fraud risks lead to potentially horrific occurrences within the homeland, within the contiguous and noncontiguous United States, and they are exceptionally important. With that, Chair now recognizes the Ranking Member, Mr. Correa. Mr. Correa. Thanks, Mr. Chair. I just wanted to follow up on the Chair's questions in terms of digitalizing this information seems to be a challenge, yet it is one of the big, glaring weaknesses in the process. So my question is: What do you need to go out and hire more folks internally to essentially digitalize fingerprint cards, digitalize other basic information that you need to cross-check a lot of these applications? Question to whoever wants to answer it. Ms. Scialabba. I can answer that. Let me first start by saying paper-based fingerprint cards are not just a USCIS issue. You have got paper-based fingerprint cards in local law enforcement; FBI still has paper-based fingerprint cards. They are everywhere, because back when you took those cards there was no way to digitize them. Going back through the process and trying to put those into a system and digitizing, you are talking about millions of fingerprint cards. I will say that the fingerprint cards that are now being ingested into our database, ICE is the one that is doing that, which is good because then we have that access to that information so that we can review it. Once they have ingested that information in, we have gone back and reviewed the cases that were granted. We are in the process of actually reviewing every single case that the inspector general referred to. Matter of fact, we have finished the review of all those cases and we are getting ready to refer the cases where we have found that someone has another identity, because they had that identity based on a paper-based fingerprint card that was not digitized and was not available for anybody to see--not only us; law enforcement, FBI, nobody could have seen that fingerprint at the time. We have gone back, we have reviewed all of those files, and we are getting ready to refer the cases to the Department of Justice for prosecution. Mr. Correa. So a step further to that, it is a National issue then. It is not you---- Ms. Scialabba. It is a National issue. Mr. Correa. So taking it a little iteration further, do you coordinate with other international police organization-- Interpol, Mexico, Canada, some the others--in terms of sharing some of that information to see if there are, in fact, some of those organized crime groups outside the United States that could possibly--some of that information assist you in that vetting process? Ms. Scialabba. We have some very good partners internationally in terms of vetting, particularly the United Kingdom, Australia, New Zealand, Canada. We have had robust sharing agreements with them for some time. Mr. Correa. Have you had those with Mexico? Ms. Scialabba. We do get some information from Mexico. Mainly that is through our law enforcement partners. But those are the systems that we check. I wanted to make one particular statement in terms of the asylum fraud. When I talk about fraud I am talking about a scheme of someone basically lying about whether or not they actually have an asylum claim. We check systems that will tell us if there is a record that someone is a terrorist or if they have got a criminal background. We continuously vet those and we would know if there is any information available about someone being a terrorist or somebody being watch-listed or somebody being a criminal. We check those in our systems; it is not just ELIS. We do TECS checks. Mr. Correa. A follow-up question: The Chairman was talking and made some very good comments about some of the citizenship green cards that should not have been issued that were issued because of internal mistakes, because your I.T. systems are not up the way they should be. But converse to that, how many green cards, how many citizenships have there been denied because of mistakes the other way? You understand what I am saying? If your information systems are not working to the point where you deny somebody-- or you give somebody a citizenship, a green card they should not have, are there mistakes being made we deny a green card or citizenship to somebody who should have them? Ms. Scialabba. I am not aware of that. I think if there is a situation where somebody is denied citizenship or permanent residence there are appeal rights that they have to---- Mr. Correa. Let me follow up one last question. Ms. Scialabba. Sure. Mr. Correa. I am running out of time. Fraud, people getting information or documents they shouldn't get, how many of those to your knowledge are due to maybe folks on the inside that are being bought off or bribed? In the years past I know some of the border agents were actually conspiring with bad elements to do things they shouldn't have been doing. Are you aware of any those cases inside that may be taking advantage of the weaknesses right now in the information systems? Ms. Scialabba. I am not aware of any. You are talking about internal security---- Mr. Correa. That is correct. Ms. Scialabba [continuing]. And we are very careful that internal security as well as external security. I am not aware of any of those situations. Most of the time when a green card goes to the wrong place it is because we didn't have the right address. We use the last address that we had and this is a population that moves frequently. So we have mailed the card to the last known address and it turns out that that is not the address the person is still at. Mr. Correa. Mr. Chair, I yield my time. Mr. Perry. Chair thanks the gentlemen. The Chair now recognizes the gentleman from Louisiana, Mr. Higgins. Mr. Higgins. Thank you, Mr. Chairman. Mr. Roth. my question is going to be directed at you, sir. I have been a law enforcement professional for the last 13 years and I have personally--I personally processed several thousand paper fingerprint cards. But during the course of my career, AFIS came into a full head of steam within the law enforcement community. Are you familiar with AFIS, sir, the Automated Fingerprint Identification System? Mr. Roth. Yes, I am. Mr. Higgins. As far as I know, in the civilian world of law enforcement every jail from sea to shining sea has been using digitalized finger printing for 25 years. So it is striking for me, from a perspective of reality, that the civilian world has responded to digitalized fingerprints for obvious reasons. People have had computers on our desks since the 1980's, and yet we are listening to testimony stating that somehow the Federal Government, after billions of dollars of expenditure of the people's treasure, has not quite caught up with that. Can you explain that please, sir? Mr. Roth. Sure. I mean, DHS right now is completely digitalized with regard to fingerprints. They use the same kind of system that the FBI uses. It is actually a different system, but they talk to each other. So there is complete uniformity with regard to currently how it is that, for example, immigrants are processed or if, in fact, somebody gets picked up and then an order of deportation is issued or an order of removal is issued, then those digital fingerprints will be available for adjudication. The difficulty was in the past--so this is before the digitization occurred, which was really for DHS right around the time of its inception around the early 2000, 2003, 2004 time frame--they were still using paper fingerprints. So you would have an individual who was audit status who gets picked up and he gets an order of removal. They rolled his fingerprints just like they do for everybody else, and then they stick those fingerprints into the alien--the paper-based alien file that CIS keeps or that the Department of Justice keeps or ICE keeps indicating that, in fact, there was a final order of removal against this person. Now, 10 years later this guy, No. 1, may have never left, or No. 2, had come back and, in fact, applied for both status as a green card and then permanent--or citizenship. There was no way to access that paper-based fingerprint that got rolled 10 years before. So right now the system works perfectly fine. The issue was that they knew that they had this large repository of fingerprints that were paper-based and they didn't take the extra effort to digitize those prints. That is one of the things that we found. Frankly, if we hadn't done the audit I think we would still be sitting here with a whole host of paper-based files. Mr. Higgins. Immigration benefit fraud involves a willful misrepresentation of material fact for the purpose of obtaining an immigration benefit, such as asylum status, without lawful entitlement. The Department of Homeland Security and Department of Justice have established dedicated anti-fraud entities within USCIS. Referring back to the fingerprint issue, does the USCIS I.T. system, sir, communicate with AFIS? Mr. Roth. The CIS system uses the DHS information system, which is called TECS, T-E-C-S, which, in fact, then---- Mr. Higgins. OK. Do those systems talk to each other? Mr. Roth [continuing]. Communicates--yes. Justice and DHS talk to each other when it comes to those things. Mr. Higgins. The paper print files that have been taken prior to the current digitalized age, as the individuals interact with immigration services in some way, are their fingerprints upgraded to digital status? Because in a civilian world, if, you know, repeat offenders that get arrested again and again is a common occurrence, and as they come through the jail if they haven't been arrested for, you know, 5, 6, 8, 10 years, then it doesn't matter that their original print files were paper because every time they get booked they get loaded into AFIS. Is there any system within the Federal Government's effort to control illegal and criminal status of immigrants--is there any effort to digitalize prints? With that, my time has expired, so perhaps in a further moment, Mr. Chair. Mr. Roth. Sure, of course. Yes. What we had found in our audit was the fact that there was about 150,000 fingerprints that had not yet been digitized. They had digitized a number of them, functionally ran out of money, and then stopped the process. As a result of our audit report, they found the money. In fact, they should have all those fingerprints digitized by the end of the fiscal year. So to answer your question, as far as it concerns orders of removal--in other words, the CIS and ICE deportation efforts-- those will be fully digitized by the end of the fiscal year. Mr. Higgins. Thank you, sir. Mr. Perry. Chair thanks the gentleman. The Chair now recognizes the gentlewoman from New York, Miss Rice. Miss Rice. Thank you, Mr. Chairman. Mr. Roth, can I take you back to I think it was in 2008, when IBM was hired to--at a cost of half a billion dollars to put the system together, a--you know---- Mr. Roth. That is correct. Miss Rice. Can you just walk us through that? Mr. Roth. I can certainly talk about what it is that we saw, which was, you know, that was the old sort of what they call the waterfall system, where you would hire some major contractor who would, say, you know, create a system for beginning to end, a single unitary system. It would take years of development. Of course, the I.T. systems don't stop. In other words, the technology improves but somehow what it is that you contracted for doesn't move. As a result of what was, you know, clearly an unfortunate situation there, CIS has moved. I believe in her testimony Ms. Scialabba talked about the fact that they moved from this waterfall system to an agile system, which is instead of doing one massive thing with one massive contractor we will have a bunch of different pieces of the process contracted out and the Government itself will be the integrator. In other words, we will contract out this part of it to one company and that part of it to another company and we will do it in smaller pieces and then implement it only in pieces. So that was the theory. It didn't quite work out that way, and I think everybody at this table acknowledges that the agile system that CIS used had some problems with it. Miss Rice. So why? I mean, if the waterfall system was so bad, this system was supposed to be better. Why was it not? Mr. Roth. There are a couple reasons. One is it requires the Federal Government to do the integration, so it requires a fair level of sophistication by sort of feds, Government individuals, to be able to do that in the right way. Second, it requires---- Miss Rice. Are you saying that we don't have that sophistication? Mr. Roth. I think that was one of the core issues that we found during the series of our audits, that, in fact, there wasn't that kind of expertise available. Second, it requires communication between those folks who actually use the system and the people who are designing and implementing the system. We found that that was problematic with regard to the CIS roll-out. Third, there is this issue of governance. In other words, the people at the top have to have clear information and an understanding of what the progress was. Quite frankly, I think that the senior leadership at CIS wasn't getting the kind of information it needed to make intelligent decisions. In January of last year I had a meeting with the head of CIS--not Ms. Scialabba, but her predecessor--who seemed unaware and sort-of highly resistant to some of our audit findings, our proposed audit findings. Frankly, the only thing that we could figure out is that he wasn't getting the kind of information that he needed to make the kinds of decisions that he needed to make. So those were some of the issues. The other is this idea of agile technology or agile development. It means you are going to take the software and you are going to put it out in what is called a minimal viable product, which means, you know, we are going to do small pieces but those pieces are actually going to work. So one of things, for example, in today's testimony is like, ``Well, we are going to roll out the N-400. And we are prepared to pull it back if it doesn't work.'' Well, that is not a minimally viable product. If, in fact, you roll it out and 4 months later you have a backlog of 250,000 applications that you are still not--haven't been able to grind through, that means you released a product that was not minimally viable. What you should have done is engage in further testing, sort-of stress testing, of the software before you rolled it out. So to my point of view, the--this idea that, well, we will put it out when if it breaks and it breaks the system and we have a quarter-million applicants, well we will then just pull it back. That is not agile. That is just not the right way to roll out software. Miss Rice. So I see a lot of parallels between the complete and utter waste of money here. I mean, now this--it goes from $2.1 billion to over $3 billion, right, in cost? Right? Mr. Roth. You know, we don't know exactly what it is going to cost at the end of the day. Miss Rice. That is not even the end of the day. So, you know, I sit on the Veterans' Affairs Committee, too, and I personally think that the V.A. should not be in the business--they are not general contractors. They should not be in the business of building anything. There is a hole in the ground, practically, in Aurora, Colorado and, you know, I don't know how many billions of dollars later there is nothing there. So, in light of the lack of expertise that you are saying exists in CIS, No. 1, from a technical standpoint, and in light of President Trump's desire to cut budgets that are going to affect CIS, how are they going to do what they have to do with even less money? Mr. Roth. Well, CIS is fee-based so they will not be as affected, I think, by whatever budget cuts occur. But I would agree that this is a high-risk system. It has been---- Miss Rice. The hiring freezes--that is not affected? You can't get the talent if you--if there is a hiring freeze and you can't hire people. Mr. Roth. I don't think there is any question that this is a high-risk system and there are some hard decisions to be made with regard to how CIS moves forward. Miss Rice. I am sorry, can you repeat that? Mr. Roth. Sure. I don't think anybody disputes that this is a high-risk system and that the history of it has shown that it is a high-risk system, and I think CIS is going to make--have to make some hard decisions as to how they are going to move forward on this. Miss Rice. Well, so they need money, they need real talent, and they need real management, right? Mr. Roth. Correct. Miss Rice. OK. Thank you, Mr. Chairman. Mr. Perry. Chair thanks the gentlelady. The Chair now recognizes the gentleman from South Carolina, Mr. Duncan. Mr. Duncan. Chairman Perry, thank you. I would be remiss if I didn't mention the court decision yesterday on President Trump's Executive Order to pause refugees and visa issuance to people from six Middle East and North Africa countries. The judge, this is judicial activism at its worst when the judge uses political rhetoric in his decision--not the statute, not the law, because the statute and the law is pretty doggone clear that the President has the ability to do this; it has been used from Jimmy Carter forward--but use campaign rhetoric to pause or halt through judicial activism an Executive Order. These are the same countries that President Obama signed into law that do not have the records necessary for the vetting process, don't cooperate with U.S. processes. It is where terrorists are embedded. So if it was truly a Muslim ban a rhetorical question to ask ourselves is: Why wouldn't it list the largest Muslim population countries in the world? If I ask you that question you may say, well, that is Saudi Arabia or some. No, it is Indonesia. Second is Pakistan. Third is India. So it is not a Muslim ban. It is targeting countries that we know ISIS has infiltrated. Take ISIS at their word. They said they are going to infiltrate our refugee program and our visa program to try to come to this country to do harm to America and Western interests. The facts are clear that these countries are harboring terrorists. Case in point: Countries that do cooperate with the United States, with the requirements of Department of State and Homeland Security, aren't listed. In fact, Iraq was removed from the previous Executive Order listing to this one because they have stepped up to the plate to meet the requirements the United States puts in place for vetting of visa applicants and refugees. So Iraq isn't on this Executive Order. It shows you the process is working because the countries are actually changing their processes. Let me shift gears. Forty-nine percent of all illegal aliens in this country are visa overstays. Forty-nine percent. You pick a number, 12 million or 20 million. Half of those are people that came to this country with a permission slip that the people sitting at this table are responsible for giving: USCIS and Department of State. They came with a visa--work visa, student visa, you name it. They were vetted; they were granted a visa of our country, a permission slip. We invited them to come to our country. They decided they liked it and decided to violate our law and stay in this country. They are visa overstays and they are here illegally because they are out of legal status. That is something we can work on. That is where we need a biometric entry-exit visa system so we know when people enter our country and leave our country, leaving our country being the big part of it. That is low-hanging fruit. We know the names of these folks; we know where they were going in most cases. In a work visa or student visa that is a great place to start for enforcement of the laws on the books that say you can't overstay your visa. We are going to give you a period of time to be in our country. We will even allow you graciously to extend that through the process. But if you overstayed you are in violation of the law and it is time to go. So that is an enforcement aspect. A biometric entry-exit systems being worked on, but we are not there yet. So regardless of how well USCIS and Department of State do their job on visa screening and refugee processing or whatnot, if we don't have a good biometric entry-exit system I don't think we are fulfilling the wishes of the American people. So, Ms. Scialabba, I ask you, where are we on that? Because that question may have been asked by someone, but where we are on the biometric entry-exit system that we have talked about in this committee since I joined it January 2011? Ms. Scialabba. Congressman, I know that they are working on that. That is a DHS priority. It is Customs and Border Protection that is responsible for the entry-exit system, so I am not really in a position to give you a good update on where they are with the system. But I know for a fact, because I have been in meetings where they are actually talking about updating and formalizing that system. Mr. Duncan. Right. Ms. Scialabba. So I know they are working on it, but I am not in a position to give you a detailed answer on that. Mr. Duncan. Let me ask you this: Do other countries do biometric entry-exit visa screening or entry-exit screening? Ms. Scialabba. Some do, some don't. Mr. Duncan. Go to Japan, you put your thumbprint on a screen when you enter the country and when you leave. They know when you are there. Ms. Scialabba. I think---- Mr. Duncan. Why don't we tap into these other countries' technology and utilize some of that here? Let's cut this process down. They have got something that is working. Rely on our allies. Mr. Chairman, I think that is just a simple start. We are going to spend billions of dollars on this; we are not even there yet. I think that is something that works. I had a lot of other questions. If we go to round two I will be glad to ask them then. I yield back. Mr. Perry. Chair thanks the gentlemen from South Carolina. The Chair now recognizes the gentlewoman from California, Ms. Barragan. Ms. Barragan. Thank you. I would be remiss if I didn't say something in reply to that. I am grateful for the judiciary system; it is a checks and balance system that we have in this country that is meant to provide the oversight when you have a President who is doing whatever he wants to do, regardless of the law. This second travel ban was just the same ban in different wrapping paper. It had the same discriminatory intent, and we can't--we don't even know what this President's financial ties are to countries that are not on the list because he won't release that information. Activism? I would say not. The fact that Iraq was taken off the list I think is just another indicator of how random the process has been. But I will switch gears here and go on to what we are talking about today. I want to talk about the merit-based system that the President has indicated we are going to move to. You know, my parents were immigrants from Mexico. My mom had only a third-grade education. Under a merit-based system she probably never would have been able to come here. I certainly wouldn't be sitting here today if that were the case. So the President has announced that he is going to move for this merit-based immigration system, breaking from decades of long practice of giving families--preference to families of U.S.-based citizens. While in many ways a patchwork, the U.S. immigration system is already attracting many of the best and brightest from around the globe. Trump's characterization of the U.S. immigration as a flood of low-skilled migrants draining public finances is flawed. New arrivals to the United States are increasingly better-educated and well-off. Ms. Scialabba, what can be USCIS fix to speed up processing for highly-skilled immigrants? Ms. Scialabba. Well, as I am sure you are aware, there are visas available for highly-skilled immigrants that we process on a regular basis. I think if you are referring to the premium processing that was suspended for a temporary period of time-- -- Ms. Barragan. Well, you raise a good point. Earlier this month the U.S. Citizenship and Immigration Service announced that starting on April 3 it would temporarily suspend premium processing for the H-1B visas and the suspension may last up to 6 months? Ms. Scialabba. Yes. Ms. Barragan. What I would like to do is I would like to ask the Chairman unanimous consent to enter a release from the USCIS announcing this temporary suspension into the record. Mr. Perry. Without objection, so ordered. [The information follows:] Submitted for the Record by Hon. Barragan USCIS Will Temporarily Suspend Premium Processing for All H-1B Petitions https://www.uscis.gov/news/alerts/uscis-will-temporarily-suspend- premium-processing-all-h-1b-petitions Starting April 3, 2017, USCIS will temporarily suspend premium processing for all H-1B petitions. This suspension may last up to 6 months. While H-1B premium processing is suspended, petitioners will not be able to file Form I-907, Request for Premium Processing Service for a Form I-129, Petition for a Nonimmigrant Worker which requests the H-1B nonimmigrant classification. We will notify the public before resuming premium processing for H-1B petitions. who is affected The temporary suspension applies to all H-1B petitions filed on or after April 3, 2017. Since FY18 cap-subject H-1B petitions cannot be filed before April 3, 2017, this suspension will apply to all petitions filed for the FY18 H-1B regular cap and master's advanced degree cap exemption (the ``master's cap''). The suspension also applies to petitions that may be cap-exempt. While premium processing is suspended, we will reject any Form I- 907 filed with an H-1B petition. If the petitioner submits one combined check for both the Form I-907 and Form I-129 H-1B fees, we will have to reject both forms. We will continue to premium process Form I-129 H-1B petitions if the petitioner properly filed an associated Form I-907 before April 3, 2017. Therefore, we will refund the premium processing fee if: (1) The petitioner filed the Form I-907 for an H-1B petition before April 3, 2017, and (2) We did not take adjudicative action on the case within the 15- calendar-day processing period. This temporary suspension of premium processing does not apply to other eligible nonimmigrant classifications filed on Form I-129. requesting expedited processing While premium processing is suspended, petitioners may submit a request to expedite an H-1B petition if they meet the criteria on the Expedite Criteria webpage. It is the petitioner's responsibility to demonstrate that they meet at least one of the expedite criteria, and we encourage petitioners to submit documentary evidence to support their expedite request. We review all expedite requests on a case-by-case basis and requests are granted at the discretion of the office leadership. why we are temporarily suspending premium processing for h-1b petitions This temporary suspension will help us to reduce overall H-1B processing times. By temporarily suspending premium processing, we will be able to: Process long-pending petitions, which we have currently been unable to process due to the high volume of incoming petitions and the significant surge in premium processing requests over the past few years; and Prioritize adjudication of H-1B extension of status cases that are nearing the 240-day mark. Ms. Barragan. OK, thank you. So companies can use these visas to hire foreign workers to temporarily fill these positions in the United States. How would you implement the President's merit-based system when this administration is suspending a program that permits high entry for highly-skilled immigrants? Ms. Scialabba. Let me first say the program is not suspended. We suspend premium processing, which means we would have to process the application in 15 days. The applications that come in beginning in April--we see a flood of applications that come on, usually it is 200,000 or more. We are unable to process those premium processing--we can't process cases in 15 days when we get 200,000 in a week. It is only suspended temporarily. Once we lift the suspension, people are able to file for premium processing and we will process their application within 15 days. I think the other thing to keep in mind is that these visas that they are applying for in April are not available until October. So what we do is we take them in, we process them, we organize them, and then when we are ready we let people file for the premium processing if they think that that is what they need, but the visas aren't available until October in any event so it is really not delaying anybody from getting their visa when they are ready to pick up the visa. Ms. Barragan. So what is being suspended? Does that mean we were not doing it before? Ms. Scialabba. No, we were doing it before. Before we have the--before we open up the H-1B season, which is when everybody can file, we are taking in those visas on a regular basis and a regular process. You can apply for premium processing at that point. What happens in April is that we open a window where people file--and usually it is only for a week because we get so many applications in that time period. We usually get in between 200,000, 240,000 applications in 1-week's time. Just getting the data entered into our systems and getting those processed so that they are ready for adjudication takes some time. That is why we are unable when we--when we suspend, the only thing we are suspending is the premium processing. We are not promising to do anybody's visa, anybody's petition in 15 days. Once we get all that data into the system, once we are ready to turn it back on, we put premium processing back in play and people can then file, if they want, to have their adjudication done within 15 days as opposed to 30, 60, 90, whatever our processing time is at the time. Ms. Barragan. Thank you. My time has expired. I yield back. Mr. Perry. Chair thanks the gentlelady. Chair is going to open a second round of questioning here. Mr. Roth, looking through your testimony regarding the USCIS Systematic Alien Verification System for Entitlements it says, ``In most cases, an error in SAVE verification means that a deportable individual can receive benefits ranging from public assistance to a driver's license,'' and you already mentioned in previous testimony, the Transportation Worker Identification Card, which allows them unescorted access to secure areas of the Nation's vessels. It appears that, in your testimony, that USCIS has failed to identify the deportable status of 12 percent of individuals submitted through SAVE. I am wondering, you know, those, according to your testimony, are individuals that the court had ordered be deported for things like felony convictions. I imagine they run the gamut, including things like extortion, assault, burglary, drugs, et cetera. What kind of numbers are we talking about, Mr. Roth? Mr. Roth. What we did was we did a representative sample, which is typical of what we do in an audit. We try to make it large enough where it is statistically significant. So we can't estimate exactly how many we are talking about the entire universe, but what we found in doing the statistical sampling was that about 1 in 8 of those queries, in fact, did not turn up the fact that somebody actually had been ordered removed from the country for, you know, a variety of reasons, as you said. That audit was in 2012. We made recommendations. CIS followed the recommendations, but in this follow-up audit that we did--that we just released it took 46 months to get a solution finally on-line. That was one of the things that to me struck me about this entire process was there seemed to be a lack of urgency in fixing the problem in a reasonable amount of time. Mr. Perry. So am I to understand, based on what you just said, that that situation has now been rectified, that we are not at 12 percent of deportable individuals in the SAVE program maintaining status here in United States? That has been rectified? Mr. Roth. That is correct. Functionally what happened was SAVE was not talking to the right kind of databases. Mr. Perry. Right, right. Which is good news, and we applaud and commend the Department for taking care of that. That is with--Mr. Roth, that is with records that we know about, right? That is able to vet, so to speak, compare the application against information that we have to see whether the applicant is worthy, for lack of a better term, or justified in maintaining their status in the United States, right? That is generally, if I could describe that, you are comparing and---- Mr. Roth. It is actually simpler than that because there is no judgment that, I mean---- Mr. Perry. Right. Mr. Roth. If they have been ordered removed then they have been ordered removed. It is not, ``Oh, we are going to assess their risks.'' Mr. Perry. Right. Mr. Roth. They have no basis to be in the country so they can't get any benefits. Mr. Perry. Right. So in previous testimony, Ms. Scialabba--and you can correct me; I just want to make sure I understand this correctly--you are saying that you check all the known databases, et cetera, for asylees to determine whether they might be criminals or terrorists, et cetera. You gave us this impression and I just want to make sure if we have the correct impression, that even though it might be a paper-based system and even though you might not have digital information, you are going to go ahead and check everything to vet these individuals. But what if you don't have anything to vet against, is my question. That is a concern for anybody coming in the country, whether it is through USCIS, whether it is through the United Nations, et cetera. Before you answer, I would just like to hear from Ms. Harris on this particular issue. If you can shed any light to the fact, because I get the impression based on that testimony that there is really nothing to be concerned about; all this is being checked. But is that true or not true, in your opinion? Ms. Harris. Mr. Chairman, unfortunately we have--I am not in the--I am not the best expert within GAO to answer that question, so I would like to take that for the record. But I can tell you that we do have on-going work on the SAVE program as well as work related to refugee vetting. So that work will be released I believe in the spring time frame. So I would like to get that information for you. Mr. Perry. OK. Well, springtime starts I think in about a week. Is that about right? So what kind of time frame are we talking about, Ms. Harris, if you know? Ms. Harris. I believe in the May time frame. Mr. Perry. OK. In the May time frame. Ms. Harris. Yes. Mr. Perry. All right. We are hoping it is a little warmer and hospitable outside. But we will look forward to that report. In my remaining 20 seconds, Ms. Scialabba, if you want to enumerate? Ms. Scialabba. Yes. What I was saying was that the systems that we can identify and that we can link to, we check. As I said before, I was the associate director for refugee asylum international operation. When we started processing Iraqi refugees we made a concerted effort to go out to the intel community, the law enforcement community, to find what other databases there were. We were able to get the Department of Defense to put their information into our IDENT system at Department of Homeland Security so that we had access to that information, too. But before that happened we were running our checks through--it is called ABIS at the Department of Defense because they had a lot of information on the Iraq population. We continue to review that constantly and always because there are always databases being developed; there are always systems that we aren't necessarily aware of because they are in the intel community and they don't necessarily let us know what they have. It is an on-going process. We have never stop looking for more. Mr. Perry. We appreciate and encourage and--your diligence, and we applaud that diligence. But at the same time, especially when you mention Iraq, which is very different, I think, from countries like Iran or Syria in databases, and the concern is that even though USCIS might seek out other databases, and diligently does so, as it should, some of these individuals-- maybe many of these individuals--there is nothing to check against. There is no way to vet them because there is no database to refer to. But I don't want to keep going on. Chair now recognizes the Ranking Member, Mr. Correa. Mr. Correa. Thanks, Mr. Chairman. I do have a follow-up question on one of the comments made by our good colleague from South Carolina. He said 49 percent of all the undocumented are overstays. Do you have any information from what countries those overstays are from? If you don't have it I would like to get that information some other time--very soon, hopefully. Ms. Scialabba. We can get that information for you, I believe, from the Department of Homeland Security. It is not information that USCIS would normally maintain---- Mr. Correa. OK. Ms. Scialabba [continuing]. But I am sure we can get it from the Department of Homeland---- Mr. Correa. The breakdown is, you know, are those educational, work? What overstays are those? You don't have it, but love to get it. Ms. Scialabba. I will look to see what the Department has. Mr. Correa. In a timely basis. Thank you very much. The other question I have is related to the EB-5 visas. Those are the, I guess, investment visas. There have been accusations of fraud, abuse, internal influence in issuing these. These are very popular. I know in my district a lot of folks get together, you need some money to invest, you go out and round up some investors from overseas, you put the project together. Is there any follow-up to assure that the requirements to get the EB-5 are actually complied with, and what--do they actually create the 10 permanent U.S. jobs, so on and so forth? Is there any follow-up at all? Is it just certification up front? You can invest half a million dollars, you get your visa, and nothing else is followed up on these visas. Ms. Scialabba. There is follow-up, particularly when they apply to remove the condition on the permanent residence. They have to prove and establish that they created the 10 jobs, that the--whatever the--whatever they developed, whether it is a store or whatever the enterprise is, that it is still functioning and that it is still viable. So at that point there is follow-up. But we have also implemented a process where we go out to visit the various enterprises that have been established to make sure they are operating, that they are what they say they are, that they actually exist. Mr. Correa. Do you visit all of them or just a sample? Ms. Scialabba. A sampling, it is a sampling of them for quality assurance. Mr. Correa. OK. My final question or few seconds I have left is we have heard that your predecessor, in terms of the I.T., the challenges, we had an audit and that person refused to acknowledge that audit. It seems like we had a situation where folks kind-of buried their head in the sand or in a hole and not really acknowledged the challenges that were being put forth. You, ma'am, have about what, a couple of months left in the agency--3? Ms. Scialabba. Two weeks. Mr. Correa. Two weeks. Oh, my gosh. Time flies. So what would your recommendation be in terms of this committee--through the Chair I would ask that--to make sure that we continue to follow up, to make sure that that situation does not repeat itself, meaning that we have consistent diligence to assure that the I.T. is actually making progress? Ms. Scialabba. I can assure you that USCIS knows that the wave of the future is electronic and that we have to have a system that works for us. We have made great progress and great strides, I think, in terms of our contracting, in terms of how we are rolling out our software. I would say the system is not failing. We have processed over 100,000 N-400's in that system; we have processed almost a million green cards in that--I-90 green card replacements in that system. We have also processed I think 750,000 immigrant visa fees in that system. It is not failing. It has---- Mr. Correa. Madam, I don't believe the issue is failure. The issue is progress, or the lack thereof, in a timely manner. So I would ask my Chair to come back very soon to again ask these same questions to make sure we are all on the same page, so to speak. Ms. Scialabba. We are happy to come and brief the committee and the staff whenever you would like. Mr. Correa. Thank you. I yield the rest of my time, sir. Mr. Perry. Gentleman yields. The Chair now recognizes the gentleman from South Carolina, Mr. Duncan. Mr. Duncan. Thank you, Mr. Chairman. Employers and law enforcement officers are using social media as a way to screen potential applicants for jobs, or fighting crime, looking for suspects. I think it would surprise me--people--the amount of social media activity in other countries rivals that of the usage here in America. So, Ms. Scialabba, to what extent does the USCIS use social media to adjudicate applications for immigrant and nonimmigrant benefits? Ms. Scialabba. We are currently using social media to vet refugee applications. We are in the process of rolling that out farther and piloting it for other applications that we use. The social media issue for USCIS is that we do large volume. If you are looking at the social media for someone that is under investigation or an individual that you are looking at it is much easier to do; if you are trying to process, I don't know, 20,000 applications at a time and you are trying to vet 20,000 people through social media, it is really not possible. So we have to do some risk analysis, which is what we are in the process of doing, to see which visas are most likely to yield the most when we do social media vetting. Obviously, we are doing it for all of the refugees; we are going to start doing it for asylum; one of the things that we are looking at piloting is for the K visas. So we are rolling out and using social media in a much more robust way than we have in the past, and we will continue to look at that and review it and use social media as best we can to ferret out anybody who means to do harm to the United States or fraud. We have seen some fraud, too, with social media. Mr. Duncan. Thank you. I hope you do. I think that is the right move to utilize more and more of that. There has been some talk today about electronic records, and we all know how electronic records have helped expedite things in our life, whether it is medical records that can be sent easily from the doctor to the hospital. But there is always a fear of hacking, and we saw what happened with the OPM with thousands or millions of employment records, having access to those that could lead to identity theft and other things. So is this a concern, Mr. Roth, of DHS? What are some safeguards that you all are looking at with regard to--these are noncitizens, but they still have private information that is part of the screening process. So what are we doing to safeguard their information, as well, because I think other countries would be interested in that? Mr. Roth. I share your concern with that. Particularly as you roll out new software you don't actually know what the security protocols or what--how secure, in fact, that system is. It is something that we are concerned about. We haven't done any formal work on it because, of course, the problem is ELIS is very much a work in progress so it is very difficult to assess the security configurations of something that hasn't yet rolled out. But we are concerned just based on CIS's challenges in getting software that works. So if they can't get software that works, we certainly have some issues with whether or not it is secure. Mr. Duncan. Right. I think there is always a fear of--even in closed systems that aren't connected to the internet in any way, not connected to any outside electronic source for tapping into, that someone on the inside could always print it off, USB drive or something, to take those documents, as we saw recently in another agency. So part of me likes the paper side of it, but I understand that is not feasible. Mr. Chairman, it is a great hearing. I appreciate the feedback from the witnesses, and I yield back. Mr. Perry. Chair thanks the gentlemen. The Chair now recognizes the gentleman from Louisiana, Mr. Higgins. Mr. Higgins. Thank you, Mr. Chairman. Mr. Roth. I am going to ask you a few yes-or-no questions. Then I will give you an opportunity to expound, sir. Would you agree, from your perspective, that the Federal Government is responsible to the American people to maintain our sovereign borders and to protect our citizenry from those who would do us harm that would enter our borders under false pretense? Mr. Roth. Yes. Mr. Higgins. Do we rely upon partnering with cooperative and capable foreign governments regarding their own vetting of those that they would issue immigrant visas for, those that would apply for legal status within the United States? Do we rely upon the cooperation and capability of our foreign partners? Mr. Roth. That is my understanding. I think that is best addressed to CIS. We haven't done any audits on it. Mr. Higgins. All right. Thank you sir. From your perspective, would you agree that I.T. capabilities and digitalizing technologies increase and improve every year? Mr. Roth. Yes, I believe that is the case. Mr. Higgins. Yes, sir. In 2009 I worked a case regarding identity theft, fraudulent checks, forged checks, and fraudulent identification in conjunction with treasury agents of the Secret Service. I was presented with driver's licenses that were completely false that I could not determine as a veteran law enforcement agent were fake. This was in 2009. The source of those driver's licenses, those fraudulent documents, was a booth in a flea market in Houston. If we rely upon our partners in foreign governments that are cooperative and capable to vet their own citizenry prior to their intended effort to enter our country, when we are responsible to protect the sovereignty of our borders, if they have no capable or cooperative vetting procedure in those nations, and if those nations are known to include high populations and dense populations of terrorist-leaning populace, how can we possibly, given the nature of technology, how can we possibly be sure if we don't have--from your perspective as a cop, how can we possibly be sure that those nations are not allowing their citizenry to attempt to enter our country with excellently forged documents and identification papers and means by which to enter our country with fraudulent intent? Mr. Roth. Well, you raise a good point, which is you are only as good as the information you get. But in your circumstance, for example, the United States, one of the most sophisticated nations on the planet, we have abilities--or bad actors have the abilities to create false identifications. So while it would be best to rely on our foreign partners that are more sophisticated, there is risk all over the process. Whether it is with our more sophisticated foreign partners or our less sophisticated foreign partners, we are always going to have the risk that people who are bad actors will use the system to come into the country. The question is: How do we control that risk? What process do we put in place to minimize the risk that we all sort-of identify as out there? Mr. Higgins. Thank you, sir. Mr. Chairman, I would encourage my colleagues on this subcommittee and from both sides of the aisle to maintain a sober diligence regarding the way we approach allowing foreign nationals to seek entry to our country as we sit with full knowledge of the fact that there is certainly the capability to produce fraudulent documents. I would hope we stop them where they come from rather than letting them make it to the booth in a flea market in Houston. With that I yield my time, Mr. Chairman. Mr. Perry. Chair thanks the gentleman. Ms. Scialabba, thank you for your service to the country. It has been a long time and we wish you well moving forward. For your successor, I would say that there are still significant questions and concerns that remain. While we applaud you for getting it together, so to speak, for things like the SAVE program, 45 months is way too long when I think about somebody that is listed by the courts as ``should be deported,'' and we don't pick that up. If that individual has harmed--would harm a member of my family or your family or any American's family, that is just something that is unacceptable to us, and I know you understand that. So while we appreciate the good work, 45 months is too long and this is--there is an urgency that is attached to this that the Department must, in my opinion, be imbued with. So we wish you well. We hope to see your successor. For your staff that is here with you, we hope to see again and we hope that we can talk under better conditions in the future. With that, the Chair thanks the witnesses for their valuable testimony and the Members for their questions. Members may have some additional questions for the witnesses, and we will ask you to respond--you folks on the panel--in writing. Pursuant to committee rule VII(D), the hearing record will remain open for 10 days. Without objection, the subcommittee stands adjourned. [Whereupon, at 11:02 a.m., the subcommittee was adjourned.] A P P E N D I X ---------- Questions From Subcommittee Chairman Scott Perry for Lori Scialabba Question 1a. The Immigration and Nationality Act (INA) requires USCIS to conduct an initial interview for asylum applications within 45 days after the date the application is filed, and to make a decision within 180 days after the date the application is filed, unless there are exceptional circumstances. However, USCIS has reported that its increasing caseloads make this time frame unachievable. How long does USCIS currently take to process asylum applications? Question 1b. To what extent is this time frame affected by paper- based documentation processing? Answer. Response was not received at the time of publication. Question 2a. Mr. Roth testified that USCIS plans to complete its efforts to digitize paper fingerprint records by the end of fiscal year 2017. Is USCIS on track to meet this time frame? Question 2b. If not, when does USCIS expect to complete these efforts? Answer. Response was not received at the time of publication. Question 3. A September 2016 GAO report on the EB-5 program focused primarily on the risk of fraud associated with the program. However, press reporting and other sources have also expressed that there are some National security risks associated with the program, such as reporting that USCIS granted EB-5 visas to individuals involved with smuggling. What steps has USCIS taken to address these security risks? Answer. Response was not received at the time of publication. Question 4. GAO and the OIG have reported on the challenges that relying on paper-based documentation poses for information sharing with Federal partners. How does USCIS mitigate those risks? Answer. Response was not received at the time of publication. Question 5a. The OIG reported that USCIS's efforts to recover the 19,000 wrongfully-issued green cards have not been effective due to a lack of consistency and urgency at USCIS. For example, when USCIS issued the wrong or duplicate cards in the spring of 2016, USCIS did not begin attempting to recall cards for months. How has USCIS addressed the issues related to consistency and urgency when recalling green cards that were issued in error? Answer. Response was not received at the time of publication. Question 5b. To date, how many of the green cards associated with the episodes outlined in your report are still unaccounted for? Answer. Response was not received at the time of publication. Question 5c. Has USCIS investigated whether these wrongfully-issued cards were used to commit fraud and/or facilitate criminal activity? Answer. Response was not received at the time of publication. Question 6. In August 2015, GAO explained how the current electronic databases used for EB-5 ``have limitations that reduce their usefulness for conducting fraud--mitigating activities. For example, information that could be useful in identifying program participants linked to potential fraud is not required to be entered in USCIS's database . . . Moreover, FDNS officials told us that some data fields are also not standardized, a fact that presents significant barriers to conducting basic fraud-related searches.'' How will transitioning EB-5 processing to ELIS address these shortcomings? When does USCIS plan to process EB-5 in ELIS? Answer. Response was not received at the time of publication. Question 7. While USCIS is planning to transition EB-5 processing to ELIS, there are currently no plans to include supporting information associated with the EB-5 applications, such as bank statements or business plans. This is an interesting decision, given that according to FDNS, ``this supporting information can be an important source of potential fraud indicators.'' Please explain the decision to not include supporting documentation in the ELIS migration. Are there any plans to eventually move this information into ELIS and if so, when does USCIS expect to do so? Answer. Response was not received at the time of publication. Question 8. In a 2015 GAO report, GAO recommended that FDNS immigration officers prescreen all asylum applications for indicators of fraud to the extent that it is cost-effective and feasible. What has USCIS done to comply with this recommendation? Answer. Response was not received at the time of publication. Questions From Ranking Member Bennie G. Thompson for Lori Scialabba Question 1. USCIS recently announced it will halt premium processing of H-1B visa petitions on April 3, for up to 6 months. Premium processing fees help USCIS cover the faster processing but the fees also go towards other expenses, including refugee processing. What will the economic impact be to USCIS, a primarily fee-funded component, without fees collected from premium processing? Answer. Response was not received at the time of publication. Question 2. We understand that the revised fiscal year goal for refugee admissions is 50,000. To date in the fiscal year, how many refugees have been admitted into the United States? To what extent have Refugee Affairs Division resources been redirected from the refugee admission process to other USCIS mission needs in light of the administration's Executive Orders? How is USCIS adjusting its refugee adjudication workload for the remainder of the fiscal year? Answer. Response was not received at the time of publication. Question 3. What is the current status of the regulation issued by former President Obama that expands the use of the Government's ``parole'' authority to authorize an immigration benefit for foreign entrepreneurs who can demonstrate they will provide a significant public benefit to the United States as a result of economic growth and/ or job creation, scheduled to go into effect July 16, 2017? Answer. Response was not received at the time of publication. Question 4. USCIS has stated that the reason for the H-1B premium processing suspension is to help address the backlog of petitions and decrease processing time overall. How will the loss of H-1B premium processing fees affect USCIS's ability to dedicate more resources to adjudicating backlogged petitions? Are officers who currently adjudicate premium processed H-1B petitions being reallocated to all H-1B petitions? Or are those officers going to be working on the many other employment-based filings that are also backlogged? Answer. Response was not received at the time of publication. Question 5a. In August 2016, USCIS discontinued use of ELIS and reverted to using the legacy management system for all new N-400 applications. In January 2017, the Inspector General learned that USCIS leadership planned to return to ELIS for application processing. What is the current status of the ELIS system? Is ELIS being used to process immigration applications? If so, which application forms? Question 5b. If ELIS is not in use, what is the current time line to revert from the legacy system back to ELIS? Answer. Response was not received at the time of publication. Question 6a. This month, USCIS indicated it will suspend premium processing of H-1B visas, a program that allows employers to bring skilled foreign workers to the United States. How long does USCIS intend to suspend premium processing? The Transformation Program is partially funded by unobligated carryover money from premium processing fees. What other USCIS programs may be impacted by the elimination of premium processing fees from H-1B visas? Answer. Response was not received at the time of publication. Question 6b. USCIS is primarily funded by fees. What are the long- term implications USCIS may face without fees collected from H-1B visa premium processing? Answer. Response was not received at the time of publication. Question 7a. Recent estimates provided by GAO indicate the Transformation Program should be completed in March 2019 at a cost of $3.1 billion dollars. Based on your most recent review of the program, are these estimates still accurate? If not, please provide the subcommittee with the updated life-cycle cost and schedule. Answer. Response was not received at the time of publication. Question 7b. How has the recent errors with green card processing impacted the anticipated life-cycle cost and schedule? Answer. Response was not received at the time of publication. Question 8. Both GAO and the IG have expressed concerns with the overall management of the USCIS Transformation Program, particularly citing USCIS failure to ``consistently follow the acquisition management approach outlined in DHS management directives.'' How has management of the Transformation Program been addressed by USCIS? Please provide particular areas USCIS management corrected or improved upon related to following leading IT management best practices, policies, and programs. Answer. Response was not received at the time of publication. Question 9. In December 2015, GAO reported on significant weaknesses in USCIS's oversight of the asylum process with particular emphasis on gaps in the agency's efforts to prevent, detect, and respond to asylum fraud. What is the status of USCIS's efforts to develop an assessment tool and implementation plan for completing regular fraud risk assessments of the affirmative asylum process? Answer. Response was not received at the time of publication. Question 10. Based on current administration priorities, what is the status of applications for humanitarian parole, particularly those applications for the Central American Minors (CAM) Program? Answer. Response was not received at the time of publication. Question 11. The USCIS Field Operations Associate Director expressed directly to USCIS CIO Mark Schwartz his concerns with the performance of ELIS and the need to meet four minimal requirements before returning to processing naturalization benefits in ELIS. What is the current status of meeting the four requirements discussed? When it was decided in January 2017 to revert back to ELIS, had the four minimal requirements provided by the Associate Director been met? Answer. Response was not received at the time of publication. Question 12. The H-1B visa program allows employers to bring skilled foreign workers to the United States. Premium processing grants those employers a response from USCIS within 15 days as opposed to the traditional response, which takes 3-6 months. What impact do you believe this longer processing period will have on employers and workers, especially given the annual cap for H-1B visas is 65,000, yet USCIS is expecting more than 200,000 petition requests? Answer. Response was not received at the time of publication. Question 13. USCIS personnel are required to check applicants' biographic data against the CBP TECS system and the FBI's name check database. However, ELIS allowed cases to be moved forward for processing despite incomplete or inaccurate background and security checks, which is incredibly concerning. According to Field Operations Directorate officials, approximately 175 applicants were granted citizenship as of January 11, 2017 before the problem was detected and USCIS began redoing the name checks to ensure they were all completed correctly. Why was the decision made to revert back to using the ELIS system despite discovering this error? What current oversight is being conducted to ensure applications cannot be processed without the sufficient database and name checks? Answer. Response was not received at the time of publication. Question 14. Please explain USCIS's decision to change the Transformation Program in 2012, including the switch from one primary contractor to multiple contractors and the change from the waterfall software development approach to the agile approach. How do you anticipate these changes impacted the total overall costs of the Program as well as the implementation time line? Answer. Response was not received at the time of publication. Question 15. As States continue expanding the reasons for which they seek to use the Systematic Alien Verification for Entitlements (SAVE) program for verification of immigration status, how is USCIS ensuring each new use is proper and appropriate? Does USCIS have concerns about the expanding uses of SAVE, including using SAVE to for voter registration purposes? Answer. Response was not received at the time of publication. Questions From Chairman Scott Perry for Carol C. Harris Question 1. What are some of the biggest concerns and risks with USCIS being unable to readily share immigration information with Federal partners? Answer. We have not specifically examined the concerns and risks with U.S. Citizenship and Immigration Services (USCIS) process for sharing immigration information with Federal partners. However, we have previously reported that challenges in USCIS's information systems and processes can hinder its efforts to use data to identify and address fraud risks in immigration benefit programs. For example, in August 2015, we reported that the agency's information systems and processes limit its ability to collect and use data on the EB-5 Program to identify fraud related to individual investors or investments or to determine any fraud trends across the program.\1\ In particular, we noted that USCIS relies heavily on paper-based documentation. While its contractors and employees enter information from these paper documents into various electronic databases, these databases have limitations that reduce their usefulness for conducting fraud-mitigating activities. --------------------------------------------------------------------------- \1\ GAO, Immigrant Investor Program: Additional Actions Needed to Better Assess Fraud Risks and Report Economic Benefits, GAO-15-696 (Washington, DC: Aug. 12, 2015). --------------------------------------------------------------------------- Moreover, we found that USCIS did not collect applicant information that could help mitigate fraud. In fiscal year 2011, the agency expanded reporting requirements to gather information about on-going regional center activities, such as information on the active projects managed by each regional center. According to USCIS and U.S. Securities and Exchange Commission officials, this information helped identify potential incidents of fraud. However, USCIS has not required EB-5 program petitioners and applicants to provide information about the businesses supported by the regional centers and program investments coordinated by the regional centers, such as the names of principals or key officers associated with the business, or information on advisers to investors such as foreign brokers, marketers, attorneys, and other advisers receiving fees from investors. U.S. Securities and Exchange Commission and Fraud Detection and National Security Directorate stakeholders with whom we spoke emphasized that collecting additional information could be useful for the agency to combat fraud. For example, according to these officials, the absence of information about businesses supported by regional centers limits USCIS's ability to identify potential fraud, such as misrepresentation of a new commercial enterprise. Given that information system improvements with the potential to expand fraud mitigation efforts would not take effect until sometime in the future, and that gaps existed in its other information collection efforts, we recommended that USCIS develop a strategy to expand information collection. In developing a strategy, we recommended that USCIS consider including the increased use of interviews at the I-829 phase as well as requiring the additional reporting of information in applicant and petitioner forms. Doing so could better position the agency to identify and mitigate potential fraud and communicate and share that information with other partners. As of April 2017, USCIS staff reported taking multiple actions to address this recommendation and we will continue to monitor their efforts to assess the extent to which these actions meet the intent of our recommendation. Question 2. USCIS usually receives around 14,000 EB-5 petitions and applications a year, the average length of which is approximately 1,000 pages. According to GAO, USCIS reviews these petitions manually, as the EB-5 process relies on paper-based documentation. This is clearly inefficient and makes adjudicating applicants more difficult and burdensome. To what extent does USCIS's reliance on paper applications undermine its ability to thoroughly vet and root out fraud when adjudicating EB-5 petitions? Answer. In September 2016, we reported that fraud mitigation in the EB-5 Program was hindered by a reliance on voluminous paper files, which limits the agency's ability to collect and analyze program information.\2\ In our review of a non-generalizable selection of files associated with EB-5 program regional centers and immigrant investors, we found that identifying fraud indicators was extremely challenging. For example, many of these files were several thousand pages long and would take significant time to review. According to USCIS documentation, the program anticipates receiving approximately 14 million pages of supporting documentation from its regional center applicants and immigrant investor petitioners annually. Agency officials noted that the state of information within the program precluded certain fraud-detection and analysis efforts, such as the development of an automated risk-weighting system to prioritize petitions and applications at higher risk of fraud. --------------------------------------------------------------------------- \2\ Immigrant Investor Program: Progress Made to Detect and Prevent Fraud, but Additional Actions Could Further Agency Efforts, GAO-16-828 (Washington, DC: Sept. 13, 2016). --------------------------------------------------------------------------- Question 3a. GAO reported that USCIS delayed efforts to move EB-5 applications to the ELIS system. What potential fraud risks exist because EB-5 applications are processed on paper rather than in an electronic system? Answer. Fraud risks that USCIS identified in the program include uncertainties in verifying that the funds invested were obtained lawfully and the existence of various investment-related schemes to defraud investors. In August 2015, we reported that USCIS was unable to comprehensively identify and address fraud trends across the program because of its reliance on paper-based documentation and because it faces certain limitations with using available data and with collecting additional data on EB-5 immigrant investors or investments.\3\ In September 2016, we further reported that USCIS officials had noted that the state of information within the program precluded certain fraud- detection and analysis efforts, such as the development of an automated risk-weighting system to prioritize petitions and applications at higher risk of fraud.\4\ --------------------------------------------------------------------------- \3\ GAO-15-696. \4\ GAO-16-828. --------------------------------------------------------------------------- For example, we reported that information from the application form that could be useful in identifying program participants linked to potential fraud is not required to be entered into USCIS's database, such as the applicant's name, address, and date of birth. Consequently, program participants linked to potential fraud might not be identified. We also reported that USCIS's rules guiding data entry leave many form fields ``optional'' in USCIS data systems. According to USCIS officials, the adjudication is completed from the paper application forms, so the agency considers entering these data unnecessary. However, information about entities such as regional center principals and other participants is not consistently recorded. Consistently including information, such as names and dates of birth, in its databases could help the agency better identify specific individuals who may be targeted for or are under investigation. Without such information, USCIS might accept applications from individuals who might be targeted or under investigation. Further, more standardized information in USCIS databases, such as information about the geographic locations of regional centers, could help the agency better identify and assess any potential regional center fraud trends. Question 3b. Based off of GAO's work on the ELIS system, what is your sense of USCIS's efforts to make EB-5 applications fully electronic? What are the biggest challenges USCIS faces in completing this effort? Answer. USCIS has been delayed in its efforts to make EB-5 applications fully electronic. In August 2015, we reported that USCIS officials had said the agency would be able to collect and maintain more readily-available data on EB-5 Program petitioners and applicants through the deployment of electronic forms in USCIS ELIS.\5\ USCIS officials told us that they expected capabilities for the EB-5 Program to become functional in 2017. However, USCIS has faced long-standing challenges in implementing USCIS ELIS, a fact that raises questions about the time frames for its eventual deployment and, thus, the extent to which the system will position the agency to collect and maintain more readily available data. For example, in our March 2017 testimony, we noted that the Transformation Program did not complete deployment of planned system functionality associated with its Citizenship line of business.\6\ As part of its remediation efforts to address the delay, USCIS planned to revise its acquisition documentation when re- baselining the Transformation Program. As of March 2017, the effort to re-baseline the Transformation Program was still on-going. Until the program establishes a new, reliable baseline, the time frames and expectations for making EB-5 applications fully electronic are uncertain. --------------------------------------------------------------------------- \5\ GAO-15-696. \6\ GAO, Immigration Benefits System: Significant Risks in USCIS's Efforts to Develop its Adjudication and Case Management System, GAO-17- 486T (Washington, DC: Mar. 16, 2017). --------------------------------------------------------------------------- USCIS's challenges in governance and management of the Transformation Program have impacted its ability to make EB-5 applications fully electronic. In 2015, we reported that DHS's oversight of the Transformation Program was limited by a lack of reliable information being reported to existing governance and oversight entities.\7\ Further, in 2016, we reported on program management challenges with the Transformation Program's adherence to best practices in Agile software development, systems integration and testing, and contract management.\8\ Until such challenges are fully addressed, even after a re-baseline, the program may still encounter further delays in the future, thereby impacting its ability to make EB- 5 applications fully electronic. Addressing our previous recommendations to improve management and oversight of the program should help to mitigate this risk of future schedule delays.\9\ --------------------------------------------------------------------------- \7\ GAO, Immigration Benefits System: Better Informed Decision Making Needed on Transformation Program, GAO-15-415 (Washington, DC: May 18, 2015). \8\ GAO, Immigration Benefits System: U.S. Citizenship and Immigration Services Can Improve Program Management, GAO-16-467 (Washington, DC: Jul 7, 2016). \9\ See GAO-15-415 for recommendations related to oversight and GAO-16-467 for recommendations related to management of the Transformation Program. --------------------------------------------------------------------------- Question 4. GAO reported in 2015 and 2016 that USCIS's methodologies for calculating EB-5 outcomes and economic benefits were invalid and unreliable. In response, USCIS said it was developing a case management system to allow it to track and report EB-5 investor data by fiscal year 2017. To what extent will this case-management system sufficiently address USCIS's current inability to track and report EB-5 data? If implemented effectively, what benefits would such a system provide? Answer. It is still too early to tell to what extent USCIS's new case management system will allow the agency to track and report EB-5 data or what benefits it will provide. According to USCIS officials, this system is designed to support EB-5 adjudications and the program's data requirements. This system, if implemented as designed, could aid some of USCIS's ability to track and report EB-5 data. However, according to USCIS officials, a time line for completing the system has not been finalized due to changes in the scope of the project. Question 5. In August 2015, GAO explained how the current electronic databases used for EB-5 ``have limitations that reduce their usefulness for conducting fraud-mitigating activities. For example, information that could be useful in identifying program participants linked to potential fraud is not required to be entered in USCIS's database . . . Moreover, FDNS officials told us that some data fields are also not standardized, a fact that presents significant barriers to conducting basic fraud-related searches.'' What additional measures can USCIS implement in the interim to ensure the integrity of the EB-5 program? Answer. To improve EB-5 program fraud prevention, detection, and mitigation capabilities, USCIS should continue to take steps to fully implement the recommendations made in our prior reports.\10\ These include recommendations to: --------------------------------------------------------------------------- \10\ GAO-15-696, GAO-16-828. --------------------------------------------------------------------------- 1. Plan and conduct regular future risk assessments of the EB-5 program. 2. Develop a strategy to expand information collection, including considering the increased use of interviews at the I-829 phase, as well as requiring the additional reporting of information in applicant and petitioner forms. 3. Develop a fraud risk profile that aligns with leading practices identified in GAO's Fraud Risk Framework.\11\ USCIS has concurred with our recommendations and has told us that it is taking steps to address them. We will continue to monitor its efforts to do so. --------------------------------------------------------------------------- \11\ GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP (Washington, DC: July 2015). --------------------------------------------------------------------------- Question 6a. While USCIS is planning to transition EB-5 processing to ELIS, there are currently no plans to include supporting information associated with the EB-5 applications, such as bank statements or business plans. This is an interesting decision, given that according to FDNS, ``this supporting information can be an important source of potential fraud indicators.'' Without including this important supporting documentation in the migration to ELIS, how effective will the move to ELIS be in addressing fraud risks within the EB-5 program? Answer. Without this supporting documentation, USCIS may lack the information it needs to conduct analysis to identify potential fraud indicators in the program. In September 2016, we reported that USCIS planned to collect and maintain more readily available data on EB-5 program petitioners and applicants through the deployment of electronic forms in its new system, USCIS ELIS.\12\ However, agency officials told us that they did not anticipate capturing supporting information provided as evidence in the petitions and applications in USCIS ELIS in the near term. According to a Fraud Detection and National Security Directorate official, this supporting information can be an important indicator of potential fraud as it contains details such as business plans associated with the investment. To strengthen fraud risk management, we recommended that USCIS develop a fraud risk profile that aligns with leading practices identified in GAO's Fraud Risk Framework.\13\ --------------------------------------------------------------------------- \12\ GAO-16-828. \13\ GAO-15-593SP. --------------------------------------------------------------------------- Question 6b. Given that USCIS has no immediate plans to move the supporting documentation to the ELIS system, what steps can USCIS take to ensure the manual review of these documents are adequately identifying fraud? Answer. To help ensure that the manual review of supporting documents adequately identifies fraud, USCIS should continue to take steps to address our prior recommendations.\14\ If effectively implemented, these recommendations should improve USCIS's ability to identify and prioritize fraud risks while also detecting fraud in the program. As previously noted, these include recommendations to: --------------------------------------------------------------------------- \14\ GAO-15-696, GAO-16-828. --------------------------------------------------------------------------- 1. Plan and conduct regular future risk assessments of the EB-5 program. 2. Develop a strategy to expand information collection, including considering the increased use of interviews at the I-829 phase, as well as requiring the additional reporting of information in applicant and petitioner forms. 3. Develop a fraud risk profile that aligns with leading practices identified in GAO's Fraud Risk Framework. USCIS has concurred with our recommendations and has told us that it is taking steps to address them. We will continue to monitor its efforts to do so. Question 7. To what extent does USCIS being fee-funded affect its openness to oversight? How has USCIS used its unobligated carryover balance to fund failing IT programs? What has been the cost to applicants based on USCIS's mismanagement? Answer. We have not previously evaluated how fee-funding affects USCIS's openness to oversight or how USCIS has used its unobligated carryover balance to fund failing IT programs. Likewise, we have not reported on the cost to applicants based on USCIS's mismanagement. However, we previously reported in 2015 that delays in deploying the Transformation Program have contributed to missed cost savings and a deferral of operational efficiencies and other benefits.\15\ Deferring operational efficiencies directly impacts applicants. For example, the Transformation Program is expected to implement organizational and business process changes to better use IT. According to USCIS, this increased use of IT should help achieve goals such as reducing the immigration benefit backlog through business process change; improving customer services through expanded electronic filing; and enhancing National security by authenticating users and integrating with external agency databases. Due to delays in the program, these improvements have yet to be achieved. Moreover, in December 2016, we reported on entities such as USCIS, where Congress has granted authority to collect and obligate funds, including fees, outside of the annual appropriations process and we examined how those entities facilitate oversight.\16\ --------------------------------------------------------------------------- \15\ GAO-15-415. \16\ Permanent Funding Authorities: Some Selected Entities Should Review Financial Management, Oversight, and Transparency Policies, GAO- 17-59 (Washington, DC: Dec. 9, 2016). --------------------------------------------------------------------------- Questions From Ranking Member Bennie G. Thompson for Carol C. Harris Question 1. Ms. Harris, in the past USCIS has used carryover funding to support the Transformation Program. In fact, USCIS has estimated that the unobligated carryover balance for the premium- processing fee could grow to $1.1 billion by fiscal year 2020, and the fee collections are expected to cover the Transformation initiative. Given the suspension of premium H-1B processing, what impact will this have on the Transformation Program? Is it possible the Program will experience additional delays? Answer. We have not assessed the H-1B contribution to total premium processing revenue. As a result, we do not know the impact that the suspension of premium H-1B processing will have on the Transformation Program, including additional delays. In July 2016, we reported that USCIS had collected approximately $467 million in premium processing revenue.\17\ USCIS estimated that the unobligated carryover balance for the premium processing fee could continue to grow to $1.1 billion by fiscal year 2020, as fee collections are expected to exceed Transformation Program funding requirements. USCIS reported in fiscal year 2015 that it had begun to reduce the growing balance by expanding the use of the premium fee collections to fund one-time infrastructure improvements that support adjudication services other than for the Transformation Program, such as its Financial Systems Modernization project. According to its spending plan from that same year, USCIS estimated that expanding the use of premium processing fee collections would result in an unobligated carryover balance for premium processing of about $341 million by the end of fiscal year 2020. --------------------------------------------------------------------------- \17\ GAO, DHS Management: Enhanced Oversight Could Better Ensure Programs Receiving Fees and Other Collections Use Funds Efficiently, GAO-16-443 (Washington, DC: July 21, 2016). --------------------------------------------------------------------------- Question 2. The USCIS Transformation Program is currently rated as a ``Medium Risk'' program on the Federal IT Dashboard. Do you believe this is the appropriate risk level given the concerns discussed today and the on-going effort to re-baseline the program? Answer. Given the current concerns, we do not view a rating of ``medium-risk'' as being appropriate for the USCIS Transformation Program. Rather, the program should be rated as ``high-risk'' on the Federal IT Dashboard. In June 2016, we assessed 95 investments across the Federal Government, including the Transformation Program, and reported that many of them had underreported their risk level.\18\ More specifically, we reported that our assessments matched the Federal IT Dashboard ratings 22 times, showed more risk 60 times, and showed less risk 13 times. We noted that the Department of Homeland Security (DHS) had reported the program as ``medium-risk,'' but that our evaluation of the program showed that it should be classified as ``high-risk.'' In response, we recommended that DHS ensure that their ratings reflect the level of risk facing an investment relative to that investment's ability to accomplish its goals. As of April 2017, this recommendation is still open and the Transformation Program is still identified as a medium-risk program on the Federal IT Dashboard. --------------------------------------------------------------------------- \18\ GAO, IT Dashboard: Agencies Need to Fully Consider Risks When Rating Their Major Investments, GAO-16-494 (Washington, DC: June 2, 2016). --------------------------------------------------------------------------- Question 3. Ms. Harris, in January 2017, President Trump instituted an immediate hiring freeze that affected a large portion of the Executive branch. The hiring freeze left room for a National security exemption but Secretary Kelly has stated that the exemption will not apply to DHS as a whole. What impact does a hiring freeze have on the progress of IT program modernization efforts, such as Transformation? In its 2017 High-Risk Update, GAO asserts that DHS needs to make additional progress in allocating resources in certain areas, such as staffing for acquisition and information technology positions. Would you agree that a hiring freeze could undoubtedly hinder this needed progress? Answer. We have not examined the effects of the 2017 Federal Hiring Freeze Executive Order on IT program modernization efforts or DHS's ability to assess and address whether appropriate numbers of trained acquisition personnel are in place at the Department and component levels. Likewise, we have not determined whether a hiring freeze will hinder the progress of DHS to allocate resources in certain areas. However, we have previously reported on the effects of Government- wide hiring freezes, and found they are not an effective means of controlling Federal employment. In March 1982, we pointed out that, because Government-wide hiring freezes did not account for individual agencies' missions, workload, and staffing requirements, they disrupted agency operations and, in some cases, increased costs to the Government.\19\ Specifically, we found that because such hiring freezes disregarded agency workload requirements and did not cover all personnel resources used by the Government, they created an incentive for managers to use alternative sources of labor. --------------------------------------------------------------------------- \19\ GAO, Recent Government-Wide Hiring Freezes Prove Ineffective in Managing Federal Employment, FPCD-82-21 (Washington DC:, March 10, 1982). --------------------------------------------------------------------------- Any potential savings produced by these freezes would be partially or completely offset by increasing overtime, contracting with private firms, or using other than full-time permanent employees. We concluded that improved workforce planning and use of the budget as a control on employment, rather than arbitrary across-the-board hiring freezes, is a more effective way to ensure that the level of personnel resources is consistent with program requirements. Question 4a. Ms. Harris, last month GAO released its High-Risk Update. In testimony before this subcommittee, your colleague at GAO indicated that DHS has fully addressed 3 key outcomes and mostly addressed another 3 outcomes in information technology management. While this is great improvement, programs such as the Transformation Program are still failing to meet important implementation targets. Please rationalize DHS's improvement in IT Management with the shortcomings of the Transformation Program. Answer. DHS has taken steps to establish basic IT management fundamentals, consistent with this high-risk area; nevertheless, it is still experiencing shortcomings with specific programs, as is the case with the Transformation Program. Over the past decade, as part of the DHS high-risk area, we have been tracking the Department's progress in improving its IT management functions. A key reason we included IT management as part of this high-risk area was because the Department lacked the basic fundamentals for IT management. The Department, among other things, had a weak enterprise architecture program (blueprint) and lacked critical practices for effective IT investment management. As we reported in February 2017, and as noted in your question, DHS had fully addressed three of the six IT management outcomes and had mostly addressed the remaining three. For example, in 2013, we reported that DHS had strengthened its enterprise architecture program to guide IT acquisitions and, thus, had fully addressed the related outcome area.\20\ Specifically, an independent assessment of the Department's enterprise architecture program showed that DHS had achieved stage four of our Enterprise Architecture Framework \21\ (that is, completing and using an enterprise architecture for targeted results). In 2015, we reported that DHS had completed and implemented a tiered governance and portfolio management structure for overseeing and managing its IT investments, and annually reviewed each of its portfolios and the associated investments to determine the most efficient allocation of resources within each of the portfolios.\22\ As such, we determined that the related outcome had been fully addressed. --------------------------------------------------------------------------- \20\ GAO, High-Risk Series: An Update, GAO-13-283 (Washington, DC: Feb. 14, 2013). \21\ GAO, Organizational Transformation: A Framework for Assessing and Improving Enterprise Architecture Management (Version 2.0) (Supersedes GAO-03-584G), GAO-10-846G (Washington, DC: Aug. 5, 2010). \22\ GAO, High-Risk Series: An Update, GAO-15-290 (Washington, DC: Feb 11, 2015). --------------------------------------------------------------------------- In addition, more recently, we reported that the DHS Chief Information Officer (CIO) had taken steps to improve the oversight and management of troubled investments.\23\ For example, the Office of the CIO conducts a Techstat review on troubled programs.\24\ The Office of the CIO has also created centers of excellence to help troubled programs, such as its IT Program/Project Manager Center of Excellence, which is a cross-functional team created to provide guidance and assistance in the management of IT programs and projects. As a result, we have found multiple previously-troubled investments improving their performance, such as U.S. Customs and Border Protection's Automated Commercial Environment and the Office of the CIO's Homeland Security Information Network. --------------------------------------------------------------------------- \23\ GAO, High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts Needed on Others, GAO-17-317 (Washington, DC: Feb. 15, 2017). \24\ A Techstat review is a face-to-face, evidence-based review of IT programs with DHS headquarters, component leadership, and the Office of Management and Budget, as appropriate. --------------------------------------------------------------------------- While DHS has taken these steps to establish basic IT management fundamentals, consistent with this high-risk area, there is still room for improvement. DHS is still experiencing problems with specific programs, as is the case with the USCIS Transformation and Human Resources IT Programs, but likely less frequently than it has in the past. We are continuing to work with the Department to ensure that our related recommendations to these troubled programs are implemented, and will continue to monitor DHS's progress in fully implementing the remaining high-risk IT outcomes. Question 4b. Based on your research, do you believe visibility on the program and its failures should be elevated higher, either to the USM or Secretary? Answer. The DHS under secretary for management currently has visibility into the Transformation Program, but we have not assessed whether elevating visibility to the Secretary would benefit the program. DHS's oversight of the Transformation Program is currently limited by a lack of reliable information being reported to existing governance and oversight entities. According to DHS's acquisition management process, the deputy secretary and under secretary for management serve as the acquisition decision authorities for the Department's largest acquisition programs, including for the Transformation Program. The Under Secretary for Management also serves as DHS's Chief Acquisition Officer and, in this role, is responsible for managing and overseeing the Department's acquisition policies and procedures. The Department's acquisition policy requires that the DHS Acquisition Review Board support the Under Secretary for Management by reviewing major acquisition programs for proper management, oversight, accountability, and alignment with the Department's strategic functions at key decision points and other meetings, as needed. In addition, in May 2012, the Under Secretary for Management chartered the Executive Steering Committee for the Transformation Program to help improve program governance. In contrast to the Acquisition Review Board, this committee assumed authority to oversee all aspects of the execution of the Transformation Program between key decision points. However, we reported in 2015 that governance bodies overseeing the Transformation Program and supporting the Under Secretary for Management were basing decisions on unreliable information. For example, in February 2014, the Acquisition Decision Authority approved a bridge contract for the solutions architect to, among other things, assist in developing a new architecture. However, operational requirements along with an integrated master schedule and cost estimates had not been approved to support this decision. To improve Transformation Program governance and oversight, we made four recommendations for the Secretary of DHS to direct to components within DHS. As of April 2017, based on the program's April 2015 re-baseline, the program had fully implemented our recommendation to re-baseline cost, schedule, and performance expectations for the remainder of the Transformation Program. Since closure of that recommendation, the program has exceeded its new schedule baseline and is again updating acquisition documentation. As of April 2017, DHS has not fully implemented the remaining three recommendations. Implementing these three outstanding recommendations should improve Transformation Program governance and oversight. Question 4c. What must DHS as a whole, and USCIS in particular, do to get this program on track? Answer. To help get the Transformation program on the right track, DHS should focus on addressing recommendations from our April 2015 report.\25\ As previously discussed in earlier responses, we found that DHS's oversight of the Transformation Program was limited by a lack of reliable information being reported to existing governance and oversight entities. DHS has taken some steps to address our recommendations, such as approving a program re-baseline in April 2015. However, the Department still needs to take additional steps such as ensuring that two key governance bodies are effectively monitoring program performance and progress. --------------------------------------------------------------------------- \25\ [Sic.] --------------------------------------------------------------------------- In addition to the efforts of the Department, USCIS should address all the recommendations from our July 2016 report.\26\ We reported that the program faced challenges with adherence to best practices in Agile software development, systems integration and testing, and contract management. USCIS has taken some steps towards implementing our recommendations, such as conducting internal audits to improve management of Transformation Program contracts. However, USCIS, with assistance from the Department, still needs to ensure that the Transformation Program executes Agile software development for USCIS ELIS consistent with its own policies and guidance and follows applicable leading practices. The program should also conduct unit and integration tests, functional acceptance tests, and code inspection consistent with stated program goals. --------------------------------------------------------------------------- \26\ [Sic.] --------------------------------------------------------------------------- Fully implementing our recommendations will help to ensure that these investments receive necessary oversight and attention, and will help address the ineffective management that the Transformation Program has experienced to date. Question 5a. Ms. Harris, USCIS has made efforts to correct ELIS's technical deficiencies while concurrently developing system functionality for the program. This simultaneous activity has caused down times, instability, and interruption in processing. Based on your expertise in information technology programs, what are the effects of continuing to use a flawed system while trying to correct errors and failures at the same time? Answer. We have not specifically reported on the effect of continuing to use a flawed system while trying to correct errors and failures at the same time. However, there is risk associated with correcting errors while a system is in operation. This risk can be reduced if appropriate program management controls and oversight are in place. Nevertheless, as discussed in our responses, we have previously identified a number of concerns with both program management controls and Transformation Program oversight. We have made multiple recommendations to resolve these issues, some specifically targeting controls over systems integration and testing. If these recommendations are effectively implemented, USCIS will be better-positioned to rapidly address on-going and future technical defects found in deployed software, as well as to decrease the number of defects contained in future software releases. Question 5b. Given these effects, should USCIS continue using ELIS in its current state? Answer. Our work has not evaluated whether USCIS should continue using ELIS in its current state. However, senior governance bodies need accurate and reliable information in order to manage USCIS ELIS consistent with DHS's acquisition management process. DHS's Deputy Secretary and Under Secretary for Management serve as the acquisition decision authorities for the Department's largest acquisition programs and are empowered to make critical decisions, such as whether to continue or suspend program operations. To assist in overseeing programs, these decision authorities rely on supporting governance bodies such as the Acquisition Review Board and Executive Steering Committee. However, in 2015, we reported that governance bodies were making key programmatic decisions based on unreliable information. We reported that, until these governance bodies based their reviews of performance on timely, complete, and accurate data, they would be limited in their ability to make timely decisions and to provide effective oversight. This includes decisions such as whether to continue using USCIS ELIS in its current state. We made four recommendations to help improve Transformation Program governance and oversight. As of April 2017, based on the program's April 2015 re-baseline, the program had fully implemented our recommendation to re-baseline cost, schedule, and performance expectations for the remainder of the Transformation Program. However, since we closed that recommendation based on the program's April 2015 re-baseline, it has exceeded its new schedule baseline and is again updating its acquisition documentation. As of April 2017, DHS has not fully implemented the remaining three recommendations, which are primarily focused on ensuring that decision makers have reliable information to inform their key programmatic decisions. Implementing these three outstanding recommendations will help improve Transformation Program governance and oversight and help inform key decisions, such as decisions about whether to continue using USCIS ELIS in its current state. Question 5c. What functions of ELIS should be corrected before USCIS attempts to use the program again? Answer. Our work has not examined the specific functions of USCIS ELIS that require correction and, therefore, we cannot determine which of its functions should be corrected before USCIS attempts to use the program again. However, as discussed in my response to the prior question, it is critical for governance bodies to have accurate and complete information in order to effectively oversee the program. Having accurate and complete information would help ensure that decision makers are appropriately informed when making critical decisions, such as decisions regarding which functions of ELIS should be corrected before USCIS attempts to use the program again. Question 6a. Ms. Harris, the GAO High-Risk Update released last month asserts, ``DHS needs to take additional actions to improve its performance monitoring data and strengthen management of the Transformation Program.'' Otherwise, additional delays, functionality problems, and production issues are highly likely. Please describe how the Transformation Program has fallen short on executing program management best practices. Answer. In 2016, we reported on issues in the management of Transformation Program Agile software development, systems integration and testing, and contract management.\27\ We found that the program's software development approach deviated from key practices in part because USCIS policy and guidance were not being updated; the program was deploying software that had not been fully tested; and the program had mixed success in monitoring its contractors for the six contracts that we reviewed. --------------------------------------------------------------------------- \27\ GAO-16-467. --------------------------------------------------------------------------- Question 6b. What areas should the Department focus on to get the program on track in the most cost-effective and efficient manner, particularly as it relates to management? Answer. To help get the program on track in the most cost-effective and efficient manner, particularly as it relates to management, we recommend that USCIS promptly address our remaining outstanding recommendations associated with Agile software development and systems integration and testing. We made 12 recommendations to address the concerns we identified. As of April 2017, the program has fully addressed 3 of those 12 recommendations. If DHS and USCIS continue to move ahead without more fully addressing the issues we've identified, it continues to be at risk of spending significant time and money without being able to effectively realize the benefits that the system is intended to achieve. Question 7. Ms. Harris, agile software development calls for delivering software in small, short increments rather than in the typically long, sequential phases used in a traditional waterfall approach. Please explain the advantages and/or disadvantages to using the agile v. waterfall approach. Was it beneficial for the Department to change course after having already invested several million dollars in the Transformation Program? Answer. We have previously reported on some of the advantages in using an Agile, rather than waterfall approach to software development.\28\ In particular, we have reported that Agile software development is consistent with industry best practices and existing incremental development requirements. Our work has shown that, if performed effectively, this approach can provide more flexibility in responding to changing agency priorities, and allow for easier incorporation of emerging technologies and termination of poorly performing investments with fewer sunk costs. --------------------------------------------------------------------------- \28\ GAO, Information Technology: Agencies Need to Establish and Implement Incremental Development Policies, GAO-14-361 (Washington, DC: May 1, 2014). --------------------------------------------------------------------------- In 2012, we reported on differences between waterfall and Agile methods and the successes and challenges particular to Agile.\29\ The Agile approach differs in several ways from traditional waterfall software development, which produces a full software product at the end of a sequence of phases. For example, the two approaches differ in: (1) The timing and scope of software development and delivery, (2) the timing and scope of project planning, (3) project status evaluation, and (4) collaboration. However, we did not discuss the advantages and disadvantages of the two approaches. --------------------------------------------------------------------------- \29\ GAO, Software Development: Effective Practices and Federal Challenges in Applying Agile Methods, GAO-12-681 (Washington, DC: July 27, 2012). --------------------------------------------------------------------------- We have not evaluated if it was beneficial for the Department to change course after having already invested several million dollars in the Transformation Program. However, in 2015, we reported that changes to the Transformation Program acquisition strategy, including a transition to Agile, had contributed to schedule delays.\30\ For example, the development and test environments stood up to support Agile development took longer than expected due to the complexity of the environments. Moreover, a bid protest of the flexible Agile development services contract required the program to adjust the schedule and extend the solution architecture contract, as well as the contract for another team to continue work until the protest was resolved. The schedule delays hampered the ability to realize cost savings and deferred operational efficiencies. For example, in fiscal year 2014, the total cost of maintaining systems that could have been decommissioned if ELIS had been fully operational was approximately $71 million. Such costs continue to be incurred with delays in the program. Nevertheless, the program had also experienced issues when initially pursuing a more traditional approach to software development. For example, as part of the root-cause analysis to inform a Techstat review, the USCIS CIO noted that delays and cost overruns were partly the result of the solution architect delivering deficient software code and performing at an unacceptably low rate of productivity. --------------------------------------------------------------------------- \30\ GAO-15-415. --------------------------------------------------------------------------- In addition, in 2016, we reported that the Transformation Program had not established outcomes for Agile software development.\31\ In our prior work on effective Agile software development practices, we found that a key practice for the successful adoption of Agile software development is to identify measurable outcomes, not outputs, of what the program wants to achieve using the approach.\32\ An example of this practice is creating a vision for project outcomes (such as a decrease in processing time by a specific percent in a set time), rather than outputs (such as the amount of code produced). However, the Transformation Program had not defined or set goals for the transition to Agile software development. Without a sense for the goals and expected outcomes for Agile software development, the program would not be able to monitor progress. We recommended that the Department establish outcomes for Agile software development. However, as of April 2017, USCIS has not yet demonstrated that it has established such outcomes. --------------------------------------------------------------------------- \31\ GAO-16-467. \32\ GAO-12-681. --------------------------------------------------------------------------- Question 8. Ms. Harris, as you know, technical debt is a concept in programing where code that is easy to implement in the short run is used instead of applying a best overall solution in the long run. Overall, a company or agency should spend 10-20% of time fixing errors associated with programs and lowing technical debt costs. However, it appears that USCIS continues to use the ELIS system without addressing long-term issues with the program. Based on your review of the Transformation Program, has USCIS accumulated technical debt? If so, is USCIS addressing the technical debt? Answer. We have not previously assessed technical debt either generally or as part of our review of the Transformation Program. However, in 2016 we reported on concerns with the overall performance of USCIS ELIS.\33\ Specifically, we found that issues in systems integration and testing increased program risk of poor system performance after release to the public. We noted that the risk was of particular concern due to system performance issues that were already realized. To address deficiencies in systems integration and testing, we recommended that USCIS review and update existing policies and guidance and consider additional controls for unit, integration, and functional acceptance testing, and code inspection consistent with stated program goals. We also recommended developing complete test plans and cases for interoperability and end-user testing, as defined in the program's test and evaluation master plan, and document the results. --------------------------------------------------------------------------- \33\ GAO-16-467. --------------------------------------------------------------------------- In following up on the agency's actions to address our open recommendations, we have obtained information from USCIS that describes some steps it is taking to manage technical debt. In an updated breach remediation plan for the Transformation Program, USCIS cited technical team capacity for remediating technical debt as one of the root causes for its recent schedule breach. To address the matter, USCIS reported in its breach remediation plan that it planned to halt all new work and focus on improving the product lines that were already built. According to the plan, the agency anticipated this action would allow the program to focus temporarily on remediating technical debt. USCIS also intended to begin initiatives to increase ELIS availability and performance, as well as the quality and consistency of its testing processes. The agency anticipated that this additional action would also address technical debt. Question 9. The DHS Inspector General has written about many troublesome operational issues associated with the Electronic Immigration System (ELIS). For example, in his January 2017 Management Alert, he identified a range of ELIS technical and functional issues that have slowed processing and productivity. These included missing core ELIS functionality, naturalization cases stuck in ELIS workflows, and ELIS's failure to connect with supporting systems. What have you found in your work at GAO that might help us understand why the program is experiencing these kinds of issues? Answer. The technical and operational issues reported by the DHS Inspector General are consistent with the kinds of issues that we would expect to see given our findings related to ELIS software development and integration and testing. For example, with respect to software development, in July 2016 we reported that metrics intended to demonstrate if the scope of each software release was consistent with plans were not fully traceable back to intended functionality, which increased the risk of gaps between intended functionality and functionality actually developed for ELIS. In addition, with respect to testing and integration, in July 2016, we reported on issues such as lack of adequate code coverage, lack of evidence that system integration testing was occurring regularly, and that the program had not developed plans or test cases showing that live interface testing had occurred consistent with its Test and Evaluation Master Plan.\34\ The program provided some results for live interface testing, so some testing was occurring, but it was not occurring consistent with the program's test plans and we were not able to make a determination on the extent to which this less formal testing occurred. --------------------------------------------------------------------------- \34\ U.S. Citizenship and Immigration Services, USCIS Test and Evaluation Master Plan: Electronic Immigration System, version 1.0. --------------------------------------------------------------------------- We also reported in July 2016 that, until the program fully addressed the key practices for systems integration and testing by ensuring the consistent implementation of policy, procedures, and guidance that aligns with leading practices, it risks poor system performance after it has been released to the public. This risk was of particular concern due to system performance issues that had already been realized. Specifically, the program reported experiencing issues with USCIS ELIS as a result of deploying software that had not been fully tested. For example, on September 24, 2015, USCIS ELIS encountered issues that impacted nearly 5,000 cases. Approximately 2,600 of these cases had to be abandoned. In February 2016, the program reported missing the threshold for USCIS ELIS reliability (e.g. mean time between failure), for 2 straight months and 4 of the last 6 months. In March 2016, program metrics indicated that production tickets had increased faster than they could be addressed. Questions From Chairman Scott Perry for John Roth Question 1. What are some of the biggest concerns and risks with USCIS being unable to readily share immigration information with Federal partners? Answer. Providing electronic capabilities for immigration benefits processing is critical to enable timely and accurate sharing of immigration data with DHS partners once immigration benefits, such as citizenship, have been granted. Within DHS, several components such as Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CPB) use USCIS's applicant information to grant admission into the United States, or track visa overstays. However, until USCIS can achieve electronic processing for all immigration benefit types, these components must conduct additional research involving cross- checks with other USCIS systems to confirm immigration status. These delays may result in individuals being wrongfully refused entry into the United States, or incorrectly classified as visa overstays. Question 2. To what extent does USCIS being fee-funded affect its openness to oversight? How has USCIS used its unobligated carryover balance to fund failing IT programs? What has been the cost to applicants based on USCIS's mismanagement? Answer. To the extent that USCIS is fee-funded, USCIS's programs may be less scrutinized compared to Federally-funded programs or investments, as oversight entities may have less insight into, and taxpayers may have less immediate concern regarding, how program dollars are spent. Nevertheless, USCIS's mismanagement has had a negative impact on members of the public. For instance, approved applicants have been delayed in receiving benefits to which they are entitled, and may even pay multiple fees for a single benefit (due to slow processing and/or benefit documents being mailed to incorrect addresses). I cannot comment on USCIS's use of its unobligated carryover balance to fund failing IT programs as our office has not done work on that particular issue. Questions From Ranking Member Bennie G. Thompson for John Roth Question 1. Mr. Roth, since 2005, the DHS Inspector General Office has issued five audit reports on multiple USCIS IT modernization attempts that were hampered by repeated delays and scope reductions. During your time as Inspector General, what patterns have you observed that may help explain why the program is still experiencing issues? What improvements, particularly as it relates to management, do you feel would assist in the program's performance? Answer. We have reported over the past 11 years that USCIS has struggled to transform its paper-based processes into an integrated and automated immigration benefits processing environment. Long-standing program management deficiencies have been central to USCIS's continued lack of progress. Historically, its automation attempts have been hampered by ineffective planning, multiple changes in direction, and inconsistent stakeholder involvement. Current program efforts are no different, as the agency continues to encounter automation challenges, additional delays, and the need to repeatedly reduce the scope of Transformation. Because the program has been primarily schedule-driven, deployments of each product line have not been properly managed to ensure adequate testing is completed prior to each release. Poor program management practices have also included a lack of stakeholder communication and involvement, as necessary field personnel or end- users are not included in decisions that have significant impact on field operations. Likewise, failure to provide sufficient technical support has been a long-standing pattern, as each product line has been implemented without a plan for providing proactive technical support to end-users. We recommend that USCIS improve stakeholder involvement, implement adequate performance metrics, fully test each system release, and provide technical support to help ensure the effectiveness of its efforts to automate immigration benefits processing. These four recommendations, issued in our March 9, 2016 report (OIG-16-48),\1\ remain open at this time. --------------------------------------------------------------------------- \1\ USCIS Automation of Immigration Benefits Processing Remains Ineffective, OIG-16-68 (March 2016). --------------------------------------------------------------------------- Question 2a. Mr. Roth, according to your March 2016 report ELIS has also had a negative impact on customer service at multiple U.S. ports of entry, where customers were detained for up to a day while waiting for verification of their permanent residence status. This problem increased as more customers filed electronic ``Applications to Replace Permanent Resident Cards'' in ELIS because CBP Officers at U.S. ports of entry lacked direct access to ELIS to validate ELIS receipt numbers. To the best of your knowledge, has USCIS addressed the delayed waits at ports of entry due to ELIS errors? In addition, has CBP been granted proper access and training for the ELIS system? Question 2b. What policies should USCIS consider implementing to ensure this sort of error does not continue in the future? Answer. USCIS's applicant information is needed to complete inspections and to determine traveler admissibility prior to allowing entry into the United States. If CBP Officers at U.S. ports of entry are unable to verify information, such as receipt numbers in ELIS, there is a high likelihood that passengers will be refused entry into the country. At this time, any passenger with an ELIS receipt number will experience increased entry delays due to the additional research needed to cross-check other systems, or call DHS personnel with ELIS access to get information. Every delay also increases the wait time for each passenger in Passport Control Secondary screening. To the best of my knowledge, CBP has not been granted any access to ELIS or received any training on the ELIS system. We recommend USCIS review and update applicable policies and operating procedures to ensure CBP Officers at U.S. ports of entry have read-only access to ELIS. This will help ensure that customers are not delayed or detained unnecessarily. Question 3a. Mr. Roth, in your January 2017 management alert, you recommend that USCIS halt plans to revert back to the ELIS processing system and instead continue using the legacy ``Computer Linked Application Information Management System.'' Do you have any concerns with USCIS continuing to use the legacy system to process immigration applications instead of the ELIS system, particularly as it relates to applicant vetting? Is the legacy system capable of fulfilling USCIS's application and processing needs? Question 3b. If USCIS completes the recommended improvements in your management alert, do you have any concerns with ELIS as it relates to applicant vetting? Answer. My office has not received any indication that immigrant vetting through the legacy system has failed to provide accurate security checks. We have received anecdotal evidence that, with upgrades, the legacy system could fulfill USCIS's existing application workload and processing needs. However, it is unknown whether legacy systems can fully support or adapt to changes in legislation related to immigrant eligibility that may increase workloads. It is also unknown how legacy systems could be updated to provide more sophisticated account-based and electronic filing functionality, which are needed to improve operational efficiency and immigration benefits delivery. At this point we have not received evidence that ELIS can consistently or accurately vet applicants. Numerous failures have occurred at critical stages in the background check process, both prior to adjudication and after adjudication. The failures include problems with ELIS connectivity and coding. For instance, during the preprocessing stage, the ELIS system sent background check requests to CBP's TECS system. However, the system connection was failing and erroneously sending false positive results back to USCIS when the checks were not actually run. Also, FBI name checks failed to run correctly for all applicants due to a coding error that caused certain letters of an individual's name to be dropped. Similar problems occurred following application adjudication, when final background checks failed due to technical errors just prior to Naturalization ceremonies. The USCIS Chief Information Officer is currently working to address the root causes for each of these failures. We have been assured that these fixes will result in a reliable and fully functioning automated applicant vetting process. Once these fixes are implemented, we will closely monitor the progress and effectiveness of the improvements. Question 4a. Mr. Roth, has USCIS responded to your management alert advising against using the ELIS system until certain minimal requirements are met? If so, have the minimal requirements outlined in your report been completed, according to USCIS? You have outlined a range of concerns with the ELIS system, including green card issuance errors, inadequate system training, and inconsistent agency response efforts. What do you believe is the primary reason behind the shortcomings of the Transformation Program? Question 4b. What impact, if any, did changes in strategy in 2012 have on the implementation of the Transformation Program? Question 4c. Do you believe the Transformation Program should institute any additional changes, either in strategy, acquisition planning, and/or other areas? Answer. Yes, we received a response from USCIS on January 27, 2017, concurring with our recommendations. USCIS is currently working to address all of the issues listed in our Management Alert. To date, we have not received evidence that the minimal improvements have been made to satisfy the intent of our recommendations. Even if USCIS addresses the specific recommendations made in the Management Alert, those recommendations relate solely to processing naturalization applications (Form N-400) in ELIS. As your question notes, and as our prior work demonstrates, there are a host of issues plaguing the ELIS system across the full range of benefit types. We have reported over the past 11 years that USCIS has struggled to transform its paper-based processes into an integrated and automated immigration benefits processing environment. Historically, these automation attempts have been hampered by ineffective planning, multiple changes in direction, and inconsistent stakeholder involvement. Current program efforts are no different, as USCIS continues to encounter automation challenges, additional delays, and the need to repeatedly reduce the scope of Transformation. The lack of Transformation Program and the system performance problems can be attributed to the same deficiencies we previously reported regarding poor program management. Specifically, USCIS has not ensured sufficient stakeholder involvement in system implementation activities and decisions for meeting operational needs; system testing has not been adequate to ensure end-to-end functionality prior to each ELIS release; and USCIS has not provided adequate post-implementation technical support for system end-users. Additionally, we found that the changes in 2012 had no effect on USCIS's ability to successfully transition to electronic processing via ELIS. One prevalent issue prior to 2012--the complexity of the ELIS architecture--continues to be the most critical impediment to progress. Specifically, complex interfaces and interdependencies in the architecture resulted in repeated system outages and slow processing speed. The changes relating to the system acquisition strategy and development methodology have also had no impact on the long-standing program management challenges we have reported over the last 11 years, including a systemic lack of stakeholder involvement, a lack of technical support, inadequate testing, and inability to measure the operational impact of electronic processing as it is implemented. Until USCIS addresses its long-standing program management deficiencies, progress will be hampered. Addressing our previous recommendations to improve stakeholder involvement, implement performance metrics, fully test each system release, and provide technical support to help end-users is critical for USCIS to progress in its efforts to automate immigration benefits processing. Question 5. Mr. Roth, you have suggested a range of areas that ELIS must improve upon, including better contingency planning to ensure continuity of operations during outages, improved case management to ensure that the ELIS system contains all necessary and up-to-date records, and enhanced efforts to address issues caused by ELIS. These improvements will undoubtedly take additional time and training of the workforce. What are the possible implications that a hiring freeze may have on the improvement of ELIS? DHS officials met with subcommittee staff last week and acknowledged that certain hires needed for the Transformation Program would not fall under the National security exemption of the hiring freeze. Please explain to the committee how inadequate staffing impacts IT modernization efforts, such as the Transformation Program, particularly as it relates to cost, schedule, and performance. Answer. We have never identified inadequate staffing as a root cause for Transformation challenges or delays. Due to the nature of its fee-funded structure, the program previously reported it had the ability to expand as needed through additional FTEs, USCIS employee details, or contract staff. Question 6. Recruiting new Federal employees and ensuring that existing personnel receive the right training and have the right tools to make use of new technologies needs to be at the forefront of the IT workforce efforts. How will progress with the Transformation Program, particularly as it relates to the workforce, be impacted by administration priorities and initiatives, such as the hiring freeze and elimination of H-1B visa premium processing? Given the additional checks that must be completed manually due to system errors, additional training needed for the complex system, and additional testing of the system, does USCIS have the available resources to get the Transformation Program on track? Answer. Again, we have never identified inadequate staffing as a root cause for Transformation challenges or delays. However, ELIS implementations over the past year have resulted in significant burdens on agency field and service center personnel. The time and effort associated with performing additional manual checks due to failed or inaccurate background checks and other system errors were not required prior to ELIS deployment. The agency also has faced increasing burdens from green cards issued in error or mis-delivered since the implementation of ELIS. Because of such ELIS-related inefficiencies, additional demands are now levied on USCIS personnel outside their normal duties, which are counter to the transformation objective of achieving a more efficient and effective electronic processing environment. These inefficiencies have also resulted in additional unanticipated costs to the agency and delays in immigration benefits delivery. Additional staff resources may help to alleviate these burdens, but only in the short term, and they do not address root causes of the problems. Question 7. Mr. Roth, in your March 2016 report on the Transformation Program, USCIS only concurred with two of the four recommendations, not agreeing to ensure adequate communications and stakeholder involvement throughout system developing and not agreeing to develop and implement a plan to provide adequate support for addressing system issues. What do you believe the impacts will be to the Transformation Program given USCIS decision to not follow these recommendations? Answer. Despite initially non-concurring, the acting director of USCIS issued a revised response on October 18, 2016 concurring with those two recommendations. However, USCIS has not yet provided evidence to demonstrate improvements in stakeholder communications and involvement, or in providing adequate support to address system issues. At this time, all four report recommendations remain open, but resolved pending corrective actions. Until USCIS addresses these long-standing issues, it will be unable to ensure a successful transition to electronic processing. Question 8. Mr. Roth, given the nature and importance of the Transformation Program investment, based on your investigations, what effect do you believe this investment's non-performance will have on the capabilities and mission of the Department of Homeland Security as a whole? Is the Transformation Program a wise investment given only 2 of approximately 90 types of immigration benefits and services are available for on-line customer filing? Answer. The issues with ELIS identified in our work have far- reaching implications. Of greatest concern is the risk to National security. Until USCIS can ensure ELIS is performing complete and accurate background security checks prior to approving applicants for U.S. Citizenship, improperly-vetted immigrants may be granted admissibility into the United States. Additionally, until USCIS remedies the issues that resulted in the delivery of green cards to the wrong address, there is a risk that green cards may fall into the wrong hands. Separate from National security concerns, until USCIS can share relevant and timely data with its stakeholders such as CBP, any passenger with an ELIS receipt number will experience increased delays while border agents cross check other systems and conduct the additional research needed to confirm U.S. Citizenship status. Further, until USCIS fully implements ELIS, the agency will not be in a position to effectively and efficiently manage existing workloads, or adapt to changes in legislation related to immigrant admissibility that may increase workloads. The Transformation Program has not yet been able to successfully transition USCIS from paper to electronic processing. The core premise of the ELIS system was to deliver an efficient, account-based system to process and manage all 90 applications and services. To date, the Transformation Program has ingested four immigration benefit types and one service into ELIS for electronic processing;\2\ however, the I-90 Application to Replace a Permanent Resident Card is the only benefit application that can be submitted by a customer on-line. We have consistently reported over the past 11 years that the Transformation Program has not been able to achieve any of its three primary goals, which were to improve customer service, increase operational efficiency of immigration benefits processing, and ensure National security and system integrity. On the contrary, our findings to date have concluded that ELIS has negatively impacted each of these three areas and created notable National security risk. --------------------------------------------------------------------------- \2\ USCIS Immigrant Fee payment, Form I-90 Application to Replace a Permanent Resident Card, Temporary Protected Status, Deferred Action for Childhood Arrivals, Form N-400 Application for Naturalization. --------------------------------------------------------------------------- Question 9. The USCIS Transformation Program is currently rated as a ``Medium-Risk'' program on the Federal IT Dashboard. Do you believe this is the appropriate risk level given the concerns discussed today and the on-going effort to re-baseline the program? Answer. We disagree with the USCIS Transformation Program's current Chief Information Officer (CIO) rating of ``Medium-Risk'' on the Federal IT Dashboard. Over the past year or more, the program has experienced numerous delays, performance issues, and a substantial lack of internal controls. Specifically, our reports identified alarming security concerns regarding errors in processing and issuing green cards to applicants. We also disclosed inadequate security checks that led to applicants being granted citizenship without complete or accurate background checks. Because of the problems encountered, USCIS decided in August 2016 to revert to legacy processing and discontinue using ELIS to process new naturalization applications. Of additional concern, DHS has not followed its own Program Health Assessment (PHA) process for the USCIS Transformation Program in terms of the frequency of CIO ratings. Specifically, the program should have been rated or assessed every quarter (3 months) based on its ``Medium- Risk'' ratings. The last three CIO ratings were August 31, 2016, January 29, 2016, and July 31, 2015; which reflect approximately 7- and 6-month gaps between the CIO ratings, respectively. DHS's failure to execute its own PHA process raises additional concerns as to the accuracy and timeliness of the CIO ratings themselves. Related to this, a June 2016 Government Accountability Office (GAO) report criticized the level of risk reflected in the Department's CIO ratings. Specifically, GAO performed independent risk assessments on seven of the Departments' major IT investments, including the USCIS Transformation Program. GAO reported that the April 2015 CIO rating of the program on the IT Dashboard did not reflect the level of risk facing the investments. GAO concluded the program should have reflected more risk and been rated ``High-Risk'' on the IT Dashboard for that month. GAO recommended that the CIO ensure the Department's CIO ratings reflect the level of risk facing an investment relative to the investment's ability to accomplish its goals. In its written comments, DHS concurred with this recommendation; however, as of April 6, 2017, the status of this recommendation was still open. Until these issues are addressed, we believe the accuracy of the Department's CIO ratings on the Federal IT Dashboard should be scrutinized.