DHS OIG, OIG-18-61, Verification Review: Better Safeguards Are Needed in USCIS Green Card Issuance (OIG-17-11) (2018)

Verification Review: Better Safeguards Are Needed in USCIS Green Card Issuance (OIG-17-11) April 10, 2018 OIG-18-61 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov April 10, 2018 MEMORANDUM FOR: The Honorable L. Francis Cissna Director United States Citizenship and Immigration Services FROM: SUBJECT: John V. Kelly Acting Inspector General Verification Review: Better Safeguards Are Needed in USCIS Green Card Issuance (OIG-17-11) We conducted a verification review to determine the adequacy, effectiveness, and timeliness of USCIS' corrective actions to address the seven report recommendations in Better Safeguards Are Needed in USCIS Green Card Issuance, OIG-17-11, November 16, 2016. In our 2016 report, we discussed numerous challenges U.S. Citizenship and Immigration Services (USCIS) faces to ensure secure and accurate processing and delivery of Green Cards to applicants. Specifically, we reported that USCIS produced at least 19,000 Green Cards that included incorrect information or were issued in duplicate between July 2013 and May 2016. Most card issuance errors during this period were due to design and functionality problems in the Electronic Immigration System (ELIS), a new system intended to automate benefits processing for certain USCIS products and services, including Green Cards.

At the time of our audit fieldwork in spring 2016, USCIS’ efforts to address the errors were inadequate. USCIS conducted a number of efforts to recover the inappropriately issued cards; however, these efforts also were not fully successful. We also reported that USCIS received more than 200,000 inquiries from approved applicants about missing cards. The number of cards sent to wrong addresses had steadily increased since 2013, due in part to the complex process for updating addresses and ELIS limitations.

Responding to card issuance errors resulted in additional workload and corresponding costs, as USCIS spent just under $1.5 million to address card-related customer inquiries in fiscal year 2015 alone. We issued seven recommendations to the USCIS Director to improve Green Card issuance and reduce errors. We periodically conduct verification reviews to evaluate agency progress in implementing audit report recommendations to determine whether corrective actions were completed as indicated. Although report recommendations had not yet been closed, we conducted this www.oig.dhs.gov OIG-18-61 OFFICE OF INSPECTOR GENERAL Department of Homeland Security verification review to address continuing congressional interest in USCIS actions to address Green Card issuance errors following Office of Inspector General (OIG) report publication.

Based on our evaluation of documentary evidence, interviews with USCIS personnel, and ELIS demonstrations, we determined that USCIS’ corrective actions were adequate, effective, and timely. As a result, we closed all seven recommendations. Verification Review Results Implementation of Recommendation 1 We recommended the USCIS Director ensure ELIS design and functionality problems are corrected to prevent, to the extent possible, further Green Card processing errors. In our report, we disclosed that between 2013 and 2016 USCIS printed approximately 13,000 cards with incorrect personal information and mailed more than 6,200 duplicate cards to individuals who should have each received one card.

Many of these errors occurred as a result of ELIS technical issues or other problems that disrupted the automated process. This recommendation was open and resolved when the verification review began. To address this recommendation, USCIS took steps to complete ELIS upgrades and data migration efforts that had previously disrupted Green Card processing. Specifically, in February 2016, the Office of Information Technology (OIT) upgraded the USCIS Immigrant Fee service, including Green Card processing, to a newer version of ELIS.1 This upgrade involved complex efforts to migrate thousands of open cases from legacy ELIS to the newer version.

However, it took USCIS an additional 14 months — until April 2017 — to work through the backlog of more than 7,000 legacy ELIS cases that did not properly transfer to the new system. Completing all legacy cases was critical, as most of the duplicate card and print errors we reported in 2016 stemmed from data migration complications. USCIS’ completion of all ELIS upgrade activities in April 2017 effectively prevented further Green Card printing errors. The OIT also implemented a number of ELIS enhancements to address other previously identified root causes for card printing errors.

For example, in October 2016, the OIT improved communication and information exchange between ELIS and the Enterprise Service Bus that directs card production requests. OIT personnel said streamlining information exchange between these two systems was important to reduce the impact of system timeouts that can interrupt card production and cause duplicate card issuance. The OIT also implemented automated checks in ELIS that validate Green Card expiration date based on the bearer’s date of permanent residence and immigrant classification code. Finally, the OIT built in stricter regression testing to 1 The USCIS Immigrant Fee covers the cost of USCIS processing, filing, and maintaining immigrant visa packets, as well as the cost of producing Green Cards. www.oig.dhs.gov 2 OIG-18-61 OFFICE OF INSPECTOR GENERAL Department of Homeland Security improve the ability to identify and correct card errors early in the production process.2 Our review confirmed that USCIS’ completion of all of these corrective actions met the intent of this recommendation.

USCIS personnel we interviewed within the OIT, and at multiple field offices, demonstrated the effectiveness of these improvements by providing evidence that they printed no cards with errors and issued few duplicate Green Cards since our 2016 report. This recommendation is now closed. Implementation of Recommendation 2 We recommended the USCIS Director ensure development and implementation of the internal controls needed to ensure Green Card errors are identified and corrected early in the production process, prior to card issuance. Our report disclosed that USCIS’ methods for addressing problems with Green Card errors, including manual intervention and production controls, were not adequate to ensure quality across the roughly 2 million cards produced and issued each year.

We concluded that more rigorous measures were needed to uphold the integrity of the production process. This recommendation was open and resolved when the verification review began. Since our 2016 report, USCIS has implemented new reporting capabilities and internal controls throughout the Green Card production process to reduce the possibility of duplicate card issuance. First, in October 2016, the OIT enhanced reporting capabilities within ELIS and other systems used for card production, enabling search queries that quickly identify card errors such as duplicate printing or mailing to the same address.

These enhancements provide USCIS managers a real-time view of duplicate cards produced for the same applicant in other systems. Second, the OIT added an automated capability to ELIS in June 2017 to alert system users of a second card request for the same customer within a specified time of the initial card production request. OIT personnel check these error messages daily to identify potential technical issues and ensure timely remediation. Our review validated that these internal control improvements were effective in enabling USCIS personnel to catch card errors early in the production process, prior to card issuance.

The substantial decrease in the number of duplicate cards produced over the last year and a half provides further evidence of improvement. Specifically, USCIS issued a total of 195 duplicate cards between June 2016 and January 2018, in comparison with 6,230 duplicate cards issued from June 2015 to May 2016. We are satisfied that USCIS’ corrective 2 Regression testing is conducted to ensure that previously developed and tested software still performs the same way after it is changed or integrated with other software. www.oig.dhs.gov OIG-18-61 3 OFFICE OF INSPECTOR GENERAL Department of Homeland Security actions met the intent of this recommendation. This recommendation is now closed.

Implementation of Recommendation 3 We recommended the USCIS Director ensure development and implementation of a standard process for card recovery efforts. Our 2016 report indicated that USCIS’ efforts to recover improperly issued Green Cards were not effective. USCIS conducted efforts to recall Green Cards in all cases involving printing errors and duplicate card issuance. However, recall efforts were not fully successful due to inconsistent recall practices and inadequate tracking.

For example, USCIS offices did not employ a standard process to contact affected individuals, did not have a standard timeframe for initiating recall efforts, and did not use a central tracking method to account for returned cards. This recommendation was open and resolved when the verification review began. To address this recommendation, USCIS instituted new guidance, Standard Operating Procedures for the Recall, Return, and Collection of Permanent Resident Cards (Green Cards), on June 20, 2017. This standard operating procedure provides formal, agency-wide guidance for coordinated recall efforts.

The procedure includes instructions for all USCIS offices, as appropriate, on identifying, collecting, and documenting the return of Green Cards that were issued in duplicate, contained incorrect information, or needed to be recalled for some other reason. USCIS’ Customer Service and Public Engagement Directorate informed field offices of the procedure on July 12, 2017, via the USCIS Connect intranet website.3 USCIS managers and personnel we interviewed confirmed they were aware of this procedure. By the end of our fieldwork in February 2018, USCIS had not yet tested this recall procedure due to the low number of Green Card errors over the previous year. Nonetheless, we believe that USCIS’ corrective actions met the intent of this recommendation.

This recommendation is now closed. Implementation of Recommendation 4 We recommended the USCIS Director ensure development and implementation of a standard procedure for identifying and preventing unrecoverable card use. Our 2016 report disclosed that USCIS lacked a standard procedure to keep the cards from being used. The USCIS Fraud Detection and National Security Directorate entered the serial number of each missing card into TECS, its law 3 USCIS Connect is an intranet website that provides links to USCIS agency information and employee resources. www.oig.dhs.gov 4 OIG-18-61 OFFICE OF INSPECTOR GENERAL Department of Homeland Security enforcement system, to flag and prevent misuse of each card.4 However, USCIS officials did not consistently follow this procedure, as they could not provide information on the total card serial numbers input to TECS over a specified period.

This recommendation was open and resolved when the verification review began. USCIS’ June 2017 standard operating procedure helps address our recommendation to identify and prevent unrecoverable cards use. The procedure includes instructions for USCIS’ Office of Intake and Document Production to destroy returned Green Cards in accordance with related USCIS guidance. The office must also notify the USCIS Fraud Detection Directorate of any cards not recovered.

Upon notification, personnel input each card serial number to the TECS system to prevent the card from being used. Our review confirmed that these corrective actions met the intent of the recommendation. USCIS provided evidence that the Fraud Detection and National Security Directorate had added numerous unrecoverable cards to the TECS system as of June 17, 2016, and April 14, 2017. However, at the time of our fieldwork, USCIS had not yet tested this procedure on a large scale due to the low number of Green Card errors over the past year.

This recommendation is now closed. Implementation of Recommendation 5 We recommended the USCIS Director implement a centralized method to track and document Green Cards returned through recovery efforts. In our 2016 report, we concluded that USCIS could not provide an accurate number of cards recovered, in part, because the various recall efforts from 2013 to 2016 were led by different USCIS offices. Based on information USCIS provided, we estimated that 34 percent of the 19,001 Green Cards sent in error were not accounted for by USCIS.

This recommendation was open and resolved when the verification review began. We believe that USCIS’ development of the Standard Operating Procedures for the Recall, Return, and Collection of Permanent Resident Cards, previously mentioned, meets the intent of this recommendation. The procedure includes instructions for all relevant USCIS offices to assist in tracking returned cards that were issued in error. For example, when USCIS personnel attempt to contact affected customers, they use a standard, templated Green Card list to track the cards that are being recalled.

The list is posted and maintained on a widely accessible, but secure, Enterprise Collaboration Network page for internal USCIS users. A designated card recall email address has been established to assist in the card tracking effort. As of February 2018, USCIS 4 TECS (not an acronym) is owned by Customs and Border Protection and is the principal system used by officers at the border to assist with screening and determinations regarding admissibility of arriving persons. www.oig.dhs.gov 5 OIG-18-61 OFFICE OF INSPECTOR GENERAL Department of Homeland Security had not yet tested this tracking method due to the low number of Green Card errors over the previous year. This recommendation is now closed.

Implementation of Recommendation 6 We recommended USCIS complete and implement an identity-proofing capability to enable customers to submit address changes online in ELIS. In our report, we stated that customer complaints regarding non-delivery of Green Cards remained among USCIS’ top 10 most common service requests from FY 2011 to FY 2015. USCIS had received more than 200,000 inquiries from approved applicants about missing cards from 2013 to 2016. The number of cards that USCIS sent to wrong addresses incrementally increased during this period due to complex processes for updating addresses, ELIS limitations, and factors beyond the agency’s control.

For example, the need to input address changes to several non-integrated USCIS systems containing customer information increased the likelihood of errors and improper delivery of immigration benefits documents. This recommendation was open and resolved when the verification review began. USCIS responded to this recommendation by developing an electronic capability, known as Identity Proofing as a Service (IDPaaS), to verify an applicant’s identity. The OIT piloted IDPaaS in July 2016 and fully implemented it for Immigrant Fee Service customers on February 21, 2017.

With IDPaaS, applicants can create online accounts and update their mailing addresses, linking them to their existing case files in ELIS. The use of IDPaaS is currently limited to customers paying the USCIS Immigrant Fee for a new Green Card; it is not available for requesting a replacement Green Card. The OIT provided us an IDPaaS system demonstration in December 2017 to illustrate each step required for customers to validate their identities and make address changes online. Although this service was implemented 1 year ago, USCIS could not confirm whether it had been effective in decreasing customer complaints about missing Green Cards.

We spoke with the Customer Service and Public Engagement Directorate officials, as well as personnel who process the USCIS Immigrant Fee, but neither could correlate the new identity proofing service with improved card delivery. Nonetheless, we believe USCIS’ corrective actions completed to date meet the intent of this recommendation. This recommendation is now closed. Implementation of Recommendation 7 We recommended USCIS evaluate the costs and benefits of using the U.S. Postal Service’s Signature Confirmation as an alternative secure method for delivering Green Cards to applicants.

During our 2016 audit, USCIS leadership acknowledged that non-delivery of Green Cards was a significant concern. Two U.S. Postal Service OIG studies regarding missing Green Cards substantiated www.oig.dhs.gov 6 OIG-18-61 OFFICE OF INSPECTOR GENERAL Department of Homeland Security these concerns. In both studies, conducted in 2015 and 2016, most USCIS customer complaints of missing Green Cards were logged “delivered as addressed.” The U.S. Postal Service OIG concluded that although the reason for the high percentage of missing cards could not be attributed to one cause, more secure delivery methods should be used, such as signature confirmation where individuals are required to sign for the packages. This recommendation was open and resolved when the verification review began.

In 2017, the USCIS Customer Service and Public Engagement Directorate evaluated alternative methods for secure delivery of immigration benefits documents. The alternatives included a hold for pickup option, which would require customers to pick up secure documents from a local post office, as well as a signature confirmation option, which would require the U.S. Post Office to obtain a signature at the time of document delivery. Following the evaluation, the USCIS Director decided to pursue signature confirmation as the secure delivery method for USCIS documents, with intent to implement it in February 2019. USCIS’ corrective actions completed to date satisfy the intent of this recommendation.

This recommendation is now closed. Additional Transformation Program Enhancements Contributed to Effectiveness of USCIS’ Corrective Actions A number of USCIS’ corrective actions to improve processing and delivery of Green Cards have already demonstrated positive change, largely due to efforts to reorganize the Transformation Program and improve ELIS’ technical foundation. Specifically, the USCIS Director developed a new governance structure by placing the Transformation Program under the auspices of the USCIS Chief Information Officer (CIO). After taking charge of the program in January 2017, the USCIS CIO instituted a new strategy to optimize the benefits of existing ELIS processing capabilities before undertaking any new development activities.

The refined scope of the Transformation Program reduced the number of ELIS benefit types to be automated, in favor of enhancing previously deployed products and services. Additionally, the USCIS CIO implemented a new management approach to enhance user feedback, technical innovation, and oversight of day-to-day system development efforts. Eight new business objectives were also put in place to measure the operational impacts of ELIS, such as adjudication time, reduction of paper, and security. Lastly, the CIO established portfolio managers directly aligned with each USCIS directorate to build relationships and obtain stakeholder feedback on ELIS development efforts.

Personnel in several USCIS field offices told us this approach has been effective to ensure that ELIS capabilities meet day-to-day business needs. www.oig.dhs.gov 7 OIG-18-61 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Objective, Scope, and Methodology Our objective was to determine the adequacy, effectiveness, and timeliness of USCIS' corrective actions to address report recommendations 1 through 7 for Better Safeguards Are Needed in USCIS Green Card Issuance (OIG-17-11, November 16, 2016). To conduct this verification review, we reviewed documentary evidence, interviewed more than 30 personnel at USCIS headquarters and field offices, and observed multiple ELIS demonstrations. We conducted this verification review between November 2017 and February 2018 pursuant to the Inspector General Act of 1978, as amended. Major contributors to this report include Kristen Bernard, Director, Information Technology Management Division; Kristen Fogarty, Audit Manager; W. Mitchell Chaine, Program Analyst; and, Yusuf Lane, Referencer.

Please call me with any questions, or your staff may contact Sondra McCauley, Assistant Inspector General, Office of Information Technology Audits, at (202) 254-5100. www.oig.dhs.gov 8 OIG-18-61 Additional Information and Copies To view this and any of our other reports, please visit our website at: www.oig.dhs.gov. For further information or questions, please contact Office of Inspector General Public Affairs at: [email protected]. Follow us on Twitter at: @dhsoig. OIG Hotline To report fraud, waste, or abuse, visit our website at www.oig.dhs.gov and click on the red "Hotline" tab.

If you cannot access our website, call our hotline at (800) 323-8603, fax our hotline at (202) 254-4297, or write to us at: Department of Homeland Security Office of Inspector General, Mail Stop 0305 Attention: Hotline 245 Murray Drive, SW Washington, DC 20528-0305