DHS OIG, OIG-17-11, Better Safeguards Are Needed in USCIS Green Card Issuance (2016)

Better Safeguards Are Needed in USCIS Green Card Issuance November 16, 2016 OIG-17-11 DHS OIG HIGHLIGHTS Better Safeguards Are Needed in USCIS Green Card Issuance November 16, 2016 What We Found Why We Did This Audit In March 2016, we reported challenges in U.S. Citizenship and Immigration Services’ (USCIS) automation of benefits processing. We conducted this follow-up audit to assess the extent to which USCIS has inappropriately issued Green Cards, evaluate its actions to recover the cards, and assess its actions and plans to prevent similar incidents in the future. What We Recommend We recommend USCIS improve Electronic Immigration System (ELIS) functionality and develop internal controls to avoid inappropriate Green Card issuance, standardize card recovery and tracking efforts, prevent unrecoverable card use, and enable remote identity verification and more secure card delivery methods. For Further Information: Contact our Office of Public Affairs at (202) 254-4100, or email us at [email protected] As we previously reported, USCIS continues to struggle to ensure proper Green Card issuance.

We found that over the past 3 years, USCIS produced at least 19,000 cards that included incorrect information or were issued in duplicate. Most card issuance errors were due to design and functionality problems in ELIS, which is being implemented to automate benefits processing. USCIS’ efforts to address the errors have been inadequate. Although USCIS conducted a number of efforts to recover the inappropriately issued cards, these efforts also were not fully successful and lacked consistency and a sense of urgency.

Over the last 3 years, USCIS received over 200,000 reports from approved applicants about missing cards. The number of cards sent to wrong addresses has incrementally increased since 2013 due in part to complex processes for updating addresses, ELIS limitations, and factors beyond the agency’s control. Improperly issued Green Cards pose significant risks and burdens for the agency. Errors can result in approved applicants being unable to obtain benefits, maintain employment, or prove lawful immigration status.

In the wrong hands, Green Cards may enable terrorists, criminals, and illegal aliens to remain in the United States and access immigrant benefits. Responding to card issuance errors has also resulted in additional workload and corresponding costs, as USCIS spent just under $1.5 million to address card- related customer inquiries in fiscal year 2015 alone.

USCIS

Response The USCIS Director concurred with our recommendations.

OFFICE OF INSPECTOR GENERAL

Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov November 16, 2016 MEMORANDUM FOR: The Honorable Leon Rodriguez Director United States Citizenship and Immigration Services FROM: SUBJECT: John Roth ~k"\(.oh_ Inspector General Better Safeguards Are Needed in USCIS Green Card Issuance Attached for your information is our final report, Better Safeguards Are Needed in USCIS Green Card Issuance. We incorporated the formal comments from the Director of United States Citizenship and Immigration Services in the final report. The report contains seven recommendations aimed to improve Electronic Immigration System functionality, avoid inappropriate Green Card issuance, and improve card recovery and delivery efforts. Based on information provided in your response to the draft report, we consider recommendations 1 through 7 open and resolved.

Once your office has fully implemented the recommendations, please submit a formal closeout letter to us within 30 days so that we may close the recommendations. The memorandum should be accompanied by evidence of completion of agreed upon corrective actions and of the disposition of any monetary amounts. Please send your response or closure request to [email protected]. Consistent with our responsibility under the Inspector General Act, we will provide copies of our report to congressional committees with oversight and appropriation responsibility over the Department of Homeland Security.

We will post the report on our website for public dissemination. Please call me with any questions, or your staff may contact Sondra McCauley, Assistant Inspector General, Information Technology Audits, at (202) 254-4041 . Attachment DHS OIG HIGHLIGHTS Better Safeguards Are Needed in USCIS Green Card Issuance Table of Contents Background .................................................................................................... 1 Results of Audit ..............................................................................................

5 Green Card Issuance Errors Primarily Due to ELIS Problems ................. 5 Recommendations............................................................................... 12 Card Recall Efforts Unsuccessful Due to Lack of Consistency and Urgency ............................................................................................... 12 Recommendations...............................................................................

14 Missing Cards Attributable to Multiple Factors .................................... 15 Recommendations............................................................................... 19 Improperly Issued Green Cards Increase Risks, Workload, and Costs... 19 Appendixes Appendix A: Objective, Scope, and Methodology .................................

30 Appendix B: USCIS Comments to the Draft Report .............................. 32 Appendix C: Office of IT Audits Major Contributors to This Report ....... 37 Appendix D: Report Distribution .......................................................... 38 Abbreviations CBP CLAIMS CPMS CSPED ELIS EPMS FOD ICE OIG OTC SCOPS SMI TSC USCIS USPS U.S. Customs and Border Protection Computer Linked Application Information Management System Customer Profile Management System Customer Service and Public Engagement Directorate Electronic Immigration System Enterprise Print Management System Field Operations Directorate U.S. Immigration and Customs Enforcement Office of Inspector General Office of Transformation Coordination Service Center Operations Secure Mail Initiative Texas Service Center United States Citizenship and Immigration Services United States Postal Service OFFICE OF INSPECTOR GENERAL Department of Homeland Security Background Within the Department of Homeland Security, United States Citizenship and Immigration Services (USCIS) is responsible for providing accurate and useful information to its customers, granting immigration benefits and U.S. citizenship, and ensuring the integrity of the immigration system.

To carry out its mission, USCIS has 19,000 government employees and contractors at 223 offices worldwide. USCIS provides services through its headquarters office in Washington, DC; 5 service centers; 29 district offices; 136 application support centers; and 4 regional offices. USCIS asylum offices, the Customer Contact Center, the National Records Center, and the National Benefits Center also provide services to customers. USCIS provides approximately 90 different types of immigration benefits and services, including lawful permanent residence.

Permanent residence status is granted to foreign nationals who have been approved to reside in the United States. The Permanent Resident Card (also known as the Green Card) serves as evidence its holder has been officially granted immigration benefits, including permission to reside and seek employment in the United States. In fiscal year 2015, USCIS issued nearly 2.1 million Green Cards. Multiple USCIS program offices and directorates participate in Green Card processing and mailing, as highlighted in figure 1.

Figure 1: USCIS Organization as of April 2016 Source: DHS Office of Inspector General (OIG)-generated from USCIS’ website www.oig.dhs.gov 1 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  The Service Center Operations Directorate (SCOPS) oversees the Service Centers responsible for processing and adjudicating most applications and petitions that do not require interviews.  The Field Operations Directorate (FOD) oversees field offices that process and adjudicate applications requiring interviews and background checks.  The Fraud Detection and National Security Directorate determines whether applicants filing for immigration benefits pose a threat to national security or safety.  The Office of Transformation Coordination (OTC) manages and oversees USCIS development of the Electronic Immigration System (ELIS).  The Customer Service and Public Engagement Directorate (CSPED) manages customer inquiries.  The Office of Intake and Document Production, located in the Management Directorate, is responsible for card production. To receive a Green Card, individuals must be eligible for an immigrant category established by the Immigration and Nationality Act.1 The categories include seeking employment, refugee or asylum status, permanent residence as the family member of a U.S. citizen or permanent resident, and a number of other special immigrant programs.2 In most cases, the process to obtain a Green Card begins when an individual, an employer, or a family member files a petition with USCIS on behalf of the immigrant.3 Once approved, the petition is sent to the U.S. Department of State's National Visa Center for assignment of a visa number. At this point, eligible individuals may apply for permanent residence either outside the United States through consular processing or inside the United States through adjustment of status, as depicted in figure 2. 1The Immigration and Nationality Act, enacted in 1952, provides basic immigration and naturalization laws (Public Law 82–414, 66 Stat. 163).

2 Special programs exist for the widow of a U.S. citizen, battered spouse or child, armed forces member, religious worker, and others. 3 Individuals can also petition on their own for visas in certain immigrant categories. However, not all immigrant categories require visa petitions. www.oig.dhs.gov OIG-17-11 2 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Figure 2: Green Card Processing Source: OIG analysis of USCIS’ current process Since May 2013, USCIS processing of new and replacement Green Cards is accomplished using ELIS. The OTC implemented this online capability to accept the applicant’s USCIS Immigrant Fee and process the Green Card.

In March 2015, USCIS transitioned the Application to Replace a Permanent Resident Card (Form I-90) to ELIS. Both the USCIS Immigrant Fee and the Form I-90 were previously processed in USCIS’ Computer Linked Application Information Management System (CLAIMS 3). The initial processing for the USCIS Immigrant Fee is done in ELIS. First, a USCIS data entry clerk or lockbox contractor enters case data for each applicant once a Visa Packet or application is received.4 Next, the data is forwarded from ELIS to the Electronic Print Management System (EPMS) at one of two USCIS card production facilities.

Once the card is produced, it is printed and placed in a U.S. Postal Service (USPS) priority mail envelope. USCIS uses a database, known as Secure Mail Initiative (SMI), to capture and store delivery tracking information once the card has been mailed. USCIS works with other DHS components, such as U.S. Customs and Border Protection (CBP), U.S. Immigration and Customs Enforcement (ICE), and other law enforcement agencies to prevent card misuse after issuance. The Green Card displays personally identifiable information, including the permanent resident’s full legal name, photo, Alien-number, fingerprint, date of birth, and country of birth, as well as a number and expiration date, as 4 Three lockbox facilities, operated by a Financial Agent of the U.S. Department of Treasury, provide intake services for data and fee payments for many USCIS form types. www.oig.dhs.gov OIG-17-11 3 OFFICE OF INSPECTOR GENERAL Department of Homeland Security depicted in figure 3.5 The cards also contain numerous built-in security features designed to prevent fraud.

The card remains valid for either 2 or 10 years, depending on whether the individual is granted conditional or permanent residence.6 Figure 3: Example of a Green Card Source: USCIS website USCIS is responsible for secure and accurate issuance of immigration benefits. However, our March 2016 report identified weaknesses in USCIS’ ability to effectively carry out its national security and system integrity goals.7 Specifically, we disclosed that USCIS had sent potentially hundreds of Green Cards to the wrong addresses due to an ELIS limitation that prevented USCIS personnel from updating customer addresses. We also reported USCIS was unable to identify the exact number of cards sent to the incorrect addresses. New information regarding the scope and volume of improperly issued Green Cards received after publication of our previous report prompted initiation of this current audit.

5 DHS is responsible for assigning Alien-numbers (“A”-numbers) to foreign nationals. 6 Permanent residents receive 10-year cards that must be renewed upon expiration. Conditional permanent residents receive 2-year cards and must apply to remove their conditional status. 7 USCIS Automation of Immigration Benefits Processing Remains Ineffective, OIG-16-48, March 2016. www.oig.dhs.gov 4 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Results of Audit As we previously reported, USCIS continues to struggle to ensure proper Green Card issuance.

We found that over the past 3 years, USCIS produced at least 19,000 cards that included incorrect information or were issued in duplicate. Most card issuance errors were due to design and functionality problems in ELIS, which is being implemented to automate benefits processing. USCIS’ efforts to address the errors have been inadequate. Although USCIS conducted a number of efforts to recover the inappropriately issued cards, these efforts also were not fully successful and lacked consistency and a sense of urgency.

Over the last 3 years, USCIS received over 200,000 reports from approved applicants about missing cards. The number of cards sent to wrong addresses has incrementally increased since 2013 due in part to complex processes for updating addresses, ELIS limitations, and factors beyond the agency’s control. Improperly issued Green Cards pose significant risks and burdens for the agency. Errors can result in approved applicants being unable to obtain benefits, maintain employment, or prove lawful immigration status.

In the wrong hands, Green Cards may enable terrorists, criminals, and illegal aliens to remain in the United States and access immigrant benefits. Responding to card issuance errors has also resulted in additional workload and corresponding costs, as USCIS spent just under $1.5 million to address card- related customer inquiries in fiscal year 2015 alone. Green Card Issuance Errors Primarily Due to ELIS Problems USCIS personnel rely on a number of systems, including ELIS, to conduct electronic processing of Green Cards. However, continual system errors have caused at least 19,000 cards to be issued with incorrect information or in duplicate over the last 3 years.

Since ELIS implementation in 2013, the percentage of Green Cards issued in error has steadily increased each year. USCIS efforts to address the errors have been inadequate. Estimated Number of Incorrect Green Cards Issued USCIS provided information on at least 12 episodes in which USCIS issued incorrect Green Cards between July 2013 and May 2016. Each episode resulted in between 19 and 5,434 incorrect Green Cards being issued.

USCIS personnel we interviewed did not have complete or accurate information readily available to account for all improperly issued cards. However, multiple offices provided records of each episode they were aware of over roughly the past 3 years.8 8 We gathered information from the OTC, FOD, and SCOPS to quantify the extent of card errors. www.oig.dhs.gov 5 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Based on our analysis of the data provided, we determined approximately 13,000 cards were printed and issued with incorrect personal information, such as the wrong name or date of birth. Additionally, over 6,200 duplicate cards were sent out to individuals who should have each received only one card. The results of our analysis are listed in table 1 below.

Table 1: Episodes of Green Card Errors and Duplicates from 2013–2016 Episode* Date Reported Number of Cards Affected Incorrect expiration dates Incorrect names or date of birth Incorrect “residence since” date 1. 2. 3. 4.

Duplicate cards issued 5. Duplicate cards issued 6. 7. 8.

Incorrect expiration dates Incorrect birth and “residence since” date Incorrect photos 9. Duplicate cards issued 10. Duplicate cards issued 11. Duplicate cards issued 12.

Duplicate cards issued July 2013 May 2014 Winter 2014 June 2015 June 2015 June 2015 September 2015 November 2015 March 2016 April 2016 April 2016 May 2016 Total Cards Issued with Incorrect Data Total Duplicate Cards Total Card Errors 2,466 5,282 3,663 5,438 36 772 219 369 174 19 242 321 12,771 6,230 19,001 Cause ELIS ELIS OTHER OTHER CLAIMS CLAIMS ELIS ELIS ELIS ELIS ELIS ELIS * Card errors are denoted in blue, duplicate cards in grey Source: OIG analysis of USCIS data Green Cards Issued with Incorrect Data As shown in table 1, USCIS mistakenly issued nearly 13,000 Green Cards with incorrect personal information to applicants between July 2013 and November 2015. All but two episodes occurred as a result of ELIS design errors or other problems that disrupted the automated process. Also, ongoing efforts to migrate cases from a previous version of ELIS, called ELIS 1, to the new version of ELIS have caused multiple errors.9 Collectively, these problems caused cards to be generated and issued with a combination of errors regarding name, date of birth, gender, expiration date, and incorrect photos. For example:  In July 2013, over 2,400 immigrants approved for 2-year conditional residence status were inadvertently issued cards with 10-year expiration 9 ELIS 1 refers to the legacy version of ELIS, which was updated in August 2015. www.oig.dhs.gov 6 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security    dates.

In other words, an applicant who should have received a card with a 2-year expiration date had a card that was valid for 10 years. The OTC traced the cause of this error to a source database containing incorrect data that was populating the expiration date field. In May 2014, approximately 5,280 cards were generated in ELIS and issued with the incorrect name and/or dates of birth. For example, applicants’ cards were printed with “No Given Name” as their first name and with their first and last names combined as the last name.

In addition, some immigrants received cards with mismatched photos and fingerprints. The OTC identified multiple root causes for these errors. For one, a system release for new functionality inadvertently introduced an error to the dataflow. Also, a technical error allowed ELIS to include the immigrant’s information on another family member’s card.

In September 2015, ELIS generated roughly 170 cards with the incorrect date of birth; all of the cards were generated with January birth dates. This issue stemmed from a legacy ELIS data migration effort that incorporated a faulty date pattern that set all applicants’ birth dates to January. In November 2015, nearly 370 cards were mistakenly issued with incorrect photos that were mismatched across family members. For example, a child’s card had a parent’s photo.

The OTC stated that this error also occurred during data migration efforts. In this case, a technical glitch enabled random association of photos across multiple family members. Unrelated to ELIS, USCIS also issued Green Cards with the wrong date information on two separate occasions in 2014 and 2015. These episodes occurred during the processing of I-90 applications to replace Green Cards.

One episode resulted from a data entry mistake. Specifically, in the winter of 2014, USCIS Adjudication Officers incorrectly entered the application approval date in the wrong field, causing more than 3,700 cards to be issued with the wrong “residence since” date. The other episode, in June 2015, was caused by incorrect data in a system field in CLAIMS 3. In this instance, a card production software update in CLAIMS 3 caused a miscalculation in the way a card expiration date would be system generated.

This coding error resulted in nearly 800 cards issued with the 2-year expiration date incorrectly calculated from the time the application was approved, rather than from the adjustment of status date.10 It should be noted that although the number of errors remains a concern, it represents a small percentage of the total number of Green Cards issued by the agency each year. For example, in FY 2015, card errors accounted for .48 percent of roughly 2 million cards that were produced and mailed. Also, the 10 Per the U.S. Department of State, the expiration date is 2 years from the date the alien obtains lawful permanent resident status. www.oig.dhs.gov OIG-17-11 7 OFFICE OF INSPECTOR GENERAL Department of Homeland Security individuals who received incorrect cards in these instances had followed the proper procedures and security checks and thus were legitimately approved to become permanent residents. However, the number of errors has increased steadily over the past 3 years.

Figure 4 shows the steady increase in Green Card errors each year, from fiscal years 2013 to 2015. Figure 4: Percentage of Errors per Cards Issued Over Time11 s d r a C r e P s r o r r E f o e g a t n e c r e P d e c u d o r P 0.50% 0.40% 0.30% 0.20% 0.10% FY13 FY14 FY15 Source: USCIS metrics as of April 2016 Green Cards Issued in Duplicate During the past year, USCIS inadvertently sent more than 6,200 duplicate Green Cards to customers. The most significant episode occurred in June 2015, when more than 5,400 individuals received duplicate cards. This error was caused by a card production software update that inadvertently generated duplicates for a backlog of cards that were queued up for printing.

Also in June 2015, an additional 36 duplicate cards were mistakenly sent out after contractors were tasked to re-enter data for cases that had been stuck in CLAIMS 3. More recently, between March and May 2016, USCIS issued at least 750 duplicate cards to its customers as a result of ELIS functionality or legacy data migration problems. The frequency and severity of these occurrences are being treated as high priority episodes by the OTC. In some cases, applicants paid the processing fee twice and received two cards.

In another case, an applicant received Green Cards that belonged to two other applicants. Texas Service Center (TSC) personnel stated that a faulty sub-status field in ELIS has caused a number of duplicate cards to be produced from a single case number. Throughout the USCIS Immigrant Fee process, ELIS displays a case 11 1,486,067, 1,807,400, and 2,081,233 Green Cards were produced and mailed in FY13, FY14, and FY15. www.oig.dhs.gov 8 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security sub-status to indicate when a card is ready to move forward to the USCIS production facility. In some cases, the system sub-status mistakenly indicated “Ready for Card Production” although the cards had previously been completed and sent forward for production.

In several extreme cases in March 2016, five cards were produced per customer over the course of a single month. Additionally, 3 cards were produced for 12 individuals each, while 2 cards were produced for hundreds of individuals each, during the past year. During our visit to the TSC in April 2016, we also watched first-hand as personnel processed a case for an applicant in ELIS, where the case sub-status displayed “Ready for Card Production,” signaling it was ready to move forward for printing. But upon further investigation, multiple cards had already been printed and mailed to that particular applicant.

TSC personnel estimated the system displays the wrong card status 10 percent of the time, which has caused their widespread reluctance to rely on ELIS data. The OTC was further investigating all such episodes during our audit in order to better understand the scope and cause for each. Inadequate USCIS Efforts to Address Green Card Errors USCIS has instituted several methods of addressing problems with Green Card errors. However, these methods — manual intervention, production controls, and system enhancements — have not proven adequate to ensure quality across the volume of cards produced and issued each year.

More rigorous measures are needed to uphold the integrity of the production process and ensure that cards are consistently issued with accurate information to approved applicants. Manual Intervention and Scrutiny TSC’s process for identifying and addressing duplicate card issuance is primarily dependent upon manual intervention and scrutiny. For example, personnel cross-check numerous systems, such as ELIS and the Customer Profile Management System (CPMS), to research and verify each card in question. However, data in these systems are not linked and do not always match.

According to TSC personnel, further analysis is required to identify duplicate card issuance because checking records in one system may only reveal whether a card was requested while another system must be checked to confirm whether a card was sent. In addition to the manual cross-checks, the OTC can generate an automated report to compare case numbers between ELIS and the CPMS as a means of identifying possible duplicate cards.12 When a duplicate is found, the OTC 12 CPMS stores biographic and biometric Green Card data. www.oig.dhs.gov 9 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security examines corresponding records in SMI to determine whether the card was already mailed. Although this is helpful, such processes to identify and address duplicate card issuance are after the fact, instead of preventative to keep the errors from occurring early in the process and before card production and mailing. Data Accuracy Controls USCIS’ Green Card quality control process is not effective.

Quality control steps have been built into card production to alert personnel when actions are needed to correct data errors or cancel duplicates before card printing begins. The quality control steps are depicted by letters A–D in figure 5. Figure 5: Current Green Card Data Accuracy and Quality Control Process Source: OIG analysis of USCIS process Based on our assessment, these quality control steps are largely manual and cannot ensure quality across the roughly 2 million Green Cards produced and mailed each year. The approximately 19,000 cards issued in error from July 2013 to May 2016 attest to this.

Specifically: A. ELIS electronically confirms that the sub-status of each case is “Ready for Card Production” before the card is sent forward to EPMS. However, the effectiveness of this check may be negated when, as reported earlier, ELIS populates the wrong case status for an applicant. B. Each case is paused for a 72-hour period to allow time for USCIS personnel to take any corrective actions needed. TSC personnel said this step is beneficial, as it provides an opportunity to make changes, such as updates to customer addresses or card cancellations, if needed.

However, this manual quality control step is inadequate to identify and address the increasing percentage of errors that occur in card production. C. EPMS electronically serves as a central hub to manage card production. EPMS conducts checks to reject cards with errors, such as blank data fields or photo images that are too light. EPMS also routes rejection messages to ELIS when duplicate receipt numbers are received, initiating a triage and www.oig.dhs.gov 10 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security inspection process to assess the situation.

Again, this manual, time- consuming process provides no assurance of catching all errors. D. A 48-hour hold is placed on each Green Card before it advances to the National Production System. This holding period serves as the final opportunity to stop card production and perform manual checks, as needed. System Enhancements The OTC has enhanced ELIS development and testing in efforts to prevent the same mistakes (i.e., incorrect and duplicate cards) from being repeated.

Such enhancements have been highly reactive in nature. Specifically, in response to each episode, the OTC halted card production to research root causes for errors and improve system functionality. This included—  issuing system configuration guidance for developers, such as step-by- step instructions to ensure toggle switches are configured correctly before an ELIS release is implemented;  requiring that developers exercise greater caution and control and use version-controlled XML files to populate source decision databases. This is to help prevent a system release from changing case details or sub- status if a case is already in card production;  expanding testing to include additional checks to detect whether card production may be negatively affected by an ELIS release.

OTC personnel said that they run about 60 “unit” and “integration” tests related to card production. They conduct “smoke” tests that are performed as part of the ELIS deployment pipeline.13 Live interface testing is also conducted to generate a virtual card and ensure there are no problems14; and  ensuring more collaboration between the Operations and Maintenance Team and the Development Team to address episodes quickly. The OTC is evaluating additional mitigation strategies, such as developing an automated process in ELIS to add a real-time view of duplicate cards that may have been produced in other systems. An interface between ELIS, the SMI database, and CPMS is being added to provide greater visibility when duplicate cards are delivered and subsequently returned to USCIS.

In addition, the OTC is collaborating with SCOPS to determine what additional quality checks are needed. Such strategies were still in the planning phase at the end of our audit fieldwork in June 2016. 13 Unit testing is a software development process in which the smallest testable parts of a system are individually tested for proper operation. Integration testing is a phase in which individual modules are combined and tested as a group.

A smoke test verifies that basic features work before they are deployed. 14 Interface testing ensures data transfers between various elements in the system are working correctly. 11 www.oig.dhs.gov OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Recommendations Recommendation 1: We recommend that the USCIS Director ensure ELIS design and functionality problems are corrected to prevent, to the extent possible, further Green Card processing errors. Recommendation 2: We recommend that the USCIS Director ensure development and implementation of the internal controls needed to ensure Green Card errors are identified and corrected early in the production process, prior to card issuance.

Card Recall Efforts Unsuccessful Due to Lack of Consistency and Urgency USCIS efforts to recover improperly issued Green Cards have not been effective. USCIS conducts recalls for all episodes, but recall efforts lacked consistency and urgency. Further, due to inadequate tracking, USCIS had difficulty determining the exact number of cards returned in response to these efforts. Based on the information available, we found that roughly 6,532 (or 34 percent) of the 19,001 Green Cards sent in error were unaccounted for, as listed in table 2.

Table 2: Green Card Episodes and Recovery Data15 Episode Date Number of Cards Affected Number of Cards Unaccounted For 1. 2. 3. Incorrect expiration dates Incorrect names or date of birth July 2013 May 2014 Incorrect “residence since” date Winter 2014 Incorrect birth and “residence since” date September 2015 4.

Duplicate cards issued 5. Duplicate cards issued Incorrect expiration dates 6. 7. 8.

Incorrect photos 9. Duplicate cards issued 10. Duplicate cards issued 11. Duplicate cards issued 12.

Duplicate cards issued 2,466 5,282 3,663 5,438 36 772 219 369 174 19 242 321 233 177 3,663 687 0 772 131 113 174 19 242 321 June 2015 June 2015 June 2015 November 2015 March 2016 April 2016 April 2016 May 2016 TOTALS 19,001 6,532 (34%) Source: OIG analysis of USCIS data 15 USCIS could not provide recall information for the episodes noted in italics. www.oig.dhs.gov 12 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Inconsistent and Untimely Recall Efforts To recover Green Cards issued in error following an episode, USCIS sends notices to affected individuals, providing instructions on how and where to return the cards. However, recall efforts conducted over the past 3 years lacked consistency. Each recall effort was managed by a designated office according to the risk level associated with the episode. USCIS offices did not employ a standardized process for how to contact affected individuals.

After most episodes took place, USCIS made multiple attempts to contact the individuals by email and/or a series of hard-copy letters. In other cases, USCIS either made only one attempt to reach individuals or was not able to confirm whether any attempt was made. Without a uniform approach for conducting recall efforts across all offices or locations, the agency cannot ensure that impacted customers are receiving clear or timely instructions on how to return improperly issued cards. In addition, USCIS did not have a standard timeframe for how soon to issue recall letters after an episode occurred.

There was no consistent management attention or urgency to initiating the recall actions. For instance, as of June 2016, USCIS had not begun recall efforts for a number of episodes from the spring of 2016; these recall efforts were still in the early stages of planning. Further, although a letter for the July 2013 episode was drafted and mailed within 2 weeks, the letter for the September 2015 episode took 6 weeks to be mailed. Officials said the variance was due in part to the internal review process for issuing letters, which included multiple offices and individuals.

For example, a designated lead in the OTC or another USCIS Program Office may be responsible for drafting a customer notice. Subsequently, all customer communications are vetted and reviewed by multiple agency stakeholders such as CSPED, SCOPS, and Counsel before final approval and signature. USCIS has a procedure to flag Green Cards sent out in error but did not consistently use it to prevent cards from being potentially misused by the recipients. When inappropriately issued cards are not recovered, the agency can flag the cards in TECS in order to alert CBP, ICE, and other law enforcement agencies of the potential for illegal activity or cards with incorrect information to be used for immigration and benefits-related purposes.16 This is referred to as a “TECS-hit” or establishing a TECS record.

Per USCIS guidance, a TECS record must be created for all lost, stolen, or unrecoverable cards; however, USCIS could not confirm whether this procedure was followed after each episode.17 For example, USCIS officials stated TECS-hits were placed on 16 TECS is the principal system used by officers at the border to assist with screening and determinations regarding admissibility of arriving persons. The system is owned by CBP. 17 USCIS TECS Records Creation Standard Operating Procedure, dated June 13, 2013, identifies the process for issuing TECS-hits. www.oig.dhs.gov OIG-17-11 13 OFFICE OF INSPECTOR GENERAL Department of Homeland Security unrecovered cards following the July 2013 and May 2014 episodes, but officials were not able to confirm this was done for the 10 later episodes. Further, USCIS did not have a standard timeframe for establishing TECS-hits.

In one instance, TECS-hits were not requested until May of 2016 for an episode that took place 8 months prior, in September 2015. To the extent that USCIS does not successfully recover cards issued in error, individuals can potentially misuse the cards to obtain benefits or illegally stay in the country. For example, when USCIS issued roughly 2,500 conditional residence cards in 2013 with the wrong expiration dates, its Immigration Records and Identity Services Directorate became concerned that the 233 unaccounted for cards are still with recipients indicating validity for 10 years rather than 2 years as required. Even if a TECS-hit had been placed on these cards, they would still be in the physical possession of the individuals who had received them.

Inadequate Tracking of Returned Cards USCIS could not provide an accurate number of cards recovered by the end of our audit fieldwork in June 2016. The agency struggled to obtain accurate counts because various recall efforts were led by different USCIS offices. In most cases, USCIS headquarters relied on regional service centers to maintain up-to-date inventories of cards returned to each location. For example, the TSC maintained spreadsheets to log each card as it was returned following at least three separate episodes between 2013 and 2015.

TSC shared these spreadsheets with headquarters during each recall effort and provided us copies upon request during our audit. However, episodes managed by other offices or locations during that same timeframe did not have the same level of awareness. For example, the National Benefits Center was unable to provide information, stating further research was needed, for card recall attempts in at least two episodes that occurred in 2014 and 2015. Recommendations Recommendation 3: We recommend that the USCIS Director ensure development and implementation of a standard process for card recovery efforts.

Recommendation 4: We recommend that the USCIS Director ensure development and implementation of a standard procedure for identifying and preventing unrecoverable cards from being used. www.oig.dhs.gov 14 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Recommendation 5: We recommend that the USCIS Director implement a centralized method to track and document Green Cards that are returned through recovery efforts. Missing Cards Attributable to Multiple Factors Over the last 3 years, USCIS received over 200,000 reports from approved applicants about missing cards. The number of cards sent to wrong addresses has incrementally increased since 2013 due in part to complex processes for updating addresses, ELIS limitations, and factors beyond the agency’s control. Increasing Service Requests Regarding Missing Green Cards Service requests initiated by USCIS customers claiming they did not receive Green Cards have steadily increased from 44,519 in FY 2013, to 67,247 in FY 2014, and 92,645 in FY 2015.

For the 3-year period, this represents an overall increase, from 3 percent to 4.5 percent, of the total Green Cards mailed each year. Figure 6 depicts this increase in service requests for missing cards, though it should be noted that some service requests may be duplicates if a customer contacted the agency more than once. Figure 6: Service Requests for Non-Delivered Cards s t s e u q e R e c i v r e S f o r e b m u N 100,000 80,000 60,000 40,000 20,000 0 FY13 FY14 FY15 Source: USCIS CSPED metrics as of June 2016 USCIS leadership acknowledged that non-delivery cases, although a small percentage of total cards issued, are a significant concern. The agency admittedly cannot quantify the exact number of cards improperly delivered, since there is no way to detect fraudulent intent when a customer reports he or she did not receive a card.

Customer complaints regarding the non-delivery of Green Cards have remained in USCIS’ top 10 most common service requests since FY 2011. www.oig.dhs.gov 15 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security The CIS Ombudsman has also experienced a steady increase in requests for assistance regarding the non-delivery of Green Cards.18 Typical requests include case assistance for adjudication delays and delivery problems. Whereas the Ombudsman received only 13 requests in FY 2013 from customers needing help, such requests increased to 83 in FY 2015, and had already climbed to 97 for FY 2016 by June 2016. The Ombudsman’s 2016 Annual Report to Congress highlighted concerns with mail delivery failure and the potential consequences for USCIS customers, such as having to re-file an application and repay the application fee. Two USPS OIG studies regarding Green Cards reported missing by USCIS customers substantiate these findings.

In October 2015, the USPS OIG researched 3,000 complaints of Green Cards missing or stolen between March 2014 and October 2015 and found that all were marked as delivered. Its June 2016 study of 18,000 cards reported missing between January and April 2016 confirmed that over 95 percent were delivered as addressed. The USPS OIG concluded that although the reason for the high percentage of missing cards could not be attributed to one cause, more secure delivery methods should be used, such as signature confirmation or certified mail, where individuals are required to sign for the packages. Challenges to Ensuring Delivery of Secure Documents USCIS integrity is highly dependent on secure mailings to the correct addresses for eligible immigrants.

The increases we found in cards sent to wrong addresses since 2013 can be attributed to complex processes for updating addresses, ELIS limitations, and factors beyond the agency’s control. Innovative measures are needed to help ensure proper delivery of immigration benefits documents. Address Change Process The Code of Federal Regulations requires that immigration documents be mailed directly to the applicant using the address provided, unless USCIS is notified of an address change.19 Applicants are required to report address changes within 10 days of moving.20 Efficient USCIS address change procedures are critical since immigrant applicants typically do not have permanent addresses. 18 The USCIS Ombudsman is an independent, impartial resource that assists individuals with case- related problems.

19 8 Code of Federal Regulations 103. USCIS will also mail notices to an applicant’s legal representative, if authorized. 20 8 Code of Federal Regulations 265 requires aliens to report a change of address within 10 days of moving. www.oig.dhs.gov OIG-17-11 16 OFFICE OF INSPECTOR GENERAL Department of Homeland Security However, USCIS’ current process for updating a customer address is complex, involving multiple steps. A customer contacts USCIS to initiate the process, but then faces numerous options for submitting a change of address.

The most common options are submitting an address change form, known as an AR-11, either online or by mail; calling the National Customer Service Center; or visiting a USCIS field office in person. Submitting an address change may be further complicated if the customer has pending or recently approved immigration benefit applications in process, requiring additional steps to ensure the address changes are captured on those other applications as well. The new address must be documented in several non-integrated USCIS systems containing customer information, including the Service Request Management Tool and CPMS. The update also must be separately entered into ELIS, the primary application for processing Green Cards.

ELIS Limitations The ELIS design makes it difficult for TSC personnel to enter address changes quickly enough to keep up with customer demand. The TSC monthly processes an average of 50,000 cases, each of which needs address confirmation before mailing. Because ELIS lacks the capability to easily update addresses, USCIS personnel must enter entirely new addresses into the system when customers request address changes. Service center personnel stated that entering new addresses each time there is an update is a burdensome process, as it entails 13 distinct steps.

The TSC submitted a system enhancement request in December 2015 to reduce the number of steps, but this had not yet been implemented as of June 2016. TSC personnel stated this has resulted in a high number of cards mailed out before address changes are completed. The TSC personnel also stated ELIS does not always accurately display address information, often eliminating or cutting off critical elements such as apartment numbers due to field character limitations. If an address is truncated, clerks sometimes enter the service center address for delivery to avoid further issues.

In other words, the clerks address the cards to themselves in efforts to keep the cases moving and prevent the cards from being mis- delivered until they can determine how to correct the problems and direct the cards to the legitimate recipients. As a further complication, ELIS does not automatically default to the most recent address in its case history. Unless a box is checked, clerks cannot easily determine which of the addresses listed in the system has become the current primary address. After a card enters production, an address update can sometimes be accomplished during the 72-hour hold before printing and mailing, but only by certain individuals with the appropriate case access level.

This hold is the final opportunity for USCIS personnel to take any corrective actions needed before card printing. Once the 72-hour window expires, all update actions are locked. www.oig.dhs.gov 17 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security As of April 2016, the number of TSC personnel who could change addresses during the hold period was less than two dozen. This was not enough staff to cover the high volume of address change requests for all USCIS documents each month at the TSC. Customers can update their profile pages in ELIS.

Given the ELIS design, however, there is no electronic mechanism in place to verify the identity of whoever accesses the system to request the address change.21 Instead, as a security measure, USCIS will only mail a Green Card to the United States address an applicant provides to a Department of State consular officer or a CBP officer at a port of entry. For more than 2 years, the OTC has been working to provide a remote identity-proofing capability that will allow immigrants to securely change their addresses in ELIS through an automated verification process. OTC officials hoped to add this functionality to ELIS in July 2016, but as of August 2016 this enhancement had not been deployed. In the meantime, CSPED personnel sought to raise awareness by issuing public reminders about how to update an address if an applicant moves after arriving in the United States.

The reminder messages are displayed on the monitors in USCIS field office waiting rooms, on the USCIS website, and in USCIS Immigrant Fee handouts. Other Factors The increasing number of missing cards may also be attributed to factors beyond the agency’s control. In some cases, customers fail to report their new addresses to USCIS or may not do so in a timely manner. External events — including mailbox theft, misrouted mail, mail delivered to incorrect locations, or mail intercepted by co-located family or friends — may also thwart card delivery to the legitimate applicants.

In such cases, the onus is on the customer or the Postal Service to ensure proper deliveries. Additional Improvements Needed USCIS has struggled to manage these card delivery issues for some time. During the past year, USCIS officials have weighed a number of alternative delivery options, including signature confirmation, hold for pickup, and certified mail. In April 2016, the USCIS Senior Policy Council decided to test the hold for pickup option, which entails leaving cards at a Post Office for customers to collect them.

CSPED plans to pilot this program for 6 months in 2017. USCIS leadership favored this option because it provides additional signature and tracking information at no additional cost to the customer. 21 Office of Management and Budget Memorandum M-04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003. See also the National Institute of Standards and Technology Special Publication 800-63-2, August 2013. www.oig.dhs.gov 18 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security CSPED is also hoping to improve the address change process on the USCIS website.

Specifically, the office plans to include USPS Address Verification for customers who submit address changes online. This involves the use of Address Verification software, which corrects spelling and formatting errors and ensures addresses are entered in the standard USPS format. Recommendations Recommendation 6: We recommend that the USCIS Director complete and implement identity-proofing capability to enable customers to submit address changes online in ELIS. Recommendation 7: We recommend that the USCIS Director evaluate the costs and benefits of using USPS’ Signature Confirmation as an alternative secure method for delivering Green Cards to applicants.

Improperly Issued Green Cards Increase Risks, Workload, and Costs Improperly issued Green Cards can pose significant risks and burdens for the agency. Errors can result in approved applicants unable to obtain benefits, maintain employment, or prove lawful immigration status. In the wrong hands, Green Cards may enable terrorists, criminals, and illegal aliens to remain in the United States and access immigrant benefits. Responding to card issuance errors has also resulted in additional workload and corresponding costs, as USCIS spent just under $1.5 million to address card-related customer inquiries in FY 2015 alone.

Denied Benefits for Approved Applicants Green Cards issued with incorrect personal information can have severe consequences for applicants who have become lawful permanent residents. Individuals use Green Cards to prove identity when applying for public benefits, such as drivers’ licenses or Social Security cards. The applicant’s eligibility is verified when the card is scanned and cross-checked against databases such as E-Verify or the Systematic Alien Verification for Entitlements program.22 Green Cards issued with the wrong name, birthdate, or photo could create confusion for Federal, state, and local agencies that 22 E-Verify is an Internet-based system that compares information from an employee's Form I-9, Employment Eligibility Verification, to data from U.S. Department of Homeland Security and Social Security Administration records to confirm employment eligibility. www.oig.dhs.gov 19 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security administer benefits.23 Recipients possessing such cards could experience denial of benefits or possible card confiscation with accusations of fraudulent intent. This creates unnecessary hardship for the applicant who must reapply for a corrected card.

When cards are missing or not properly delivered, applicants may be unable to obtain or renew driver’s licenses, Social Security cards, employment without interruption, or authorization to exit and re-enter the United States. In such cases, approved applicants may not be able to exercise their rights as lawful immigrants. National Security Risks Green Cards issued in error can pose national security risks. Thousands of cards issued with incorrect information or in duplicate remain unaccounted for, creating opportunities for exploitation by individuals with malicious intent.

For instance, Green Cards that fall into the wrong hands may enable illegal immigrants to remain in the United States and demonstrate legal residence status to employers. The cards may be used to obtain various public benefits such as Social Security, Medicare, Veterans’ assistance, and government grants. Card holders might secure loans to purchase cars, homes, and travel. Drivers’ licenses, firearms, and concealed handgun licenses may be issued to card holders in certain states without restrictions.

Officials within CBP’s Fraudulent Document Analysis Unit confirmed that there is a huge black market demand for legal documentation such as Green Cards. Such credentials can be used by imposters to reside in the United States or access other individuals’ benefits. Hundreds of imposter cases are recorded each year, accounting for over 80 percent of all Green Card fraud-related cases. CBP recorded over 4,600 cases of imposter Green Cards between 2013 and 2015.

Additional Workload and Costs When Green Cards are not properly delivered, the agency incurs additional workload and costs that could have been avoided. Managing the day-to-day activities to address each Green Card episode has typically entailed assembling a “Tiger Team” comprised of up to 4 dozen personnel from across multiple program offices and locations to deal with the widespread implications of the card errors. For example, team members worked together to locate customer contact information, draft recall notices, process and track returned cards, and 23 Such as the U.S. Department of Housing and Urban Development, Social Security Administration, Transportation Security Administration, state-level Departments of Education, Health, and Motor Vehicles, and local social services. www.oig.dhs.gov 20 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security process applications for replacement cards. These efforts required several weeks or months to complete all relevant tasks.

The increasing number of returned cards also creates additional work for individual service center personnel. Handling returned cards at the TSC was previously a collateral duty; it now requires 8 employees as over 30,000 Green Cards were returned to that facility in FY 2015. Each returned card requires a number of specific personnel actions, such as filing the card and logging the card as received in the inventory tracking spreadsheet. Personnel must look up each customer case to determine whether a new mailing address has been received since the original card was issued.

In addition, each time a customer issues a complaint that a card was not received, service center personnel must search through drawers of returned cards to try to locate the one in question. At the time of our visit in April 2016, the TSC had over 15,000 returned cards in its possession. Further, CSPED addresses thousands of customer inquiries every month regarding non-delivery of Green Cards, soliciting the efforts of multiple USCIS personnel to research and manage each case. Customers may make inquiries online or by phone.

For example, there are three possible levels of assistance for customers who call the National Customer Service Center and require help beyond the automated navigation menu. First, a live customer service representative will attempt to resolve the inquiry. If resolution is not reached, the service request is forwarded to another USCIS office, or routed to a USCIS officer with access to USCIS systems. As a final resort, calls may be escalated to a supervisory USCIS officer possessing the ability to contact other USCIS offices to obtain help in addressing issues that require immediate or direct assistance.

The associated cost of dealing with these customer inquiries has significantly increased over the last few years. Specifically, the cost to USCIS for receiving and responding to non-delivery service requests nearly doubled from $780,267 in FY 2013 to $1,488,082 in FY 2015. CSPED indicated the approximate cost to respond to a typical service request regarding an undeliverable secure document is between $10.85 and $14.46. We used the lower estimate of $10.85 to illustrate these costs in figure 7. www.oig.dhs.gov 21 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Figure 7: Cost for Card Delivery Service Requests, FY 2013–2015 $1,500,000 $1,300,000 $1,100,000 $900,000 $700,000 s t s e u q e R e c i v r e S f o t s o C FY13 FY14 FY15 Source: USCIS CSPED Metrics as of June 2016 Until USCIS takes the steps needed to prevent card issuance errors, the upward trend in agency costs, as well as the risks to applicants and national security, is only likely to continue.

OIG Analysis of USCIS Comments We obtained written comments on a draft of this report from the Director of USCIS. We have included a copy of the comments in their entirety in appendix B. In the comments, the USCIS Director appreciated the OIG acknowledging that the number of Green Cards containing errors actually represents a very small percentage of the total number of Green Cards issued by the agency each year. Also, the Director recognized the importance of further reducing these errors to the fullest extent possible and expressed commitment to improving USCIS processes and systems to accomplish that goal. The USCIS Director concurred with all of our recommendations.

We reviewed the Director’s comments, as well as the technical comments previously submitted under separate cover, and made changes to the report as appropriate. Following is our evaluation of the Director’s general comments, as well as his response to each recommendation in the draft report provided for agency review and comments. OIG Response to General Comments:  Regarding the Green Cards that were produced with inaccurate information or in duplicate, the Director emphasized that the individuals who received those cards were lawful permanent residents and were entitled to Green Cards. Therefore, while there may have been errors with data on the cards or issuance of duplicate cards, it is not precise to www.oig.dhs.gov 22 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security indicate that USCIS inappropriately issued Green Cards.

In addition, the Director stated that it is in the best interest of the individuals who received cards with data errors to follow specific USCIS procedures to return and replace those cards. Individuals who received multiple cards should either return the duplicate cards to USCIS or keep them safe to protect against identity theft. The Director stated that the inference that a substantial number of these recipients might put their identities at risk by misusing the cards is questionable. We disagree with the Director’s assertion.

To the extent that USCIS does not successfully recover cards issued in error, improper recipients can potentially misuse the cards to obtain benefits or stay in the country illegally. For example, as stated in our report, when USCIS issued roughly 2,500 conditional residence cards in 2013 with the wrong expiration dates, its Immigration Records and Identity Services Directorate became concerned that 233 unaccounted for cards, indicating validity for 10 years rather than 2 years as required, were still with recipients. Even if a TECS record had been established to flag these cards, the cards would remain in the possession of the individuals who had received them. Further, as we state in this report, officials within CBP’s Fraudulent Document Analysis Unit confirmed that there is a black market demand for legal documentation such as Green Cards.  The Director reiterated that the number of cards issued with errors is a very small percentage of the total number of Green Cards issued by the agency each year.

However, the Director pointed out that figure 4 and the accompanying narrative indicating that the number of errors has “steadily increased” over the past 3 years could benefit from greater context. Specifically, the Director took issue with our excluding 2016 data in figure 4, although we included it in tables 1 and 2. The Director asserted that including the 2016 data in figure 4 would have shown a precipitous drop in the Green Card error rate following FY 2015, attributable to USCIS’ efforts in this area. Moreover, the Director indicated that the error rate increase illustrated in figure 4 was very small, only about four one-thousandths of a percent of the total volume of cards issued.

We did not include FY 2016 data in figure 4 because the full year’s worth of data was not available when we completed our audit fieldwork in June 2016. We reviewed figure 4 and corrected the graphic to show that the error rate increased from one-tenth of a percent to approximately five- tenths of a percent from FY 2013 to FY 2015 although, as the Director asserted, this remained a very small percent increase of the total volume of cards issued. www.oig.dhs.gov 23 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  The Director clarified our finding throughout the report that USCIS mailed Green Cards to the “wrong address.” The Director stated that USCIS' standard practice is to mail Green Cards to the last known address on record, using a U.S. Postal Service that provides confirmation of delivery. The Director agreed that it is a challenge to have applicants timely provide address updates to USCIS for input to the appropriate systems as quickly as possible. As such, USCIS continues its outreach efforts to remind applicants of their responsibility to update their addresses, and to do so online when that capability becomes available.

We state in our report that the increase in cards sent to the wrong addresses since 2013 may be attributed to factors beyond USCIS’ control, such as applicants failing to report changes of address. We also recognize that external events, such as mailbox theft, misrouted mail, mail delivered to incorrect locations, or mail intercepted by co-located family or friends may also thwart card delivery to the legitimate applicants. Without up-to-date address information, the Postal Service cannot ensure proper deliveries. To safeguard the integrity of the Green Card program, we believe it is incumbent upon USCIS to pursue every measure possible to ensure secure mailings to eligible immigrants.  The Director opined that our report statement that “over 200,000 of the cards recorded as delivered during the last 3 years were reported by customers as missing” does not take into consideration that the number of calls does not equate to the number of missing cards.

He explained that many applicants call multiple times, and some receive their cards after calling the National Customer Service Center. Further, the Director stated that a number of those calls may reflect instances in which no card was sent, or the card sent was returned by the U.S. Postal Service to USCIS. During our audit, USCIS officials admittedly could not quantify the exact number of cards improperly delivered. Nonetheless, we have revised our report to state that “over the last 3 years, USCIS received over 200,000 reports from approved applicants about missing cards” instead of citing 200,000 cards as missing.  The Director took issue with our draft report statement that unrecovered cards pose potential national security risks and opportunities for exploitation by individuals with malicious intent.

The Director countered that the Green Cards that USCIS issues are highly tamper resistant with three layers of security features. As such, a card would need to not only fall into the hands of someone with malicious intent, but also with a physical resemblance to the individual for whom the card was intended. www.oig.dhs.gov 24 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security We acknowledge in our report that Green Cards contain numerous built- in security features designed to prevent fraud. However, we stand firm in our position that unrecovered cards create potential national security risks and opportunities for exploitation. As we stated in our report, officials within CBP’s Fraudulent Document Analysis Unit confirmed that there is a demand for legal documentation such as Green Cards.

Hundreds of imposter cases are recorded each year, accounting for over 80 percent of all CBP Green Card fraud-related cases. For example, CBP recorded over 4,600 cases of imposter Green Cards between 2013 and 2015.  The Director stated that whenever USCIS identifies instances of issuance of duplicate cards, cards with incorrect information, or cards not received by the intended recipient, USCIS takes steps to render the card invalid in the appropriate DHS systems. Therefore, anyone who checks against USCIS systems to verify an individual's status would receive information that the card is invalid. Invalidated cards cannot be used to seek immigration benefits because USCIS conducts biometric checks and validates the applicant's eligibility at the time the new benefit request is made.

Nonetheless, the Director advised that USCIS will review the possibility of expanding this process of invalidating cards to include instances where individuals complain about missing cards. In our report, we discussed that USCIS did not consistently follow its process to flag Green Cards sent out in error. As a result, USCIS was unable to certify that no missing cards were potentially misused by recipients. Further, USCIS did not have a standard timeframe for invalidating cards issued in error.

In one instance, 8 months passed before USCIS took steps to invalidate cards issued in error. We believe the Director’s plan to potentially expand this process may be beneficial. Response to Report Recommendations: In the formal written comments, the Director concurred with all of our recommendations. Following is a summary of USCIS management’s response to each recommendation and our analysis.

Recommendation 1: Ensure ELIS design and functionality problems are corrected to prevent, to the extent possible, further Green Card processing errors. www.oig.dhs.gov 25 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Management Comments The Director concurred with recommendation 1, stating that USCIS' OTC has built-in controls to mitigate issuing cards with inaccurate information in the new ELIS system. Within OTC, work was underway to create alerts and queries with other systems in the workflow to assist in identifying duplicate cards before the duplicates were created or sent. The Director estimated that these actions would be completed by December 30, 2016. OIG Analysis We agree that the plans and actions described above to improve system controls and information sharing between systems in the Green Card processing workflow should help to prevent further errors.

This recommendation will remain open and resolved until USCIS provides evidence it has completed the steps described above to prevent further Green Card processing errors. Recommendation 2: Ensure development and implementation of the internal controls needed to ensure Green Card errors are identified and corrected early in the production process, prior to card issuance. Management Comments The Director concurred with recommendation 2, stating that OTC was working to improve ELIS testing, both automatic and exploratory, and build in stricter regression testing to improve identification and correction of errors. The Director estimated that these actions would be completed by April 28, 2017.

Further, the Director stated that USCIS has implemented a number of internal controls in CLAIMS 3 to prevent Green Card issuance errors. Specifically, after a card request has been submitted to the National Production System through the Enterprise Print Management Service (EPMS), no changes can be made to the request. CLAIMS 3 returns a “duplicate” request error to the adjudicator if the same case number is submitted to the production queue within a 72-hour timeframe. To prevent duplicate card creation due to systematic issues, each card request has a specific transaction identification number, which returns an error if the same number is submitted multiple times.

Once a card has been produced, a duplicate card cannot be requested in CLAIMS 3 without a two- person authorization for production. All USCIS authorized personnel can access the card queue system to determine the current status of a card request. www.oig.dhs.gov 26 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security OIG Analysis We agree that the actions described above to improve testing and build in stricter regression testing should help ensure Green Card errors are identified and corrected early in the production process. This recommendation will remain open and resolved until USCIS provides evidence that it has developed and fully implemented all testing and internal controls needed to ensure Green Card errors are identified and corrected prior to card issuance. Recommendation 3: Ensure development and implementation of a standard process for card recovery efforts.

Management Comments The Director concurred with recommendation 3, stating that USCIS' CSPED will lead a review of previous end-to-end processes for card recovery efforts and lessons learned to develop a Standard Operating Procedure for these efforts. The Director estimated that these actions will be completed by January 31, 2017. OIG Analysis The plans described to develop a standard operating procedure for card recovery efforts satisfy the intent of the recommendation. This recommendation will remain open and resolved until USCIS provides evidence that it has developed and implemented a standard process for card recovery efforts.

Recommendation 4: Ensure development and implementation of a standard procedure for identifying and preventing unrecoverable cards from being used. Management Comments The Director concurred with recommendation 4, again citing CSPED’s plans to lead a review of end-to-end processes and lessons learned for card recovery efforts and develop a Standard Operating Procedure by January 31, 2017. OIG Analysis We agree with USCIS’ plans as described to develop a standard operating procedure for card recovery efforts. USCIS should ensure this procedure also includes a method for identifying and preventing unrecoverable cards from being used.

This recommendation will remain open and resolved until USCIS www.oig.dhs.gov 27 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security provides evidence that it has developed and implemented a standard procedure for identifying and preventing unrecoverable cards from being used. Recommendation 5: Implement a centralized method to track and document Green Cards that are returned through recovery efforts. Management Comments The Director concurred with recommendation 5, agreeing that a centralized method to track and document card recovery efforts would be beneficial. CSPED will explore how tracking will occur and where it would be best situated within USCIS.

The Director estimated that these actions will be completed by March 31, 2017. OIG Analysis The plans described to establish a centralized method to track and document card recovery efforts satisfy the intent of the recommendation. This recommendation will remain open and resolved until USCIS provides evidence that it has implemented a centralized method to track and document Green Cards that are returned through recovery efforts. Recommendation 6: Complete and implement identity-proofing capability to enable customers to submit address changes online in ELIS.

Management Comments The Director concurred with recommendation 6, stating that USCIS has already developed an online process to remotely verify a new immigrant's identity. The Director explained that this process provides additional security by ensuring that only the applicant can access and update his or her information in an online USCIS account. The first phase of this process began on July 12, 2016. USCIS is piloting this capability and plans to implement it fully by January 31, 2017.

OIG Analysis We agree that USCIS’ plans to implement an online process may improve its ability to remotely verify a new immigrant's identity. This recommendation will remain open and resolved until USCIS provides evidence that it has fully implemented identity-proofing capability to enable all customers to submit address changes online in ELIS. www.oig.dhs.gov 28 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Recommendation 7: Evaluate the costs and benefits of using USPS’ Signature Confirmation as an alternative secure method for delivering Green Cards to applicants. Management Comments The Director concurred with recommendation 7. He stated that, in addition to pursuing other options, USCIS previously conducted an in-depth analysis of the costs and benefits of using USPS' Signature Confirmation as a secure method for delivering Green Cards to applicants.

The Director estimated that corrective actions will be completed by June 30, 2017. OIG Analysis USCIS’ plans for reviewing alternative secure methods for delivering Green Cards are a step in the right direction. This recommendation will remain open and resolved until USCIS provides evidence that it has evaluated the costs and benefits of using USPS’ Signature Confirmation as an alternative secure method for delivering Green Cards to applicants. www.oig.dhs.gov 29 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix A Objective, Scope, and Methodology As part of our ongoing responsibilities to assess the efficiency, effectiveness, and economy of departmental programs and operations, we audited USCIS' processes and procedures for printing and mailing Green Cards to applicants. Specifically, our objective was to assess the extent to which USCIS has inappropriately issued Green Cards, evaluated its actions to recover the cards, and assessed its actions and plans to prevent similar incidents in the future.

We researched and reviewed Federal laws and agency guidance, policies, and procedures related to Green Card eligibility, production, and distribution. We obtained documents, congressional testimony, and news articles regarding Green Cards. Additionally, we reviewed published Government Accountability Office and DHS OIG reports to identify prior findings and recommendations. We used this information to establish a data collection approach that consisted of interviews with relevant stakeholders, focused information gathering, documentation analysis, selected site visits, and system demonstrations to accomplish our inquiry objectives.

We held more than 30 meetings and participated in teleconferences with USCIS staff at headquarters and at field offices to learn about Green Card processing. At headquarters, we met with representatives of the Office of Transformation Coordination, Management Directorate, Office of Intake and Document Production, Document Management Division, Customer Service and Public Engagement Directorate, Fraud Detection and National Security, Office of Information Technology, Field Operations Directorate, and Service Center Operations Directorate. We interviewed USCIS officials, including the Office of Transformation Coordination Chief, Office of Management Associate Director, Field Operations Directorate Acting Associate Director, Field Operations Directorate Deputy Associate Director, Service Center Operations Associate Director, and Customer Service and Public Engagement Deputy Associate Director to discuss their roles and responsibilities related to Green Card processing. We also held meetings and participated in teleconferences with individuals from the USCIS Ombudsman’s Office, CBP, ICE, and USPS.

We visited USCIS Service Centers in Texas and Virginia in April and May 2016 respectively. We also conducted a teleconference with the National Benefits Center. During our field visits, we met with executive personnel, Section Chiefs, Immigration Services Officers, and ELIS end-users to understand system requirements and use in the field. We discussed USCIS’ Green Card processes, IT environment, user involvement, system challenges, and communication with headquarters and collected supporting documentation. www.oig.dhs.gov 30 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security We conducted this performance audit between April and June 2016 pursuant to the Inspector General Act of 1978, as amended, and according to generally accepted government auditing standards.

Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based upon our audit objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based upon our audit objectives. www.oig.dhs.gov 31 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix B Agency Comments to the Draft Report www.oig.dhs.gov 32 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security www.oig.dhs.gov 33 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security www.oig.dhs.gov 34 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security www.oig.dhs.gov 35 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security www.oig.dhs.gov 36 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix C Office of IT Audits Major Contributors to This Report Kristen Bernard, Director Kristen Fogarty, Audit Manager Swati Nijhawan, Senior Program Analyst Gregory Flatow, Program Analyst Sagen Gearhart, Program Assistant Richard Saunders, Referencer www.oig.dhs.gov 37 OIG-17-11 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix D Report Distribution Department of Homeland Security Secretary Deputy Secretary Chief of Staff Deputy Chiefs of Staff General Counsel Executive Secretary Director, GAO/OIG Liaison Office Assistant Secretary for Office of Policy Assistant Secretary for Office of Public Affairs Assistant Secretary for Office of Legislative Affairs Director, USCIS Deputy Director, USCIS Liaison, USCIS Office of Management and Budget Chief, Homeland Security Branch DHS OIG Budget Examiner Congress Congressional Oversight and Appropriations Committees www.oig.dhs.gov 38 OIG-17-11 ADDITIONAL INFORMATION AND COPIES To view this and any of our other reports, please visit our website at: www.oig.dhs.gov. For further information or questions, please contact Office of Inspector General Public Affairs at: [email protected]. Follow us on Twitter at: @dhsoig.

OIG HOTLINE

To report fraud, waste, or abuse, visit our website at www.oig.dhs.gov and click on the red "Hotline" tab. If you cannot access our website, call our hotline at (800) 323-8603, fax our hotline at (202) 254-4297, or write to us at: Department of Homeland Security Office of Inspector General, Mail Stop 0305 Attention: Hotline 245 Murray Drive, SW Washington, DC 20528-0305