New U.S. Customs and Border Protection (CBP) regulations took effect this month that combine two bad ideas — fees to encourage foreigners to visit the US by charging them more to do so, and fees for the Electronic System for Travel Authorization (ESTA) — in a way that creates new possibilities for travel surveillance and control that are far worse than either component alone.

The Interim Final Rule for ESTA and Travel Promotion Act fees took effect on an emergency basis on September 8, 2010, with public comments and objections being taken only after the fact. In promulgating the new rule, CBP continues to ignore the objections we raised to the fundamental illegality of the ESTA scheme. CBP also continues to ignore the Presidential Directive that it consider in its rulemakings US obligations under international human rights law, and continues to claim, in direct contravention of the applicable law, that it doesn’t need to consider the impact of the rule on individuals because “individuals are not small economic entities”, despite the fact that a sole proprietor, freelancer, or other self-employed individual is the epitome of a small economic entity (as the DHS has itself admitted in response to some of our previous objections to this same false boilerplate claim in other rulemakings). And it remains unclear if and when an ESTA is actually required, or how the “requirement” is supposed to be enforced.

But the most problematic consequences of the new rule result from the new requirement, completely lacking in statutory authority, that the the new “travel promotion” and ESTA fees can be paid only by one of four specified brands of credit or debit cards.  This implies:

1. Travel control by credit and debit card issuers: If you do not have one of these four types of cards, you cannot travel to the US intending to enter under the Visa Waiver Program (VWP), but may enter the US only if you obtain a visa at a cost of at least US$135 plus a personal interview at a US consulate or embassy (for which there may be a waiting list of several months). Since the regulations impose no obligations whatsoever on the issuers of these cards, this means that collectively the four companies (Visa, MasterCharge, American Express, and Discover) have absolute, secret, standardless commercial veto power over eligibility for VWP entry to the US.
2. Universal financial surveillance of VWP travellers: Because the credit or debit card details must be provided as part of the same online ESTA application with the would-be visitor’s personal information, it is now illegal to travdel to the US intending to enter under the VWP without having at least one currently valid credit or debit card on file with CBP and linked to your identifying and travel details.  As some news reports have already noted, this creates new possibilities for financial surveillance of travelers. All of the four acceptable types of cards are issued through US-based commercial entities, so all records related to them can be accessed by the US government in secret, without warrant, through “National Security Letters”. Even if you use a different card while in the US, it will in almost all cases be linkable through card application or other banking records (such as those obtainable by the US government from SWIFT or other companies through the “Terrorist Finance Tracking Program”).
3. Vastly increased potential for identity theft, phishing, and other ESTA-based fraud: Because ESTA requires entry through an easy-to-imitate website of exactly the sort of personal information that’s needed for identity theft, together with travel itinerary information that makes it easy to carry out the attack while the victim is away from home and less likely to notice or be able to respond quickly and effectively, ESTA phishing and fraud are already rampant.  But the addition of current valid credit or debit card data to the online-only ESTA application requirements has put phony ESTA websites in the vanguard of current phishing techniques. Already, most of the top search results for “ESTA application” in the languages of countries in the VWP are fraudulent phishing sites, and the problem is getting steadily worse. We can tell you that the only legitimate ESTA application website is at https://esta.cbp.dhs.gov — but how do you, or anyone else, know to believe us rather than to believe any of the other bogus websites that say otherwise?:Visitor beware!