JAN. 1, 2016

WASHINGTON — The question from the congressman to the Obama administration official was straightforward enough: How many foreign visitors overstay their visas every year?

The reply was simple too, but not in a satisfying way. “We don’t know,” the official said.

The testy exchange during a recent congressional hearing between Representative Mark Meadows, Republican of North Carolina, and Alan Bersin, the assistant secretary for international affairs at the Department of Homeland Security, highlights what some law enforcement officials call a critical weakness in the United States foreign visa program.

The issue has taken on added urgency as part of a broader examination of immigration policy following the mass shootings in San Bernardino, Calif., that left 14 people dead and 22 wounded. Tashfeen Malik, one of the attackers, was granted entry to the United States under a K-1 visa, also known as a fiancé visa. Her husband, Syed Rizwan Farook, was an American-born citizen. Both died in a shootout with the police. While Ms. Malik did not overstay her visa, the attack added to fears that a terrorist could exploit gaps in the system.

Nearly 20 years ago, Congress passed a law requiring the federal government to develop a system to track people who overstayed their visas. After the attacks of Sept. 11, 2001, an entry and exit tracking system was seen as a vital national security and counterterrorism tool, and the 9/11 Commission recommended that the Department of Homeland Security complete a system “as soon as possible.” Two of the 9/11 hijackers, Satam al-Suqami and Nawaf al-Hazmi, had overstayed their visas.

Since then, the federal government has spent millions of dollars on the effort, yet officials can only roughly estimate the number of people in the United States illegally after overstaying visas.

Officials blame a lack of technology to conduct more advanced collection of data like iris scans, resistance from the airline and tourism industry because of cost, and questions about the usefulness of tracking people exiting the country as a counterterrorism measure.

Some experts also note that a sizable number of those who overstayed their visas are highly skilled workers who come under the H-1B program or are foreign students.

One widely cited statistic, from a 1997 report by the Immigration and Naturalization Service, puts the number of people who overstay their visas at 40 percent, about 4.4 million of the estimated 11 million undocumented residents in the United States. Numerous lawmakers, including the Republican presidential candidates Marco Rubio and Ted Cruz, have used that figure when trying to describe the scope of the problem. But even that number has never been conclusively substantiated.

Federal agencies have not provided a new report to Congress on overstays since 1994, despite the congressional mandate.

In early 2013, Janet Napolitano, then the secretary of Homeland Security, testified before Congress that the agency planned to issue a report on overstay rates by December 2013. The agency did not follow through because officials said they did not have confidence in the quality of the data. Mr. Bersin said last month that the report would be issued in the next six months.

Many members of Congress and some law enforcement officials worry that terrorists could exploit the visa program because the United States does not routinely collect biometric information — fingerprints, iris scans and photographs that can be used for facial recognition — of people leaving the country. Nearly three dozen countries, including many in Europe, Asia and Africa, collect such information.

“U.S. airports and other entry and exit points were never designed with departure control in mind,” said Theresa Cardinal Brown, the director of Immigration Policy at the Bipartisan Policy Center in Washington and a Department of Homeland Security official under President George W. Bush. “If we want to do that it’s going to mean building a lot more infrastructure.”

The 9/11 Commission report called the establishment of an entry and exit biometric system “fundamental to intercepting terrorists” trying to enter the United States because it would allow law enforcement officials to determine if a traveler had overstayed a visa.

Still, efforts to build such a system to collect the information have stalled for decades.

In 2004, lawmakers passed legislation that required Homeland Security officials to accelerate their efforts to create an automated biometric entry and exit data system.

Congress repeated its demand for a biometric exit system in 2007 and set a deadline for 2009. But the deadline passed, with the department putting into place only a handful of pilot programs.

Since then, the department has continued to struggle to meet this requirement. A 2013 report by the Government Accountability Office said the Department of Homeland Security had more than one million “unmatched” arrival records, meaning that those records could not be checked against other information showing that the individuals had left the country, but again the department could not offer a precise number.

Despite the call by some lawmakers for an exit system, airports and the airline industry have balked because it would cost airlines $3 billion, according to a 2013 Homeland Security estimate. The Department of Homeland Security issued regulations in 2008 requiring airports to collect biometric exit information, but carriers have largely ignored the regulation, and there have been no sanctions.

Some national security experts are not convinced that a biometric system would be an effective counterterrorism tool.

“A biometric exit system does little to help stop those who fail to register an exit — i.e., overstay their visas,” said David Inserra, a policy analyst on homeland security with the Heritage Foundation. “The system merely tells officials that an overstay has occurred, not if it is a false positive, a national security risk, or just an honest mistake.”

Mr. Inserra and other experts like Ms. Brown of the Bipartisan Policy Center added that Homeland Security did not have the resources to enforce existing immigration laws, let alone pursue all those who overstay their visas. The best way to deal with terrorism threats, they say, is to give more resources to intelligence agencies.

“The biometric exit system is not going to solve all our problems,” Ms. Brown said. “All it will ever do is just generate a really expensive list if there aren’t any additional resources allocated.”

The experts say the Department of Homeland Security would be better off using biographical information, such as a traveler’s name and date of birth, to track exits and collect overstay data.

But other experts say names and identifications like passports and travel documents are hardly foolproof.

Groups like the Islamic State have used fake passports and aliases to bypass border checkpoints and move from country to country, Janice Kephart, former counsel for the Senate Judiciary Committee and a staff member on the 9/11 Commission, said in congressional testimony last year.

She provided lawmakers with Islamic State documents that encouraged supporters to get fake credentials.

“Having accurate data on who is coming and going — not who is pretending to be coming and going — is essential to curtailing the insidious and increasing direct threat that ISIS is loudly declaring at our homeland,” said Ms. Kephart, who is now the chief executive of the Secure Identity and Biometrics Association, a trade group.