Problems with the new ESTA

The US has just deployed a new weapon against those evil foreigners who hate our freedoms so much. Now we’re going to keep all you terrorists out by making it too annoying to enter the country.

Enter the Electronic System for Travel Authorization (ESTA). In a nutshell, almost all non-US citizens from visa-waiver countries (including Japan) have to register online before entering the US. You can read all about the details elsewhere.

I took a look at the Japanese version of the website and noticed some very large holes in the implementation.

• The translation is confusing and broken in parts. There were sentences that just cut off halfway through.

• Due to the details of Japanese text input on computers, you have to specifically tell users to enter single-byte characters in text forms, and actually enforce the this requirement with proper input validation because many people don’t really understand the difference. This is unless, of course, you’re prepared to handle double-byte alphanumerics on the back end. (Example: ABC123 is single-byte, ＡＢＣ１２３ is double-byte. More info on Wikipedia.)

  Anyway, the form tells you to enter your info in the Latin alphabet (rōmaji), but nowhere does it specify single-byte. I wanted to test the form to see how well it coped with double-byte characters, but I didn’t want the DHS knocking down my door in the middle of the night.

• The website is not designed with mobile access in mind (or so I assume; I couldn’t even connect to the site on my AU phone). Many, many Japanese people don’t have PCs, and do all their internet activities on their mobile phones with very limited browsers.
• The website does no geo sniffing and ignores preferred language settings, defaulting to English and throwing up a giant legalese JavaScript popup. Talk about unfriendly.

Ultimately I suspect that people will end up leaving all this bullshit to travel agents, and very few people will personally deal with the system on any level (unless that’s not allowed for some reason).

Even if they fix the above problems, I think that this is yet another highly unnecessary act of security theater that will accomplish nothing but to annoy people, waste tax dollars, and serve as another potential vector for personal information to be lost or stolen.

USA! USA! USA!