Daniel just got back from the U.S., and he's still buzzing about something most travelers barely register — an approval email that landed in his inbox within hours. He's made his second trip on an Israeli passport since Israel joined the Visa Waiver Program, and he says the significance of that milestone still hasn't been fully appreciated. He feels proud and grateful, and he wants to understand the machinery behind it.
What he's asking is this. The ESTA process is streamlined, his approval comes through in a few hours, but that speed makes him suspect it's not fully automated — even though he can't imagine how humans could be reviewing every application given the volume. He wants the history of when and why the U.S. instituted this requirement, how many other countries have some early authorization layer, and what border authorities actually gain from it that they couldn't get from the old model where airlines simply enforce visa rules and people without valid visas don't travel in the first place. He also notes Israel has adopted its own version, and he's curious about that lineage.
The answer to almost every one of those questions runs through a single insight, and it's not the one most coverage leads with. ESTA isn't a security check in the way people assume. It's a liability transfer dressed up as a screening tool.
That's a strong opening claim. Walk me through it.
Let me define the thing precisely first, because the definition does half the work. ESTA is the Electronic System for Travel Authorization. It applies only to citizens of Visa Waiver Program countries — people who can already enter the U.S. without a visa for up to ninety days for business or tourism. It is not a visa. It's an authorization to board a carrier heading to the U.S. The final admissibility decision still happens at the border, with a CBP officer. ESTA is a pre-boarding gate, not a replacement for the border interview.
So it's a permission slip to get on the plane, not a permission slip to enter the country.
And that distinction matters, because it tells you who the system is really for. It's not primarily for the traveler. It's for the airline. Before ESTA, an airline checking in a passenger to a U.S.-bound flight had to make a judgment call: does this person's passport look valid, do they have a visa or a visa waiver, do they seem likely to be admitted? And if the airline got it wrong, it faced fines — thousands of dollars per improperly transported passenger — plus the cost of flying that person back. The airline was the de facto enforcer of U.S. immigration rules, and it absorbed the risk.
And airlines are famously thrilled about absorbing risk.
They hated it. So when the U.S. government came along after nine eleven and said, we'll make the admissibility call ourselves, before you even sell the ticket, the airlines were the quietest and most enthusiastic lobbyists you've ever seen. It shifted the entire enforcement burden from the check-in counter to a database.
Let's go back to nine eleven, because that's where the story actually starts. The Visa Waiver Program itself dates to nineteen eighty-six. For two decades after that, citizens of participating countries just showed up at the airport with a passport, and the airline checked that the passport was valid and maybe that there was an onward ticket. The actual decision about whether you could enter happened when you landed.
And the nine eleven hijackers exploited a hole in that system. Fifteen of the nineteen entered the United States legally, on tourist or business visas. The system had no way to flag them before they were on U.S. soil, because the only real vetting happened at the border itself, and at the border they presented as ordinary travelers. The attacks revealed that the United States was making admissibility decisions after people had already arrived at the point where the decision was most consequential and least informed.
So the Intelligence Reform and Terrorism Prevention Act of two thousand four mandated that the Department of Homeland Security develop an electronic travel authorization system for Visa Waiver Program travelers. That's the statutory origin. ESTA went live in August two thousand eight, initially as a voluntary program. It became mandatory in January two thousand nine. And the fee arrived in September twenty ten — fourteen dollars at the time. It's now twenty-one dollars, with four going to a travel promotion fund and seventeen to DHS for border security operations.
The fee structure is honestly one of the more elegant details. Four dollars of every application funds Brand USA, the tourism promotion agency. So every German or Japanese or Israeli traveler who applies for ESTA is partially subsidizing the marketing campaign that convinces more people to visit the United States. It's a self-licking ice cream cone.
A self-licking ice cream cone that also funds border security. Bureaucracy at its most efficient.
Now, Daniel's observation about speed — that approvals come within hours, sometimes minutes, and that this suggests the system can't be fully automated — that's actually backwards. The speed is the evidence that it IS automated. What's not automated is the subset that gets flagged.
Explain the triage.
When you submit an ESTA application, you're providing biographical data and answering a series of admissibility questions — criminal history, communicable diseases, prior immigration violations, travel to certain countries. The system runs that against watchlists and databases. Most applicants come back clean almost instantly, because there's nothing to review. A smaller subset gets flagged for manual scrutiny. A tiny fraction gets denied. The speed most people experience is the system doing exactly what it was designed to do: clear the low-risk majority algorithmically so that human attention can focus on the exceptions.
So it's not that a human is somehow reviewing every application in two hours. It's that the algorithm decides most applications don't need human review at all, and the ones that do get held. Daniel's instinct that humans are involved somewhere is correct — they're just not involved in the part he experienced.
And that's the key insight about what border authorities gain from ESTA that they couldn't get from the old airline-enforcement model. The old model was reactive. The airline looked at a passport and made a guess. If the guess was wrong, the problem was discovered at the border, after the person had already traveled. ESTA makes the process proactive. The government runs the check before the traveler books the flight, before they pack a bag, before they show up at the airport. The airline's job becomes verifying that a valid authorization exists, not making an admissibility judgment.
That's also why the airline fine structure matters. Carriers face penalties of thousands of dollars per improperly transported passenger. Before ESTA, that risk was on the airline every single time. After ESTA, the airline can point to the government's own authorization and say, you told us this person was cleared. The liability shifted.
Which brings us to the global picture, because the United States did not invent this concept. It popularized it, it weaponized it for security screening, but the underlying idea — an electronic pre-authorization before travel — dates back further.
Australia.
Australia launched its Electronic Travel Authority in nineteen ninety-six. That's twelve years before ESTA went live. But Australia's system was originally a visa waiver mechanism, not a security screening tool. It was about streamlining entry for tourists while maintaining immigration control. The innovation of the U.S. ESTA was applying the same electronic pre-authorization concept to counterterrorism screening. That's why ESTA became the template the rest of the world copied, even though it wasn't first.
And the rest of the world has been copying it at a remarkable clip. As of twenty twenty-six, at least thirty countries or territories have some form of electronic travel authorization or pre-screening requirement for visa-exempt visitors. That's a quiet revolution in border management, and most travelers experience it as a minor form to fill out.
Let me run through the major systems, because the list itself tells a story. Canada launched its eTA in twenty sixteen. New Zealand launched the NZeTA in twenty nineteen. South Korea launched K-ETA in twenty twenty-one. The United Kingdom began rolling out its Electronic Travel Authorisation in twenty twenty-three, and it's been expanding through twenty twenty-four and twenty twenty-five. Sri Lanka has a system. Kenya has a system. Several other countries have introduced similar schemes.
And then there's the big one still pending. The European Union's ETIAS — the European Travel Information and Authorisation System — which will require citizens of visa-exempt countries to obtain pre-travel authorization before entering the Schengen Area. It's been delayed repeatedly. It was originally slated for twenty twenty-three or twenty twenty-four. As of September twenty twenty-six, it's expected to go live in twenty twenty-seven. Seven euro fee, approval valid for three years.
The delays are worth noting, because they reveal how hard it is to build one of these systems across twenty-seven member states with different border agencies, different databases, different privacy regulations. The United States built ESTA as a single national system. The EU is trying to build something equivalent across a continent, and it's been slipping for years.
And then there's the one Daniel experienced firsthand. Israel's ETA-IL system launched in twenty twenty-four, initially for citizens of visa-exempt countries including the U.S., Germany, and others. Travelers apply online before departure, pay a small fee, and receive approval before boarding. Israeli officials have explicitly acknowledged that the system was modeled on the ESTA framework.
That's the part Daniel's pride connects to. Israel joined the Visa Waiver Program, which meant Israelis could travel to the U.S. without a visa, and then Israel adopted the ESTA model for its own inbound travelers. So the relationship is reciprocal — the U.S. opened its borders to Israelis, and Israel adopted the American screening architecture for its own borders. It's a kind of security alignment that goes beyond just travel policy.
There's something deeper here about the social contract of international travel. For most of aviation history, the presumption was that a citizen of a friendly country could visit another friendly country with minimal friction. A passport check at the border was sufficient. The post-nine eleven era inverted that. Now the presumption is that everyone is a potential threat until algorithmically cleared.
And what's striking is how little public debate accompanied that shift. Travelers largely accepted it as a minor inconvenience. Fill out a form, pay twenty-one dollars, get an email, move on. But the underlying change is profound. The state now makes a preliminary admissibility decision about you before you've even booked a flight. That decision is made by an algorithm you can't see, using databases you can't access, and if the algorithm says no, your recourse is limited.
Daniel's point about this being an additional layer that most countries don't levy on casual ninety-day visitors is well taken. But the direction of travel is clear. The countries that don't have such a system are increasingly the exception, not the rule. And the systems are converging on a common architecture: online application, small fee, algorithmic triage, approval valid for multiple years, airline verification at check-in.
There's a knock-on effect worth naming. These systems create a digital paper trail that didn't exist before. Every ESTA application, every ETA-IL application, every eTA application is a data point. The government knows when you applied, where you said you were going, what you answered about your criminal history, your health, your prior travel. That data can be used for overstay tracking, for security investigations, for analytics about travel patterns. The screening is the visible function. The data collection is the invisible one.
And the cost shift is real too. Vetting someone at the border is expensive — it requires a human officer, a physical location, time. Vetting someone digitally before they travel is cheap — it's a database query. By moving the screening earlier, the state shifts the cost of vetting from itself to the traveler, who now has to fill out the form, pay the fee, and deal with any technical problems. It's a privatization of the inconvenience.
I want to push back on one part of Daniel's framing, though. He says it's easy to see ESTA as just another part of travel, but it's actually an additional layer most countries don't levy. That's true today. But the trajectory suggests it won't be true for long. When ETIAS goes live, the Schengen Area — twenty-seven countries — will require pre-authorization. The UK already does. Canada, Australia, New Zealand, South Korea, Israel. The countries that don't have such a system are increasingly the ones without the infrastructure or the tourist volume to justify it.
So the question isn't whether this is an unusual additional layer. It's whether we're watching the last years of the era when it was unusual.
And I think the answer is yes. The ESTA model has normalized the idea that governments screen travelers before they board. The next frontier is likely biometric matching and risk-scoring based on travel patterns. Some systems already collect biometric data at the border. The question is whether that data gets integrated into the pre-authorization layer, so that the algorithm isn't just checking your answers against watchlists, but also evaluating your face, your fingerprints, your travel history.
That's the part where the social contract gets uncomfortable. An ESTA application is a form you fill out. A biometric pre-clearance is a body you surrender. The first feels like bureaucracy. The second feels like something else.
The Australia caveat matters here, because it shows that the concept wasn't always about security. Australia's ETA started as a way to streamline entry for tourists while maintaining immigration control. It was about efficiency, not threat detection. The U.S. ESTA was the pivot point where the same tool got pointed at counterterrorism. And once that pivot happened, the efficiency argument became secondary to the security argument, and the security argument is much harder to push back on.
Because who wants to be the politician who voted against screening travelers?
Right. And that's why the systems spread so fast. The cost of implementing one is low. The political benefit of having one is high. The cost of not having one is being the country that didn't screen its visitors before the next attack.
Daniel's point about the volume of applicants is worth sitting with for a second. He says he can't imagine how the system could be fully automated given the volume. But the volume is exactly why it has to be. The U.S. processes millions of ESTA applications a year. There's no human workforce that could review every one of those in the time travelers expect. The only way to handle the volume is to automate the triage and reserve human review for the exceptions.
The exceptions are where the system's real character shows. Most people never see that side of it. They apply, they get approved, they fly. But the people who get flagged — because of a name similarity, a prior overstay, a trip to a country on a watchlist — they experience a very different system. Delays, requests for more information, denials with no clear explanation and no obvious appeal mechanism. The frictionless experience for the majority depends on a high-friction experience for the minority.
That's the algorithmic triage in a nutshell. The system is designed to be as frictionless as possible for the vast majority while still catching the exceptions. Daniel's experience — approval in a few hours, no friction — is the system working as intended for someone who doesn't trip any flags.
That's not nothing. It's a genuine achievement of systems design. But it also means the system's failures are concentrated on the people least able to navigate them. If you're a citizen of a Visa Waiver Program country with a clean record and a straightforward itinerary, ESTA is a minor formality. If you're a citizen of the same country with a name that matches someone on a watchlist, ESTA is a Kafkaesque ordeal.
The privilege of the unremarkable.
That's exactly the phrase.
Let's take stock of where we are. ESTA is not a visa, it's a pre-boarding authorization. It was created because nine eleven revealed that the old system made admissibility decisions too late and with too little information. It works by algorithmic triage — most applicants are cleared automatically, a subset gets human review. And it shifted the enforcement burden from the airline to the government, which is why airlines quietly loved it.
It spawned a global wave. Thirty-plus countries now have some version of it. Israel's ETA-IL is a direct descendant. The EU's ETIAS is the next big one. Australia's ETA was the precursor that proved the concept. Canada, New Zealand, South Korea, the UK — they've all built their own.
The deeper implication is that the presumption of free movement between friendly countries has been inverted. The default is now suspicion until clearance. And that shift happened with remarkably little public debate.
There's one more thing I want to flag before we move on. The ESTA fee structure — twenty-one dollars, with four going to tourism promotion and seventeen to border security — is a reminder that these systems are also revenue streams. They're not just security infrastructure. They're user-funded programs. The traveler pays for the privilege of being screened. And the screening itself generates data that has value beyond the immediate security context.
The traveler pays to provide the state with data that the state uses for purposes the traveler never sees. It's a remarkable bargain when you spell it out.
Most travelers never spell it out. They just fill in the form and move on. Which is, in a way, the system's greatest success. It's become invisible.
Hilbert: You keep saying the airlines loved it. They didn't love it at first. I worked for a travel technology company in Melbourne in the late nineties — we built the backend booking systems for airlines running the Australia-Asia routes. When the Australian ETA launched, we had to integrate the verification checks into the reservation flow. The airlines hated it. It added a step, it created new failure points, it slowed down the booking process. There were meetings where grown men yelled about milliseconds of latency.
Hilbert: Then the fines started getting enforced properly. Before ETA, if an airline carried someone who got denied at the border, the airline ate the cost of flying them back plus the penalty. That could run thousands of dollars per passenger. After ETA, the government was making the call in advance. The airline wasn't making a judgment anymore, it was just checking a flag in a database. The liability shifted. And suddenly the same people who'd been yelling about latency were asking us to make the check faster.
That's the liability transfer I was describing, but from the inside. The airlines didn't just quietly accept it — they initially resisted it and then realized it protected them.
Hilbert: The U.S. copied that logic wholesale. ESTA is Australia's liability shift with better branding. The Australians built it to streamline tourist entry and accidentally created the tool the Americans would use for counterterrorism screening. Nobody in Melbourne in nineteen ninety-six thought they were building the template for global border security. We thought we were making the booking process slightly less annoying.
The accidental architect of the surveillance state.
Hilbert: The accidental architect of a database query that runs a few hundred times a day. My old company still has a server in a Melbourne data center handling ETA verification queries. It's running code I wrote in nineteen ninety-eight. I checked recently. Still processing thousands of queries a day. That code has outlived three Australian governments.
Wait. You wrote the verification code in nineteen ninety-eight and it's still running?
Hilbert: Parts of it. They've patched around it over the years, but the core query logic is still mine. I was twenty-four years old, I didn't know what I was doing, and I wrote something that's now quietly underpinning a global system of border screening. If I'd known it would still be running in twenty twenty-six, I'd have used better variable names.
That's remarkable. A piece of pre-nine eleven Australian code, written by a twenty-four-year-old who didn't know what he was doing, is still processing verification queries for a system that became the model for border security worldwide.
Hilbert: The funny thing is, the code doesn't know what it's doing either. It just checks a name against a database and returns a yes or a no. It has no idea it's part of a global security architecture. It's just a query.
That's the whole system in miniature, honestly. The grand security architecture is built out of small, mundane components — a database query here, a form field there, a fee structure someone designed in an afternoon. And those components accumulate into something that shapes how billions of people cross borders.
Hilbert: The fee was my idea, by the way. Not the amount, but the idea of charging for it. I suggested it in a meeting as a joke. Someone took it seriously.
Of course they did.
Hilbert: Anyway. The code's still running. I don't know if that's reassuring or terrifying. Probably both.
That's a wild thought to sit with. But it raises a bigger question about where all this is heading. If ETIAS goes live in twenty twenty-seven, and the UK's ETA keeps expanding, and more countries build their own versions, we're approaching a point where every international journey requires some form of digital pre-authorization. The era of just showing up at a border with a passport is ending.
The systems making these decisions are increasingly automated. The question is what recourse a traveler has when an algorithm says no. With a human border officer, you can appeal, you can explain, you can show documents. With an algorithm, you get an email that says denied, and the path to challenge it is opaque.
The next frontier is probably biometric matching and risk-scoring based on travel patterns. Some systems already collect biometric data at the border. The question is whether that gets integrated into the pre-authorization layer, so the algorithm isn't just checking your answers but also evaluating your face, your movements, your history.
Whether travelers will accept those layers as readily as they accepted ESTA. My guess is yes, because the convenience argument is powerful. Most people experience these systems as a minor formality, and they don't think about the architecture underneath. The friction is invisible until it isn't.
Daniel's pride in Israel's VWP inclusion is a reminder that these systems are also about access. They open doors even as they add layers of scrutiny. For an Irish-born Israeli citizen, the ability to travel to the U.S. on an Israeli passport without a visa is a genuine milestone. It's a recognition of a relationship.
The fact that Israel then adopted the ESTA model for its own borders shows how that recognition flows both ways. The U.S. opened a door, and Israel adopted the American screening architecture. It's a security alignment that goes beyond travel policy.
The one thing I'll take from this is that the ESTA model didn't just add a layer to travel. It changed who makes the admissibility decision, when they make it, and what the traveler has to do to be allowed to board. The border didn't disappear. It just moved earlier, into a database query that runs before you book your flight.
That database query might be running on code written by a twenty-four-year-old in Melbourne who didn't know what he was doing. Which is either the most reassuring or the most terrifying fact we've uncovered today.
Thanks to our producer Hilbert Flumingtop for keeping the show running, and for the code that's apparently still running too.
This has been My Weird Prompts, the human-AI collaboration podcast. Email us at show at my weird prompts dot com with your own prompts and questions.
We'll be back soon.
