At least four of the terrorists involved in last month’s deadly Paris attacks were French citizens. This means that, under the terms of the Visa Waiver Program, they could have legally entered the U.S. with nothing more than their passports. After Paris the Obama administration announced updates to the program, such as better tracking of “past travel to countries constituting a terrorist safe haven” and “fines from $5,000 to $50,000 for air carriers that fail to verify a traveler’s passport data.” These measures aren’t nearly enough.

The Visa Waiver Program allows as many as 20 million citizens from 38 countries—including Japan, Australia and much of Europe—to travel to the U.S. for up to 90 days without the extra layers of security attached to their procuring a visa at a U.S. consulate. The program has encouraged tourism and business that benefit America. It also allows Americans to travel abroad to these countries with minimal hassle.

But the program has two serious security gaps. The first is that the U.S. has become wholly dependent upon the competence and thoroughness of the countries that participate. Visitors’ eligibility for entry under the Visa Waiver Program is determined by the Electronic System for Travel Authorization. But a 2012 audit by the Government Accountability Office found that roughly 364,000 people reached the U.S. in 2010 “without verified ESTA approval.” This security gap, long ignored, has now become enormously important.

Over the past two years, thousands of European citizens have gone to Syria to fight with ISIS, and these killers are returning to Europe. Because they travel through covert channels, evading passport controls, in many cases European security agencies don’t know who went where. These men and women can travel freely under the European Union’s Schengen Agreement, which has done away with border controls among 26 European countries.

Getting into the Middle East from Europe—and back again to Europe—without being monitored by a European security agency has never been easier. And if these agencies don’t know, we don’t know. ISIS today is likely working hard to identify a group of Europeans who can reach America with only a perfunctory security check to launch an attack. That cannot be allowed to happen.