FIREARMS DATA

ATF Did Not Always 

Comply with the 

Appropriations Act 

Restriction and 

Should Better Adhere 

to Its Policies

Report to Congressional Requesters

June 2016

GAO-16-552

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-16-552, a report to 

congressional requesters

June 2016

FIREARMS DATA

ATF Did Not Always Comply with the Appropriations 

Act Restriction and Should Better Adhere to Its 

Policies

Why GAO Did This Study

ATF is responsible for enforcing certain 

criminal statutes related to firearms, 

and must balance its role in combatting 

the illegal use of firearms with 

protecting the privacy rights of lawabiding gun owners. As part of this 

balance, FFLs are required to maintain 

firearms transaction records, while ATF 

has the statutory authority to obtain 

these records under certain 

circumstances. ATF must also comply 

with an appropriations act provision 

that restricts the agency from using 

appropriated funds to consolidate or 

centralize FFL records. 

GAO was asked to review ATF’s 

compliance with this restriction. This 

report (1) identifies the ATF data 

systems that contain retail firearms 

purchaser data and (2) determines 

whether selected ATF data systems 

comply with the appropriations act 

restriction and adhere to ATF policies. 

GAO reviewed ATF policy and 

program documents, observed use of 

data systems at NTC, reviewed a 

generalizable sample of one system’s 

records, and interviewed ATF officials 

at headquarters and NTC. 

What GAO Recommends

GAO recommends that ATF provide 

guidance to FFLs participating in A2K 

on the provision of records to ATF

when they go out of business; align 

system capability with ATF policy to 

limit access to FRNP firearms 

purchaser information for ATF agents; 

and align timing and ATF policy for 

deleting MS records. ATF concurred 

with our recommendations.

What GAO Found

To carry out its criminal and regulatory enforcement responsibilities, the Bureau 

of Alcohol, Tobacco, Firearms and Explosives (ATF) has 25 firearms-related data 

systems, 16 of which contain retail firearms purchaser information from a federal 

firearms licensee (FFL)—such as firearms importers and retailers. GAO selected 

4 systems for review that are used in the firearms tracing process, based on 

factors such as the inclusion of retail purchaser information and original data. 

• The Out-of-Business Records Imaging System (OBRIS) stores 

nonsearchable images of firearms records from out-of-business FFLs. Such 

FFLs are required by law to provide their records to ATF. 

• Access 2000 (A2K) provides servers for National Tracing Center (NTC) 

personnel to electronically search participating FFLs’ records at their 

premises for firearms disposition information during a trace.

• The Firearm Recovery Notification Program (FRNP) maintains information on 

firearms that have not yet been recovered by law enforcement, but are 

suspected of being involved in criminal activity and are associated with an 

ATF criminal investigation.

• Multiple Sales (MS) includes firearms information from multiple sales reports. 

FFLs are required by law to report to ATF sales of two or more revolvers or 

pistols during 5 consecutive business days. ATF policy requires that certain

information in MS be deleted after 2 years if the firearm has not been 

connected to a trace.

Of the 4 data systems, 2 fully comply and 2 did not always comply with the 

appropriations act restriction prohibiting consolidation or centralization of FFL 

records. ATF addressed these compliance issues during the course of GAO’s 

review. ATF also does not consistently adhere to its policies. Specifically:

• OBRIS complies with the restriction and adheres to policy.

• A2K for in-business FFL records complies with the restriction. A2K for out-ofbusiness FFL records did not comply with the restriction because ATF 

maintained these data on a single server at ATF. Thus, ATF deleted the 

records in March 2016. In addition, ATF policy does not specify how, if at all, 

FFLs may use A2K records to meet out-of-business record submission 

requirements. Such guidance would help ensure they submit such records.

• FRNP generally complies with the restriction. However, a 2007 through 2009 

program using FRNP did not comply. ATF cancelled this program in 2009 

and deleted the related data in March 2016. Also, a technical defect allows 

ATF agents to access FRNP data—including purchaser data—beyond what 

ATF policy permits. Aligning system capability with ATF policy would ensure 

that firearms purchaser data are only provided to those with a need to know.

• MS complies with the restriction, but ATF inconsistently adheres to its policy 

when deleting MS records. Specifically, until May 2016, MS contained over 

10,000 names that were not consistently deleted within the required 2 years. 

Aligning the MS deletion policy with the timing of deletions could help ATF 

View GAO-16-552. For more information, maintain only useful MS purchaser data and safeguard privacy. contact Diana C. Maurer at (202) 512-9627 or 

maurerd@gao.gov, or Helen Desaulniers at 

(202) 512-4740 or desaulniersh@gao.gov.
Page i GAO-16-552 Firearms Purchaser Data

Letter 1

Background 6

ATF Has 16 Data Systems That Contain Retail Firearms 

Purchaser Data; Selected Systems Are Involved in Tracing 

Process 11

ATF Did Not Always Comply with the Appropriations Act 

Restriction and Does Not Consistently Adhere to Its Policies on 

Maintenance of Firearms Data 21

Conclusions 44

Recommendations for Executive Action 45

Agency Comments and Our Evaluation 45

Appendix I Objectives, Scope, and Methodology 49

Appendix II Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) FirearmsRelated Data Systems 55

Appendix III Out-of-Business Records Imaging System (OBRIS) 62

Appendix IV Firearm Recovery Notification Program Submission Form 65

Appendix V Multiple Sales Submission Form for Multiple Sales Reports 66

Appendix VI Multiple Sales Submission Form for Demand Letter 3 Reports 67

Appendix VII Legal Analysis of Compliance with the Restriction on Consolidation or 

Centralization of Firearms Records 68

Appendix VIII GAO Contacts and Staff Acknowledgments 92

Contents
Page ii GAO-16-552 Firearms Purchaser Data

Tables

Table 1: Multiple Sales (MS) Deletion Policy Requirement 

Implementation and Timing 42

Table 2: Selected Bureau of Alcohol, Tobacco, Firearms and 

Explosives (ATF) Firearms-Related Data Systems and 

Their Selection Criteria Based on System Design 51

Table 3: Selected Bureau of Alcohol, Tobacco, Firearms and 

Explosives (ATF) Firearms-Related Data Systems that 

Contain Retail Firearms Purchaser Information 55

Table 4: Other Bureau of Alcohol, Tobacco, Firearms and 

Explosives (ATF) Firearms-Related Data Systems That 

Contain Retail Firearms Purchaser Information 57

Table 5: Bureau of Alcohol, Tobacco, Firearms and Explosives 

(ATF) Firearms-Related Data Systems That Do Not 

Contain Retail Purchaser Information 61

Figures

Figure 1: Possible Scenario of a Firearm’s Purchase, Use in a 

Crime, and Law Enforcement Recovery 7

Figure 2: Firearms Tracing Process at National Tracing Center 

(NTC) 8

Figure 3: Role of Selected Data Systems in the Firearms Tracing 

Process 13

Figure 4: Numerous Out-of-Business Records File Boxes Lining 

the Halls at the Bureau of Alcohol, Tobacco, Firearms 

and Explosives’ National Tracing Center 62

Figure 5: Bureau of Alcohol, Tobacco, Firearms, and Explosives’ 

Microfilm Archive for Records from Out-of-Business 

Federal Firearms Licensees 64

Figure 6: Firearm Recovery Notification Program Submission 

Form (ATF Form 3317.1) 65

Figure 7: Multiple Sales Submission Form for Multiple Sales 

Reports (ATF Form 3310.4) 66

Figure 8: Multiple Sales Submission Form for Demand Letter 3

Reports (ATF Form 3310.12) 67
Page iii GAO-16-552 Firearms Purchaser Data

Abbreviations

A2K Access 2000

ATF Bureau of Alcohol, Tobacco, Firearms and Explosives 

DOJ Department of Justice

FFL federal firearms licensee

FIRES Firearms Information Reporting System

FLS Federal Licensing System

FOPA Firearms Owners’ Protection Act of 1986

FRNP Firearm Recovery Notification Program 

FTS Firearms Tracing System

MS Multiple Sales 

NFA National Firearms Act System

NFRTR National Firearms Registration and Transfer Record 

System

NIBIN National Integrated Ballistic Information Network

NICS National Instant Criminal Background Check System

NSOT National Firearms Act Special Occupational Tax System

NTC National Tracing Center

OBRIS Out-of-Business Records Imaging System

OMB Office of Management and Budget

SWBWOC Southwest Border Secondary Market Weapons of Choice

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-16-552 Firearms Purchaser Data

441 G St. N.W.

Washington, DC 20548

June 30, 2016

The Honorable Charles E. Grassley

Chairman

Committee on the Judiciary

United States Senate

The Honorable Jason Chaffetz

Chairman

Committee on Oversight and Government Reform

House of Representatives

The Honorable Darrell Issa

House of Representatives

As of 2013, there were an estimated 350 million firearms in the United 

States.1 Although many are owned by law-abiding individuals, firearms 

can be used for illegal purposes, and were involved in approximately 

10,000 murders in 2014 in the United States.2 The federal government 

has an important role in combatting the illegal use of firearms, and must 

balance this with protecting the privacy rights of law-abiding gun owners.

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), a 

criminal and regulatory enforcement agency within the Department of 

Justice (DOJ), is responsible for the regulation of the firearms industry 

and enforcing federal statutes regarding firearms, including enforcing 

criminal statutes related to the illegal possession, use, transfer, or 

 1

This estimate is based on our analysis of data on firearms manufacturing, importing, and 

exporting from the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) from 1899 

through 2013, including handguns, rifles, and shotguns. It does not include firearms 

produced for the U.S. military, but does include firearms sold to domestic law enforcement 

agencies. It does not include firearms imported to or exported from the United States 

illegally, or used firearms exported from the United States legally. It does not account for 

loss, breakage, or destruction of firearms. According to ATF, ATF’s data are based, in 

part, on information that is reported by manufacturers, some of whom do not report their 

data in a timely manner, if at all.

2

This figure is based on our analysis of data from the Federal Bureau of Investigation’s 

Uniform Crime Reports. It does not include justifiable homicides or suicides.

Letter
Page 2 GAO-16-552 Firearms Purchaser Data

trafficking of firearms, among other things. The Gun Control Act of 1968,3

as amended, established a system requiring federal firearms licensees 

(FFL)4 to record and maintain records of firearms transactions and make 

these records available to ATF for inspection under certain 

circumstances. To carry out its enforcement responsibilities, ATF 

maintains certain computerized information on firearms, firearms 

transactions, and firearms purchasers.

Over the years, Congress has balanced the law enforcement need for 

firearms retail purchaser information with the competing interest of 

protecting the privacy of firearms owners. To achieve this balance, 

Congress requires FFLs to provide certain firearms transaction 

information to ATF, while also restricting ATF’s maintenance and use of 

such information.5 Since 1979, Congress has restricted ATF from using 

appropriated funds to consolidate or centralize FFL records within the 

department where ATF is located.6 Through the years, members of 

Congress have raised questions about ATF’s oversight of these data 

restrictions, including whether ATF is complying with legal standards for 

entering firearms records into its data systems, whether ATF is 

inappropriately using its data systems to track information about firearms

owners, and whether ATF is complying with the restriction related to 

consolidating and centralizing data from FFL records. You asked us to 

review ATF’s compliance with this restriction.

 3

As originally enacted, the Gun Control Act of 1968 required FFLs to submit such reports 

and information as the Secretary of the Treasury prescribed by regulation and authorized 

the Secretary to prescribe such rules and regulations as deemed reasonably necessary to 

carry out the provisions of the act. At that time, ATF was part of the Department of the 

Treasury.

4

FFLs are persons—including companies—licensed by ATF, pursuant to federal firearms 

laws and regulations, to engage in a firearms business, such as manufacturing, 

purchasing, and selling firearms. FFLs include firearms manufacturers, importers, 

wholesalers, and retailers, among other things. 

5

For the purposes of this report, ATF maintaining information means keeping information 

at an ATF facility in a variety of formats—such as electronic and paper copies. Depending 

on the type of information, statutory and policy restrictions apply to ATF’s maintenance of 

the information, as discussed later in this report.

6

In 2003, ATF was transferred from the Department of the Treasury to DOJ pursuant to 

the Homeland Security Act of 2002, Pub. L. No. 107-296, §§ 1111-1115, 116 Stat. 2135, 

2274-80.
Page 3 GAO-16-552 Firearms Purchaser Data

This report examines the following objectives:

1. Identify the ATF data systems that contain retail firearms purchaser 

data and describe the characteristics of selected systems.7

2. Determine whether selected ATF data systems comply with the 

appropriations act restriction on consolidation or centralization of 

firearms records and adhere to ATF policies.

To address the first objective, we reviewed ATF policy and program 

documents to identify ATF data systems related to firearms, including 

ATF orders, system user manuals, and data submission forms. For the 

purposes of this report, “data systems” or “systems” refers to ATF’s data 

systems and system components, including what ATF refers to as 

“modules” of a larger system, and what ATF refers to as “programs” 

whose associated data are contained within related systems. We 

compared information from these policy and program documents to the 

systems identified in a GAO September 1996 report, and conducted 

searches of publicly available information to develop a comprehensive 

and current list of systems.8 In order to identify the systems and better 

understand them and their contents, we spoke with ATF officials in 

headquarters and at ATF’s National Tracing Center (NTC). We also 

discussed these systems with ATF investigative and regulatory officials in 

the Baltimore and Los Angeles field offices, who provided varying 

perspectives due to geographic factors.

We selected four systems for a more in-depth review: Out-of-Business 

Records Imaging System (OBRIS), Access 2000 (A2K), Firearm 

Recovery Notification Program (FRNP), and Multiple Sales (MS). We

selected systems that contained retail purchaser information and original 

 7

For the purposes of this report, “data systems” or “systems” refers to ATF’s data systems 

and system components, including what ATF refers to as “modules” of a larger system, 

and what ATF refers to as “programs” whose associated data are contained within related 

systems. 

8

GAO, Federal Firearms Licensee Data: ATF’s Compliance with Statutory Restrictions,

GAO/GGD-96-174 (Washington, D.C.: Sept. 11, 1996).
Page 4 GAO-16-552 Firearms Purchaser Data

records, among other criteria.9 For the selected systems, we reviewed 

ATF data on the number of system records, among other things—for 

OBRIS and A2K for fiscal year 2015, and for FRNP and MS from fiscal 

years 2010 through 2015. We assessed the reliability of these data by 

interviewing ATF staff and reviewing relevant documentation, and 

concluded that these data were sufficiently reliable for the purposes of our 

report. We reviewed ATF policy and program documents to obtain indepth descriptions of these selected systems, and discussed these 

systems with ATF officials. We visited NTC to observe the selected 

systems in operation.

To address the second objective, we reviewed relevant laws, including 

statutory data restrictions, and ATF policy and program documents. We 

also solicited the agency’s interpretation of the restriction on consolidation 

or centralization of records as applied to each of the systems, and 

interviewed ATF officials regarding the data systems’ compliance with 

that restriction and ATF policies. We visited NTC to observe how selected 

systems’ data are collected, used, and stored. We observed NTC 

analysts using the selected systems and observed the extent to which the 

systems are searchable for retail purchaser information. For OBRIS, 

FRNP, and MS, we observed NTC analysts receiving and entering data 

into the systems and processing the original data submissions.

For A2K, we reviewed budgetary information to determine the source of 

funding for the system for fiscal year 2008 through fiscal year 2014. We 

also interviewed representatives from the contractor that manages A2K, 

and 3 of 35 industry members that use A2K. We selected industry 

members that had several years of experience using A2K and reflected 

variation in FFL size and type. Although our interviews with these industry 

members are not generalizable, they provided us with insight on the 

firearms industry’s use of A2K.

In order to evaluate the contents of FRNP for the presence of retail 

purchaser information and adherence to the appropriations act restriction 

 9

A system was more likely to be selected if (1) it contained data unrelated to a criminal 

investigation, (2) a large percentage of system records contained retail purchaser 

information, (3) the retail purchaser information was searchable, or (4) ATF initiated the 

system—as opposed to ATF being statutorily required to maintain the system. App. I 

contains additional details on our selection criteria.
Page 5 GAO-16-552 Firearms Purchaser Data

and FRNP policies, we reviewed several fields of data for the entire 

population of records. During our site visit, we also reviewed additional 

fields of data for a generalizable sample of records and the associated 

submission forms that are used to populate the records.10 We assessed 

the reliability of the FRNP data by conducting electronic tests of the data 

for obvious errors and anomalies, interviewing staff responsible for 

managing the data, and reviewing relevant documentation, and 

concluded that these data were sufficiently reliable for the purposes of our 

report. For MS, we observed the process of querying to identify particular 

records.

We determined the selected data systems’ compliance with the 

appropriations act restriction, and compared them to multiple ATF policies 

on collection and maintenance of information, and criteria in Standards for 

Internal Control in the Federal Government related to control activities for 

communication and for the access to and design of information 

systems.11 See appendix I for additional information on our scope and 

methodology.

We conducted this performance audit from January 2015 to June 2016 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

 10All percentage estimates from the review of the generalizable sample of FRNP records 

have margins of error at the 95 percent confidence level of plus or minus 5 percentage 

points or less, unless otherwise noted. All percentage estimates from the review of 

submission forms have margins of error at the 95 percent confidence level of plus or 

minus 3 percentage points or less, unless otherwise noted. See app. I for additional 

details on our sampling methodology and record review.

11See GAO, Standards for Internal Control in the Federal Government, 

GAO/AIMD-00-21.3.1 (Washington, D.C.: Nov. 1, 1999), and Standards for Internal 

Control in the Federal Government, GAO-14-704G (Washington, D.C.: Sept. 10, 2014).
Page 6 GAO-16-552 Firearms Purchaser Data

ATF’s mission is to protect communities from violent criminals, criminal 

organizations, and illegal use and trafficking of firearms, among other 

things. To fulfill this mission, ATF has 25 field divisions located throughout 

the United States. To efficiently and effectively carry out its criminal 

enforcement responsibilities related to firearms, ATF maintains certain 

computerized information on firearms, firearms transactions, and firearms 

purchasers. To balance ATF’s law enforcement responsibility with the 

privacy of firearms owners, Congress has required FFLs to provide ATF 

certain information about firearms transactions and the ownership of 

firearms while placing restrictions on ATF’s maintenance and use of such 

data. In addition to its enforcement activities, ATF also regulates the 

firearms industry, including issuing firearms licenses to prospective FFLs, 

and conducting FFL qualification and compliance inspections.

A critical component of ATF’s criminal enforcement mission is the tracing 

of firearms used in crimes to identify the first retail purchaser of a firearm 

from an FFL. The Gun Control Act of 1968, as amended, established a 

system requiring FFLs to record firearms transactions, maintain that 

information at their business premises, and make these records available 

to ATF for inspection and search under certain prescribed circumstances, 

such as during a firearms trace.12 The system was intended to permit law 

enforcement officials to trace firearms involved in crimes while allowing 

the records themselves to be maintained by the FFLs rather than by a 

governmental entity.13 Figure 1 shows one possible scenario in which a 

firearm is purchased at an FFL, the FFL maintains records on the 

purchase, the firearm is used in a crime, and a law enforcement agency 

recovers the firearm and submits it for tracing.

 12Pub. L. No. 90-618, 82 Stat. 1213 (Oct. 22, 1968).

13For many firearms traces, ATF must consult FFLs to obtain the relevant firearms 

information. However, there are some categories of records that ATF does maintain. For 

example, when an FFL goes out of business permanently, the FFL must submit its records 

to ATF within 30 days. 18 U.S.C. § 923(g)(4).

Background

ATF Roles and 

Responsibilities

Firearms Tracing Process
Page 7 GAO-16-552 Firearms Purchaser Data

Figure 1: Possible Scenario of a Firearm’s Purchase, Use in a Crime, and Law Enforcement Recovery

Through the use of these records maintained by FFLs and provided to 

ATF in certain circumstances, ATF provides firearms tracing services to 

federal, state, local, and foreign law enforcement agencies.14 The 

objective of the trace is to identify the first retail purchaser of the firearm.15

To carry out its firearms tracing responsibilities, ATF maintains a firearms 

tracing operation at NTC in Martinsburg, West Virginia. As shown in figure 

2, NTC traces firearms suspected of being involved in crimes to the first 

retail purchaser to assist law enforcement agencies in identifying 

suspects.

 14These records include, among other things, an acquisition and disposition logbook and 

firearms transaction records (ATF Form 4473). Firearms transaction records include, 

among other things, the name of the purchaser, the type of firearm purchased, and the 

firearm model and serial number.

15According to ATF officials, subsequent purchasers of firearms may also be identified 

through certain NTC systems.
Page 8 GAO-16-552 Firearms Purchaser Data

Figure 2: Firearms Tracing Process at National Tracing Center (NTC)

NTC generally receives trace requests through eTrace, a web-based 

submission system, but also receives requests by fax, telephone, and 

mail.16 To conduct a trace, NTC must receive the recovered firearm’s 

description—including manufacturer and serial number—from the law 

enforcement agency. NTC determines the ownership of the firearm by 

first conducting automated checks of data systems that are maintained at 

NTC. If these automated checks do not identify a matching firearm 

description within the systems, an NTC analyst contacts the chain of 

distribution for the firearm—the series of businesses that are involved in 

manufacturing and selling the firearm. For example, after automated data 

system checks, an NTC analyst may call the manufacturer of the firearm, 

who informs NTC that the firearm was sold to a certain distributor. The 

NTC analyst will then call that distributor, and so on until the individual is 

 16eTrace is a paperless firearms trace request submission system and an interactive 

firearms trace analysis tool that provides an electronic exchange of crime gun incidentbased data in a secure web-based environment. Through eTrace, law enforcement 

agencies can electronically submit firearms trace requests, monitor the progress of traces, 

retrieve completed trace results, and query firearms trace-related data. eTrace includes 

analytical and download capabilities for ATF’s firearms trace information, including 

selective field searches and statistical reporting. According to ATF, as of May 5, 2016, 

eTrace has registered more than 6,160 law enforcement agencies, including agencies in 

42 foreign countries, and more than 42,570 individual eTrace accounts have been 

provisioned for law enforcement users.
Page 9 GAO-16-552 Firearms Purchaser Data

identified. For many traces, an FFL in the chain of distribution has gone 

out of business, so an NTC analyst must consult the FFL’s out-ofbusiness records, which are also maintained by NTC.

ATF documents each trace request and its results, and provides that 

information to the law enforcement requester. ATF considers a request 

completed when it traces the firearm to a retail purchaser, or when it 

cannot identify the purchaser for various reasons. For example, the 

description of the firearm as submitted by the requester may not have 

contained sufficient information to perform a trace. For fiscal year 2015, 

ATF received a total of 373,349 trace requests, completed 372,992 

traces, and identified a retail FFL or a purchaser of the traced firearm in 

about 68 percent of the completed traces.17

Since the passage of the Gun Control Act of 1968, Congress has passed 

provisions that place restrictions on ATF’s handling of FFL records. In 

1978, citing to the general authorities contained in the Gun Control Act, 

ATF proposed regulations that would have required FFLs to report most 

of their firearms transactions to ATF through quarterly reports. Under the 

proposed regulations, these FFL reports of sales and other dispositions 

would not have identified a nonlicensed transferee, such as a retail 

purchaser, by name and address.18 These proposed regulations 

prompted concerns from those who believed that the reporting 

requirements would lead to the establishment of a system of firearms 

registration. Since then, Congress has placed restrictions on ATF’s use of 

funds to consolidate or centralize firearms records, as discussed below.

• In 1978, the Treasury, Postal Service, and General Government 

Appropriations Act, 1979, prohibited the use of funds for 

administrative expenses in connection with the consolidation or 

centralization of FFL records at the agency, or the final issuance of 

 17The remaining 32 percent of completed traces did not identify a retail FFL or a 

purchaser of the traced firearm.

1843 Fed. Reg. 11,800 (Mar. 21, 1978). 

Statutory Data Restrictions
Page 10 GAO-16-552 Firearms Purchaser Data

the 1978 proposed regulations.19 This restriction was included in each 

of ATF’s annual appropriations through fiscal year 1993.20

• In 1993, the Treasury, Postal Service, and General Government 

Appropriations Act, 1994, removed the reference to the 1978 

proposed rules, but expanded the prohibition to include the 

consolidation or centralization of portions of records, and to apply to 

the use of funds for salaries as well as administrative expenses.21

This provision was included in each of ATF’s annual appropriations 

through fiscal year 2011.

• In 2011, the Consolidated and Further Continuing Appropriations Act, 

2012, made this restriction on ATF’s use of funds permanent.22

Specifically, the act stated

“[t]hat no funds appropriated herein or hereafter shall be available for salaries or 

administrative expenses in connection with consolidating or centralizing, within the 

 19Pub. L. No. 95-429, 92 Stat. 1001, 1002 (1978). The appropriations act restriction 

provided “[t]hat no funds appropriated herein shall be available for administrative 

expenses in connection with consolidating or centralizing within the Department of the 

Treasury the records of receipt and disposition of firearms maintained by Federal firearms 

licensees or for issuing or carrying out any provisions of the proposed rules of the 

Department of the Treasury, Bureau of Alcohol, Tobacco and Firearms, on Firearms 

Regulations, as published in the Federal Register, volume 43, number 55, of March 21, 

1978.”

20In addition, a provision of the Firearms Owners’ Protection Act of 1986 (FOPA), codified 

at 18 U.S.C. § 926(a), prohibited ATF from issuing any rule or regulation after the date of 

the enactment of FOPA that requires (1) records to be maintained pursuant to certain 

statutory provisions, or any portion of the contents of such records, to be recorded at or 

transferred to a facility owned, managed, or controlled by the United States or any state or 

political subdivision thereof or (2) any systems of registration of firearms, firearms owners, 

or firearms transactions or dispositions to be established.

21Pub. L. No. 103-123, 107 Stat. 1226, 1229 (1993), stated “[t]hat no funds appropriated 

herein shall be available for salaries or administrative expenses in connection with 

consolidating or centralizing, within the Department of the Treasury, the records, or any 

portion thereof, of acquisition and disposition of firearms maintained by Federal firearms 

licensees.”

22Pub. L. No. 112-55, 125 Stat. 552, 609-610 (2011). An additional provision, first enacted 

in 1996, was also made permanent in the fiscal year 2012 appropriations act. The 

Omnibus Consolidated Appropriations Act, 1997, limited the methods ATF could use to 

retrieve information from records transmitted to the agency by FFLs going out of business. 

It stated “[t]hat no funds under this Act may be used to electronically retrieve information 

gathered pursuant to 18 U.S.C. 923(g)(4) by name or personal identification code.” Pub. L. 

No. 104-208, 110 Stat. 3009, 3009-319 (1996).
Page 11 GAO-16-552 Firearms Purchaser Data

Department of Justice, the records, or any portion thereof, of acquisition and 

disposition of firearms maintained by Federal firearms licensees.”

ATF collects and maintains data from the firearms industry to carry out its 

criminal and regulatory enforcement responsibilities, and has established 

25 national ATF data systems relating to firearms to maintain the data it 

collects. Of these 25 data systems, the following 16 data systems contain 

retail firearms purchaser information:

1. Access 2000 (A2K)

2. ATF NICS Referral

3. Firearm Recovery Notification Program (FRNP)

4. Firearms and Explosives Import System

5. Firearms Information Reporting System

6. Firearms Tracing System23

7. eTrace

8. Interstate Theft

9. Multiple Sales (MS)

10. National Firearms Act System / National Firearms Registration and 

Transfer Record System

 23The Firearms Tracing System contains data related to, for example, FRNP, Interstate 

Theft, MS, and Trace, which we refer to as “systems” for the purposes of this report. 

ATF Has 16 Data 

Systems That Contain 

Retail Firearms 

Purchaser Data; 

Selected Systems Are 

Involved in Tracing 

Process

ATF Has 16 Systems with 

Retail Purchaser Data
Page 12 GAO-16-552 Firearms Purchaser Data

11. National Integrated Ballistic Information Network

12. NFORCE

13. NSPECT

14. Out-of-Business Records Imaging System (OBRIS)

15. Suspect Person Database

16. Trace

More details on these systems are provided in appendix II.

From the 16 data systems that contain retail purchaser information, we 

selected 4 systems for an in-depth review of compliance with the 

appropriations act restriction on consolidation or centralization, and 

adherence to ATF policies: OBRIS, A2K, FRNP, and MS, including 

Demand Letter 3. See appendix I for our selection criteria. These systems 

are operated and maintained by NTC and play a significant role in the 

firearms tracing process as shown in figure 3.

Four ATF Systems We 

Selected Are Used in the 

Firearms Tracing Process
Page 13 GAO-16-552 Firearms Purchaser Data

Figure 3: Role of Selected Data Systems in the Firearms Tracing Process

OBRIS is a repository of nonsearchable images of firearms records that 

allows NTC employees to manually search for and retrieve records during 

a firearms trace using an FFL number and a firearm description (e.g., 

OBRIS
Page 14 GAO-16-552 Firearms Purchaser Data

serial number).24 Out-of-business records are integral to the firearms 

tracing process. According to ATF officials, in approximately 35 to 38 

percent of trace requests, there is at least one entity in the chain of 

distribution that has gone out of business. Therefore, in more than onethird of firearms trace requests, NTC analysts must consult OBRIS at 

least once. According to ATF data, as of May 5, 2016, there were 

297,468,978 images of firearms records in OBRIS.25 Further, in fiscal 

year 2015, NTC accomplished 134,226 of 372,992 total completed trace 

requests using OBRIS.26

OBRIS was developed in 2006 to assist NTC with maintaining the out-ofbusiness FFL records that are received each year. By statute, when FFLs 

discontinue their businesses and there is no successor, the records 

required to be kept under the Gun Control Act of 1968, as amended, must 

be delivered within 30 days to the Attorney General.27 This includes all 

acquisition and disposition logbooks, firearms transactions records—such 

as Form 4473 that contains purchaser information—and other required 

records. NTC receives an average of about 1.9 million out-of-business 

records per month, of which a large percentage are paper-based.

Since 2006, when paper records are received from an FFL that has gone 

out of business, NTC scans them as TIFF image files and stores them in 

OBRIS.28 By design, the files are stored as images (with no optical 

character recognition) so that they cannot be searched using text 

 24The predecessor to OBRIS—the Microfilm Retrieval System—was one of the systems 

we reviewed for compliance in our prior report, GAO/GGD-96-174. In our prior report, we 

referred to the Microfilm Retrieval System as the Out-of-Business Records System. For 

the purposes of this report, nonsearchable means that the document is not searchable 

through character recognition using text queries. To locate OBRIS records, NTC 

employees manually search records identified through an index by FFL number or firearm 

description.

25ATF does not know how many firearms are represented by these OBRIS images since 

one image or multiple images can represent one or more firearms.

26A completed trace request is a trace request that has resulted in a successful 

identification of the first retail purchaser of the firearm, or that cannot identify the 

purchaser for various reasons. 

27See 18 U.S.C. § 923(g)(4).

28Tagged-Image File Format (TIFF) is a computer file format used for storing images.
Page 15 GAO-16-552 Firearms Purchaser Data

queries.29 In addition, ATF sometimes receives electronic FFL out-ofbusiness records in the forms of computer external removable drives and 

hard drives. In these cases, ATF converts the data to a nonsearchable 

format consistent with OBRIS records. During processing of OBRIS 

records, NTC conducts a quality-assurance process, including document 

sorting, scanning, and error checks on 100 percent of the records 

received. Officials stated that the imaged records are maintained 

indefinitely in OBRIS. For more information on OBRIS, see appendix III.

ATF implemented A2K in 1995 at the request of firearms industry 

members to allow manufacturer, importer, and wholesaler FFLs to more 

efficiently respond to requests from NTC for firearms traces.30 By statute, 

FFLs are required to respond within 24 hours to a firearms trace—a 

request from ATF for firearms disposition information—needed for a 

criminal investigation.31 Normally, when an NTC analyst contacts an FFL 

in the chain of distribution during a trace, the analyst contacts the FFL by 

phone, fax, or e-mail. ATF officials reported that this can be burdensome 

if the FFL receives a large number of trace requests, and that such 

requests can number more than 100 per day. With A2K—a voluntary 

program—the participating industry member uploads electronic firearms 

disposition records (i.e., information on the FFL or, in rare cases, the 

individual to whom the firearm was sold) onto a server that ATF owns and 

maintains, but is located at the site of the industry member.32 A2K 

provides a secure user web interface to this server, through which 

authorized NTC personnel can search—by firearm serial number only—to 

obtain disposition data for a firearm during a trace.

 29Optical character recognition technology allows recognition of printed text using optical 

scanners and software, which convert the text to digital data.

30According to ATF, A2K FFLs are manufacturers, importers, and wholesalers, but not 

retailers. However, NTC officials stated that they are not aware whether an A2K industry 

member has a retail store as part of its operations, as was the case with one A2K industry 

member we interviewed. For the purposes of this report, the term “industry members”

refers to FFLs participating in A2K.

3118 U.S.C. § 923(g)(7). See also, 27 C.F.R. § 478.25a.

32According to ATF, as of April 25, 2016, 4 of 35 industry members own their own A2K 

servers. 

A2K
Page 16 GAO-16-552 Firearms Purchaser Data

According to the A2K memorandum of understanding with industry 

members, each participating industry member maintains ownership over 

its data. Further, NTC access to A2K’s search function is limited to 

analysts conducting traces for each particular industry member. NTC 

analysts access A2K using a different URL and login information for each 

participating industry member, and can only retrieve the disposition data 

for the particular firearm they are tracing.

Participation in A2K is voluntary and, according to ATF officials and the 

three industry members we spoke with, can reduce an industry member’s 

costs associated with responding to firearms trace requests. According to 

ATF officials, as of April 25, 2016, there are 35 industry members using 

A2K, which account for 66 manufacturer, importer, and wholesaler FFLs.

All three of the participating industry members we spoke with agreed that 

A2K has been beneficial since it reduces the industry member resources 

necessary to respond to trace requests. A2K also benefits NTC by 

providing immediate access to industry member data at all times, thereby 

allowing tracing operations to continue outside of normal business hours, 

which can be crucial for urgent trace requests. According to ATF data, as 

of March 17, 2016, there were 290,256,532 firearms in A2K. Further, in 

fiscal year 2015, NTC accomplished 130,982 of 372,992 total completed 

trace requests using A2K.

Established in 1991, FRNP (formerly known as the Suspect Gun 

Program) provides a criminal investigative service to ATF agents by 

maintaining a database of firearms that have not yet been recovered by 

law enforcement, but are suspected to be involved in criminal activity.33

An ATF agent submits firearms information to FRNP, in connection with a 

specific ATF criminal investigation, to flag a particular firearm so that in 

the event that it is recovered and traced at some future time, the 

requesting agent will be notified.

A request to enter a firearm into FRNP could start with an ATF agent 

recovering another firearm during an undercover investigation of illegal 

sales from a firearms trafficker. By searching eTrace, the agent may 

discover that the recovered firearm was part of a multiple sale with three 

 33For purposes of this report, we refer to the system as the Firearm Recovery Notification 

Program (FRNP), even when discussing its prior use when it was called the Suspect Gun 

Program.

FRNP
Page 17 GAO-16-552 Firearms Purchaser Data

other firearms.34 The ATF agent then may request that the other three 

firearms be entered into FRNP because they are associated with the 

firearm the agent recovered and, therefore, are likely to also be trafficked. 

ATF officials stated that, in this hypothetical case, it is likely that those 

three firearms, if recovered and traced in the future, would support a 

potential firearms trafficking case. If the firearms are in FRNP, if and 

when they are recovered and traced, NTC would notify the requesting 

agent, who could then contact the agency that recovered and traced the 

firearms to coordinate building such a case.

To enter a firearm into FRNP, an ATF agent submits ATF Form 3317.1 

(see app. IV) to NTC. According to ATF, no other law enforcement 

agencies may submit firearms to FRNP or view information in the system; 

only ATF agents and NTC staff have access. When a firearm is recovered 

in a crime and is traced, NTC conducts an automated check to determine 

whether the firearm description in the trace request matches a firearm 

description in FRNP. If so, an analyst will validate that the entries match. 

If they do, NTC generally notifies the ATF agent who submitted the 

firearm for inclusion in FRNP that the firearm has been recovered and 

traced. Then, the analyst completes the trace and sends the results to the 

requester of the trace. Occasionally, in submitting the firearm to FRNP, 

the agent directs NTC to not complete the trace on the firearm in the 

event that the firearm is recovered and traced (i.e., not provide the trace 

results to the law enforcement agency who requested the trace).35 For 

example, an agent might want to prevent trace information from being 

released to protect an undercover operation or other investigation. 

According to ATF data, as of May 3, 2016, there were 174,928 firearms 

and the names of 8,705 unique persons (e.g., criminal suspects, firearms 

purchasers, associates) in FRNP, making up 41,964 total FRNP 

 34eTrace provides registered users with immediate access to query their own firearms 

trace-related data. Other law enforcement agencies can also use eTrace to check the 

tracing status of a firearm that they have recovered and submitted for tracing. According to 

ATF documentation, their access would be limited to those firearms submitted for tracing 

by their agency or, according to ATF officials, by another agency in their state if both 

agencies have elected to participate in collective data sharing. eTrace does not allow nonATF users to search other ATF data systems, such as FRNP or MS.

35According to ATF data, of the 37,420 firearms added to FRNP in fiscal years 2010 

through 2015, about 14 percent have this designation.
Page 18 GAO-16-552 Firearms Purchaser Data

records.36 Further, in fiscal year 2015, NTC accomplished 110 of 372,992 

total completed trace requests using FRNP.37 Also, according to ATF 

data, as of May 5, 2016, there were 23,227 firearms in FRNP that had 

been linked to a firearms trace.38

Once the ATF investigation that led to the FRNP firearms submission has 

been closed, any FRNP entries associated with that investigation are to 

be labeled as “inactive” in FRNP. Information from inactive records is 

used to assist with the tracing process, but when a trace hits on an 

inactive FRNP record, NTC does not notify the ATF agent who submitted 

the firearm since the associated investigation is closed and the 

information would no longer be useful to the agent. According to our 

review of all FRNP records, as of July 2015, about 16 percent of the 

41,625 records were designated “active” and about 84 percent were 

designated “inactive.” Inactive records remain in the system for tracing 

purposes. The original submission form is also preserved as a digital 

image.39

MS was developed in 1995 to collect and track reports of the purchase by 

one individual of two or more pistols or revolvers, or both, at one time or 

during any 5 consecutive business days. FFLs are required by statute to 

 36Based on our review of a sample of FRNP records, an estimated 51 percent of records 

contain 1 firearm, an estimated 22 percent of records contain 2 firearms, and an estimated 

18 percent of records contain between 3 and 7 firearms. The maximum number of 

firearms we observed in a single FRNP record from this sample was 116 firearms.

37FRNP’s purpose is to provide a criminal investigative service to ATF agents. As part of 

the firearms tracing process, the records are also used for traces. ATF officials reported 

that the number of firearms in FRNP is small in comparison to the universe of guns that 

are traced. Therefore, the percentage of traces that are completed using FRNP is small.

38Based on our review of a sample of FRNP records, an estimated 18 percent of records 

contain at least 1 firearm that has been linked to a firearms trace, including an estimated 6 

percent of records with 2 or more firearms linked to a trace and an estimated 11 percent of 

records with 1 firearm linked to a trace (numbers do not sum to 18 percent due to 

rounding). The remaining estimated 82 percent of FRNP records contain firearms that 

have not been linked to firearms traces. FRNP records may be linked to a trace without 

having been used to complete a trace, since a different system, such as MS, might 

contain the original information on the purchaser used to complete a trace.

39ATF officials reported that, after entry into FRNP, the submission form is saved as a

nonsearchable pdf file into a shared NTC drive. 

MS
Page 19 GAO-16-552 Firearms Purchaser Data

report these sales to ATF.40 The multiple sales reports are completed by 

FFLs, submitted to NTC using ATF form 3310.4 (see app. V), and entered 

into MS. According to ATF, these reports, when cross-referenced with 

firearms trace information, serve as an important indicator in the detection 

of potential firearms trafficking. They can also allow successful tracing of 

older firearms that have reentered the retail market.

MS also maintains the information from Demand Letter 3 reports.41 In 

2011, ATF issued Demand Letter 3 to dealer and pawnbroker FFLs 

located in Arizona, California, New Mexico and Texas. The letter requires 

these FFLs to prepare reports of the purchase or disposition of two or 

more semiautomatic rifles capable of accepting a detachable magazine 

and with a caliber greater than .22, at one time or during any 5 

consecutive business days, to a person who is not an FFL. According to 

ATF, this information is intended to assist ATF in its efforts in 

investigating and combatting the illegal movement of firearms along and 

across the southwest border. Demand Letter 3 reports are completed by 

FFLs, submitted to NTC using ATF form 3310.12 (see app. VI), and

entered into MS.

According to ATF officials and our observations, Demand Letter 3 and 

multiple sales reports are managed identically within MS. During a 

firearms trace, MS is automatically checked for a match with the firearm 

serial number. If a match is found, the trace time can be substantially 

shortened since the retail FFL and purchaser name to complete the trace 

are contained within the MS record. According to ATF data, as of May 3, 

2016, there were 8,950,209 firearms in MS, making up 3,848,623 total 

MS records. Further, in fiscal year 2015, NTC accomplished 15,164 of 

372,992 total completed trace requests using MS.

 4018 U.S.C. § 923(g)(3)(A). See also 27 C.F.R. 178.126a. MS was one of the systems we 

reviewed for compliance in our prior report, GAO/GGD-96-174.

41Pursuant to 18 U.S.C. § 923(g)(5)(A), the Attorney General may issue letters requiring 

FFLs to submit information required to be kept and maintained under the Gun Control Act 

of 1968, as amended, for specified time periods. Demand Letter 3 is issued under this 

authority. In addition to Demand Letter 3, there are two other letters that are issued to 

FFLs. Demand Letter 1 is issued to FFLs that do not comply with their statutory 

responsibility to respond within 24 hours to firearms trace requests. Demand Letter 2 is 

sent to FFLs who had 10 or more firearms traced to them the previous calendar year with 

a “time-to-crime” of 3 years or less.
Page 20 GAO-16-552 Firearms Purchaser Data

In November 1995, ATF implemented a policy to computerize multiple 

sales reports at NTC, which now also applies to Demand Letter 3 

reports.

42 The original multiple sales or Demand Letter 3 paper report 

received from the FFL is scanned in a nonsearchable, TIFF image format 

and tagged with the MS transaction number. The TIFF file is then stored 

in an image-only repository, and is retained indefinitely. However, as part 

of the computerization policy, ATF included a requirement for deleting 

firearms purchaser names from MS 2 years after the date of sale if such 

firearms are not connected to a trace.43 ATF preserves the remainder of 

the data, such as the firearm description, for the purpose of supporting 

investigations. In contrast, if an MS record is connected to a firearms 

trace, then ATF preserves the entire record, including purchaser 

information, in the system. MS reports are available to any ATF staff that 

has access to eTrace but not to outside law enforcement agencies with 

eTrace access. However, after the purchaser name in a MS record has 

been deleted in accordance with the 2-year deletion policy, only NTC 

officials have access to this information in the digital image of the original 

multiple sales or Demand Letter 3 reports. If an ATF agent needs to see 

the deleted information, the agent must contact NTC.

 42Before November 1995, ATF required that multiple sales reports be maintained by its 

field divisions. According to ATF, these divisions in the past maintained multiple sales 

reports in a variety of ways: some used local computer information tracking systems, 

others used alphabetical card files, and before 1987 some used the Department of the 

Treasury’s Enforcement Communications System, a law enforcement data system that 

includes centralized databases used by Treasury and other law enforcement agencies.

43Such firearms—that have not been connected to a trace—have not been recovered by 

local law enforcement as part of a criminal investigation and, therefore, law enforcement 

officials have not needed information, such as the original purchaser’s name, in order to 

support their investigation.
Page 21 GAO-16-552 Firearms Purchaser Data

Of the four data systems we reviewed, two systems were in full 

compliance with the appropriations act restriction. The other two data 

systems did not always comply with the restriction, although ATF 

addressed the compliance issues during the course of our review. In 

addition, three data systems could better adhere to ATF policies. 

Specifically:

• OBRIS complies with the appropriations act restriction and adheres to 

ATF policies.

• A2K for in-business industry members’ records complies with the 

appropriations act restriction, but ATF’s collection and maintenance of 

A2K out-of-business records in A2K on a server at NTC violated the 

appropriations act restriction. ATF deleted the records from the server 

in March 2016. In addition, industry members may benefit from clearer 

ATF guidance to ensure that they are submitting out-of-business 

records as required.

• FRNP generally complies with the appropriations act restriction. 

However, a regional program using FRNP from 2007 through 2009 

did not comply with the restriction, and ATF removed the data it 

collected through this program from FRNP in March 2016.44 Further, 

FRNP generally adheres to ATF policies, but a technical defect allows 

ATF agents to view and print FRNP data beyond what ATF policy 

permits.

• MS complies with the appropriations act restriction, but ATF continues 

to inconsistently adhere to its own policy when deleting these records.

For a more detailed legal analysis of compliance with the appropriations 

act restriction, see appendix VII.

 44The regional program operated from June 8, 2007 to October 2, 2009. 

ATF Did Not Always 

Comply with the 

Appropriations Act 

Restriction and Does 

Not Consistently 

Adhere to Its Policies 

on Maintenance of 

Firearms Data
Page 22 GAO-16-552 Firearms Purchaser Data

We previously considered ATF’s compliance with the restriction on using 

appropriated funds for consolidation or centralization in connection with 

ATF’s Microfilm Retrieval System and MS in 1996.45 In that report, we 

stated that the appropriations act restriction did not preclude all 

information practices and data systems that involved an element of 

consolidation or centralization. We interpreted the restriction in light of its 

purpose and in the context of other statutory provisions governing ATF’s 

acquisition and use of information on firearms. We found that the two 

systems complied with the appropriations act restriction on the grounds 

that ATF’s consolidation of records in these systems was incident to 

carrying out specific responsibilities set forth in the Gun Control Act of 

1968, as amended, and that the systems did not aggregate data on 

firearms transactions in a manner that went beyond these purposes. We 

are employing a similar analytical approach to the systems under review 

here: we consider whether ATF’s aggregation of records in each system 

serves a statutory purpose, and how it relates to that purpose.

OBRIS complies with the appropriations act restriction and adheres to 

policies designed to help ensure that the system is in compliance with the 

restriction. FFLs are specifically required to submit records to ATF when 

going out of business, and the system limits the accessibility of key 

firearms records information, such as retail purchaser data. As we 

reported in 1996, ATF first issued regulations in 1968 requiring FFLs that 

permanently go out of business to deliver their firearms transaction 

records to the federal government within 30 days.46 This provided a 

means of accessing the records for firearms tracing purposes after an 

FFL went out of business. The legislative history related to ATF’s fiscal 

year 1979 appropriation did not provide any indication that Congress 

intended a change in ATF’s existing practice. In 1986, the Firearms 

Owners’ Protection Act (FOPA) codified this regulatory reporting 

 45GAO/GGD-96-174. ATF refers to the predecessor to OBRIS as the Microfilm Retrieval 

System. At the time of our 1996 report, we referred to it as the Out-of-Business Records 

System. At that time, MS only included multiple sales reports, and we referred to it as the 

Multiple Sales System.

4626 C.F.R. § 178.127 (1969). See 33 Fed. Reg. 18,555, 18,571 (Dec. 14, 1968).

Framework for Legal 

Analysis Set Forth in 1996 

Report

OBRIS Complies with the 

Appropriations Act 

Restriction and Adheres to 

ATF Data-Processing 

Policies
Page 23 GAO-16-552 Firearms Purchaser Data

requirement, affirming ATF’s authority to collect this information.47 In 

1996, we also reported that the predecessor to OBRIS—the Microfilm 

Retrieval System—as designed, complied with the statutory data 

restrictions and that ATF operated the system consistently with its 

design.48 We found that the Microfilm Retrieval System included in a 

computerized index the information necessary to assist ATF in completing 

a firearms trace, and did not aggregate information in a manner beyond 

that necessary to implement the Gun Control Act.49 Notably, ATF’s 

system of microfilmed records did not capture and store certain key 

information, such as firearms purchaser information, in a searchable 

format.

In response to logistical challenges and technological advances, ATF 

developed OBRIS in 2006 as the repository to maintain digital images of 

out-of-business FFL records. ATF transitioned from using microfilm 

images of records to scanning records into OBRIS as digital images not 

searchable through character recognition, consistent with ATF’s design 

and use of its prior Microfilm Retrieval System.50 It is our view that, like its 

microfilm predecessor system, OBRIS also complies with the 

appropriations act restriction because OBRIS’s statutory basis and 

 47Pub. L. No. 99-308, § 103, 100 Stat. 449, 453-456 (1986) (codified at 18 U.S.C. § 

923(g)(4)). The Senate-passed version of FOPA would have prohibited the Secretary of 

the Treasury (where ATF was located at the time) from maintaining out-of-business 

records at a centralized location and from entering them into a computer for storage or 

retrieval. This restrictive provision was dropped from the version of the bill passed by 

Congress. S. 49, 99th Cong., 1st Sess. (1985).

48ATF refers to the predecessor to OBRIS as the Microfilm Retrieval System. At the time 

of our 1996 report, we referred to it as the Out-of-Business Records System. 

GAO/GGD-96-174.

49The index contained the following information: (1) the cartridge number of the microfilm; 

(2) an index number; (3) the serial number of the firearm; (4) the FFL number; and (5) the 

type of document on microfilm. 

50Conference reports accompanying ATF’s appropriations during this period indicated 

support for its development of OBRIS. See H.R. Rep. No. 108-792, at 733 (2004) (Conf. 

Rep.) (accompanying the Consolidated Appropriations Act, 2005, Pub. L. No. 108-447, 

118 Stat. 2809), and H.R. Rep. No. 109-272, at 82 (2005) (Conf. Rep.) (accompanying the 

Science, State, Justice, Commerce, and Related Agencies Appropriations Act, 2006, Pub. 

L. No. 109-108, 119 Stat. 2290).
Page 24 GAO-16-552 Firearms Purchaser Data

accessibility are essentially the same as the prior system.51 As with the 

prior system, OBRIS generally allows users to identify potentially relevant 

individual records through manual review by searching an index using an 

FFL number. Other information, specifically firearms purchaser 

information, remains stored in nonsearchable images, and is not 

accessible to ATF through a text search.52

In OBRIS, ATF put data processing policies in place to maintain records 

in compliance with the appropriations act restriction. Specifically, when an 

FFL going out of business sends records to NTC, according to ATF policy 

and verified by our observations, NTC personnel follow policies to sort 

and scan the records in OBRIS in a manner that maintains the 

nonsearchability of the records. For example, NTC personnel spend extra 

time indexing the images by FFL number, and chronologically sorting FFL 

records, typically by month and by year.53 When tracing a firearm, 

according to ATF policy and verified by our observations, NTC personnel 

generally identify a group of FFL records through the FFL number index, 

then manually search the dates of the FFL records to narrow in on a 

group of records that might contain the firearm being traced. NTC 

personnel then manually skim through each record in this group until they 

identify the relevant firearm information. According to NTC officials, NTC 

staff sometimes search thousands of pages of records to find the record 

that matches the trace request. This policy for a manual process to 

maintain and use records in OBRIS helps to ensure its compliance with 

 51Additionally, ATF’s implementing regulation for OBRIS remains essentially the same. As 

discussed earlier, FOPA prohibited ATF from issuing any rule or regulation after the date 

of the enactment of FOPA that requires (1) records to be maintained pursuant to certain 

statutory provisions, or any portion of the contents of such records to be recorded at or 

transferred to a facility owned, managed, or controlled by the United States or any state or 

political subdivision thereof or (2) any systems of registration of firearms, firearms owners, 

or firearms transactions or dispositions to be established. See 18 U.S.C. § 926(a). Since 

the passage of FOPA, there have been only technical administrative changes to this 

regulation. See 27 C.F.R. § 478.127. 

52For this reason, the system also complies with the restriction in the fiscal year 2012 

appropriations act described earlier on using funds to electronically retrieve out-ofbusiness information by name or personal identification code.

53When ATF staff scan the records into OBRIS, batches of records are indexed—or 

tagged—with the FFL number associated with the records and the beginning purchase 

date in the batch of records. According to ATF officials, in approximately 1 percent of 

records, the records are also indexed by serial number, manufacturer, caliber, type, and 

acquisition date.
Page 25 GAO-16-552 Firearms Purchaser Data

the appropriations act restriction. For more details on OBRIS’s data 

processing policies, see appendix III.

ATF maintains A2K for in-business industry members who store their own 

A2K data and maintained A2K for certain records of out-of-business 

industry members at NTC.54 ATF’s collection and maintenance of the 

records of out-of-business A2K industry members at NTC violated the 

appropriations act restriction on consolidation or centralization of firearms 

records. However, ATF officials transferred the records to OBRIS, and in 

March 2016 removed these records from A2K. In addition, industry 

members would benefit from clearer A2K guidance from ATF to ensure 

that they are submitting required out-of-business records.

A2K for firearms records of in-business industry members complies with 

the appropriations act restriction on consolidation and centralization 

based on A2K’s statutory foundation and its features. ATF believes, and 

we agree, that A2K for in-business records appropriately balances the 

restriction on consolidating and centralizing firearms records with ATF’s 

need to access firearms information in support of its mission to enforce 

the Gun Control Act of 1968, as amended.

Federal law requires FFLs to provide firearms disposition information to 

ATF within 24 hours in response to a trace request in the course of a 

criminal investigation.55 ATF officials told us that they developed A2K in 

response to industry member requests for an automated option for 

responding to trace requests. Prior to A2K, FFLs could only respond to 

trace requests by having dedicated personnel research firearms 

disposition information and then submit that information to ATF by phone, 

fax, or e-mail. In contrast, A2K provides industry members—who 

voluntarily participate in A2K—with servers to facilitate automated 

 54According to ATF, as of April 25, 2016, there are 35 industry members representing 66 

manufacturer, importer, and wholesaler FFLs participating in A2K. Generally, retail FFLs 

are not able to participate in A2K. However, NTC officials stated that they are not aware 

whether an A2K industry member has a retail store as part of its operations, as was the 

case with one A2K industry member we interviewed. For the purposes of this report, the 

term “industry members” refers to FFLs participating in A2K.

5518 U.S.C. § 923(g)(7). With regard to the FOPA restriction on the issuance of certain 

rules or regulations, we note that there is no regulatory scheme for this system.

A2K for Out-of-Business 

Records Did Not Comply 

with the Appropriations Act 

Restriction, and ATF Could 

Improve Guidance to 

Industry

A2K for In-Business Records 

Complies with the 

Appropriations Act Restriction
Page 26 GAO-16-552 Firearms Purchaser Data

electronic responses to ATF trace requests.56 Under A2K, industry 

members upload their electronic firearms disposition information onto the 

servers located at their premises on a regular basis. Industry members—

not ATF—retain possession and control of their disposition records and, 

according to ATF officials, they may withdraw from A2K and remove their 

records from the servers at any time. A2K includes a secure user web 

interface to each of the servers and ATF may only obtain A2K disposition 

information by searching individual industry member servers by exact 

firearm serial number. Through this search, ATF obtains the same 

information from each industry member as it would otherwise obtain by 

phone, fax, or e-mail, and in similar disaggregated form.

Beginning in 2000, ATF maintained A2K disposition data from out-ofbusiness industry members on a single partitioned server within NTC, and 

removed the records from the server in March 2016.57 ATF’s maintenance 

of the disposition records in this manner violated the appropriations act 

restriction on consolidation or centralization. This arrangement was not 

supported by any specific authority. As described earlier, A2K was 

designed as an alternative for FFLs to meet the requirement to respond 

promptly to ATF trace requests, which does not apply to FFLs once they 

go out of business. Another statutory provision requires FFLs to submit 

firearms records to ATF when they go out of business, and ATF has 

designed a separate system for this purpose—OBRIS—as described 

earlier.58

 56In 2004, the conference report accompanying ATF’s 2005 appropriation indicated 

support for the expansion of A2K, pointing to the increased operational efficiency 

associated with ATF’s immediate access to disposition records through the automated 

system. The report stated “[T]he conferees are aware that the Access 2000 program was 

initiated by ATF to improve the efficiency and reduce the costs associated with firearms 

tracing incurred by Federal Firearms Licensees (FFLs). . . . The conferees encourage the 

ATF to place more emphasis on this program and expand the number of partners to the 

greatest extent possible.” H.R. Rep. No. 108-792, at 734 (2004) (Conf. Rep.).

57According to ATF officials, when an A2K participating industry member went out of 

business, NTC’s A2K contractor remotely transferred the data on the A2K server to the 

server’s backup disk and remotely deleted the data on the server itself. The eight industry 

members that went out of business between 2000 and 2012 all shipped their blank A2K 

servers back to NTC along with the backup disks with intact disposition information.

5818 U.S.C. § 923(g)(4).

A2K for Out-of-Business 

Records Did Not Comply with 

the Appropriations Act 

Restriction, and ATF Could 

Provide Clearer Guidance
Page 27 GAO-16-552 Firearms Purchaser Data

A2K for out-of-business records functioned differently than OBRIS and 

went beyond the consolidation of out-of-business records in that system 

incident to specific responsibilities under the Gun Control Act. As 

discussed earlier, out-of-business records are maintained as 

nonsearchable digital images in OBRIS to comply with the appropriations 

act restriction, while at the same time allowing ATF to perform its tracing 

function. ATF completed traces using A2K disposition data from out-ofbusiness industry members through the same type of secure user web 

interface as used while the industry members were in business. 

According to ATF, this was more efficient than relying on OBRIS to 

complete firearms traces. Our observations of A2K out-of-business 

searches in August 2015 confirmed ATF officials’ statements that these 

records were accessed in the same way as in-business records. Records 

were only retrievable by exact serial number search, in accordance with 

ATF policy. However, according to ATF officials, it would have been 

technically possible for ATF to reconfigure the server to allow the records 

to be queried by any field, including fields with retail purchaser 

information.

ATF agreed with our assessment that treating disposition information 

from industry members that go out of business in the same manner as 

disposition information from in-business industry members would violate 

the appropriations act restriction.59 After we raised concerns about A2K 

out-of-business records on the server at NTC, ATF told us that they had 

begun a process of transferring the out-of-business A2K records from the 

server into OBRIS as digital images. ATF permanently deleted the 

records from the out-of-business A2K server in March 2016.

In addition, ATF could provide clearer ATF guidance to ensure that 

industry members submit out-of-business records in accordance with the 

Gun Control Act of 1968, as amended. These industry members and their 

corresponding FFLs are required to provide transaction forms, acquisition 

records, and disposition records to ATF within 30 days of going out of 

 59According to ATF, when an FFL ceases participation in A2K, “that FFL’s records 

become just like any other FFL records and, as such, must be stored in the same manner. 

Otherwise, records which were formerly accessible on a discrete basis under A2K would 

be readily accessible in a database which would, in our opinion based on the 1996 GAO 

Report, violate the appropriation rider. Our decision, therefore, was to ensure that A2K 

records have the same character and are retrievable in the same manner as any other 

out-of-business records.”
Page 28 GAO-16-552 Firearms Purchaser Data

business. However, it is unclear how the requirements apply to industry 

members’ A2K disposition data. A2K agreements specifically state that 

the A2K data belong to the industry member. Conversely, ATF requires 

that the ATF-owned A2K equipment be returned when industry members 

go out of business, which includes the hardware and software on which 

the data were housed at the industry member’s location.

The A2K memorandums of understanding and ATF guidance to industry 

members do not specify that industry members may retain the backup 

disk or how A2K data may be used to meet the out-of-business record 

submission requirements to ATF, if at all. All of the eight industry 

members that have gone out of business have provided their backup 

disks with data to ATF. According to ATF, six industry members 

separately provided their acquisition and disposition information, while the 

other two industry members, which were licensed importers, only 

provided invoices. According to ATF officials, discussions with these 

industry members did not include the industry member’s option to keep 

the backup disk where the data are stored or whether submitting the 

backup disk to ATF would fulfill part of the industry member’s submission 

requirement. Further, the three industry members we spoke with 

corroborated that ATF lacks guidance for its requirements related to 

industry members submitting out-of-business A2K data in accordance 

with the Gun Control Act, as amended.

Federal internal control standards require that agencies communicate 

necessary quality information with external parties to achieve agency 

objectives, which includes providing industry members with record 

submission guidance so that ATF has the necessary records for firearms 

tracing.60 According to ATF officials, ATF has not provided guidance to 

A2K industry members on how to submit out-of-business records 

because industry members already have the standard requirements that 

apply to all FFLs, and industry members have not asked for guidance 

specific to A2K. Industry members that we spoke to had not contemplated 

the process for providing A2K equipment and records to ATF because 

they did not anticipate going out of business. However, if ATF does not 

have all required out-of-business records, the agency may not be able to 

locate the first purchaser of a firearm during a trace, and thus may not be 

 60GAO/AIMD-00-21.3.1 and GAO-14-704G.
Page 29 GAO-16-552 Firearms Purchaser Data

able to fulfill part of its mission. ATF officials agreed that providing such 

guidance—for example, in the A2K memorandum of understanding 

between an industry member and A2K—would be helpful to industry 

members to ensure that records are submitted to ATF as required. 

Industry members could benefit from clear ATF guidance on, for example, 

whether they are required to submit their A2K records in electronic 

format; whether they are allowed to only submit hard copy records; or 

what to do if one part of the company goes out of business, but A2K 

continues at the industry member’s remaining FFLs. Such ATF guidance 

could clarify how industry members may submit A2K data to fulfill a 

portion of Gun Control Act requirements.

FRNP generally complies with the appropriations act restriction and 

generally adheres to ATF policies that help ensure such compliance. 

However, a regional ATF program using FRNP from 2007 through 2009 

was not in compliance with the appropriations act restriction. ATF deleted 

the data it collected through this program from FRNP in March 2016. In 

addition, a technical defect in one of ATF’s key data systems allows ATF 

agents to access FRNP records in a manner that is inconsistent with ATF 

policy.

ATF gathers and combines specific firearms transaction data to a limited 

degree in FRNP in order to implement its statutory responsibilities related 

to firearms criminal enforcement and, in this respect, the system complies 

with the appropriations act restriction. By statute, ATF is responsible for 

enforcing the federal statutes regarding firearms, including those related 

to the illegal possession, use, transfer, or trafficking of firearms.61 FRNP 

was established to provide an investigative service to ATF agents by 

maintaining a database of firearms suspected of being involved in 

criminal activity and associated with an ATF criminal investigation. As 

discussed earlier, the appropriations act restriction does not preclude all 

information practices and data systems that involve an element of 

 61Generally, under 28 U.S.C. § 599A, subject to the direction of the Attorney General, ATF 

is responsible for investigating (1) criminal and regulatory violations of the federal firearms 

laws; and (2) any function related to the investigation of violent crime or domestic 

terrorism that is delegated to ATF by the Attorney General. 

FRNP Generally Complies 

with the Appropriations Act 

Restriction, but a Past 

Regional Program Did Not 

Comply, and ATF Agents 

Are Able to Access 

Information That Is Not 

Permitted by ATF Policy

FRNP Generally Complies with 

the Appropriations Act 

Restriction and Adheres to 

ATF Policies That Help Ensure 

Compliance
Page 30 GAO-16-552 Firearms Purchaser Data

“consolidating or centralizing” FFL records. As designed, the aggregation 

of firearms transaction records in FRNP is incident to carrying out specific 

ATF criminal enforcement responsibilities and is limited to that purpose. 

Therefore, FRNP—when used for the purpose as a database of firearms 

suspected of being involved in criminal activity and associated with an 

ATF criminal investigation—complies with the appropriations act 

restriction.62 Moreover, based on our analysis of FRNP records, virtually 

all records in FRNP are associated with an ATF criminal investigation, 

and thus are related to ATF’s statutory responsibilities.63

ATF policies for the implementation of FRNP support the conclusion that 

it complies with the appropriations act restriction, when operated as 

designed. ATF policies specify that ATF agents may submit a firearm for 

entry into FRNP if the firearm is associated with an active, nongeneral 

ATF criminal investigation and meets certain submission criteria.64 ATF 

agents must use a designated submission form when requesting that 

firearms information be entered in the FRNP system, which, among other 

things, contains a field for the agent to include an active, nongeneral 

investigation number. The form also contains a field to indicate the 

additional, specific submission criteria for the firearm, which align with 

ATF’s statutory responsibility of enforcing criminal statutes related to the 

illegal possession, use, transfer, or trafficking of firearms. These criteria 

include: (1) Large quantities of firearms purchased by individual; (2) 

Firearms suspected in trafficking, but not stolen from an FFL dealer; (3) 

FFL dealers suspected of performing firearms transactions without proper 

documentation; (4) Firearms purchased by suspected straw purchasers; 

 62With regard to the FOPA restriction on the issuance of certain regulations, we note that 

there is no regulatory scheme for this system.

63Specifically, out of the entire population of 41,625 records reviewed, less than 1/10 of 1 

percent of records were not associated at all with an investigation number.

64According to ATF officials, general investigation numbers are assigned to an ATF 

investigation when an ATF agent is examining whether enough evidence exists to open a 

nongeneral, “active” investigation. In this report, we did not evaluate the method by which 

ATF opens a criminal investigation or the criteria that must be met in order to open a 

criminal investigation. In August 2006, NTC implemented a policy of generally not 

accepting general investigation numbers for FRNP submissions. ATF officials were 

uncertain whether, prior to August 2006, general investigation numbers were to be 

accepted. A March 2003 procedures document requested that ATF agents not use 

general investigation numbers; however, exceptions could be made if the ATF agent 

submitted a memo explaining why an active investigation number could not be assigned. 
Page 31 GAO-16-552 Firearms Purchaser Data

and (5) Other—a category that the submitting agent is to explain on the 

form.

According to NTC procedures, and verified by our observations, upon 

receiving an FRNP submission form, an NTC analyst reviews the form for 

completeness and conducts several validation and verification steps. For 

example, the analyst uses ATF’s case-management system to verify that 

the investigation number on the FRNP submission form is active and that 

at least one criterion was selected on the submission form. Once the 

validation and verification checks are complete, the NTC analyst either 

enters the firearms information into FRNP or contacts the requesting ATF 

agent if information is missing or not in alignment with the criteria required 

for FRNP submission.

During our review of selected fields for all 41,625 FRNP records, and a 

generalizable sample of records and submission forms, we found that for 

the vast majority of firearms entered, ATF abided by its policy for entries 

to be associated with an active investigation. Out of the entire population 

of 41,625 records reviewed, less than 1/10 of 1 percent of records were 

not associated at all with an investigation number and, according to ATF 

officials, were likely data-entry errors or records entered for testing or 

training purposes.65 Moreover, based on our sample review, an estimated 

96 percent of FRNP records were entered while the related criminal 

investigation was open.66 ATF officials stated that most of the remaining 

records—entered before the related investigation was open or after it was 

closed—were the result of data-entry errors or the result of investigation 

 65As further corroboration of FRNP records’ association with criminal investigations, based 

on our sample review, an estimated 99.4 percent of submission forms from November 

2004 through July 2015 included an investigation number on the form. Based on our 

review of general investigation numbers associated with FRNP records between August 

2006 and July 2015, the total percentage of FRNP records associated with general 

investigation numbers was less than 2 percent. ATF officials stated that the records 

associated with general investigation numbers since August 2006 were likely associated 

with undercover investigations or investigations led by ATF agents in foreign posts, both of 

which allow general investigation numbers. Prior to August 2006, about 13 percent of 

records were associated with general investigation numbers. 

66These criminal investigations included some general investigations since some general 

investigation numbers were accepted prior to August 2006.
Page 32 GAO-16-552 Firearms Purchaser Data

numbers being reopened at a later date.67 Additional, specific submission 

criteria were required to be noted on the FRNP submission form since 

November 2004.68 Based on our sample review, an estimated 97 percent 

of FRNP submission forms from November 2004 through July 2015 

included the selection of at least one criterion. For an estimated 13 

percent of these—or 23 submission forms in our sample—the “Other”

criteria was selected, and all but 2 of these had an explanation for why 

the firearms were entered in FRNP.69 For example, in 1 submission form 

that contained an explanation for “Other,” business owners were 

suspected of selling firearms without a license. ATF officials could not 

definitively state why an estimated 3 percent of submissions from 

November 2004 through July 2015 did not contain criteria selection. 

Officials speculated, for example, that an NTC analyst may have obtained 

the criteria selection from the requesting agent by phone or e-mail and 

may not have noted his or her conversation in the FRNP file. However, 

officials acknowledged that the criteria selection is an important quality 

control and allows ATF the ability to audit records related to an 

investigation if necessary.

 67According to ATF officials, some of the data-entry errors were caused when ATF 

converted to a new case-management system. However, ATF officials stated that original 

case files could be consulted for the correct case date ranges.

68Since the inception of FRNP in 1991, ATF has periodically changed its procedures for 

submitting firearms for entry in the system. Prior to June 1997, ATF agents submitted a 

memorandum requesting that firearms be entered in the FRNP system. In 1997, ATF 

developed a formal submission form for FRNP submission requests, and the form has 

been subsequently updated and modified, including in 2003, 2004, and 2006. Earlier 

iterations of the submission form, such as several of those prior to November 2004, did 

not include selection options for criteria. Approximately 60 percent of records in the FRNP 

system were entered prior to November 2004. 

69Of the submission forms from November 2004 through July 2015 that contained at least 

one specific submission criterion, an estimated 72 percent (plus or minus 6.7 percentage 

points) included the selection of “firearms suspected in trafficking, but not stolen from an 

FFL dealer”; an estimated 61 percent (plus or minus 7.2 percentage points) included the 

selection of “large quantities of firearms purchaser by individual”; an estimated 61 percent 

(plus or minus 7.2 percentage points) included the selection of “firearms purchased by 

suspected straw purchaser”; and an estimated 2 percent (plus or minus 1.9 percentage 

points) included the selection of “FFL dealers suspected of performing firearms 

transactions without proper documentation.” The confidence interval for the estimated 13 

percent with “Other” selected was plus or minus 5 percentage points.
Page 33 GAO-16-552 Firearms Purchaser Data

ATF officials told us that only names associated with the criminal 

investigation are entered in the FRNP system.70 These names are 

generally limited to suspects and purchasers, but ATF officials 

acknowledged that the names of victims or witnesses may be included in 

the system if they are associated with the criminal investigation, though 

this does not happen routinely.71 Based on our observations of FRNP 

entry procedures, an NTC analyst verifies that any names on the 

submission form match the names listed in the case-management system 

for that particular investigation, prior to entering the information in the 

FRNP system.

An ATF regional program conducted from 2007 through 2009 to enter 

firearms into FRNP—the Southwest Border Secondary Market Weapons 

of Choice (SWBWOC) Program—did not comply with the appropriations 

act restriction on consolidating or centralizing FFLs’ firearms records, 

because the individual firearms were not suspected of being involved in 

criminal activity associated with an ATF criminal investigation. During the 

course of our review, ATF reported that it planned to delete the related 

data from FRNP, and ATF did so in March 2016.

According to ATF officials, the SWBWOC Program was in place in ATF’s 

four southwest border field divisions in order to more effectively identify—

during a trace—the purchasers of used firearms trafficked to Mexico.72

The program was implemented during routine regulatory inspections of 

 70As discussed earlier, according to ATF data, as of May 3, 2016, the names of 8,705 

unique persons (e.g., criminal suspects, firearms purchasers, associates) were in FRNP, 

making up 41,964 total FRNP records.

71During our review of the FRNP submission forms, we noted a few instances when 

“associates” were listed and some instances of firearms “possessors”; however, we were 

unable to determine in FRNP whether the associate or possessor was under investigation, 

or just associated with the investigation. To determine how each name was affiliated with 

the FRNP record or submission form would require a review of ATF case-management 

files associated with the FRNP entry, and therefore was outside the scope of our review.

72According to ATF officials, in October 2005, the governments of the United States and 

Mexico instituted a cooperative effort to address surging drug–cartel driven violence in 

Mexico and along the southwest border. This effort became known as the Southwest 

Border Initiative. ATF’s main role in the Southwest Border Initiative was to develop 

strategies and programs to stem the illegal trafficking of firearms from the United States to 

Mexico. In June 2007, as part of its overall Southwest Border Initiative strategy, ATF 

developed an Industry Operations Strategy for its four southwest border field divisions. 

One aspect of the Industry Operations Strategy was the SWBWOC Program.

A Past ATF Regional Program 

Did Not Comply with the 

Appropriations Act Restriction
Page 34 GAO-16-552 Firearms Purchaser Data

FFLs in the region who were engaged primarily in the sale of used 

firearms—generally pawnbrokers. According to ATF, used firearms sales, 

referred to as “secondary market” sales, played a significant role in 

firearms trafficking to Mexico, particularly certain firearms most sought by 

the Mexican drug cartels, referred to as “weapons of choice.” According 

to ATF officials, this program was developed to record certain firearms in 

an effort to enhance ATF’s ability to trace those firearms to a retail 

purchaser in the event of crime-related recoveries of the firearms.73 As 

part of the program, during regulatory inspections, ATF investigators were 

to record any specified weapons of choice that were found in the FFLs’

inventory or sold or disposed of by the FFLs within the inspection period. 

According to ATF officials, the information recorded was limited to the 

serial number and description of the firearm, and was not to include any 

purchaser information.74 The firearms information was then submitted to 

FRNP for all of the used firearms identified during the inspection. If the 

firearm was subsequently recovered by law enforcement and submitted 

for a trace, NTC’s automatic checks on the firearm description would 

result in a match in the FRNP system. ATF would then be able to more 

quickly identify the FFL pawn shop that previously had the firearm in its 

inventory.75

According to ATF officials and documentation, the program was cancelled 

on October 2, 2009, following ATF’s legal review of the process by which 

the firearms information entered during the program was recorded and 

submitted to FRNP. ATF’s legal review determined that the program was 

not consistent with the appropriations act restriction on consolidation or 

 73A successful firearms trace ends with the identification of the first purchaser of the 

firearm from a licensed retailer. If, after this first purchase, a firearm is subsequently sold 

in the secondary market—private sales, gun shows, and used firearms dealers such as 

pawn shops—the normal ATF tracing process would not identify who sold or purchased 

the firearm.

74Our review of a sample of records in FRNP included seven records from the SWBWOC 

Program. The submission forms associated with these seven records did not include any 

purchaser information. Although purchaser information was not to be recorded for the 

SWBWOC Program, inclusion of these firearms in FRNP made it more likely to be able to 

identify the most recent retail purchaser during a trace by directing NTC analysts to the 

retail FFL that presumably last sold the firearm and maintained the transaction record, 

including information related to the retail purchaser. 

75According to ATF, approximately 3 percent of firearms—or 373—entered into FRNP as 

a result of the program were associated with a trace.
Page 35 GAO-16-552 Firearms Purchaser Data

centralization. According to ATF officials, the program was not reviewed 

by the ATF Chief Counsel’s office prior to its initiation in June 2007. They 

stated that the program’s existence was the result of incomplete 

communication by ATF executives responsible for industry operations 

programs with ATF’s Chief Counsel prior to the implementation of the 

program. Upon learning of the program, ATF Counsel determined that 

FFL information on a firearm, in and of itself—even when unaccompanied 

by purchaser information—is not permitted to be collected and 

consolidated without a specific basis in statute or regulation, or a direct 

nexus to a law enforcement purpose, such as a criminal investigation. 

The ATF Chief Counsel’s office advised that the program be immediately 

terminated and, in October 2009, the program was cancelled and the 

firearms information already entered into FRNP during the program was 

marked as “Inactive.”76

We concur with ATF’s assessment that the inclusion of firearms 

information from the program in FRNP did not comply with the 

appropriations act restriction. It is our view that information obtained from 

an FFL about a firearm in and of itself, and unaccompanied by purchaser 

information, is not permitted to be collected and consolidated within ATF 

without a specific basis in statute. As a result of our review, ATF officials 

deleted the records for the affected data from FRNP—855 records 

relating to 11,693 firearms—in March 2016.

 76Information from inactive records is still used to assist with the tracing process.
Page 36 GAO-16-552 Firearms Purchaser Data

A technical defect in eTrace 4.0 allows ATF agents to view and print 

FRNP data beyond what ATF policy permits. These data include 

purchaser names and suspect names in a summary format called a 

Suspect Gun Summary Report.77 Any ATF agent with eTrace access can 

view or print these reports, including up to 500 FRNP records at one time. 

According to ATF officials, the eTrace defect occurred when the 

contractor developing eTrace 4.0 included a global print function for 

Suspect Gun Summary Reports—which can contain retail purchaser 

information—that was accessible from the search results screen. In 

December 2008, prior to the release of eTrace 4.0 in 2009, ATF provided 

the contractor with a list of the new system’s technical issues, including 

this FRNP printing defect. ATF officials explained that because all ATF 

eTrace users had the appropriate security clearances, and because there 

would not be a reason for ATF agents to access the Suspect Gun 

Summary Reports, the print issue was not considered a high-priority 

concern. However, ATF officials told us that no audit logs or access 

listings are available to determine how often ATF agents have accessed 

records containing purchaser information. Therefore, ATF has no 

assurance that the purchaser information entered in FRNP and 

accessible through eTrace is not being improperly accessed.

eTrace is available to federal, state, and local law enforcement entities 

that have entered into an eTrace memorandum of understanding with 

ATF. ATF agents have access to information in eTrace that is unavailable 

to state and local law enforcement entities, such as FRNP data. However, 

according to eTrace system documentation, ATF agents are to be limited 

 77FRNP submission forms contain fields to specify information about the purchaser, as 

well as information about the suspect (if different than the purchaser). However, the FRNP 

system only contains fields for “individual” instead of suspect and purchaser. Once the 

names from the submission form are added to the FRNP system as “individuals,” there is 

no way to distinguish whether the individual is a suspect or purchaser, or both, without 

referring to the original submission form. Therefore, although FRNP data and Suspect 

Gun Summary Reports contain individuals’ information, and the individuals can be either 

suspects or purchasers, or both, it is not possible to distinguish whether the name on the 

Suspect Gun Summary Report is a suspect or purchaser. ATF maintains a separate 

way—permitted by ATF policy—to print Suspect Gun Summary Reports. However, 

printing these reports is limited to certain NTC staff and, less commonly, certain ATF 

agents assigned to investigative task forces, such as Crime Gun Intelligence Centers, 

where ATF and other interagency collaborators collect, manage, and analyze crime gun 

intelligence. ATF maintains a system called the Firearms Information Reporting System to 

print the allowable Suspect Gun Summary Reports, among other reports that require 

printing at NTC. See app. II for more information about this system. 

ATF Agents Are Able to 

Access FRNP Information 

beyond What Is Permitted by 

ATF Policy
Page 37 GAO-16-552 Firearms Purchaser Data

in their access to FRNP records. Specifically, ATF agents should only be 

able to view the firearm description and the name and contact information 

of the ATF case agent associated with the investigation, and not 

purchaser information or FFL information. If an ATF agent wanted further 

information about the FRNP data, the agent should have to contact the 

case agent. ATF officials told us that ATF’s policy is intended to provide 

FRNP information to ATF agents on a “need-to-know” basis in order to 

protect the security of ATF investigations, and protect gun owner 

information.78 Moreover, federal internal control standards specify that 

control activities to limit user access to information technology include 

restricting authorized users to the applications or functions commensurate 

with assigned responsibilities.79

According to ATF officials, options are limited for resolving the global print 

function defect. ATF’s contract with the eTrace 4.0 developer has ended, 

and therefore ATF cannot contact the developer to fix the printing issue. 

ATF could have the issue resolved when a new version of eTrace, 

version 5.0, is released, but there is no timeline for the rollout of eTrace 

5.0. ATF officials told us that, in the short term, one method to fix the 

printing issue would be to remove individuals’ names and identifying 

information from the FRNP system, so it is not available for Suspect Gun 

Summary Reports. The firearms information and case agent information 

would remain available to all ATF agents, and ATF officials indicated that 

they did not think that removing the identifying information would hamper 

ATF agents’ investigations. Developing and implementing short-term and 

long-term mechanisms to align the eTrace system capability with existing 

ATF policy to limit access to purchaser information for ATF agents could 

ensure that firearms purchaser information remains limited to those with a 

need to know.

 78ATF referred to this as a policy throughout our review, but noted in technical comments 

to the report that it is a matter of practice and an “operational security preference.” We are 

using the term policy in a broad sense to describe the operations that ATF requires per 

the systematic processes and procedures stipulated in eTrace system documentation. 

79GAO/AIMD-00-21.3.1.
Page 38 GAO-16-552 Firearms Purchaser Data

MS complies with the appropriations act restriction; however, ATF lacks 

consistency among its MS deletion policy, system design, and policy 

implementation timing. Since we reported on MS in 1996, ATF has made 

minimal changes to the system itself, but the information contained in MS 

has changed with the inclusion of Demand Letter 3 reports, in addition to 

multiple sales reports.80

Multiple sales reports. By statute,81 FFLs are required to provide to ATF 

a multiple sales report whenever the FFL sells or otherwise disposes of, 

within any 5 consecutive business days, two or more pistols or revolvers, 

to an unlicensed person.82 The reports provide a means of monitoring and 

deterring illegal interstate commerce in pistols and revolvers by 

unlicensed persons. ATF’s maintenance of multiple sales reports in MS 

complies with the appropriations act restriction because of ATF’s statutory 

authority related to multiple sales reports, and the lack of significant 

changes to the maintenance of multiple sales reports in MS since we 

found it to be in compliance in 1996.

As we reported in 1996, ATF operates MS with specific statutory authority 

to collect multiple sales reports. In 1975, under the authority of the Gun 

Control Act of 1968, ATF first issued regulations requiring FFLs to 

prepare multiple sales reports and submit those reports to ATF. The 

legislative history related to ATF’s fiscal year 1979 appropriations act 

restriction did not provide any indication that Congress intended a change 

in ATF’s existing practice. In 1986, a provision of FOPA codified FFLs’

 80GAO/GGD-96-174. In September 1996, we reported that MS (which did not include 

Demand Letter 3 reports at the time), as designed, complied with the statutory data 

restrictions and that ATF operated the system consistently with its design, with one 

exception related to the system’s deletion requirement. ATF subsequently informed us 

that it had taken action to correct this. Changes to the system since then include adding 

optional fields to identify purchaser country of birth and multiple sales occurring at gun 

shows. 

8118 U.S.C. § 923(g)(3)(A). There is also an implementing regulation at 27 C.F.R. § 

478.126a. Since the passage of FOPA, there have been only technical administrative 

changes to this regulation.

82An “unlicensed person” is an individual who does not have a license pursuant to the 

Gun Control Act of 1968, as amended. FFLs are not required to prepare multiple sales 

reports for sales between FFLs, which are licensed.

MS Complies with the 

Appropriations Act 

Restriction, but ATF 

Continues to 

Inconsistently Adhere to 

ATF Policy When Deleting 

Records

Multiple Sales Reports and 

Demand Letter 3 Reports 

Maintained in MS Comply with 

the Appropriations Act 

Restriction
Page 39 GAO-16-552 Firearms Purchaser Data

regulatory reporting requirement, affirming ATF’s authority to collect 

multiple sales reports.83 In addition, this provision required, among other 

things, FFLs to forward multiple sales reports to the office specified by 

ATF. Therefore, under this provision, ATF was given the statutory 

authority to specify that FFLs forward multiple sales reports to a central 

location. In our 1996 report, we examined MS and found that it did not 

violate the prohibition on the consolidation or centralization of firearms 

records because ATF’s collection and maintenance of records was 

incident to its specific statutory responsibility. As we noted at that time, 

multiple sales reports are retrievable by firearms and purchaser 

information, such as serial number and purchaser name. We did not 

identify any significant changes to the maintenance of the multiple sales 

reports since we last reported on ATF’s compliance with the statutory 

restriction that would support a different conclusion in connection with this 

review.84

Demand Letter 3 reports. In 2011, in an effort to reduce gun trafficking 

from the United States to Mexico, ATF issued demand letters to FFLs 

classified as dealers or pawnbrokers in four southwest border states: 

Arizona, California, New Mexico, and Texas. The letter, referred to as 

Demand Letter 3, required these FFLs to submit a report to ATF on the 

sale or other disposition of two or more of a specific type of 

semiautomatic rifle, at one time or during any 5 consecutive business 

days, to an unlicensed person.85 Federal courts that have considered the 

issue have held that ATF’s collection of Demand Letter 3 reports are 

consistent with the appropriations act restriction. It is our view that ATF’s 

maintenance of Demand Letter 3 reports in MS is consistent with the 

appropriations act restriction in light of the statutory basis for Demand 

Letter 3, the courts’ decisions, and the way in which the records are 

maintained.

ATF has specific statutory authority to collect reports like Demand Letter 

3 reports. As discussed, FFLs are required to maintain certain firearms 

 83Pub. L. No. 99-308, § 103, 100 Stat. 449, 453-456 (1986). 

84Changes to the system since our 1996 report include adding optional fields to identify 

purchaser country of birth and multiple sales occurring at gun shows.

85The specific type of semiautomatic rifle is one that is capable of accepting a detachable 

magazine and with a caliber greater than .22.
Page 40 GAO-16-552 Firearms Purchaser Data

records at their places of business.86 By statute, FFLs may be issued 

letters requiring them to provide their record information or any portion of 

information required to be maintained by the Gun Control Act of 1968, as 

amended, for periods and at times specified by the letter.87

Some FFLs have challenged the legality of Demand Letter 3 reports for a 

number of reasons, including that it did not comply with the appropriations 

act restriction. Federal courts that have considered the issue have upheld 

ATF’s use of Demand Letter 3 as consistent with the appropriations act 

restriction. In one case before the U.S. Court of Appeals for the Tenth 

Circuit,88 the FFL contended that the demand letter created a national 

firearms registry in violation of the restriction on consolidation or 

centralization.89 The Tenth Circuit stated that the plain meaning of 

“consolidating or centralizing” does not prohibit the mere collection of 

some limited information. The court went on to state that the July 2011 

demand letter requested very specific information from a limited segment 

of FFLs. In addition, the court pointed out that Congress authorized the 

issuance of the letters in 1986, after passing the first appropriations act 

restriction, and Congress could not have intended to authorize the record 

collection in statute while simultaneously prohibiting it in ATF’s annual 

appropriations act. In other similar cases, the courts have also held that 

ATF had the authority to issue the demand letter and that ATF’s issuance 

of the demand letter complied with the appropriations act restriction.90 In 

addition, Demand Letter 3 reports are maintained in MS in an identical 

manner to multiple sales reports.

 8618 U.S.C. 923 (g)(1)(A).

8718 U.S.C. 923 (g)(5)(A). The provision provides, “Each licensee shall, when required by 

letter issued by the Attorney General, and until notified to the contrary in writing by the 

Attorney General, submit on a form specified by the Attorney General, for periods and at 

the times specified in such letter, all record information required to be kept by this chapter 

[Chapter 44 (Firearms) of Title 18 of the United States Code] or such lesser record 

information as the Attorney General in such letter may specify.”

88Ron Peterson Firearms, LLC v. Jones, 760 F.3d 1147 (10th Cir. 2014).

89The act stated “[t]hat no funds appropriated herein or hereafter shall be available for 

salaries or administrative expenses in connection with consolidating or centralizing, within 

the Department of Justice, the records, or any portion thereof, of acquisition and 

disposition of firearms maintained by Federal firearms licensees.”

90See 10 Ring Precision v. Jones, 722 F.3d 711 (5th Cir. 2013); Nat’l Shooting Sports 

Found., Inc. v. Jones, 716 F.3d 200 (D.C. Cir. 2013).
Page 41 GAO-16-552 Firearms Purchaser Data

Although not required by statute, ATF policy requires that firearms 

purchaser names be deleted from MS 2 years after the date of the 

reports, if the firearm has not been connected to a firearms trace.91

However, ATF’s method to identify records for deletion is not 

comprehensive and, therefore, 10,041 names that should have been 

deleted remained in MS until May 2016.92 According to ATF officials, 

because of MS system design limitations, analysts must write complex 

queries to locate such names in MS. For example, since the information 

needed to identify the correct records could exist in free-form fields, the 

success of the queries in comprehensively identifying all appropriate 

records depends on consistent data entry of several text phrases 

throughout the history of the system. In addition, ATF’s queries have 

inconsistently aligned with its system design—for instance, as the system 

was modified and updated, the query text remained aligned with the 

outdated system—and therefore these queries resulted in incomplete 

identification of records to be deleted. Changes to MS to address system 

query limitations would require a system-wide database enhancement, 

but there is currently not an operations and maintenance support contract 

in place for this system.

Moreover, even if the system could ensure that deletions capture all 

required records, ATF has inconsistently adhered to the timetable of 

deletions required by its policy. For example, according to ATF’s deletion 

log and our verification of the log, some records entered in 1997 were not 

deleted until November 2009—about 10 years after the required 2 

 91According to ATF officials, ATF’s policy is designed to balance the law enforcement

need to retain and access multiple sale information that may be relevant to criminal 

investigations with the privacy interests of firearms purchasers. ATF reported that, during 

the course of our review, it modified its deletion procedures to identify records to delete 

based on report date, in order to ensure strict alignment with ATF’s deletion policy. 

Previously, ATF identified records to delete based on the date of entry in MS, which in 

most instances is within 24 hours of the date of the report, according to ATF. 

92At our request, an NTC data analyst queried MS to identify records (1) not associated 

with a trace, (2) entered prior to January 2009—a period for which NTC did delete data, 

and (3) did not have the purchaser name replaced with the text “PURGED”—ATF’s 

mechanism for deleting the records. This search resulted in identifying records from every 

year from 1995 through 2008—ranging from 21 records to 5,878 records in a given year—

that should have been deleted but were not. The total number of records was 10,041 of 

1,509,054 records—or less than 1 percent—entered through December 2008 that NTC 

should have deleted but still maintained with purchaser names in MS until May 2016. The 

vast majority of these records were from 1996 and 1997.

ATF’s Long-Standing Struggle 

to Implement Its MS Deletion 

Policy Persists
Page 42 GAO-16-552 Firearms Purchaser Data

years.93 As shown in table 1 below, ATF’s timing for implementing 

deletions did not adhere to ATF policy directives.

As shown in table 1 below, the ATF deletion policy for MS has changed 

over time including variations in the frequency of deletions (e.g., annually,

monthly, weekly), and pauses to the deletion policy because of, according 

to ATF officials, litigation and requests from Congress. According to NTC 

officials, delayed deletions occurred because deleting a large number of 

records at once negatively affects the system, slowing system response 

time or stopping entirely the larger related data system.94 However, 

according to NTC’s deletion log and verified by our observations of NTC 

system queries, deletions were conducted in average increments of 

almost 100,000 records per day—representing on average a full year’s 

worth of records to be deleted. In addition, ATF confirmed that a single 

deletion of 290,942 records on one day in January 2011 did not affect the 

system. Therefore, system constraints do not seem to be the reason for 

the delayed deletion. ATF did not identify further causes for the delays in 

deletions.

Table 1: Multiple Sales (MS) Deletion Policy Requirement Implementation and Timing

MS deletion policy requires deleting firearms purchaser names over 2 years old and not linked to firearms traces. GAO tested the 

system for undeleted names and reviewed the deletion log where Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) analysts 

recorded deletions.

Deletion Policy 

Requirementa Year of Entry of

MS Recordb

Applicable names 

remaining undeleted, 

as of October 2015 

Applicable names 

deleted, based on 

deletion log

Timeliness of deletions, 

based on deletion log

Begin deleting names from 

records (effective November 

1995– December 1999), on 

weekly basis starting July 

1996c

1995–1996 3,793 n/ad n/ad

1997 5878 1855 9 years and 11 months late

 93Based on NTC queries that we observed, we verified that, of the records logged as 

deleted on five different dates, more than 99 percent had been deleted. We therefore 

determined that the dates on which ATF personnel actually deleted purchaser names from 

MS, and the number of records actually deleted, generally matched the dates and number 

of deleted records on the log.

94The larger related data system is the Firearms Tracing System, which contains MS data. 

See app. II for more details.
Page 43 GAO-16-552 Firearms Purchaser Data

Deletion Policy 

Requirementa Year of Entry ofMS Recordb

Applicable names 

remaining undeleted, 

as of October 2015 

Applicable names 

deleted, based on 

deletion log

Timeliness of deletions, 

based on deletion log

Pause deletions due to 

litigation (effective January 

2000–October 2009)e

1998–2007 No deletions conducted because of pause in deletion policy

Delete names from records all 

at once (onetime deletion 

directed in November 2009)

1998–2001 101 352,416 On time

2002–Part of 2005 118 347,076 2 months late

Part of 2005–Part 

of 2006

45 50,357 6 months late

Part of 2006–2007 43 261,282 14 months late

Delete names from records 

on fiscal year basis (effective 

November 2009–December 

2010) 

2008 63 183,604 3 months late for records 

entered from November 

2007 through September 

2008 

Delete names from records 

on monthly basis (effective 

January 2011) 

In accordance with policy for 

records entered from 

October 2008 through 

December 2008

Pause deletions due to 

requests from Congress 

(effective February 2011–

present)e

2009–2014 No deletions conducted because of pause in deletion policy

Source: GAO analysis of ATF information. | GAO-16-552.

a

Policy requirements listed in this timeline apply generally to the year of entry of MS record indicated; 

policies may apply up to several months before or after the indicated year of entry.

b

Because of a lack of precision in ATF’s deletion log, we could not determine whether deletions 

covering partial years corresponded to the beginning or later parts of the years, nor which portion of 

the year included the undeleted records. Thus, the years of entry and number of deleted names are 

listed in the order shown on ATF’s deletion log, and the number of undeleted names is included in the 

first mention of the applicable year. Because ATF created MS in 1995, multiple sales reported in 1995 

and prior are all included in the “1995” year of entry of MS record.

c

We were not able to determine the policy for frequency of deletions (e.g., weekly) from November 

1995 through June 1996.

d

n/a means not available. We reviewed the ATF deletion log, which covered records entered in 1997 

through 2008. The deletion logs did not include records entered before 1997, and we did not validate 

the timing of these deletions in the system.

e

According to ATF, ATF suspended implementation of its deletion policy because of litigation 

(affecting records entered from January 1998 through October 2007) and requests from Congress 

(affecting records entered from January 2009 through 2014 and on an ongoing basis). ATF officials 

could not be certain of when the deletion pause for litigation began, but they believe that it likely 

started in or before June 2000. We therefore selected January 2000 as the start date of the pause to 

the deletion policy for this table. We did not independently verify the basis for suspending deletions 

related to litigation.
Page 44 GAO-16-552 Firearms Purchaser Data

ATF reported that the objective for its deletion policy was primarily to 

delete data that may not be useful because of its age and to safeguard 

privacy concerns related to retaining firearms purchaser data. Federal 

internal control standards require control activities to help ensure that 

management’s directives are carried out.95 Additionally, information 

systems and related control activities should be designed to achieve 

objectives and respond to risks.96 Specifically, an organization’s 

information system should be designed by considering the processes for 

which the information system will be used. For example, to alleviate the 

risk of not meeting the objectives established through the MS deletion 

policy, ATF must ensure the policy is consistent with the design of the MS 

data system and ATF must ensure that it meets the policy’s timeline 

requirements. In September 1996, we reported that ATF had not fully 

implemented its 2-year deletion requirement.97 During the course of our 

1996 review, ATF provided documentation that it had subsequently 

deleted the required records and that it would conduct weekly deletions in 

the future. Similarly, as a result of our current review, according to ATF 

documentation, in May 2016, the agency deleted the 10,041 records that 

should have been deleted earlier.98 However, given that this has been a 

20-year issue, it is critical that ATF develop consistency between its 

deletion policy, the design of the MS system, and the timeliness with 

which deletions are carried out. By aligning the MS system design and 

the timeliness of deletion practices with its policy, ATF could ensure that it 

maintains only useful purchaser information while safeguarding the 

privacy of firearms purchasers.

ATF has an important role in combatting the illegal use of firearms, and 

must balance this with protecting the privacy rights of law-abiding firearms 

owners. Of the four ATF firearms data systems we reviewed that 

contained firearms purchaser information, we found that certain aspects 

of two of these systems violated the appropriations act restriction on 

 95GAO/AIMD-00-21.3.1.

96GAO-14-704G.

97GAO/GGD-96-174.

98At the time of the May 2016 deletion, the NTC analyst identified and deleted 10,044 

records that should have been deleted earlier—3 more records than we identified during 

our review. 

Conclusions
Page 45 GAO-16-552 Firearms Purchaser Data

consolidating or centralizing FFL firearms records, but ATF resolved 

these issues during the course of our review. With regard to ATF policies 

on maintenance of firearms records, ATF should do more to ensure that 

these policies are followed and that they are clearly communicated. 

Specifically, providing guidance to industry members participating in A2K 

for how to submit their records when they go out of business would help 

ensure they submit required records to ATF. Without this clear guidance, 

ATF risks not being able to locate the first purchaser of a firearm during a 

trace, and thus may not be able to fulfill part of its mission. In addition, 

aligning eTrace system capability with ATF policy to limit access to 

firearms purchaser information in FRNP would ensure that such 

information is only provided to those with a need to know. Finally, aligning 

the MS system design and the timeliness of deletion practices with the 

MS deletion policy would help ATF maintain only useful purchaser data 

and safeguard the privacy of firearms purchasers.

In order to help ensure that ATF adheres to its policies and facilitates 

industry compliance with requirements, we recommend that the Deputy 

Director of ATF take the following three actions:

• provide guidance to FFLs participating in A2K for provision of out-ofbusiness records to ATF, so that FFLs can better ensure that they are 

in compliance with statutory and regulatory requirements;

• develop and implement short-term and long-term mechanisms to align 

the eTrace system capability with existing ATF policy to limit access to 

FRNP purchaser information for ATF agents; and

• align the MS deletion policy, MS system design, and the timeliness of 

deletion practices to improve ATF’s compliance with the policy.

We provided a draft of this report to ATF and DOJ on May 25, 2016 for 

review and comment. On June 16, 2016, ATF provided an email 

response, stating that the agency concurs with all three of our 

recommendations and is taking several actions to address them. 

ATF concurred with our recommendation that ATF provide guidance to 

FFLs participating in A2K for provision of out-of-business records to ATF.

ATF stated that the agency is modifying its standard Memorandum of 

Understanding with A2K participants to incorporate specific guidance 

regarding the procedures to be followed when a participant goes out of 

business. ATF also stated that, as a condition of participation, all current 

Recommendations for 

Executive Action

Agency Comments 

and Our Evaluation
Page 46 GAO-16-552 Firearms Purchaser Data

and future A2K participants will be required to adopt the revised 

Memorandum of Understanding. The implementation of such guidance in 

the Memorandum of Understanding for A2K participants should meet the 

intent of our recommendation.

ATF concurred with our recommendation that ATF develop and 

implement mechanisms to align the eTrace system capability with existing 

ATF policy to limit access to FRNP purchaser information for ATF agents.

ATF stated that, in the short term, the agency will delete all purchaser 

information associated with a firearm entered into FRNP, and will no 

longer enter any purchaser information into FRNP. ATF stated that, in the 

long term, the agency will modify the Firearms Tracing System to remove 

the purchaser information fields from the FRNP module, and will modify 

eTrace as necessary to reflect this change. These short- and long-term 

plans, if fully implemented, should meet the intent of our 

recommendation.

ATF concurred with our recommendation that ATF align the MS deletion 

policy, MS system design, and the timeliness of deletion practices to 

improve ATF’s compliance with the policy. As we reported above, ATF 

stated that the agency deleted all purchaser names from MS that should 

have been deleted earlier. ATF also stated that the agency is 

implementing protocols to ensure that deleting purchaser names from MS 

aligns with ATF policy. If such protocols can be consistently implemented 

in future years, and address both the timeliness of deletions and the 

comprehensive identification of records for deletion, they should meet the 

intent of our recommendation. 

On June 22, 2016, DOJ requested additional time for its Justice 

Management Division to review our conclusions regarding ATF’s 

compliance with the appropriations act restriction and the Antideficiency 

Act. As noted earlier, we solicited ATF’s interpretation of the restriction on 

consolidation or centralization of records as applied to each of the 

systems under review by letter of December 21, 2015, consistent with our 

standard procedures for the preparation of legal opinions.99 ATF 

responded to our inquiry on January 27, 2016, and its views are reflected 

 99GAO, Procedures and Practices for Legal Decisions and Opinions, GAO-06-1064SP

(Washington, D.C.: Sept. 5, 2006).
Page 47 GAO-16-552 Firearms Purchaser Data

in the report. Nevertheless, DOJ stated that ATF and DOJ officials had 

not followed DOJ’s own processes regarding potential violations of the 

Antideficiency Act, specifically promptly informing the Assistant Attorney 

General for Administration. As a result, DOJ requested additional time to 

review the appropriations law issues raised by the draft report.

As explained in appendix VII, ATF’s failure to comply with the prohibition 

on the consolidation or centralization of firearms records violated the 

Antideficiency Act, which requires the agency head to submit a report to 

the President, Congress, and the Comptroller General.100 The Office of 

Management and Budget (OMB) has published requirements for 

executive agencies for reporting Antideficiency Act violations in Circular 

A-11, and has advised executive agencies to report violations found by 

GAO.101 OMB has further advised that “[i]f the agency does not agree that 

a violation has occurred, the report to the President, Congress, and the 

Comptroller General will explain the agency’s position.”102 We believe that 

the process set forth by OMB affords DOJ the opportunity to consider and 

express its views.103

ATF also provided us written technical comments, which we incorporated 

as appropriate.

As agreed with your offices, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send copies to the Deputy Director of 

ATF, the Attorney General of the United States, and other interested 

parties. In addition, the report will be available at no charge on the GAO 

website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact 

Diana C. Maurer at (202) 512-9627 or maurerd@gao.gov, or Helen T. 

Desaulniers at (202) 512-4740 or desaulniersh@gao.gov. Contact points 

 10031 U.S.C. § 1351. 

101OMB, Preparation, Submission, and Execution of the Budget, OMB Circular No. A-11, 

§§ 145, 145.8 (Washington, D.C.: June 2015). 102Id.

103DOJ officials told us that they are initiating the OMB process.
Page 48 GAO-16-552 Firearms Purchaser Data

for our Offices of Congressional Relations and Public Affairs may be 

found on the last page of this report. GAO staff who made key 

contributions to this report are listed in appendix VIII.

Diana C. Maurer

Director

Homeland Security and Justice Issues

Helen T. Desaulniers

Managing Associate General Counsel

Office of the General Counsel
Appendix I: Objectives, Scope, and 

Methodology

Page 49 GAO-16-552 Firearms Purchaser Data

This report addresses the following objectives:

1. Identify the Bureau of Alcohol, Tobacco, Firearms and Explosives 

(ATF) data systems that contain retail firearms purchaser data and 

describe the characteristics of selected systems.

2. Determine whether selected ATF data systems comply with the 

appropriations act restriction on consolidation or centralization of 

firearms records and ATF policies.

To calculate the estimated number of firearms in the United States in 

2013, we used data from ATF’s February 2000 report on Commerce in 

Firearms in the United States and ATF’s 2015 Annual Statistical Update 

to this report.1 To calculate the approximate number of murders in which 

 1

Department of the Treasury, Bureau of Alcohol, Tobacco & Firearms, Commerce in 

Firearms in the United States (Washington, D.C.: Feb. 2, 2000). United States Department 

of Justice, Bureau of Alcohol, Tobacco, Firearms and Explosives, Firearms Commerce in 

the United States: Annual Statistical Update 2015 (Washington, D.C.: 2015). We used the 

firearms manufacturing, export, and import data from 1899 through 1985 from the report, 

and from 1986 through 2013 from the update. We added the total handguns (including 

pistols and revolvers), rifles, and shotguns that were manufactured; subtracted the total 

that were exported; and added the total that were imported. We rounded the total down to 

the nearest 10 million to obtain an estimated number. Including miscellaneous firearms—a 

category that includes pistol grip firearms, starter guns, and firearms frames and 

receivers—did not change our final estimate, so our estimate applies to a total with or 

without miscellaneous firearms. ATF officials stated that this methodology is an 

appropriate use of the agency’s data, noting that the data are based, in part, on 

information reported by manufacturers, some of whom do not report their data in a timely 

manner, if at all, and that the data are only as accurate as the information provided by 

these federal firearms licensees (FFL). 

Appendix I: Objectives, Scope, and 

Methodology
Appendix I: Objectives, Scope, and 

Methodology

Page 50 GAO-16-552 Firearms Purchaser Data

firearms were involved in 2014, we used data from the Federal Bureau of 

Investigation’s Uniform Crime Reports from 2014.2

To address the first objective, we reviewed ATF policy and program 

documents to identify ATF data systems related to firearms. For the 

purposes of this report, “data systems” or “systems” refers to ATF’s data 

systems and system components, including what ATF refers to as 

“modules” of a larger system, and what ATF refers to as “programs” 

whose associated data are contained within related systems. These 

policy and program documents included, among other things, ATF orders, 

system descriptions, system user manuals, system training materials, and 

data submission forms. We compared this information to the systems 

identified in our September 1996 report, and conducted searches of 

publicly available information to develop a comprehensive and current list 

of systems.3 In order to identify the systems and better understand them 

and their contents, we spoke with ATF officials in headquarters and at 

ATF’s National Tracing Center (NTC). We also discussed these systems 

with ATF investigative and regulatory officials in the Baltimore and Los 

Angeles field offices, who provided varying perspectives due to 

geographic factors. These actions enabled us to confirm a 

comprehensive list of systems, and determine the presence of retail 

purchaser information within these systems.

 2

Federal Bureau of Investigation, Uniform Crime Reports: 2014 Crime in the United 

States, accessed April 20, 2016, https://www.fbi.gov/about-us/cjis/ucr/crime-in-theu.s/2014/crime-in-the-u.s.-2014. We used the Expanded Homicide Data Table 8 to 

determine the number of murder victims in 2014 by firearms from the total number of 

murder victims by known methods. We added to this an estimate of the number of murder 

victims by unknown methods that were likely by firearms. To do this, we determined the 

number of murder victims by unknown methods by using the Crime in the United States 

Table 1 to determine the total number of murder victims in 2014 and subtracting from this 

the total number of murder victims by firearms. We applied the percentage of murders with 

known methods that were by firearms to the number of murder victims by unknown 

methods. After summing the number of murder victims by firearms with the number of 

murder victims by unknown methods that were likely firearms, we rounded to the nearest 

1,000. Because the 2014 Uniform Crime Reports data will be updated and finalized when 

the 2015 data are issued, we calculated the likely changes to the data based on previous 

years’ changes, and determined that the maximum and minimum likely changes would not 

result in a change to our estimated figure. Federal Bureau of Investigation officials stated 

that this methodology is an appropriate use of the agency’s data.

3

GAO, Federal Firearms Licensee Data: ATF’s Compliance with Statutory Restrictions,

GAO/GGD-96-174 (Washington, D.C.: Sept. 11, 1996).
Appendix I: Objectives, Scope, and 

Methodology

Page 51 GAO-16-552 Firearms Purchaser Data

We selected four systems for a more in-depth review: Out-of-Business 

Records Imaging System (OBRIS), Access 2000 (A2K), Firearm 

Recovery Notification Program (FRNP), and Multiple Sales (MS).4

Selected systems, at a minimum, contained retail purchaser information 

and contained original records—as opposed to systems that transmitted 

information, such as a system that only pulls data from another system in 

order to print a report or fill out a form. A system was more likely to be 

selected if (1) it contained data unrelated to a criminal investigation,5 (2) a 

large percentage of system records contained retail purchaser 

information, (3) the retail purchaser information was searchable, or (4) 

ATF initiated the system—as opposed to ATF being statutorily required to 

maintain the system. See table 2 for more details.

Table 2: Selected Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) Firearms-Related Data Systems and Their 

Selection Criteria Based on System Design

Designed to 

contain any retail 

purchaser 

information

Designed to 

contain original 

records

Designed to contain 

data unrelated to a 

criminal 

investigation

Designed for a 

large percentage 

of records in the 

system to contain 

retail purchaser 

information

Designed to 

contain retail 

purchaser 

information that is 

searchable

ATF initiated 

the system

Out-of-Business 

Records Imaging 

System Yes Yes Yes Yes No No

Access 2000 Yes Yes Yes No No Yes

Firearm Recovery 

Notification 

Program Yes Yes No Yes Yes Yes

Multiple Sales Yes Yes Yes Yes Yes No

Source: GAO analysis of ATF information. | GAO-16-552.

For the selected systems, we reviewed ATF data on the number of 

system records, among other things—for OBRIS and A2K for fiscal year 

2015, and for FRNP and MS from fiscal years 2010 through 2015. We 

 4

For the purposes of this report, “data systems” or “systems” refers to ATF’s data systems 

and system components, including what ATF refers to as “modules” of a larger system, 

and what ATF refers to as “programs” whose associated data are contained within related 

systems.

5

In this report, we did not evaluate the method by which ATF opens a criminal 

investigation or the criteria which must be met in order to open a criminal investigation.
Appendix I: Objectives, Scope, and 

Methodology

Page 52 GAO-16-552 Firearms Purchaser Data

assessed the reliability of these data by interviewing ATF staff 

responsible for managing the data and reviewing relevant documentation, 

and concluded that these data were sufficiently reliable for the purposes 

of our report. We reviewed ATF policy and program documents to obtain 

in-depth descriptions of these selected systems, and discussed these 

systems with ATF officials. We visited NTC to observe the selected 

systems in operation.

To address the second objective, we reviewed relevant laws, including 

statutory data restrictions, and ATF policy and program documents 

relating to ATF’s firearms tracing operations and the selected systems. 

We also solicited the agency’s interpretation of the restriction on 

consolidation or centralization of records as applied to each of the 

systems, and interviewed ATF officials regarding the data systems’

compliance with that restriction and ATF policies. We visited NTC to 

observe how selected systems’ data are collected, used, and stored. For 

OBRIS, A2K, FRNP, and MS, we observed NTC analysts using the 

systems during firearms traces and observed the extent to which the 

systems are searchable for retail purchaser information. For OBRIS, 

FRNP, and MS, we observed NTC analysts receiving and entering data 

into the systems and processing the original data submissions—either 

electronically or through scanning and saving documents—including 

quality-control checks.

For A2K, we reviewed budgetary information to determine the source of 

funding for the system for fiscal year 2008 through fiscal year 2014. We 

also interviewed representatives from the contractor that manages A2K, 

and 3 of 35 industry members that use A2K, to better understand how the 

system functions. We selected industry members that had several years 

of experience using A2K and reflected variation in federal firearms 

licensee (FFL) size and type. Although our interviews with these industry 

members are not generalizable, they provided us with insight on the 

firearms industry’s use of A2K.

In order to evaluate the contents of FRNP for the presence of retail 

purchaser information and compliance with the appropriations act 

restriction and FRNP policies, we reviewed several fields of data for the 

entire population of records. During our site visit, we also reviewed 

additional fields of data for a generalizable sample of records and the 

associated submission forms that are used to populate the records.

For this sample, we compared selected data in the system to information 

on the forms, and collected information from the forms. We drew a 
Appendix I: Objectives, Scope, and 

Methodology

Page 53 GAO-16-552 Firearms Purchaser Data

stratified random probability sample of 434 records from a total population 

of 41,625 FRNP records entered from June 1991 through July 2015. With 

this probability sample, each member of the study population had a 

nonzero probability of being included, and that probability could be 

computed for any member. We stratified the population by active/inactive 

record status and new/old (based on a cutoff of Nov. 1, 2004).6 Each 

sample element was subsequently weighted in the analysis to account 

statistically for all the records, including those that were not selected. 

Because we followed a probability procedure based on random 

selections, our sample is only one of a large number of samples that we 

might have drawn. Since each sample could have provided different 

estimates, we express our confidence in the precision of our particular 

sample’s results as a 95 percent confidence interval. This is the interval 

that would contain the actual population value for 95 percent of the 

samples we could have drawn. All percentage estimates from the review 

of the generalizable sample of FRNP records have margins of error at the 

95 percent confidence level of plus or minus 5 percentage points or less, 

unless otherwise noted.

For our review of the submission forms associated with FRNP records, 

we reviewed 195 forms entered into FRNP from November 2004 through 

July 2015 that were sampled from the “new” stratum. Prior to November 

2004, the submission forms did not include selection options for criteria 

for entry into FRNP. We therefore only reviewed the more recent forms in 

order to assess the presence of criteria on these forms. Our review of 

these forms is generalizable to submission forms entered into FRNP from 

November 2004 through July 2015. All percentage estimates from the 

review of submission forms have margins of error at the 95 percent 

confidence level of plus or minus 3 percentage points or less, unless 

otherwise noted.

We assessed the reliability of the FRNP data by conducting electronic 

tests of the data for obvious errors and anomalies, interviewing staff 

 6

Active/inactive refers to a record’s status in FRNP; an FRNP record is made inactive 

when the related ATF investigation is closed. New/old refers to the age of the record. For 

the purposes of this report, a record was considered to be new if it had an entry date of 

November 1, 2004 or later; a record was considered to be old if it had an entry date prior 

to November 1, 2004. We selected this cutoff date because of changes to the FRNP 

submission forms since November 2004.
Appendix I: Objectives, Scope, and 

Methodology

Page 54 GAO-16-552 Firearms Purchaser Data

responsible for managing the data, and reviewing relevant 

documentation, and concluded that these data were sufficiently reliable 

for the purposes of our report. For MS, we observed the process of 

querying to identify particular records.7

We determined the selected data systems’ compliance with the 

appropriations act restriction, and compared them to multiple ATF policies 

on collection and maintenance of information, and criteria in Standards for 

Internal Control in the Federal Government related to control activities for 

communication and for the access to and design of information systems.8

We conducted this performance audit from January 2015 to June 2016 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

 7

To verify ATF’s spreadsheet-based deletion log for MS records that had been deleted—

which contains dates and the total number of records deleted—we requested that an NTC 

data analyst query MS records that were deleted on five separate dates. We then 

compared the results of the query to the data in the deletion log. We reduced the 

difference in the results by the number of records that had likely been repopulated as the 

result of a trace. (The purchaser name is repopulated in cases where deleted records are 

subsequently matched with firearms traces.)

8

See GAO, Standards for Internal Control in the Federal Government, 

GAO/AIMD-00-21.3.1 (Washington, D.C.: Nov. 1, 1999), and Standards for Internal 

Control in the Federal Government, GAO-14-704G (Washington, D.C.: Sept. 10, 2014).
Appendix II: Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) Firearms-Related Data Systems

Page 55 GAO-16-552 Firearms Purchaser Data

Table 3: Selected Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) Firearms-Related Data Systems that Contain Retail Firearms Purchaser Information

Data 

system Purpose

Responsible 

ATF branch Data sources

Contents related to 

firearms purchaser 

information

Number of 

records

Who can view the 

information

Imports 

information 

from 

Exports 

information to 

Access 

2000 (A2K)

Stores the electronic 

disposition records of 

participating industry 

members (limited to 

manufacturers, importers, 

and distributors, and not 

retail dealers) to allow 

National Tracing Center 

(NTC) personnel to 

search—during a gun 

trace—via secure web 

portal by exact firearm 

serial number and obtain 

firearms disposition data

NTC Participating 

industry members 

upload data to 

ATF-owned 

servers or, in 

some cases, 

private servers 

using ATF 

software

Electronic disposition 

records, including 

firearms information 

(e.g., serial number, 

model), name and 

address to which 

firearm was shipped, 

and transaction date

252,433,229, 

representing the 

same number of 

firearmsa

44 authorized NTC 

employees and 

contractors 

(searching by exact 

serial number only)

Closed system 

with no direct 

link to any other 

ATF system

Closed system 

with no direct link 

to any other ATF 

system

Firearm 

Recovery 

Notification 

Program 

(FRNP)

Collects information on 

firearms associated with 

an ATF criminal 

investigation that have not 

yet been recovered by law 

enforcement.b The system 

allows NTC to notify 

requesting ATF agents if 

such firearms are 

recovered and traced.

NTC ATF agents send 

data to NTC on 

FRNP submission 

form (ATF Form 

3317.1)

Firearms information 

(e.g., serial number, 

model), request 

information (e.g., 

requestor’s name, 

contact information), 

suspect and retail 

purchaser information 

(e.g., name, date of 

birth), federal firearms 

licensee (FFL) 

information (e.g., FFL 

name, FFL number)

41,879, 

representing 

183,015 

firearmsc

About 396 Firearms 

Tracing System 

users, primarily 

NTC personnel, 

and the 3,050 ATF 

users, which 

includes ATF 

agents. ATF eTrace 

users outside of 

NTC are generally 

to be limited to 

viewing firearms 

and requesting 

agent information. 

Firearms 

Licensing 

System

eTrace; Firearms 

Information 

Reporting 

System (FIRES); 

Firearms Tracing 

System (FTS) 

(Data related to 

FRNP are 

contained in 

FTS.)

Appendix II: Bureau of Alcohol, Tobacco, 

Firearms and Explosives (ATF) FirearmsRelated Data Systems
Appendix II: Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) Firearms-Related Data Systems

Page 56 GAO-16-552 Firearms Purchaser Data

Data 

system Purpose

Responsible 

ATF branch Data sources

Contents related to 

firearms purchaser 

information

Number of 

records

Who can view the 

information

Imports 

information 

from 

Exports 

information to 

Multiple 

Sales (MS)

Collects and tracks data 

on retail purchasers of two 

or more pistols or 

revolvers, or both, and two 

or more of certain rifles—

in Arizona, California, New 

Mexico, and Texas—at 

one time or during any 5 

consecutive business 

days for regulatory and 

criminal enforcement

NTC FFLs send reports 

to NTC on a 

specified form 

(ATF Form 

3310.4)

Firearms information 

(e.g., serial number, 

model), retail 

purchaser information 

(e.g., name, date of 

birth); FFL information 

(e.g., FFL name, FFL 

number) 

3,545,942, 

representing 

8,261,816 

firearmsc

About 396 ATF 

Firearms Tracing 

System (FTS) 

users, primarily 

NTC personnel, 

and the 3,050 ATF 

users, which 

includes ATF 

agents. ATF eTrace 

users outside of 

NTC are generally 

to be limited to 

viewing firearms 

and requesting 

agent information. 

Firearms 

Licensing 

System

eTrace; FIRES; 

FTS (Data 

related to MS are 

contained in 

FTS.) 

Out-ofBusiness 

Records 

Imaging 

System 

(OBRIS)

Collects, indexes, and 

retrieves digital copies of 

firearms transaction 

records—for regulatory 

and criminal 

enforcement—of FFLs 

that have permanently 

gone out of business

NTC Out-of-business 

FFLs send 

firearms 

transaction 

records to NTC, 

specifically 

acquisition and 

disposition 

logbooks and a 

specified form 

(ATF Form 4473)

Firearms information 

(e.g., serial number, 

model), retail 

purchaser information 

(e.g., name, date of 

birth); FFL information 

(e.g., FFL name, FFL 

number) stored as 

non-searchable 

photographic imagesd

284,324,693 

imagese About 376 ATF users, including 

281 NTC 

employees and 

contractors, have 

complete access to 

the system, and 95 

ATF users outside 

NTC

Closed system 

with no direct 

link to any other 

ATF system

Closed system 

with no direct link 

to any other ATF 

system

Source: GAO analysis of ATF data. | GAO-16-552

a

Each record represents one firearm as of October 2, 2015.

b

FRNP contained 855 records, relating to 11,693 firearms, not associated with an ATF criminal investigation, which ATF deleted in 

March 2016. For more information on these records, see earlier in this report.

c

Each record represents one or more firearms as of September 30, 2015.

d

For the purposes of this report, nonsearchable means that the document is not searchable through character recognition using text 

queries.

e

There were 284,324,693 images as of September 30, 2015. ATF does not know how many firearms are represented by these OBRIS 

images since one image or multiple images can represent one or more firearms.
Appendix II: Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) Firearms-Related Data Systems

Page 57 GAO-16-552 Firearms Purchaser Data

Table 4: Other Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) Firearms-Related Data Systems That Contain Retail Firearms Purchaser Information

Data system Purpose, as designed

Responsible ATF 

branch

Contents related to firearms 

purchaser informationa Who can view the information

Imports 

information from 

Exports 

information to 

ATF National Instant 

Criminal Background 

Check System 

(NICS) Referralb

Contains information on 

purchasers that 

attempted to acquire a 

firearm and did not pass 

the NICS check

Denial 

Enforcement and 

NICS Intelligence 

Branch

Retail purchaser information of 

prohibited individuals who 

attempted to purchase a firearm 

(e.g., name); firearms information 

(e.g., serial number, model)

ATF employees Federal Licensing 

System (FLS) 

NFORCE

eTrace Allows law enforcement 

agency users to submit 

firearms trace requests, 

search and view trace 

results, and run analytical 

reports on trace data

National Tracing 

Center (NTC)

Firearms information (e.g., serial 

number, model), retail purchaser 

information (e.g., name, date of 

birth); federal firearms licensee 

(FFL) information (e.g., FFL name, 

FFL number)

ATF employees; federal, 

state, local, and foreign law 

enforcement agencies. 

Non-ATF users have 

access to information on 

their own trace requests 

and those from agencies 

with which they have a 

memorandum of 

understanding.

FFL Theft; FLS; 

Firearm Recovery 

Notification Program 

(FRNP); Interstate 

Theft; Multiple Sales 

(MS); Trace

Trace

Firearms and 

Explosives Import 

System 

Tracks information on the 

importation of firearms 

and explosives into the 

United States 

Firearms and 

Explosives 

Services Division

Firearms information (e.g., serial 

number, model), retail purchaser 

information (e.g., name, address); 

FFL information (e.g., FFL name, 

FFL number) 

ATF employees have readonly access, Firearms and 

Explosives Services 

Division analysts have edit 

rights

eForms; FLS No ATF firearmsrelated data systems

Firearms Information 

Reporting System 

(FIRES)

Prints paper copies of 

reports of closed traces 

and other NTC reports

NTC Firearms information (e.g., serial 

number, model); retail purchaser, 

possessor, and associates 

information (e.g., first and last 

name); FFL information (e.g., city 

and state)

NTC employees and ATF 

personnel at Crime Gun 

Intelligence Centers

FFL Theft; FLS; 

FRNP; Interstate 

Theft; MS; Trace

No ATF firearmsrelated data systems
Appendix II: Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) Firearms-Related Data Systems

Page 58 GAO-16-552 Firearms Purchaser Data

Data system Purpose, as designed

Responsible ATF 

branch

Contents related to firearms 

purchaser informationa Who can view the information

Imports 

information from 

Exports 

information to 

Firearms Tracing 

System (FTS)c Overarching data system that contains firearms 

trace information related 

to Demand, FFL Theft, 

Firearm Recovery 

Notification Program, 

Interstate Theft, Multiple 

Sales, and Trace, in 

order to respond to trace 

requests and analyze 

crime and firearms data

NTC Firearms information (e.g., serial 

number, model), retail purchaser 

information (e.g., name, date of 

birth); FFL information (e.g., FFL 

name, FFL number) 

Selected NTC personnel 

and ATF field agents 

FFL Theft; FLS; 

FRNP; Interstate 

Theft; MS; Trace

No ATF firearmsrelated data systems

Interstate Theft Collects and tracks, for 

criminal enforcement 

purposes, information on 

thefts of firearms during 

interstate shipment 

between FFLs

NTC Firearms information (e.g., serial 

number, model), retail purchaser 

information (e.g. name); FFL 

information (e.g., FFL name, FFL 

number) 

eTrace and FTS users FLS eTrace; FIRES; FTS 

(Data related to 

Interstate Theft are 

contained in FTS.)

National Firearms 

Act System (NFA) / 

National Firearms 

Registration and 

Transfer Record 

System (NFRTR)d

Collects and tracks data 

from applications and 

forms submitted by 

manufacturers, dealers, 

and owners of NFA 

firearms (i.e., machine 

guns, destructive 

devices, and certain 

other firearms) to monitor 

and enforce these 

classes of firearms for 

regulatory and criminal 

enforcement

Firearms and 

Explosives 

Services Division

Firearms information (e.g., serial 

number, model), retail purchaser 

information (e.g., name, date of 

birth); FFL information (e.g., FFL 

name, FFL number). Original and 

subsequent purchasers are 

maintained as part of the system.

ATF employees with 

supervisor approval have 

read-only access, NFRTR 

analysts have edit rights

FLS; National 

Firearms Act Special 

Occupational Tax 

System (NSOT) 

No ATF firearmsrelated data systems
Appendix II: Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) Firearms-Related Data Systems

Page 59 GAO-16-552 Firearms Purchaser Data

Data system Purpose, as designed

Responsible ATF 

branch

Contents related to firearms 

purchaser informationa Who can view the information

Imports 

information from 

Exports 

information to 

National Integrated 

Ballistic Information 

Network (NIBIN)

Stores images and digital 

signatures of shell 

casings and bullets after 

they have been fired in 

order to connect them 

from a crime scene to a 

firearm, and to other 

related crime scenes

NIBIN Branch Firearms information (e.g., serial 

number, model). Firearms 

possessor information—limited to 

first, middle, and last name—but 

that information is not searchable.

Federal, state and local 

personnel including 

contractors 

Closed system with 

no direct link to any 

other ATF system

Closed system with 

no direct link to any 

other ATF system

NFORCE ATF case management 

system that, among other 

things, collects and 

tracks firearms data that 

have been collected for 

criminal investigative 

purposes

National Field 

Office Case 

Information 

System Branch

Firearms information (e.g., serial 

number, model); personal 

information for individuals 

including possessors, legal 

owners, or individuals who 

recovered the firearm (e.g., first 

and last name)

ATF special agents, 

industry operations 

investigators and 

assistants, and research 

specialists 

ATF NICS Referral No ATF firearmsrelated data systems

NSPECT Collects and tracks ATF 

industry operations 

investigators’ regulatory 

enforcement work

National Field 

Office Case 

Information 

System Branch

Firearms information (e.g., 

manufacturer, model) of firearms 

related to regulatory violations; 

retail purchaser information only in 

certain cases of regulatory 

violations

ATF industry operations 

investigators and 

assistants, and some 

special agents

Closed system with 

no direct link to any 

other ATF system

Closed system with 

no direct link to any 

other ATF system

Suspect Person 

Database

Collects information 

related to an individual 

currently under active 

criminal investigation 

who is suspected of 

illegally using or 

trafficking firearms.

Violent Crime 

Analysis Branch

Suspect information (e.g., name, 

identification numbers such as 

driver’s license number)

Violent Crime Analysis 

Branch analysts

Closed system with 

no direct link to any 

other ATF system

Closed system with 

no direct link to any 

other ATF system
Appendix II: Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) Firearms-Related Data Systems

Page 60 GAO-16-552 Firearms Purchaser Data

Data system Purpose, as designed

Responsible ATF 

branch

Contents related to firearms 

purchaser informationa Who can view the information

Imports 

information from 

Exports 

information to 

Trace Collects firearms trace 

requests from law 

enforcement officials and 

the information obtained 

about traced firearms 

through the tracing 

process—for example, 

from manufacture or 

import through the 

distribution chain to the 

point of first retail sale

NTC Firearms information (e.g., serial 

number, model), retail purchaser 

information (e.g., name, date of 

birth); FFL information (e.g., FFL 

name, FFL number) 

ATF employees; federal, 

state, local, and foreign law 

enforcement agencies. 

Federal, state, local, and 

foreign law enforcement 

agencies only have access 

to information on their own 

trace requests and those 

from agencies with which 

they have a memorandum 

of understanding. 

eTrace; FFL 

Information 

Database; FLS

Electronic Trace 

Operation Workflow 

Reporting System; 

eTrace; FIRES; FTS 

(Data related to 

Trace are contained 

in FTS.)

Source: GAO analysis of ATF data. | GAO-16-552

a

In this table, “Contents” may refer to information that is accessible by the data system, but that is not necessarily housed in the data 

system. For example, some systems do not contain original records, but rather pull data from another system in order to print a report or fill 

out a form.

b

Under the Brady Handgun Violence Prevention Act, Pub. L. No. 103-159, 107 Stat. 1536 (1993), and implementing regulations, the 

Federal Bureau of Investigation, within DOJ, and designated state and local criminal justice agencies use NICS to conduct background 

checks on individuals seeking to purchase firearms from FFLs or obtain permits to possess, acquire, or carry firearms. NICS was 

established in 1998.

c

FTS does not contain original records, rather it imports data from its subsystems in order to conduct analysis.

d

NFRTR contains firearms purchaser information pursuant to Title 26 of the IRS code, 26 U.S.C. Chapter 53, regarding the registration and 

transfers of registration taxes. Specifically, it states that there should be a central registry, called the National Firearms Registration and 

Transfer Record, of all firearms as defined in the code, including machine guns, destructive devices such as bazookas and mortars, and 

“other” “gadget-type” weapons such as firearms made to resemble pens.
Appendix II: Bureau of Alcohol, Tobacco, 

Firearms and Explosives (ATF) FirearmsRelated Data Systems

Page 61 GAO-16-552 Firearms Purchaser Data

Table 5: Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) Firearms-Related Data Systems That Do Not Contain 

Retail Purchaser Information

Data system Purpose

Annual Firearms Manufacturing and 

Exportation Report System 

Tracks firearms production and export data that are gathered annually from licensed 

manufacturers and exporters for regulatory enforcement

Demanda

Collects information from federal firearms licensees (FFL) who do not comply with their 

statutory responsibility to respond within 24 hours to firearms trace requests; collects 

information on used guns from FFLs who had 10 or more guns traced to them the previous 

calendar year with a “time-to-crime” of 3 years or lessb

. (Data related to Demand are 

contained in the Firearms Tracing System [FTS].)

eForms

Allows industry members to electronically complete and submit forms, such as applying for 

permits to import firearms, ammunition, and implements of war 

Electronic Trace Operation Workflow 

Reporting System 

Tracks work assignments at the National Tracing Center (NTC) and manages the overall 

firearms tracing workflow process

Federal Licensing System 

Tracks applications and permits for federal firearms and explosives licenses for regulatory 

and criminal enforcement

FFL Ezcheck Compiles information in a public web portal for determining the validity of FFLs

FFL Information Database 

Collects additional FFL information at NTC that may be useful in completing trace requests, 

such as additional dealer information like phone numbers or other points of contact

FFL Theft 

Collects and tracks data on firearms stolen, or missing in inventory, from FFLs’ places of 

business for regulatory and criminal enforcement. (Data related to FFL Theft are contained 

in FTS.)

National Firearms Act Special 

Occupational Tax System (NSOT)

Calculates and tracks Special Occupational Tax payments received from regulated industry 

members. The system processes and stores information relative to the identity of taxpayers, 

tax returns, and the amount of tax paid

Source: GAO analysis of ATF data. | GAO-16-552

a

This system contains information from reports related to Demand Letters 1 and 2.

b

Time-to-crime is the time period between the retail sale of a firearm and its recovery from use in a 

crime.
Appendix III: Out-of-Business Records Imaging 

System (OBRIS)

Page 62 GAO-16-552 Firearms Purchaser Data

Since 1968, the Bureau of Alcohol, Tobacco, Firearms and Explosives 

(ATF) has received several hundred million out-of-business records. 

According to ATF officials, as of May 5, 2016 there are about 8,060 boxes 

of paper records at the National Tracing Center (NTC) awaiting scanning 

into digital images before they are to be destroyed. At NTC, we observed 

these boxes lining the walls and stacked along cubicles and file cabinets, 

as shown in figure 4. The officials stated that, according to the General 

Services Administration, the facility floor will collapse if the number of 

boxes in the building increases to 10,000.1 Therefore, when the number 

of boxes approaches this quantity, NTC staff move the boxes to large 

shipping containers outside. Currently, there are three containers of 

boxes on the property, which contain records awaiting destruction.

Figure 4: Numerous Out-of-Business Records File Boxes Lining the Halls at the Bureau of Alcohol, Tobacco, Firearms and 

Explosives’ National Tracing Center

 1

The General Services Administration serves as the federal government’s landlord and 

designs, builds, manages, and leases the facilities supporting the needs of other federal 

agencies throughout the government. As part of this mission, the agency provides 

policies, guidelines, and standards involving the government facilities, which cover, among 

other things, facility management, assignment and utilization of space, and safety and 

environmental management.

Appendix III: Out-of-Business Records 

Imaging System (OBRIS)
Appendix III: Out-of-Business Records Imaging 

System (OBRIS)

Page 63 GAO-16-552 Firearms Purchaser Data

Prior to digital imaging, records were housed on microfilm or in storage 

boxes, and the system was referred to simply as Microfilm Retrieval 

System.2 According to NTC officials, ATF is transitioning to digital imaging 

because of the benefits of improved image resolution, speed in accessing 

images, simultaneous accessibility of images to complete urgent traces, 

and less voluminous storage. The digitized records also helped mitigate 

the challenges of deteriorating microfilm images and maintaining the 

obsolete technology of microfilm. According to officials, NTC has 

completed the process of converting the microfilm records to digital 

images, and officials expect that the images will become fully available to 

NTC analysts for tracing during fiscal year 2016. Currently, access is 

limited to a single workstation within NTC. While ATF finalizes this effort, 

staff continue to access the records in the NTC microfilm archive in order 

to respond to trace requests, as shown in figure 5.

Before fiscal year 1991, ATF stored the out-of-business records in boxes 

with an NTC file number assigned to each federal firearms licensee 

(FFL). If, during a trace, ATF determined that the FFL who sold the 

firearm was out of business and had sent in its records, ATF employees 

were to locate the boxes containing the records and manually search 

them for the appropriate serial number. According to ATF, this was a 

time-consuming and labor-intensive process, which also created storage 

problems. In 1991, ATF began a major project to microfilm the out-ofbusiness records and destroy the originals. Instead of in boxes, the outof-business records were stored on microfilm cartridges, with the FFL 

numbers assigned to them. Although this system occupied much less 

space than the hard copies of the records, ATF officials said it was still 

time-consuming to conduct firearms traces because employees had to 

examine up to 3,000 images on each microfilm cartridge to locate a 

record. The officials stated that scanning records and creating digital 

images in OBRIS has sped up the ability to search for out-of-business 

records during a trace. According to the officials, it takes roughly 20 

minutes to complete a trace with digital images and roughly 45 minutes 

using microfilm.

 2

ATF refers to the predecessor to OBRIS as the Microfilm Retrieval System. At the time of 

our 1996 report, we referred to it as the Out-of-Business Records System. This was one of 

the systems we reviewed for compliance in that report. See GAO, Federal Firearms 

Licensee Data: ATF’s Compliance with Statutory Restrictions, GAO/GGD-96-174

(Washington, D.C.: Sept. 11, 1996). 
Appendix III: Out-of-Business Records Imaging 

System (OBRIS)

Page 64 GAO-16-552 Firearms Purchaser Data

Figure 5: Bureau of Alcohol, Tobacco, Firearms, and Explosives’ Microfilm Archive 

for Records from Out-of-Business Federal Firearms Licensees
Appendix IV: Firearm Recovery Notification 

Program Submission Form

Page 65 GAO-16-552 Firearms Purchaser Data

Figure 6: Firearm Recovery Notification Program Submission Form (ATF Form 

3317.1)

Appendix IV: Firearm Recovery Notification 

Program Submission Form
Appendix V: Multiple Sales Submission Form 

for Multiple Sales Reports

Page 66 GAO-16-552 Firearms Purchaser Data

Figure 7: Multiple Sales Submission Form for Multiple Sales Reports (ATF Form 

3310.4)

Appendix V: Multiple Sales Submission Form 

for Multiple Sales Reports
Appendix VI: Multiple Sales Submission Form 

for Demand Letter 3 Reports

Page 67 GAO-16-552 Firearms Purchaser Data

Figure 8: Multiple Sales Submission Form for Demand Letter 3 Reports (ATF Form 

3310.12)

Appendix VI: Multiple Sales Submission 

Form for Demand Letter 3 Reports
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 68 GAO-16-552 Firearms Purchaser Data

A provision in the fiscal year 2012 appropriation for the Bureau of Alcohol, 

Tobacco, Firearms and Explosives (ATF) prohibits the use of the 

appropriation to consolidate or centralize records on the acquisition and 

disposition of firearms maintained by federal firearms licensees (FFL).1

This statutory restriction originated in the agency’s appropriation for fiscal 

year 19792 and, with some modification, was made permanent in fiscal 

year 2012. We reviewed whether ATF’s collection and maintenance of 

acquisition and disposition records in four data systems—Out-of-Business 

Records Imaging System (OBRIS), Access 2000 (A2K), Firearm 

Recovery Notification Program (FRNP), and Multiple Sales (MS)3

—

violated this restriction.4

As discussed below, we considered the critical characteristics of each 

data system and related ATF activities in light of the restriction and in the 

context of ATF’s statutory authorities. We conclude that ATF violated the 

restriction when it collected and maintained the disposition records of FFL 

participants in A2K on a single server within the National Tracing Center 

(NTC) after those FFLs had discontinued their operations. We also agree 

with ATF’s 2009 determination that the agency violated the restriction 

when it collected and maintained records of certain FFLs engaged 

primarily in the sale of used firearms as part of FRNP. ATF’s failure to 

comply with the restriction on consolidation or centralization also violated 

the Antideficiency Act. Under section 1351 of title 31, United States Code, 

 1

See Consolidated and Further Continuing Appropriations Act, 2012, Pub. L. No. 112-55, 

125 Stat. 552, 609-610 (2011). Generally, FFLs are required to maintain records of the 

acquisition of firearms (whether such acquisition was by manufacture, import, purchase, or 

other acquisition), recording information such as the type, model, caliber or gauge, serial 

number of the firearm, and the date of acquisition. Similarly, FFLs are also generally 

required to maintain records of the disposition of firearms, recording information related to 

the firearm, the person the firearm was transferred to, and the date of the transaction, 

among other things. See 18 U.S.C. § 923(g)(1); 27 C.F.R. §§ 478.121-478.125.

2

See Treasury, Postal Service, and General Government Appropriations Act, 1979, Pub. 

L. No. 95-429, 92 Stat. 1001, 1002 (1978). 

3

The data related to FRNP and MS are contained within ATF’s Firearms Tracing System.

4

By letter of December 21, 2015 to the ATF Acting Director, we solicited the agency’s 

views on our description of each system and its interpretation of the restriction as applied 

to each system. We received a response on January 27, 2016 from ATF’s Assistant 

Director, Office of Enforcement Programs and Services.

Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 69 GAO-16-552 Firearms Purchaser Data

the agency is required to report these violations to the President and 

Congress.

ATF, a criminal and regulatory enforcement agency within the 

Department of Justice (DOJ), is responsible for the regulation of the 

firearms industry and enforcement of federal statutes regarding firearms, 

including criminal statutes related to the illegal possession, use, transfer, 

or trafficking of firearms.5 One component of ATF’s criminal enforcement 

mission involves the tracing of firearms used in crimes to identify the first 

retail purchaser of a firearm from an FFL.6 To conduct a trace, the 

requesting law enforcement agency must identify the manufacturer or 

importer of the firearm and its type, caliber, and serial number, as well as 

other information related to the recovery, crime, and possessor. 

According to ATF, NTC7 personnel must typically use the information 

provided by the law enforcement agency to contact the manufacturer or 

importer to determine when and to whom the firearm in question was 

sold.8 The manufacturer or importer may have sold the firearm to an FFL 

wholesaler. In that case, NTC personnel would contact the FFL 

wholesaler to determine when and to whom the firearm in question was 

sold, usually to an FFL retailer. The tracing process continues until NTC 

identifies the first retail purchaser who is a nonlicensee.

The Gun Control Act of 1968, as amended, established a system 

requiring FFLs to record firearms transactions, maintain that information 

at their business premises, and make such records available to ATF for 

 5

28 U.S.C. § 599A.

6

See 18 U.S.C. § 923(g)(7). The term “federal firearms licensee” (FFL) generally means a 

person licensed under the Gun Control Act of 1968, as amended, to engage in the 

business of importing, manufacturing, or dealing in firearms, or in the course of such 

business to ship, transport, or receive any firearm in interstate or foreign commerce.

7

ATF maintains a firearms tracing operation at NTC in Martinsburg, West Virginia. NTC 

traces firearms suspected of being involved in crimes to the first retail purchaser to assist 

law enforcement in identifying suspects.

8

There are instances where ATF is able to complete traces without contacting FFLs by 

checking databases that it maintains under various authorities. 

Background
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 70 GAO-16-552 Firearms Purchaser Data

inspection and search under certain prescribed circumstances.9 This 

system was intended to permit law enforcement officials to trace firearms 

involved in crimes as described above while allowing the records 

themselves to be maintained by the FFLs rather than by a governmental 

entity. As originally enacted, the Gun Control Act required FFLs to submit 

such reports and information as the Secretary of the Treasury prescribed 

by regulation and authorized the Secretary to prescribe such rules and 

regulations as deemed reasonably necessary to carry out the provisions 

of the act.10

In 1978, citing the general authorities contained in the Gun Control Act, 

ATF proposed regulations that would have required FFLs to report most 

of their firearms transactions to ATF through quarterly reports. Under the 

proposed regulations, these FFL reports of sales and other dispositions 

would not have identified a nonlicensed transferee, such as a retail 

purchaser, by name and address.11 However, the proposed regulations 

prompted concerns from those who believed that the reporting 

requirements would lead to the establishment of a system of firearms 

registration. Congress included in ATF’s fiscal year 1979 appropriation for 

salaries and expenses a provision prohibiting the use of funds for 

administrative expenses for the consolidation or centralization of certain 

FFL records, or the final issuance of the 1978 proposed regulations. The 

provision continues to apply, with some modifications as described below.

The 1979 appropriation provided:

 9

Pub. L. No. 90-618, 82 Stat. 1213 (1968) (codified, as amended, at 18 U.S.C. §§ 921-

931). Section 923(g)(1) provides that FFLs shall not be required to submit reports and 

information with respect to their records and their contents to the Attorney General except 

as provided in section 923. The Attorney General delegated to the Director of ATF the 

authority to “investigate, administer, and enforce the laws related to alcohol, tobacco, 

firearms, explosives, and arson, and perform other duties as assigned by the Attorney 

General, including exercising the functions and powers of the Attorney General” under a 

number of provisions of law, including 18 U.S.C. Chapter 44 (related to firearms). 28 

C.F.R. § 0.130(a).

10See Pub. L. No. 90-618, § 102, 82 Stat. 1213, 1223-24, 1226 (1968) (codified, as 

amended, at 18 U.S.C. §§ 923(g)(1) and 926).

11Firearms Regulations, 43 Fed. Reg. 11,800, 11,802 (proposed Mar. 21, 1978). 
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 71 GAO-16-552 Firearms Purchaser Data

[t]hat no funds appropriated herein shall be available for administrative expenses in 

connection with consolidating or centralizing within the Department of the Treasury the 

records of receipt and disposition of firearms maintained by Federal firearms licensees or 

for issuing or carrying out any provisions of the proposed rules of the Department of the 

Treasury, Bureau of Alcohol, Tobacco and Firearms, on Firearms Regulations, as 

published in the Federal Register, volume 43, number 55, of March 21, 1978.12

The Senate Appropriations Committee report explained the purpose of 

the provision as follows:

The Bureau of Alcohol, Tobacco, and Firearms (BATF) has proposed implementation of 

several new regulations regarding firearms. The proposed regulations, as published in the 

Federal Register of March 21, 1978 would require:

(1) A unique serial number on each gun manufactured or imported into the United States.

(2) Reporting of all thefts and losses of guns by manufacturers, wholesalers and dealers.

(3) Reporting of all commercial transactions involving guns between manufacturers, 

wholesalers and dealers.

The Bureau would establish a centralized computer data bank to store the above 

information. It is important to note that the proposed regulations would create a central 

Federal computer record of commercial transactions involving all firearms—whether 

shotguns, rifles, or handguns. There are approximately 168,000 federally licensed 

firearms dealers, manufacturers, and importers. It is estimated that the proposed 

regulations would require submission of 700,000 reports annually involving 25 million to 

45 million transactions.

It is the view of the Committee that the proposed regulations go beyond the intent of 

Congress when it passed the Gun Control Act of 1968. It would appear that BATF and the 

 12Treasury, Postal Service, and General Government Appropriations Act, 1979, Pub. L. 

No. 95-429, 92 Stat. 1001, 1002 (1978). In 2003, ATF was transferred from the 

Department of the Treasury to DOJ pursuant to the Homeland Security Act of 2002. Pub. 

L. No. 107-296, §§ 1111-1115, 116 Stat. 2135, 2274-80 (2002). Successive 

appropriations acts reflected the transfer in the restriction on consolidation or 

centralization. See, e.g., Consolidated Appropriations Act, 2004, Pub. L. No. 108-199, 118 

Stat. 3, 53 (2004). 
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 72 GAO-16-552 Firearms Purchaser Data

Department of Treasury are attempting to exceed their statutory authority and accomplish 

by regulation that which Congress has declined to legislate.13

The reference to the 1978 proposed rules was removed from the annual 

provision as of the fiscal year 1994 appropriations act, but the prohibition 

against using funds for administrative expenses for consolidating or 

centralizing records was included in each of ATF’s annual appropriations 

through fiscal year 2012 in much the same form. In fiscal year 1994, the 

Treasury, Postal Service, and General Government Appropriations Act, 

1994, expanded the prohibition to include the consolidation or 

centralization of portions of records and to apply to the use of funds for 

salaries as well as administrative expenses, stating “[t]hat no funds 

appropriated herein shall be available for salaries or administrative 

expenses in connection with consolidating or centralizing, within the 

Department of the Treasury, the records, or any portion thereof, of 

acquisition and disposition of firearms maintained by Federal firearms 

licensees” (emphasis added).14

The fiscal year 2012 Consolidated and Further Continuing Appropriations 

Act made the restriction on ATF’s use of funds permanent, incorporating 

the word “hereafter” to indicate future application.15 Specifically, it stated

“[t]hat no funds appropriated herein or hereafter shall be available for salaries or 

administrative expenses in connection with consolidating or centralizing, within the 

 13S. Rep. No. 95-939, at 11-12 (1978).

14Pub. L. No. 103-123, 107 Stat. 1226, 1229 (1993).

15Appropriations acts are, by their nature, nonpermanent legislation, and provisions in 

appropriations acts are presumed effective only for the covered fiscal year. B-319414, 

June 9, 2010. However, where Congress incorporates “words of futurity,” such as 

“hereafter,” appropriations provisions are generally construed to be permanent. Id. See 

also B-316510, July 15, 2008 and B-309704, Aug. 28, 2007 (provisions prohibiting the use 

of appropriated funds for disclosures from ATF’s Firearms Tracing System found to be 

permanent).
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 73 GAO-16-552 Firearms Purchaser Data

Department of Justice, the records, or any portion thereof, of acquisition and disposition of 

firearms maintained by Federal firearms licensees” (emphasis added).16

The conference report accompanying the act explained that the provision 

had been made permanent.17

We previously considered ATF’s compliance with the restriction on 

consolidation or centralization in 1996 in connection with the agency’s 

Microfilm Retrieval System and Multiple Sales System.18 We stated that 

the restriction did not preclude all information practices and data systems 

that involved an element of consolidation or centralization, but that it had 

to be interpreted in light of its purpose and in the context of other statutory 

provisions governing ATF’s acquisition and use of information on 

firearms.19 In this respect, our analyses reflected the well-established 

principle that statutory provisions should be construed harmoniously so 

as to give them maximum effect whenever possible, avoiding the 

conclusion that one statute implicitly repealed another in the absence of 

clear evidence to the contrary.20 We found that the two systems complied 

with the statutory restriction on the grounds that ATF’s consolidation of 

 16Pub. L. No. 112-55, 125 Stat. 552, 609 (2011). An additional provision, first enacted in 

1996, was also made permanent in the fiscal year 2012 appropriations act. Id. at 610. The 

Omnibus Consolidated Appropriations Act, 1997, limited the methods ATF could use to 

retrieve information from records submitted to the agency by FFLs going out of business. 

It stated “[t]hat no funds under this Act may be used to electronically retrieve information 

gathered pursuant to 18 U.S.C. § 923(g)(4) by name or personal identification code.” Pub. 

L. No. 104-208, 110 Stat. 3009, 3009-319 (1996). This restriction was also repeated in 

each ATF annual appropriations act until it was made permanent in 2012.

17See H.R. Rep. No. 112-284, at 240 (2011) (Conf. Rep.).

18ATF refers to the predecessor to OBRIS as the Microfilm Retrieval System. In our 1996 

report, we referred to this system as the Out-of-Business Records System and we referred 

to MS as the Multiple Sales System. See GAO, Federal Firearms Licensee Data: ATF’s 

Compliance with Statutory Restrictions, GAO/GGD-96-174 (Washington, D.C.: Sept. 11, 

1996).

19As discussed below, the United States Court of Appeals for the Fifth Circuit echoed the 

reasoning embodied in our 1996 report when considering ATF’s collection of information 

under a 2011 initiative. See 10 Ring Precision, Inc. v. Jones, 722 F.3d 711, 715-16, 722 

(5th Cir. 2013) (upholding ATF’s inquiry to certain FFLs operating along the southwest 

border, referred to as “Demand Letter 3”).

20See TVA v. Hill, 437 U.S. 153, 190-91 (1978); Posadas v. Nat’l City Bank, 296 U.S.497, 

503 (1936). 
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 74 GAO-16-552 Firearms Purchaser Data

records was incident to carrying out specific responsibilities set forth in 

the Gun Control Act of 1968, as amended, and that the systems did not 

aggregate data on firearms transactions in a manner that went beyond 

these purposes. Thus, our analysis did not turn on the presence or 

absence of retail purchaser information in the system, but rather on the 

extent to which the aggregation of data corresponded to a statutory 

purpose. We employ a similar analytical approach, which ATF has also 

adopted, in assessing the four systems under review here, taking into 

account ATF’s statutory authorities and the critical characteristics of each 

system.

Two of the four data systems we reviewed—OBRIS and MS—do not 

consolidate or centralize firearms in violation of the restriction contained 

in the fiscal year 2012 appropriations act. In contrast, ATF violated the 

restriction when it collected and maintained disposition records of FFL 

participants in A2K on a single server at NTC after they had discontinued 

their operations. ATF also violated the restriction when it collected and 

maintained records of certain FFLs engaged primarily in the sale of used 

firearms as part of FRNP.

OBRIS is ATF’s repository for records submitted by FFLs that have 

permanently discontinued their operations, as required by the Gun 

Control Act of 1968, as amended. Section 923(g)(1)(A) of title 18, United 

States Code, requires each FFL to maintain such records of importation, 

production, shipment, receipt, sale, or other disposition of firearms at its 

place of business as prescribed by the Attorney General.21 Under 18 

U.S.C. § 923(g)(4), when a firearms business is discontinued and there is 

no successor, the records required to be maintained by FFLs must be 

delivered within 30 days to ATF.22

 21See, e.g., 27 C.F.R. §§ 478.122 (requires licensed importers to maintain records of 

importation and disposition), 478.123 (requires licensed manufacturers to maintain 

records of production and disposition), 478.124 (requires FFLs to record a sale or other 

disposition of any firearm to any unlicensed person), and 478.125 (requires FFLs to record 

each receipt and disposition of firearms).

22Under 18 U.S.C. § 923(g)(4), “where discontinuance of the business is absolute, such 

records shall be delivered within thirty days after the business discontinuance to [ATF].”

See 27 C.F.R. § 478.127.

Discussion

OBRIS
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 75 GAO-16-552 Firearms Purchaser Data

ATF’s system for maintaining the records of out-of-business FFLs for its 

statutory tracing function has evolved over time in response to logistical 

challenges and technological advances. Prior to fiscal year 1991, ATF 

maintained out-of-business FFLs’ records in hard copy, with a file number 

assigned to each FFL. During a trace, if ATF determined that a firearm 

had been transferred or disposed of by an out-of-business FFL, ATF 

employees manually searched the FFL’s records until they found the 

records corresponding to the serial number of the firearm being traced. 

According to ATF, this was a time-consuming and labor-intensive 

process, and the volume of records created storage problems. In 1991, 

ATF began a major project to microfilm these records and destroy the 

originals. For fiscal year 1992, Congress appropriated $650,000 “solely 

for improvement of information retrieval systems at the National Firearms 

Tracing Center.”23 In fiscal year 1992, ATF began creating a 

computerized index of the microfilmed records containing the information 

necessary to identify whether ATF had a record relating to a firearm being 

traced. The index contained the following information: (1) the cartridge 

number of the microfilm; (2) an index number; (3) the serial number of the 

firearm; (4) the FFL number; and (5) the type of document on microfilm, 

i.e., a Firearms Transaction Record form or acquisition and disposition 

logbook pages. This information was stored on a database in ATF’s 

mainframe computer to allow searches. Other information, however, 

including a firearms purchaser’s name or other identifying information and 

the manufacturer, type, and model remained stored on microfilm 

cartridges and was not computerized. Therefore, this information was not 

accessible to ATF personnel through a text search.

In our 1996 report, we concluded that the Microfilm Retrieval System did 

not violate the restriction on consolidation or centralization due to its 

statutory underpinnings and design. ATF had initially required out-ofbusiness FFLs to deliver their records to ATF through a 1968 regulation.24

We found no indication in its legislative history that the appropriations act 

restriction was intended to overturn this regulation and noted that, 

historically, out-of-business records had been maintained at a central 

location. We also explained that the Firearms Owners’ Protection Act of 

 23Pub. L. No. 102-141, 105 Stat. 834, 836 (1991).

2433 Fed. Reg. 18,555, 18,571 (Dec. 14, 1968) (originally codified at 26 C.F.R. § 

178.127).
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 76 GAO-16-552 Firearms Purchaser Data

1986 (FOPA) had codified the ATF regulation, affirming the agency’s 

authority to collect this information,25 and that a subsequent 

appropriations act had provided funding specifically for ATF’s microfilming 

effort.26 Finally, ATF’s system of microfilmed records did not capture and 

store certain key information, such as firearms purchaser information, in 

an automated file. In this regard, we found that the system did not 

aggregate information in a manner beyond that necessary to implement 

the Gun Control Act of 1968, as amended by FOPA.

In 2006, ATF developed OBRIS, according to ATF officials, due to 

significant practical concerns related to the conversion of paper-based 

records to microfilm; the deterioration of the images captured on 

microfilm; and the difficulty in procuring microfilm readers, parts, and 

maintenance services. The conference report accompanying ATF’s 

annual appropriation for fiscal year 2005 indicated support for this project, 

which was designed to convert the microfilm images of FFL records in the 

Microfilm Retrieval System to digital images. The report stated:

Conversion of Records.—The conferees recognize the need for the ATF to begin 

converting tens of thousands of existing records of out-of-business Federal firearms 

dealers from film to digital images at the National Tracing Center. Once the out-ofbusiness records are fully converted, the search time for these records will be reduced to 

an average of 5 minutes per search from the current average of 45 minutes per search. 

This significant time saving will ultimately reduce overall costs and increase efficiency at 

the National Tracing Center. Therefore, the conference agreement includes a $4,200,000 

increase for the ATF to hire additional contract personnel to begin this conversion.27

 25Pub. L. No. 99-308, § 103, 100 Stat. 449, 453-456 (1986) (codified at 18 U.S.C. § 

923(g)(4)). The Senate-passed version of FOPA would have prohibited the Secretary of 

the Treasury from maintaining out-of-business records at a centralized location and from 

entering them into a computer for storage or retrieval. S. 49, 99th Cong. (1985). This 

provision was dropped from the version of the bill passed by Congress.

26Treasury, Postal Service and General Government Appropriations Act, 1992, Pub. L. 

No. 102-141, 105 Stat. 834, 836 (Oct. 28, 1991).

27H.R. Rep. No. 108-792, at 734 (2004) (Conf. Rep.).
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 77 GAO-16-552 Firearms Purchaser Data

Similarly, the conference report accompanying the fiscal year 2006 

appropriations act reflected the conferees’ support for ATF’s transition of 

out-of-business records to OBRIS.28

Since 2006, NTC has converted records submitted by FFLs discontinuing 

their operations to digital images in OBRIS. Specifically, NTC sorts and 

scans records provided by out-of-business FFLs, converting and storing 

them in an image repository on an electronic server.29 Images stored in 

OBRIS are generally indexed by FFL number.30 The records themselves 

are stored as images without optical character recognition so that they 

cannot be searched or retrieved using text queries, but must be searched 

through the index, generally by FFL number. After narrowing down the 

possible records through an index search, an NTC analyst must manually 

scroll through digital images to identify the record of the particular firearm 

in question.

The technological changes represented by OBRIS do not compel a 

different conclusion regarding ATF’s compliance with the restriction on 

consolidation or centralization from the one we reached in 1996 with 

respect to the predecessor system. The statutory basis for OBRIS is the 

same as for the Microfilm Retrieval System and OBRIS makes records 

accessible to the same extent as that system, functioning in essentially 

the same manner though with enhanced technology. As with the prior 

microfilm system, users identify potentially relevant individual records 

through manual review after searching an index using an FFL number, or 

firearms information if available. In this regard, OBRIS, like its 

predecessor, does not aggregate records in a manner beyond that 

 28H.R. Rep. No. 109-272 at 82 (2005) (Conf. Rep.).

29ATF officials told us that the agency receives records of out-of-business FFLs in a 

variety of paper and electronic forms and converts the records to digital images regardless 

of the form in which they are received.

30Certain records are also indexed by firearm description. 
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 78 GAO-16-552 Firearms Purchaser Data

required to implement the Gun Control Act of 1968, as amended by 

FOPA.31

We assessed A2K with regard to in-business records and out-of-business 

records. We conclude that A2K for in-business records complies with the 

restriction on consolidation or centralization, while A2K for out-ofbusiness records violated the restriction.

The Gun Control Act of 1968, as amended, requires FFLs to provide 

firearms disposition information to ATF in response to a trace request. 

Specifically, section 923(g)(7) of title 18, United States Code, requires 

FFLs to respond within 24 hours to a request for records to determine the 

disposition of firearms in the course of a criminal investigation.32 Prior to 

the implementation of A2K, FFLs could only respond to such requests 

manually. A2K provides manufacturer, importer, and wholesaler FFLs 

with an automated alternative to facilitate their statutorily required 

response to ATF requests.

ATF developed A2K in response to requests from firearms industry 

members33 for the agency to create a way for them to respond to trace 

requests other than by having dedicated personnel submit information by 

phone, fax, or e-mail. Under A2K, ATF provides servers to participating 

industry members and they upload electronic firearms disposition 

 31Like the microfilm system, OBRIS also does not violate the prohibition on using funds to 

electronically retrieve information gathered under 18 U.S.C. § 923(g)(4) by name or any 

personal identification code. Indeed, as the system is designed, it is not possible to 

conduct a computerized search of text that would constitute a name or personal 

identification code. 

32In pertinent part, the statute requires FFLs to “respond immediately to, and in no event 

later than 24 hours after the receipt of, a request by the Attorney General for information 

contained in the records required to be kept by this chapter as may be required for 

determining the disposition of 1 or more firearms in the course of a bona fide criminal 

investigation.” See 27 C.F.R. 478.25a.

33Industry members are generally manufacturers, importers, and wholesalers. However, 

some industry members are comprised of more than one FFL, and in rare circumstances, 

a retail FFL could be part of an industry member. In addition, according to ATF officials 

and one industry member that we interviewed, some of the A2K disposition records could 

include sales of firearms to retail purchasers. Therefore, the A2K server includes some 

number of nonlicensed purchasers.

A2K

A2K In-Business Records
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 79 GAO-16-552 Firearms Purchaser Data

information on to the servers in an ATF-approved format on a regular 

basis.34 A2K includes a secure user web interface to each of the servers 

and ATF may obtain disposition information by searching individual 

servers by exact firearm serial number. In 2004, the conference report 

accompanying ATF’s annual appropriation for fiscal year 2005 indicated 

support for this system, pointing to the increased operational efficiency 

associated with ATF’s immediate access to disposition records through 

the automated system. The report stated:

[T]he conferees are aware that the Access 2000 program was initiated by ATF to improve 

the efficiency and reduce the costs associated with firearms tracing incurred by Federal 

Firearms Licensees (FFLs). ATF and FFL importers, manufacturers, and wholesalers form 

a partnership in this effort. FFLs take their data from their mainframe computer and import 

it into a stand-alone server provided by the ATF. The National Tracing Center is 

connected to this server remotely by secure dial-up and obtains information on a firearm 

that is subject to a firearms trace. The conferees support this program, which reduces the 

administrative burdens of the FFL and allows the ATF around the clock access to the 

records. The ATF currently has 36 Access 2000 partners. The conferees encourage the 

ATF to place more emphasis on this program and expand the number of partners to the 

greatest extent possible.35

According to ATF, as of April 25, 2016, there are 35 industry members 

representing 66 individual manufacturer, importer, and wholesaler FFLs 

currently participating in A2K.

ATF believes that A2K “... has appropriately balanced Congressional 

concerns related to the consolidation of firearm records with the necessity 

of being able to access firearm information in support of its underlying 

mission to enforce the Gun Control Act,” as amended. We agree. Given 

the statutory underpinning and features of the system for in-business 

FFLs, we conclude that ATF’s use of A2K for in-business records does 

not violate the restriction on the consolidation or centralization of firearms 

records. ATF’s use of A2K for in-business records is rooted in the specific 

statutory requirement that FFLs respond promptly to ATF trace requests 

in connection with criminal investigations. In addition, although the system 

 34According to ATF, industry members may use their own servers and three A2K 

participants own the servers used for A2K.

35H.R. Rep. No. 108-792, at 734 (2004) (Conf. Rep.).
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 80 GAO-16-552 Firearms Purchaser Data

allows FFLs to respond to ATF’s trace requests virtually, ATF obtains the 

same information as it would otherwise obtain by phone, fax, or e-mail 

and in similar disaggregated form, that is, through multiple servers 

located at individual FFLs. Moreover, industry members retain possession 

and control of their disposition records and, according to ATF officials, 

may withdraw from using A2K—and remove their records from the ATFaccessible servers—at any time. For these reasons, we do not view A2K 

for in-business records to constitute the type of data aggregation 

prohibited by the appropriations act restriction on the consolidation or 

centralization of records within DOJ.

During the course of our review, we found that when participating industry 

members permanently discontinued their operations, the disposition data 

maintained in connection with A2K was transferred to ATF, and ATF used 

the data when conducting firearms traces. Specifically, when an A2K 

participant went out of business, an ATF contractor remotely transferred 

the data on the server to a backup disk and the industry member shipped 

the backup disk with intact disposition records, as well as the blank 

server, to ATF’s NTC. ATF officials placed the data from the backup disk 

on a single partitioned server at NTC and accessed the data for firearms 

traces using the same type of interface and URL as used while the 

industry member was in business. As a result, in response to an industry 

member–specific query using an exact firearm serial number, the A2K 

out-of-business server would automatically generate the disposition 

information related to that firearm serial number.

According to ATF, records of eight industry members were placed on the 

server at NTC from as early as late 2000 through mid-2012. While ATF 

estimated that there were approximately 20 million records associated 

with these industry members on the server, the agency did not have a 

means of ascertaining the actual number of records. The number of 

records on the ATF server would have been expected to grow as 

additional A2K participants discontinued their operations and provided 

their backup disks to ATF. However, during the course of our review, ATF 

officials told us that the agency planned to move all of the A2K records 

into OBRIS and that, once converted to OBRIS images, the records 

would be searchable like other OBRIS records. In January 2016, ATF 

officials reported that NTC was in the process of transferring all of the 

records from the A2K out-of-business records server to OBRIS and a 

quality-control process was under way to verify the accuracy of the 

transfer. They subsequently deleted all records from the server in March 

2016.

A2K Out-of-Business Records
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 81 GAO-16-552 Firearms Purchaser Data

We conclude that ATF’s use of A2K with respect to out-of-business 

records violated the restriction on consolidation or centralization. In 

contrast to the discrete servers in the possession of the in-business 

industry members, ATF combined disposition records across industry 

members on the single, though partitioned, A2K server at NTC. In 

addition, the records were stored on the single A2K server in a manner 

that made them more easily searchable than other out-of-business 

records. Unlike OBRIS, which requires the manual review of potentially 

relevant records identified through an index, the A2K server within NTC 

generated records automatically in response to an industry member–

specific text query, that is, exact firearm serial number. In addition, 

according to NTC officials, they could have modified the structure of the 

NTC server to achieve further aggregation, by programming the system to 

allow text searches across a broader set of data fields. As a result, ATF 

could have searched for records by name or other personal identifier.

As explained earlier, our analysis of ATF’s aggregation of firearms 

records turns not on the presence or absence of retail purchaser 

information, but rather on the extent to which the aggregation of data 

corresponds to a statutory purpose. ATF’s maintenance of out-ofbusiness industry members’ disposition records on a single server at NTC 

was not incident to the implementation of a specific statutory requirement. 

As discussed above, A2K was designed to allow in-business industry 

members to respond promptly to ATF trace requests as required by 18 

U.S.C. § 923(g)(7) without having to dedicate personnel to this function. 

Section 923(g)(7), however, has no applicability to FFLs once they 

discontinue operations. A separate statutory provision, 18 U.S.C. § 

923(g)(4), applies to FFLs that permanently discontinue their operations. 

ATF has long maintained a separate system—formerly the Microfilm 

Retrieval System and currently OBRIS—to hold the records submitted 

under that provision, and the disposition records that ATF maintained on 

the NTC server were among the types of records required to be submitted 

under section 923(g)(4) for which ATF had created that system. 

Therefore, we find no statutory underpinning for ATF’s maintenance of 

out-of-business A2K participants’ disposition records on the server at 

NTC.

In response to our inquiries, ATF officials confirmed that the agency’s 

maintenance of the server at NTC was not necessary to carry out a 

specific statutory function, stating that, in terms of types of information, 

there was “absolutely no benefit to ATF in keeping the data from out-ofbusiness A2K servers.” They explained that the only benefit of keeping 

the data from these servers was that it was “quicker to locate” disposition 
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 82 GAO-16-552 Firearms Purchaser Data

information on the server using the FFL number and serial number. They 

further stated, however, that it would be inconsistent with the restriction 

on consolidation or centralization to maintain those records outside of 

OBRIS. Elaborating on the application of the statutory restriction on 

consolidation or centralization to the records of A2K participants, ATF 

officials explained:

Our implementation of A2K included strict security protocols to limit ATF access to only 

that information to which it is statutorily required, e.g., the next step in the distribution of 

the traced firearm. That is, ATF would simply have access to the same information it could 

obtain by calling the participating FFL. However, that calculus is altered when an FFL 

ceases participation in A2K. At that point, that FFL’s records become just like any other 

FFL records and, as such, must be stored in the same manner. Otherwise, records which 

were formerly accessible on a discrete basis under A2K would be readily accessible in a 

database which would, in our opinion based on the 1996 GAO Report, violate the 

appropriation rider. Our decision, therefore, was to ensure that A2K records have the 

same character and are retrievable in the same manner as any other out-of-business 

records.

In addition to removing all data from the A2K out-of-business records 

server, ATF officials reported that, going forward, the agency plans to 

convert records of A2K participants that go out of business directly into 

OBRIS images. However, they said, when such records are received by 

out-of-business FFLs, the time frame for converting the records into 

OBRIS images will depend on the backlog of electronic records awaiting 

conversion.

Similarly, ATF officials told us that they had anticipated that A2K 

participants would submit acquisition and disposition records together, 

consistent with the format provided for in ATF’s regulations, for inclusion 

in OBRIS. They had not expected that A2K participants would satisfy any 

part of their statutory responsibility by providing their backup disks to the 

agency. However, even if industry members’ submission of disposition 

data on the backup disks could be said to be in furtherance of the portion 

of the statutory requirement pertaining to disposition records, given the 

existence and successful functioning of OBRIS, we conclude that ATF’s 

maintenance of those records on the NTC server went beyond the 

purposes of the Gun Control Act of 1968, as amended.

We conclude that FRNP complies with the restriction on consolidation 

and centralization of firearms records when used as a tool for ATF agents 

in connection with an ATF criminal investigation. However, ATF’s use of 

FRNP
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 83 GAO-16-552 Firearms Purchaser Data

FRNP to maintain information on firearms identified during regulatory 

inspections of FFLs under the Southwest Border Secondary Market 

Weapons of Choice Program (SWBWOC), as discussed below, was a 

violation of the restriction.

Under section 599A of title 28, United States Code, ATF is responsible for 

investigating criminal and regulatory violations of federal firearms laws, 

and for carrying out any other function related to the investigation of 

violent crime or domestic terrorism that is delegated to it by the Attorney 

General. Among other things, ATF is responsible for enforcing federal 

statutes regarding firearms, including those regarding illegal possession, 

use, transfer, or trafficking.36 FRNP, formerly known as the Suspect Gun 

Program, was established in 1991 within the Firearms Tracing System to 

provide an investigative service to ATF agents conducting criminal 

investigations. Through this program, ATF records information—

manufacturer, serial number, and type—about firearms that have not yet 

been recovered by other law enforcement authorities, but are suspected 

of being involved in criminal activity and are associated with an ATF 

criminal investigation.37 When such firearms are recovered, ATF uses the 

information available through the program to notify the investigating ATF 

official and to coordinate the release of trace results to other law 

enforcement authorities with the ongoing ATF investigation.38

To enter firearms information into the system, ATF agents investigating 

potential criminal activity involving firearms must identify the firearms at 

issue, the number of an open ATF criminal investigation, and at least one 

of five specified criteria for using the system. The five criteria correspond 

 36See 18 U.S.C. § 922.

37The name of the purchaser or criminal suspect is also recorded, if available. 

38NTC provided an example of how a firearm may be recorded in FRNP. Specifically, an 

ATF agent may find a firearm—perhaps while undercover or through an illegal sale from a 

firearms trafficker—and trace it through NTC. The recovered firearm may be identified as 

part of a multiple sale with other firearms. The ATF agent may then request that those 

other firearms be entered into FRNP. If the firearms are later traced, this could assist the 

ATF agent conducting the original investigation to build a firearms trafficking case.

FRNP for Criminal 

Investigations
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 84 GAO-16-552 Firearms Purchaser Data

to bases for ATF investigation.39 ATF agents also indicate on the 

submission form whether NTC should release trace results to requesters 

of a trace for the firearms listed on the form. Where criminal investigations 

are ongoing and FRNP records are designated as “active,” NTC will notify 

the investigating ATF agent when the firearm described on the form is 

recovered. In addition, where the ATF agent has indicated that NTC

should release trace information, NTC will notify the ATF agent and the 

requesting law enforcement agency of trace results. Where the ATF 

agent has indicated that NTC should not release trace information, the 

ATF agent is notified of the trace results and determines when that 

information may be released to the requesting law enforcement agency. 

For criminal investigations that have been closed, the FRNP record 

associated with the investigation is labeled “inactive,” although the 

records may provide investigative leads, according to ATF officials. In 

such cases, the ATF agent associated with the investigation is not notified 

of the recovery of the identified firearms or related trace requests, and the 

release of trace results to requesting law enforcement agencies proceeds 

without any delay.

ATF is authorized by statute to investigate violations of federal firearms 

laws. As described above, FRNP is designed for the limited purpose of 

facilitating ATF’s conduct of specific criminal investigations under its 

jurisdiction. The inclusion of data in FRNP requires an open ATF 

investigation of an identified criminal matter, which helps to ensure that 

the data are maintained only as needed to support this investigative 

purpose. Further, ATF requires its agents to identify with specificity the 

firearms relevant to the investigation. As we observed in 1996, the 

restriction on consolidation or centralization does not preclude all data 

systems that involve an element of consolidation. Where ATF adheres to 

the limitations incorporated in the design of FRNP, the maintenance of 

information through FRNP is incident to ATF’s exercise of its statutory 

authority to conduct criminal investigations and does not involve the 

aggregation of data in a manner that goes beyond that purpose. In this 

respect, we conclude that it does not represent a consolidation or 

centralization of records in violation of the statutory restriction.

 39The five criteria are: “Large Quantities of Firearms Purchased by Individual,” “Firearms 

Suspected in Trafficking, but not Stolen from an FFL Dealer,” “FFL Dealer Suspected of 

Performing Firearms Transactions Without Proper Documentation,” “Firearms Purchased 

by Suspected Straw Purchasers,” and “Other (Explain in Synopsis).”
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 85 GAO-16-552 Firearms Purchaser Data

In response to our inquiries about FRNP data, ATF officials told us that in 

2009, the ATF Chief Counsel had concluded that the agency had violated 

the appropriations restriction in connection with the system. Specifically, 

ATF officials told us that the agency had maintained records on the 

inventories of certain FFLs in violation of the restriction, from 2007 

through 2009 under ATF’s Southwest Border Secondary Market 

Weapons of Choice (SWBWOC) Program.40 We agree with the ATF Chief 

Counsel’s conclusion that its collection and maintenance of information in 

connection with this program violated the restriction on the consolidation 

or centralization of firearms records.

In October 2005, the governments of the United States and Mexico 

instituted a cooperative effort to address surging drug cartel–driven 

violence in Mexico and along the southwest border of the United States. 

ATF’s main role in this initiative was to develop strategies and programs 

to stem the illegal trafficking of firearms from the United States to Mexico. 

ATF determined that used gun sales—referred to in the industry as 

“secondary market” sales—played a significant role in firearms trafficking 

to Mexico, particularly for the types of firearms most sought by the 

Mexican drug cartels, known as “weapons of choice.” Accordingly, in 

June 2007, the agency developed a protocol to be used during its annual 

inspections of FFLs in the region engaged primarily in the sale of used 

firearms.41 This protocol, known as the SWBWOC Program was intended 

to enhance ATF’s ability to track secondary market sales. It called for ATF 

investigators to record the serial number and description of all used 

weapons of choice in each FFL’s inventory and those sold or otherwise 

disposed of during the period covered by the inspection. Under the 

protocol, the investigators forwarded the information to the relevant ATF 

field division, which opened a single investigative file for all submissions 

from the area under its jurisdiction and determined whether any of the 

weapons had been traced since their last retail sale. After review, the field 

 40The regional program operated from June 8, 2007 to October 2, 2009. 

41Section 923(g)(1)(B) of title 18, United States Code, authorizes ATF to conduct 

inspections of FFLs to ensure compliance with the record-keeping requirements of the 

Gun Control Act of 1968, as amended, no more than once a year or at any time when the 

records are related to a firearm that is traced to the FFL. Inspections are also authorized 

in connection with a criminal investigation. ATF regulations concerning the scope of such 

inspections indicate that ATF officers are not authorized to seize any records other than 

those constituting material evidence of a violation of law. See 27 C.F.R. § 478.23(d).

Southwest Border Secondary 

Market Weapons of Choice 

Program
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 86 GAO-16-552 Firearms Purchaser Data

division forwarded the information to FRNP. According to ATF, the Dallas, 

Houston, and Los Angeles Field Divisions began to submit records from 

the SWBWOC Program to FRNP in July 2007, and the Phoenix Field 

Division began to do so in October 2007.

The SWBWOC Program was cancelled on October 2, 2009, following a 

review by ATF’s Office of Chief Counsel of the process by which the 

secondary market weapons of choice information had been recorded and 

submitted to FRNP.42 The Office of Chief Counsel determined that the 

SWBWOC Program was not consistent with the consolidation or 

centralization restriction. It advised that information obtained from an FFL 

about a firearm in and of itself and unaccompanied by purchaser 

information could not be collected and consolidated absent a specific 

basis in statute or regulation, or a direct nexus to discrete law 

enforcement purposes such as a specific criminal investigation. The 

Office of Chief Counsel found that the collection of information from FFLs 

under the SWBWOC Program lacked these essential, individualized 

characteristics.

We agree with ATF’s conclusion that the collection and maintenance of 

firearms information from the SWBWOC Program in FRNP exceeded the 

permissible scope of the appropriations act restriction. As discussed 

above, our analysis of ATF’s aggregation of firearms data turns not on the 

presence or absence of retail purchaser information, but rather on the 

extent to which the aggregation of data corresponds to a statutory 

purpose. Here, ATF collected and maintained acquisition and disposition 

data without a statutory foundation based on nothing more than the 

characteristics of the firearms. The collection and maintenance of 

information about a category of firearms, “weapons of choice,” from a 

category of FFLs, primarily pawnbrokers, did not pertain to a specific 

criminal investigation within the scope of ATF’s statutory investigative 

authority. Nor did it fall within the scope of ATF’s authority to conduct 

regulatory inspections. For this reason, we conclude that the program 

involved the type of aggregation of information contemplated by Congress 

when it passed the restriction on the consolidation or centralization of 

firearms records. ATF deleted the related data from FRNP in March 2016.

 42According to ATF officials, the SWBWOC Program was not reviewed by the Office of 

Chief Counsel prior to its initiation in June 2007.
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 87 GAO-16-552 Firearms Purchaser Data

The Gun Control Act of 1968, as amended, requires FFLs to report 

transactions involving the sales of multiple firearms. Specifically, under 18 

U.S.C. § 923(g)(3)(A), an FFL is required to report sales or other 

dispositions of two or more pistols or revolvers to a non-FFL at one time 

or during 5 consecutive business days.43 Under these circumstances, the 

FFL is required to report information about the firearms, such as type, 

serial number, manufacturer, and model, and the person acquiring the 

firearms, such as name, address, ethnicity, race, identification number, 

and type of identification to ATF. ATF enters data from these reports into 

the MS portion of its Firearms Tracing System so that it can monitor and 

deter illegal interstate commerce in pistols and revolvers.44

Our 1996 report examined the Multiple Sales System and found that it did 

not violate the prohibition on the consolidation or centralization of firearms 

records because the collection and maintenance of records was incident 

to a specific statutory responsibility. In connection with our current review, 

we observed the functioning of the present system for reports of multiple 

sales. We found no changes since 1996 that would suggest a different 

conclusion with respect to ATF’s compliance with the appropriations act 

restriction.

As we reported in 1996, a regulatory requirement for FFLs to prepare and 

provide multiple sales reports to ATF existed before the prohibition on 

consolidation or centralization of firearms records was enacted in fiscal 

year 197945 and there was no indication in the legislative history that the 

prohibition was intended to overturn ATF’s existing practices with respect 

to multiple sales. In addition, we explained that the Firearms Owners’

Protection Act had codified the ATF regulation, affirming the agency’s 

authority to collect this information.46 FOPA’s requirement that FFLs send 

 43These reports are required to be submitted to ATF no later than the close of business on 

the day that the multiple sale or disposition occurs. 18 U.S.C. § 923(g)(3)(A). The 

reporting requirement also applies to sales or dispositions of combinations of pistols and 

revolvers totaling two or more. 27 C.F.R. § 478.126A.

44See 40 Fed. Reg. 19,201 (May 2, 1975) (pertaining to a multiple sales regulation that 

predated 18 U.S.C. § 923(g)(3)(A)). 

45See 40 Fed. Reg. 19,201, 19,201-19,202 (May 2, 1975) (codified at 27 C.F.R. §§ 

178.11, 178.126a). 

46Pub. L. No. 99-308, § 103, 100 Stat. 449, 455 (1986).

Multiple Sales and 

“Demand Letter 3” Reports
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 88 GAO-16-552 Firearms Purchaser Data

the reports “to the office specified” on an ATF form suggested that ATF 

could specify that the information be sent to a central location.

Our review of FOPA’s legislative history confirmed our interpretation of 

the statute. When considering the passage of FOPA, Congress clearly 

considered placing constraints on ATF’s maintenance of multiple sales 

reports, but declined to do so. Specifically, the Senate-passed version of 

FOPA prohibited the Secretary of the Treasury from maintaining multiple 

sales reports at a centralized location and from entering them into a 

computer for storage or retrieval.47 This provision was not included in the 

version of the bill that was ultimately passed. In light of the above, we 

reach the same conclusion as we did in 1996 and find that ATF’s use of 

MS complies with the restriction on the consolidation or centralization of 

firearms records.

In addition, ATF has collected and maintained information on the multiple 

sales of firearms under a separate authority, 18 U.S.C. § 923(g)(5)(A). 

Section 923(g)(5)(A) authorizes the Attorney General to require FFLs to 

submit information that they are required to maintain under the Gun 

Control Act of 1968, as amended.48 This provision was also included in 

FOPA.49 Relying on this authority, ATF issues “demand letters” requiring 

FFLs to provide ATF with specific information. In 2011, ATF issued a 

demand letter requiring certain FFLs in Arizona, California, New Mexico, 

and Texas to submit reports of multiple sales or other dispositions of 

particular types of semiautomatic rifles to non-FFLs (referred to as 

“Demand Letter 3” reports).50 These reports are submitted to ATF and 

included in the MS portion of its Firearms Tracing System. According to 

ATF, the information was intended to assist in its efforts to investigate and 

 47S. 49, 99th Cong. (1985).

48Under the statute, an FFL must, “when required by letter issued by the Attorney General 

. . . submit on a form specified by the Attorney General, for periods and at the times 

specified in such letter, all record information required to be kept by this chapter.” See 27 

C.F.R. § 478.126. 

49Pub. L. No. 99-308, § 103, 100 Stat. 449, 455 (1986).

50Specifically, ATF required licensed dealers and pawnbrokers to prepare reports on sales 

or other dispositions of two or more semiautomatic rifles capable of accepting a 

detachable magazine and with a caliber greater than .22 at one time or during any 5 

consecutive business days. 
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 89 GAO-16-552 Firearms Purchaser Data

combat the illegal movement of firearms along and across the southwest 

border.

Several FFLs challenged the legality of ATF’s demand letter, asserting, 

among other things, that it would create a national firearms registry in 

violation of the fiscal year 2012 appropriations act restriction. In each of 

the cases, the court placed ATF’s initiative in its statutory context and 

held that the appropriations act did not prohibit ATF’s issuance of the 

demand letter.51 Similar to our 1996 analyses of the Out-of-Business 

Records and Multiple Sales Systems, the United States Court of Appeals 

for the Fifth Circuit examined the enactment of ATF’s authority to issue 

demand letters in relation to the appropriations act restriction.52 The court 

observed that ATF’s demand letter authority was enacted as part of 

FOPA and that because FOPA “clearly contemplate[d] ATF’s collection of 

some firearms records,” the appropriations provision did not prohibit “any 

collection of firearms transaction records.”53 In this regard, the court 

further noted that the plain meaning of “consolidating or centralizing” did 

not prohibit the collection of a limited amount of information.54

Other courts also emphasized that the ATF 2011 demand letter required 

FFLs to provide only a limited subset of the information that they were 

required to maintain, as opposed to the substantial amount of information 

that they believed would characterize a “consolidation or centralization.”

For example, the Court of Appeals for the District of Columbia Circuit 

enumerated the limitations on ATF’s 2011 collection of information, noting 

that it applied to (1) FFLs in four states; (2) who are licensed dealers and 

pawnbrokers; (3) and who sell two or more rifles of a specific type; (4) to 

the same person; (5) in a 5-business-day period.55 The court found that 

 51Ron Peterson Firearms, LLC v. Jones, 760 F.3d 1147 (10th Cir. 2014); 10 Ring 

Precision, Inc. v. Jones, 722 F.3d 711 (5th Cir. 2013); Nat’l Shooting Sports Found., Inc. v. 

Jones, 716 F.3d 200 (D.C. Cir. 2013). Earlier decisions similarly upheld prior ATF 

information collection initiatives under 18 U.S.C. § 923(g)(5)(A). Blaustein & Reich, Inc. v. 

Buckles, 365 F.3d 281 (4th Cir. 2004); RSM, Inc. v. Buckles, 254 F.3d 61 (4th Cir. 2001). 

5210 Ring Precision, Inc. v. Jones, 722 F.3d 711, 722 (5th Cir. 2013).

53Id. at 722. The court cited the canon of statutory construction that a statute should be 

interpreted so as not to render one part inoperative.

54Id.

55Nat’l Shooting Sports Found., Inc. v. Jones, 716 F.3d 200, 213 (D.C. Cir. 2013). 
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 90 GAO-16-552 Firearms Purchaser Data

because ATF sent the demand letter to a limited number of FFLs 

nationwide and required information on only a small number of 

transactions, “the . . . demand letter does not come close to creating a 

‘national firearms registry.’”56 In light of the court decisions regarding 

ATF’s exercise of its statutory authority in this context, we conclude that 

the Demand Letter 3 initiative does not violate the restriction on the 

consolidation or centralization of firearms records.

Two of the data systems under review, OBRIS and MS, comply with the 

provision in ATF’s fiscal year 2012 appropriation prohibiting the use of 

funds for the consolidation or centralization of firearms records. ATF 

collects and maintains firearms transaction information in each system 

incident to the implementation of specific statutory authority and it does 

not exceed those statutory purposes. ATF’s A2K system for in-business 

FFLs and its maintenance of certain firearms information pertinent to 

criminal investigations in FRNP are likewise consistent with the 

appropriations act restriction. However, ATF’s collection and maintenance 

of out-of-business A2K records on the server at NTC violated the 

restriction, as did its collection and maintenance of data from certain FFLs 

as part of the SWBWOC Program. In both cases, ATF’s aggregation of 

information was not supported by any statutory purpose.

ATF’s failure to comply with the prohibition on the consolidation or 

centralization of firearms records also violated the Antideficiency Act.57

The Antideficiency Act prohibits making or authorizing an expenditure or 

obligation that exceeds available budget authority.58 As a result of the 

statutory prohibition, ATF had no appropriation available for the salaries 

or administrative expenses of consolidating or centralizing records, or 

portions of records, of the acquisition and disposition of firearms in 

 56Id. at 214.

5731 U.S.C. § 1341(a).

58We have consistently concluded that the use of appropriated funds for prohibited 

purposes violates the Antideficiency Act, because no funds are available for the purpose. 

See, e.g., B-325248, Sept. 9, 2014 (appropriations used in violation of a grassroots 

lobbying prohibition); B-321982, Oct. 11, 2011 (appropriations used in violation of 

statutory restriction against engaging in bilateral activities with China or Chinese-owned 

companies); B-302710, May 19, 2004 (appropriations used in violation of prohibition 

against publicity or propaganda).

Conclusion
Appendix VII: Legal Analysis of Compliance 

with the Restriction on Consolidation or 

Centralization of Firearms Records

Page 91 GAO-16-552 Firearms Purchaser Data

connection with the SWBWOC Program59 or A2K for out-of-business 

records. The Antideficiency Act requires that the agency head “shall 

report immediately to the President and Congress all relevant facts and a 

statement of actions taken.”60 In addition, the agency must send a copy of 

the report to the Comptroller General on the same date it transmits the 

report to the President and Congress.61

 59We have no record of GAO receiving an Antideficiency Act report from ATF after the 

Chief Counsel’s 2009 determination that the agency had violated the restriction on the 

consolidation or centralization of records.

6031 U.S.C. § 1351.

61Id. The Office of Management and Budget (OMB) has published requirements for 

executive agencies for reporting violations. OMB, Preparation, Submission, and Execution 

of the Budget, OMB Circular No. A-11, §§ 145, 145.8 (Washington, D.C.: June 2015).

OMB has advised executive agencies to report violations found by GAO. The Circular 

further provides that “[i]f the agency does not agree that a violation has occurred, the 

report to the President, Congress, and the Comptroller General will explain the agency’s 

position.” 
Appendix VIII: GAO Contacts and Staff 

Acknowledgments

Page 92 GAO-16-552 Firearms Purchaser Data

Diana C. Maurer, (202) 512-9627 or maurerd@gao.gov

Helen T. Desaulniers, (202) 512-4740 or desaulniersh@gao.gov

In addition to the contact named above, Dawn Locke (Assistant Director) 

and Rebecca Kuhlmann Taylor (Analyst-in-Charge) managed this work. 

In addition, Willie Commons III, Susan Czachor, Michele Fejfar, Justin 

Fisher, Farrah Graham, Melissa Hargy, Jan Montgomery, and Michelle 

Serfass made significant contributions to the report. Also contributing to 

this report were Dominick M. Dale, Juan R. Gobel, Eric D. Hauswirth, 

Ramon J. Rodriguez, and Eric Winter.

Appendix VIII: GAO Contacts and Staff 

Acknowledgments

GAO Contacts

Staff 

Acknowledgments

(441281)
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. 

Listen to our Podcasts and read The Watchblog.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.