Firearms Data: ATF Did Not Always Comply with the Appropriations Act Restriction and Should Better Adhere to Its Policies
Published: 2016-06-30T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: ATF is responsible for enforcing certain criminal statutes related to firearms, and must balance its role in combatting the illegal use of firearms with protecting the privacy rights of law-abiding gun owners. As part of this balance, FFLs are required to maintain firearms transaction records, while ATF has the statutory authority to obtain these records under certain circumstances. ATF must also comply with an appropriations act provision that restricts the agency from using appropriated funds to consolidate or centralize FFL records.
GAO was asked to review ATF's compliance with this restriction. This report (1) identifies the ATF data systems that contain retail firearms purchaser data and (2) determines whether selected ATF data systems comply with the appropriations act restriction and adhere to ATF policies. GAO reviewed ATF policy and program documents, observed use of data systems at NTC, reviewed a generalizable sample of one system's records, and interviewed ATF officials at headquarters and NTC.
section_title: What GAO Found
paragraphs: To carry out its criminal and regulatory enforcement responsibilities, the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has 25 firearms-related data systems, 16 of which contain retail firearms purchaser information from a federal firearms licensee (FFL)—such as firearms importers and retailers. GAO selected 4 systems for review that are used in the firearms tracing process, based on factors such as the inclusion of retail purchaser information and original data.
The Out-of-Business Records Imaging System (OBRIS) stores nonsearchable images of firearms records from out-of-business FFLs. Such FFLs are required by law to provide their records to ATF.
Access 2000 (A2K) provides servers for National Tracing Center (NTC) personnel to electronically search participating FFLs' records at their premises for firearms disposition information during a trace.
The Firearm Recovery Notification Program (FRNP) maintains information on firearms that have not yet been recovered by law enforcement, but are suspected of being involved in criminal activity and are associated with an ATF criminal investigation.
Multiple Sales (MS) includes firearms information from multiple sales reports. FFLs are required by law to report to ATF sales of two or more revolvers or pistols during 5 consecutive business days. ATF policy requires that certain information in MS be deleted after 2 years if the firearm has not been connected to a trace.
Of the 4 data systems, 2 fully comply and 2 did not always comply with the appropriations act restriction prohibiting consolidation or centralization of FFL records. ATF addressed these compliance issues during the course of GAO's review. ATF also does not consistently adhere to its policies. Specifically:
OBRIS complies with the restriction and adheres to policy.
A2K for in-business FFL records complies with the restriction. A2K for out-of-business FFL records did not comply with the restriction because ATF maintained these data on a single server at ATF. Thus, ATF deleted the records in March 2016. In addition, ATF policy does not specify how, if at all, FFLs may use A2K records to meet out-of-business record submission requirements. Such guidance would help ensure they submit such records.
FRNP generally complies with the restriction. However, a 2007 through 2009 program using FRNP did not comply. ATF cancelled this program in 2009 and deleted the related data in March 2016. Also, a technical defect allows ATF agents to access FRNP data—including purchaser data—beyond what ATF policy permits. Aligning system capability with ATF policy would ensure that firearms purchaser data are only provided to those with a need to know.
MS complies with the restriction, but ATF inconsistently adheres to its policy when deleting MS records. Specifically, until May 2016, MS contained over 10,000 names that were not consistently deleted within the required 2 years. Aligning the MS deletion policy with the timing of deletions could help ATF maintain only useful MS purchaser data and safeguard privacy.
section_title: What GAO Recommends
paragraphs: GAO recommends that ATF provide guidance to FFLs participating in A2K on the provision of records to ATF when they go out of business; align system capability with ATF policy to limit access to FRNP firearms purchaser information for ATF agents; and align timing and ATF policy for deleting MS records. ATF concurred with our recommendations.

section_title: Letter
paragraphs: As of 2013, there were an estimated 350 million firearms in the United  States. Although many are owned by law-abiding individuals, firearms  can be used for illegal purposes, and were involved in approximately  10,000 murders in 2014 in the United States. The federal government  has an important role in combatting the illegal use of firearms, and must  balance this with protecting the privacy rights of law-abiding gun owners.
The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), a  criminal and regulatory enforcement agency within the Department of  Justice (DOJ), is responsible for the regulation of the firearms industry  and enforcing federal statutes regarding firearms, including enforcing  criminal statutes related to the illegal possession, use, transfer, or  trafficking of firearms, among other things. The Gun Control Act of 1968,  as amended, established a system requiring federal firearms licensees  (FFL) to record and maintain records of firearms transactions and make  these records available to ATF for inspection under certain  circumstances. To carry out its enforcement responsibilities, ATF  maintains certain computerized information on firearms, firearms  transactions, and firearms purchasers.
Over the years, Congress has balanced the law enforcement need for  firearms retail purchaser information with the competing interest of  protecting the privacy of firearms owners. To achieve this balance,  Congress requires FFLs to provide certain firearms transaction  information to ATF, while also restricting ATF’s maintenance and use of  such information. Since 1979, Congress has restricted ATF from using  appropriated funds to consolidate or centralize FFL records within the  department where ATF is located. Through the years, members of  Congress have raised questions about ATF’s oversight of these data  restrictions, including whether ATF is complying with legal standards for  entering firearms records into its data systems, whether ATF is  inappropriately using its data systems to track information about firearms  owners, and whether ATF is complying with the restriction related to  consolidating and centralizing data from FFL records. You asked us to  review ATF’s compliance with this restriction.
This report examines the following objectives:  1.  Identify the ATF data systems that contain retail firearms purchaser  data and describe the characteristics of selected systems.  2.  Determine whether selected ATF data systems comply with the  appropriations act restriction on consolidation or centralization of  firearms records and adhere to ATF policies.
To address the first objective, we reviewed ATF policy and program  documents to identify ATF data systems related to firearms, including  ATF orders, system user manuals, and data submission forms. For the  purposes of this report, “data systems” or “systems” refers to ATF’s data  systems and system components, including what ATF refers to as  “modules” of a larger system, and what ATF refers to as “programs”  whose associated data are contained within related systems. We  compared information from these policy and program documents to the  systems identified in a GAO September 1996 report, and conducted  searches of publicly available information to develop a comprehensive  and current list of systems. In order to identify the systems and better  understand them and their contents, we spoke with ATF officials in  headquarters and at ATF’s National Tracing Center (NTC). We also  discussed these systems with ATF investigative and regulatory officials in  the Baltimore and Los Angeles field offices, who provided varying  perspectives due to geographic factors.
We selected four systems for a more in-depth review: Out-of-Business  Records Imaging System (OBRIS), Access 2000 (A2K), Firearm  Recovery Notification Program (FRNP), and Multiple Sales (MS). We  selected systems that contained retail purchaser information and original  records, among other criteria. For the selected systems, we reviewed  ATF data on the number of system records, among other things—for  OBRIS and A2K for fiscal year 2015, and for FRNP and MS from fiscal  years 2010 through 2015. We assessed the reliability of these data by  interviewing ATF staff and reviewing relevant documentation, and  concluded that these data were sufficiently reliable for the purposes of our  report. We reviewed ATF policy and program documents to obtain in- depth descriptions of these selected systems, and discussed these  systems with ATF officials. We visited NTC to observe the selected  systems in operation.
To address the second objective, we reviewed relevant laws, including  statutory data restrictions, and ATF policy and program documents. We  also solicited the agency’s interpretation of the restriction on consolidation  or centralization of records as applied to each of the systems, and  interviewed ATF officials regarding the data systems’ compliance with  that restriction and ATF policies. We visited NTC to observe how selected  systems’ data are collected, used, and stored. We observed NTC  analysts using the selected systems and observed the extent to which the  systems are searchable for retail purchaser information. For OBRIS,  FRNP, and MS, we observed NTC analysts receiving and entering data  into the systems and processing the original data submissions.
For A2K, we reviewed budgetary information to determine the source of  funding for the system for fiscal year 2008 through fiscal year 2014. We  also interviewed representatives from the contractor that manages A2K,  and 3 of 35 industry members that use A2K. We selected industry  members that had several years of experience using A2K and reflected  variation in FFL size and type. Although our interviews with these industry  members are not generalizable, they provided us with insight on the  firearms industry’s use of A2K.
In order to evaluate the contents of FRNP for the presence of retail  purchaser information and adherence to the appropriations act restriction  and FRNP policies, we reviewed several fields of data for the entire  population of records. During our site visit, we also reviewed additional  fields of data for a generalizable sample of records and the associated  submission forms that are used to populate the records. We assessed  the reliability of the FRNP data by conducting electronic tests of the data  for obvious errors and anomalies, interviewing staff responsible for  managing the data, and reviewing relevant documentation, and  concluded that these data were sufficiently reliable for the purposes of our  report. For MS, we observed the process of querying to identify particular  records.
We determined the selected data systems’ compliance with the  appropriations act restriction, and compared them to multiple ATF policies  on collection and maintenance of information, and criteria in Standards for  Internal Control in the Federal Government related to control activities for  communication and for the access to and design of information  systems. See appendix I for additional information on our scope and  methodology.
We conducted this performance audit from January 2015 to June 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: ATF Roles and Responsibilities
paragraphs: ATF’s mission is to protect communities from violent criminals, criminal  organizations, and illegal use and trafficking of firearms, among other  things. To fulfill this mission, ATF has 25 field divisions located throughout  the United States. To efficiently and effectively carry out its criminal  enforcement responsibilities related to firearms, ATF maintains certain  computerized information on firearms, firearms transactions, and firearms  purchasers. To balance ATF’s law enforcement responsibility with the  privacy of firearms owners, Congress has required FFLs to provide ATF  certain information about firearms transactions and the ownership of  firearms while placing restrictions on ATF’s maintenance and use of such  data. In addition to its enforcement activities, ATF also regulates the  firearms industry, including issuing firearms licenses to prospective FFLs,  and conducting FFL qualification and compliance inspections.
section_title: Firearms Tracing Process
paragraphs: A critical component of ATF’s criminal enforcement mission is the tracing  of firearms used in crimes to identify the first retail purchaser of a firearm  from an FFL. The Gun Control Act of 1968, as amended, established a  system requiring FFLs to record firearms transactions, maintain that  information at their business premises, and make these records available  to ATF for inspection and search under certain prescribed circumstances,  such as during a firearms trace. The system was intended to permit law  enforcement officials to trace firearms involved in crimes while allowing  the records themselves to be maintained by the FFLs rather than by a  governmental entity. Figure 1 shows one possible scenario in which a  firearm is purchased at an FFL, the FFL maintains records on the  purchase, the firearm is used in a crime, and a law enforcement agency  recovers the firearm and submits it for tracing.
Through the use of these records maintained by FFLs and provided to  ATF in certain circumstances, ATF provides firearms tracing services to  federal, state, local, and foreign law enforcement agencies. The  objective of the trace is to identify the first retail purchaser of the firearm.  To carry out its firearms tracing responsibilities, ATF maintains a firearms  tracing operation at NTC in Martinsburg, West Virginia. As shown in figure  2, NTC traces firearms suspected of being involved in crimes to the first  retail purchaser to assist law enforcement agencies in identifying  suspects.
NTC generally receives trace requests through eTrace, a web-based  submission system, but also receives requests by fax, telephone, and  mail. To conduct a trace, NTC must receive the recovered firearm’s  description—including manufacturer and serial number—from the law  enforcement agency. NTC determines the ownership of the firearm by  first conducting automated checks of data systems that are maintained at  NTC. If these automated checks do not identify a matching firearm  description within the systems, an NTC analyst contacts the chain of  distribution for the firearm—the series of businesses that are involved in  manufacturing and selling the firearm. For example, after automated data  system checks, an NTC analyst may call the manufacturer of the firearm,  who informs NTC that the firearm was sold to a certain distributor. The  NTC analyst will then call that distributor, and so on until the individual is  identified. For many traces, an FFL in the chain of distribution has gone  out of business, so an NTC analyst must consult the FFL’s out-of- business records, which are also maintained by NTC.
ATF documents each trace request and its results, and provides that  information to the law enforcement requester. ATF considers a request  completed when it traces the firearm to a retail purchaser, or when it  cannot identify the purchaser for various reasons. For example, the  description of the firearm as submitted by the requester may not have  contained sufficient information to perform a trace. For fiscal year 2015,  ATF received a total of 373,349 trace requests, completed 372,992  traces, and identified a retail FFL or a purchaser of the traced firearm in  about 68 percent of the completed traces.
section_title: Statutory Data Restrictions
paragraphs: Since the passage of the Gun Control Act of 1968, Congress has passed  provisions that place restrictions on ATF’s handling of FFL records. In  1978, citing to the general authorities contained in the Gun Control Act,  ATF proposed regulations that would have required FFLs to report most  of their firearms transactions to ATF through quarterly reports. Under the  proposed regulations, these FFL reports of sales and other dispositions  would not have identified a nonlicensed transferee, such as a retail  purchaser, by name and address. These proposed regulations  prompted concerns from those who believed that the reporting  requirements would lead to the establishment of a system of firearms  registration. Since then, Congress has placed restrictions on ATF’s use of  funds to consolidate or centralize firearms records, as discussed below.
In 1978, the Treasury, Postal Service, and General Government  Appropriations Act, 1979, prohibited the use of funds for  administrative expenses in connection with the consolidation or  centralization of FFL records at the agency, or the final issuance of  the 1978 proposed regulations. This restriction was included in each  of ATF’s annual appropriations through fiscal year 1993.
In 1993, the Treasury, Postal Service, and General Government  Appropriations Act, 1994, removed the reference to the 1978  proposed rules, but expanded the prohibition to include the  consolidation or centralization of portions of records, and to apply to  the use of funds for salaries as well as administrative expenses.  This provision was included in each of ATF’s annual appropriations  through fiscal year 2011. “hat no funds appropriated herein or hereafter shall be available for salaries or  administrative expenses in connection with consolidating or centralizing, within the  Department of Justice, the records, or any portion thereof, of acquisition and  disposition of firearms maintained by Federal firearms licensees.”
section_title: ATF Has 16 Data Systems That Contain Retail Firearms Purchaser Data; Selected Systems Are Involved in Tracing Process
subsections: section_title: ATF Has 16 Systems with Retail Purchaser Data
paragraphs: ATF collects and maintains data from the firearms industry to carry out its  criminal and regulatory enforcement responsibilities, and has established  25 national ATF data systems relating to firearms to maintain the data it  collects. Of these 25 data systems, the following 16 data systems contain  retail firearms purchaser information:  1.  Access 2000 (A2K)  2.  ATF NICS Referral  3.  Firearm Recovery Notification Program (FRNP)  4.  Firearms and Explosives Import System  5.  Firearms Information Reporting System  6.  Firearms Tracing System  9.  Multiple Sales (MS)  10. National Firearms Act System / National Firearms Registration and  Transfer Record System  14. Out-of-Business Records Imaging System (OBRIS)  15. Suspect Person Database  More details on these systems are provided in appendix II.
section_title: Four ATF Systems We Selected Are Used in the Firearms Tracing Process
paragraphs: From the 16 data systems that contain retail purchaser information, we  selected 4 systems for an in-depth review of compliance with the  appropriations act restriction on consolidation or centralization, and  adherence to ATF policies: OBRIS, A2K, FRNP, and MS, including  Demand Letter 3. See appendix I for our selection criteria. These systems  are operated and maintained by NTC and play a significant role in the  firearms tracing process as shown in figure 3.
OBRIS is a repository of nonsearchable images of firearms records that  allows NTC employees to manually search for and retrieve records during  a firearms trace using an FFL number and a firearm description (e.g.,  serial number). Out-of-business records are integral to the firearms  tracing process. According to ATF officials, in approximately 35 to 38  percent of trace requests, there is at least one entity in the chain of  distribution that has gone out of business. Therefore, in more than one- third of firearms trace requests, NTC analysts must consult OBRIS at  least once. According to ATF data, as of May 5, 2016, there were  297,468,978 images of firearms records in OBRIS. Further, in fiscal  year 2015, NTC accomplished 134,226 of 372,992 total completed trace  requests using OBRIS.
OBRIS was developed in 2006 to assist NTC with maintaining the out-of- business FFL records that are received each year. By statute, when FFLs  discontinue their businesses and there is no successor, the records  required to be kept under the Gun Control Act of 1968, as amended, must  be delivered within 30 days to the Attorney General. This includes all  acquisition and disposition logbooks, firearms transactions records—such  as Form 4473 that contains purchaser information—and other required  records. NTC receives an average of about 1.9 million out-of-business  records per month, of which a large percentage are paper-based.
Since 2006, when paper records are received from an FFL that has gone  out of business, NTC scans them as TIFF image files and stores them in  OBRIS. By design, the files are stored as images (with no optical  character recognition) so that they cannot be searched using text  queries. In addition, ATF sometimes receives electronic FFL out-of- business records in the forms of computer external removable drives and  hard drives. In these cases, ATF converts the data to a nonsearchable  format consistent with OBRIS records. During processing of OBRIS  records, NTC conducts a quality-assurance process, including document  sorting, scanning, and error checks on 100 percent of the records  received. Officials stated that the imaged records are maintained  indefinitely in OBRIS. For more information on OBRIS, see appendix III.
subsections: section_title: A2K
paragraphs: ATF implemented A2K in 1995 at the request of firearms industry  members to allow manufacturer, importer, and wholesaler FFLs to more  efficiently respond to requests from NTC for firearms traces. By statute,  FFLs are required to respond within 24 hours to a firearms trace—a  request from ATF for firearms disposition information—needed for a  criminal investigation. Normally, when an NTC analyst contacts an FFL  in the chain of distribution during a trace, the analyst contacts the FFL by  phone, fax, or e-mail. ATF officials reported that this can be burdensome  if the FFL receives a large number of trace requests, and that such  requests can number more than 100 per day. With A2K—a voluntary  program—the participating industry member uploads electronic firearms  disposition records (i.e., information on the FFL or, in rare cases, the  individual to whom the firearm was sold) onto a server that ATF owns and  maintains, but is located at the site of the industry member. A2K  provides a secure user web interface to this server, through which  authorized NTC personnel can search—by firearm serial number only—to  obtain disposition data for a firearm during a trace.
According to the A2K memorandum of understanding with industry  members, each participating industry member maintains ownership over  its data. Further, NTC access to A2K’s search function is limited to  analysts conducting traces for each particular industry member. NTC  analysts access A2K using a different URL and login information for each  participating industry member, and can only retrieve the disposition data  for the particular firearm they are tracing.
Participation in A2K is voluntary and, according to ATF officials and the  three industry members we spoke with, can reduce an industry member’s  costs associated with responding to firearms trace requests. According to  ATF officials, as of April 25, 2016, there are 35 industry members using  A2K, which account for 66 manufacturer, importer, and wholesaler FFLs.  All three of the participating industry members we spoke with agreed that  A2K has been beneficial since it reduces the industry member resources  necessary to respond to trace requests. A2K also benefits NTC by  providing immediate access to industry member data at all times, thereby  allowing tracing operations to continue outside of normal business hours,  which can be crucial for urgent trace requests. According to ATF data, as  of March 17, 2016, there were 290,256,532 firearms in A2K. Further, in  fiscal year 2015, NTC accomplished 130,982 of 372,992 total completed  trace requests using A2K.
Established in 1991, FRNP (formerly known as the Suspect Gun  Program) provides a criminal investigative service to ATF agents by  maintaining a database of firearms that have not yet been recovered by  law enforcement, but are suspected to be involved in criminal activity.  An ATF agent submits firearms information to FRNP, in connection with a  specific ATF criminal investigation, to flag a particular firearm so that in  the event that it is recovered and traced at some future time, the  requesting agent will be notified.
A request to enter a firearm into FRNP could start with an ATF agent  recovering another firearm during an undercover investigation of illegal  sales from a firearms trafficker. By searching eTrace, the agent may  discover that the recovered firearm was part of a multiple sale with three  other firearms. The ATF agent then may request that the other three  firearms be entered into FRNP because they are associated with the  firearm the agent recovered and, therefore, are likely to also be trafficked.  ATF officials stated that, in this hypothetical case, it is likely that those  three firearms, if recovered and traced in the future, would support a  potential firearms trafficking case. If the firearms are in FRNP, if and  when they are recovered and traced, NTC would notify the requesting  agent, who could then contact the agency that recovered and traced the  firearms to coordinate building such a case.
To enter a firearm into FRNP, an ATF agent submits ATF Form 3317.1  (see app. IV) to NTC. According to ATF, no other law enforcement  agencies may submit firearms to FRNP or view information in the system;  only ATF agents and NTC staff have access. When a firearm is recovered  in a crime and is traced, NTC conducts an automated check to determine  whether the firearm description in the trace request matches a firearm  description in FRNP. If so, an analyst will validate that the entries match.  If they do, NTC generally notifies the ATF agent who submitted the  firearm for inclusion in FRNP that the firearm has been recovered and  traced. Then, the analyst completes the trace and sends the results to the  requester of the trace. Occasionally, in submitting the firearm to FRNP,  the agent directs NTC to not complete the trace on the firearm in the  event that the firearm is recovered and traced (i.e., not provide the trace  results to the law enforcement agency who requested the trace). For  example, an agent might want to prevent trace information from being  released to protect an undercover operation or other investigation.  According to ATF data, as of May 3, 2016, there were 174,928 firearms  and the names of 8,705 unique persons (e.g., criminal suspects, firearms  purchasers, associates) in FRNP, making up 41,964 total FRNP  records. Further, in fiscal year 2015, NTC accomplished 110 of 372,992  total completed trace requests using FRNP. Also, according to ATF  data, as of May 5, 2016, there were 23,227 firearms in FRNP that had  been linked to a firearms trace.
Once the ATF investigation that led to the FRNP firearms submission has  been closed, any FRNP entries associated with that investigation are to  be labeled as “inactive” in FRNP. Information from inactive records is  used to assist with the tracing process, but when a trace hits on an  inactive FRNP record, NTC does not notify the ATF agent who submitted  the firearm since the associated investigation is closed and the  information would no longer be useful to the agent. According to our  review of all FRNP records, as of July 2015, about 16 percent of the  41,625 records were designated “active” and about 84 percent were  designated “inactive.” Inactive records remain in the system for tracing  purposes. The original submission form is also preserved as a digital  image.
MS was developed in 1995 to collect and track reports of the purchase by  one individual of two or more pistols or revolvers, or both, at one time or  during any 5 consecutive business days. FFLs are required by statute to  report these sales to ATF. The multiple sales reports are completed by  FFLs, submitted to NTC using ATF form 3310.4 (see app. V), and entered  into MS. According to ATF, these reports, when cross-referenced with  firearms trace information, serve as an important indicator in the detection  of potential firearms trafficking. They can also allow successful tracing of  older firearms that have reentered the retail market.
MS also maintains the information from Demand Letter 3 reports. In  2011, ATF issued Demand Letter 3 to dealer and pawnbroker FFLs  located in Arizona, California, New Mexico and Texas. The letter requires  these FFLs to prepare reports of the purchase or disposition of two or  more semiautomatic rifles capable of accepting a detachable magazine  and with a caliber greater than .22, at one time or during any 5  consecutive business days, to a person who is not an FFL. According to  ATF, this information is intended to assist ATF in its efforts in  investigating and combatting the illegal movement of firearms along and  across the southwest border. Demand Letter 3 reports are completed by  FFLs, submitted to NTC using ATF form 3310.12 (see app. VI), and  entered into MS.
According to ATF officials and our observations, Demand Letter 3 and  multiple sales reports are managed identically within MS. During a  firearms trace, MS is automatically checked for a match with the firearm  serial number. If a match is found, the trace time can be substantially  shortened since the retail FFL and purchaser name to complete the trace  are contained within the MS record. According to ATF data, as of May 3,  2016, there were 8,950,209 firearms in MS, making up 3,848,623 total  MS records. Further, in fiscal year 2015, NTC accomplished 15,164 of  372,992 total completed trace requests using MS.
In November 1995, ATF implemented a policy to computerize multiple  sales reports at NTC, which now also applies to Demand Letter 3  reports. The original multiple sales or Demand Letter 3 paper report  received from the FFL is scanned in a nonsearchable, TIFF image format  and tagged with the MS transaction number. The TIFF file is then stored  in an image-only repository, and is retained indefinitely. However, as part  of the computerization policy, ATF included a requirement for deleting  firearms purchaser names from MS 2 years after the date of sale if such  firearms are not connected to a trace. ATF preserves the remainder of  the data, such as the firearm description, for the purpose of supporting  investigations. In contrast, if an MS record is connected to a firearms  trace, then ATF preserves the entire record, including purchaser  information, in the system. MS reports are available to any ATF staff that  has access to eTrace but not to outside law enforcement agencies with  eTrace access. However, after the purchaser name in a MS record has  been deleted in accordance with the 2-year deletion policy, only NTC  officials have access to this information in the digital image of the original  multiple sales or Demand Letter 3 reports. If an ATF agent needs to see  the deleted information, the agent must contact NTC.
section_title: ATF Did Not Always Comply with the Appropriations Act Restriction and Does Not Consistently Adhere to Its Policies on Maintenance of Firearms Data
paragraphs: Of the four data systems we reviewed, two systems were in full  compliance with the appropriations act restriction. The other two data  systems did not always comply with the restriction, although ATF  addressed the compliance issues during the course of our review. In  addition, three data systems could better adhere to ATF policies.  Specifically:
OBRIS complies with the appropriations act restriction and adheres to  ATF policies.
A2K for in-business industry members’ records complies with the  appropriations act restriction, but ATF’s collection and maintenance of  A2K out-of-business records in A2K on a server at NTC violated the  appropriations act restriction. ATF deleted the records from the server  in March 2016. In addition, industry members may benefit from clearer  ATF guidance to ensure that they are submitting out-of-business  records as required.
FRNP generally complies with the appropriations act restriction.
However, a regional program using FRNP from 2007 through 2009  did not comply with the restriction, and ATF removed the data it  collected through this program from FRNP in March 2016. Further,  FRNP generally adheres to ATF policies, but a technical defect allows  ATF agents to view and print FRNP data beyond what ATF policy  permits.
MS complies with the appropriations act restriction, but ATF continues  to inconsistently adhere to its own policy when deleting these records.
For a more detailed legal analysis of compliance with the appropriations  act restriction, see appendix VII.
subsections: section_title: Framework for Legal Analysis Set Forth in 1996 Report
paragraphs: We previously considered ATF’s compliance with the restriction on using  appropriated funds for consolidation or centralization in connection with  ATF’s Microfilm Retrieval System and MS in 1996. In that report, we  stated that the appropriations act restriction did not preclude all  information practices and data systems that involved an element of  consolidation or centralization. We interpreted the restriction in light of its  purpose and in the context of other statutory provisions governing ATF’s  acquisition and use of information on firearms. We found that the two  systems complied with the appropriations act restriction on the grounds  that ATF’s consolidation of records in these systems was incident to  carrying out specific responsibilities set forth in the Gun Control Act of  1968, as amended, and that the systems did not aggregate data on  firearms transactions in a manner that went beyond these purposes. We  are employing a similar analytical approach to the systems under review  here: we consider whether ATF’s aggregation of records in each system  serves a statutory purpose, and how it relates to that purpose.
section_title: OBRIS Complies with the Appropriations Act Restriction and Adheres to ATF Data-Processing Policies
paragraphs: OBRIS complies with the appropriations act restriction and adheres to  policies designed to help ensure that the system is in compliance with the  restriction. FFLs are specifically required to submit records to ATF when  going out of business, and the system limits the accessibility of key  firearms records information, such as retail purchaser data. As we  reported in 1996, ATF first issued regulations in 1968 requiring FFLs that  permanently go out of business to deliver their firearms transaction  records to the federal government within 30 days. This provided a  means of accessing the records for firearms tracing purposes after an  FFL went out of business. The legislative history related to ATF’s fiscal  year 1979 appropriation did not provide any indication that Congress  intended a change in ATF’s existing practice. In 1986, the Firearms  Owners’ Protection Act (FOPA) codified this regulatory reporting  requirement, affirming ATF’s authority to collect this information. In  1996, we also reported that the predecessor to OBRIS—the Microfilm  Retrieval System—as designed, complied with the statutory data  restrictions and that ATF operated the system consistently with its  design. We found that the Microfilm Retrieval System included in a  computerized index the information necessary to assist ATF in completing  a firearms trace, and did not aggregate information in a manner beyond  that necessary to implement the Gun Control Act. Notably, ATF’s  system of microfilmed records did not capture and store certain key  information, such as firearms purchaser information, in a searchable  format.
In response to logistical challenges and technological advances, ATF  developed OBRIS in 2006 as the repository to maintain digital images of  out-of-business FFL records. ATF transitioned from using microfilm  images of records to scanning records into OBRIS as digital images not  searchable through character recognition, consistent with ATF’s design  and use of its prior Microfilm Retrieval System. It is our view that, like its  microfilm predecessor system, OBRIS also complies with the  appropriations act restriction because OBRIS’s statutory basis and  accessibility are essentially the same as the prior system. As with the  prior system, OBRIS generally allows users to identify potentially relevant  individual records through manual review by searching an index using an  FFL number. Other information, specifically firearms purchaser  information, remains stored in nonsearchable images, and is not  accessible to ATF through a text search.
In OBRIS, ATF put data processing policies in place to maintain records  in compliance with the appropriations act restriction. Specifically, when an  FFL going out of business sends records to NTC, according to ATF policy  and verified by our observations, NTC personnel follow policies to sort  and scan the records in OBRIS in a manner that maintains the  nonsearchability of the records. For example, NTC personnel spend extra  time indexing the images by FFL number, and chronologically sorting FFL  records, typically by month and by year. When tracing a firearm,  according to ATF policy and verified by our observations, NTC personnel  generally identify a group of FFL records through the FFL number index,  then manually search the dates of the FFL records to narrow in on a  group of records that might contain the firearm being traced. NTC  personnel then manually skim through each record in this group until they  identify the relevant firearm information. According to NTC officials, NTC  staff sometimes search thousands of pages of records to find the record  that matches the trace request. This policy for a manual process to  maintain and use records in OBRIS helps to ensure its compliance with  the appropriations act restriction. For more details on OBRIS’s data  processing policies, see appendix III.
section_title: A2K for Out-of-Business Records Did Not Comply with the Appropriations Act Restriction, and ATF Could Improve Guidance to Industry
paragraphs: ATF maintains A2K for in-business industry members who store their own  A2K data and maintained A2K for certain records of out-of-business  industry members at NTC. ATF’s collection and maintenance of the  records of out-of-business A2K industry members at NTC violated the  appropriations act restriction on consolidation or centralization of firearms  records. However, ATF officials transferred the records to OBRIS, and in  March 2016 removed these records from A2K. In addition, industry  members would benefit from clearer A2K guidance from ATF to ensure  that they are submitting required out-of-business records.
subsections: section_title: A2K for In-Business Records Complies with the Appropriations Act Restriction
paragraphs: A2K for firearms records of in-business industry members complies with  the appropriations act restriction on consolidation and centralization  based on A2K’s statutory foundation and its features. ATF believes, and  we agree, that A2K for in-business records appropriately balances the  restriction on consolidating and centralizing firearms records with ATF’s  need to access firearms information in support of its mission to enforce  the Gun Control Act of 1968, as amended.
Federal law requires FFLs to provide firearms disposition information to  ATF within 24 hours in response to a trace request in the course of a  criminal investigation. ATF officials told us that they developed A2K in  response to industry member requests for an automated option for  responding to trace requests. Prior to A2K, FFLs could only respond to  trace requests by having dedicated personnel research firearms  disposition information and then submit that information to ATF by phone,  fax, or e-mail. In contrast, A2K provides industry members—who  voluntarily participate in A2K—with servers to facilitate automated  electronic responses to ATF trace requests. Under A2K, industry  members upload their electronic firearms disposition information onto the  servers located at their premises on a regular basis. Industry members— not ATF—retain possession and control of their disposition records and,  according to ATF officials, they may withdraw from A2K and remove their  records from the servers at any time. A2K includes a secure user web  interface to each of the servers and ATF may only obtain A2K disposition  information by searching individual industry member servers by exact  firearm serial number. Through this search, ATF obtains the same  information from each industry member as it would otherwise obtain by  phone, fax, or e-mail, and in similar disaggregated form.
section_title: A2K for Out-of-Business Records Did Not Comply with the Appropriations Act Restriction, and ATF Could Provide Clearer Guidance
paragraphs: Beginning in 2000, ATF maintained A2K disposition data from out-of- business industry members on a single partitioned server within NTC, and  removed the records from the server in March 2016. ATF’s maintenance  of the disposition records in this manner violated the appropriations act  restriction on consolidation or centralization. This arrangement was not  supported by any specific authority. As described earlier, A2K was  designed as an alternative for FFLs to meet the requirement to respond  promptly to ATF trace requests, which does not apply to FFLs once they  go out of business. Another statutory provision requires FFLs to submit  firearms records to ATF when they go out of business, and ATF has  designed a separate system for this purpose—OBRIS—as described  earlier.
A2K for out-of-business records functioned differently than OBRIS and  went beyond the consolidation of out-of-business records in that system  incident to specific responsibilities under the Gun Control Act. As  discussed earlier, out-of-business records are maintained as  nonsearchable digital images in OBRIS to comply with the appropriations  act restriction, while at the same time allowing ATF to perform its tracing  function. ATF completed traces using A2K disposition data from out-of- business industry members through the same type of secure user web  interface as used while the industry members were in business.  According to ATF, this was more efficient than relying on OBRIS to  complete firearms traces. Our observations of A2K out-of-business  searches in August 2015 confirmed ATF officials’ statements that these  records were accessed in the same way as in-business records. Records  were only retrievable by exact serial number search, in accordance with  ATF policy. However, according to ATF officials, it would have been  technically possible for ATF to reconfigure the server to allow the records  to be queried by any field, including fields with retail purchaser  information.
ATF agreed with our assessment that treating disposition information  from industry members that go out of business in the same manner as  disposition information from in-business industry members would violate  the appropriations act restriction. After we raised concerns about A2K  out-of-business records on the server at NTC, ATF told us that they had  begun a process of transferring the out-of-business A2K records from the  server into OBRIS as digital images. ATF permanently deleted the  records from the out-of-business A2K server in March 2016.
In addition, ATF could provide clearer ATF guidance to ensure that  industry members submit out-of-business records in accordance with the  Gun Control Act of 1968, as amended. These industry members and their  corresponding FFLs are required to provide transaction forms, acquisition  records, and disposition records to ATF within 30 days of going out of  business. However, it is unclear how the requirements apply to industry  members’ A2K disposition data. A2K agreements specifically state that  the A2K data belong to the industry member. Conversely, ATF requires  that the ATF-owned A2K equipment be returned when industry members  go out of business, which includes the hardware and software on which  the data were housed at the industry member’s location.
The A2K memorandums of understanding and ATF guidance to industry  members do not specify that industry members may retain the backup  disk or how A2K data may be used to meet the out-of-business record  submission requirements to ATF, if at all. All of the eight industry  members that have gone out of business have provided their backup  disks with data to ATF. According to ATF, six industry members  separately provided their acquisition and disposition information, while the  other two industry members, which were licensed importers, only  provided invoices. According to ATF officials, discussions with these  industry members did not include the industry member’s option to keep  the backup disk where the data are stored or whether submitting the  backup disk to ATF would fulfill part of the industry member’s submission  requirement. Further, the three industry members we spoke with  corroborated that ATF lacks guidance for its requirements related to  industry members submitting out-of-business A2K data in accordance  with the Gun Control Act, as amended.
Federal internal control standards require that agencies communicate  necessary quality information with external parties to achieve agency  objectives, which includes providing industry members with record  submission guidance so that ATF has the necessary records for firearms  tracing. According to ATF officials, ATF has not provided guidance to  A2K industry members on how to submit out-of-business records  because industry members already have the standard requirements that  apply to all FFLs, and industry members have not asked for guidance  specific to A2K. Industry members that we spoke to had not contemplated  the process for providing A2K equipment and records to ATF because  they did not anticipate going out of business. However, if ATF does not  have all required out-of-business records, the agency may not be able to  locate the first purchaser of a firearm during a trace, and thus may not be  able to fulfill part of its mission. ATF officials agreed that providing such  guidance—for example, in the A2K memorandum of understanding  between an industry member and A2K—would be helpful to industry  members to ensure that records are submitted to ATF as required.  Industry members could benefit from clear ATF guidance on, for example,  whether they are required to submit their A2K records in electronic  format; whether they are allowed to only submit hard copy records; or  what to do if one part of the company goes out of business, but A2K  continues at the industry member’s remaining FFLs. Such ATF guidance  could clarify how industry members may submit A2K data to fulfill a  portion of Gun Control Act requirements.
section_title: FRNP Generally Complies with the Appropriations Act Restriction, but a Past Regional Program Did Not Comply, and ATF Agents Are Able to Access Information That Is Not Permitted by ATF Policy
paragraphs: FRNP generally complies with the appropriations act restriction and  generally adheres to ATF policies that help ensure such compliance.  However, a regional ATF program using FRNP from 2007 through 2009  was not in compliance with the appropriations act restriction. ATF deleted  the data it collected through this program from FRNP in March 2016. In  addition, a technical defect in one of ATF’s key data systems allows ATF  agents to access FRNP records in a manner that is inconsistent with ATF  policy.
subsections: section_title: FRNP Generally Complies with the Appropriations Act Restriction and Adheres to ATF Policies That Help Ensure Compliance
paragraphs: ATF gathers and combines specific firearms transaction data to a limited  degree in FRNP in order to implement its statutory responsibilities related  to firearms criminal enforcement and, in this respect, the system complies  with the appropriations act restriction. By statute, ATF is responsible for  enforcing the federal statutes regarding firearms, including those related  to the illegal possession, use, transfer, or trafficking of firearms. FRNP  was established to provide an investigative service to ATF agents by  maintaining a database of firearms suspected of being involved in  criminal activity and associated with an ATF criminal investigation. As  discussed earlier, the appropriations act restriction does not preclude all  information practices and data systems that involve an element of  “consolidating or centralizing” FFL records. As designed, the aggregation  of firearms transaction records in FRNP is incident to carrying out specific  ATF criminal enforcement responsibilities and is limited to that purpose.  Therefore, FRNP—when used for the purpose as a database of firearms  suspected of being involved in criminal activity and associated with an  ATF criminal investigation—complies with the appropriations act  restriction. Moreover, based on our analysis of FRNP records, virtually  all records in FRNP are associated with an ATF criminal investigation,  and thus are related to ATF’s statutory responsibilities.
ATF policies for the implementation of FRNP support the conclusion that  it complies with the appropriations act restriction, when operated as  designed. ATF policies specify that ATF agents may submit a firearm for  entry into FRNP if the firearm is associated with an active, nongeneral  ATF criminal investigation and meets certain submission criteria. ATF  agents must use a designated submission form when requesting that  firearms information be entered in the FRNP system, which, among other  things, contains a field for the agent to include an active, nongeneral  investigation number. The form also contains a field to indicate the  additional, specific submission criteria for the firearm, which align with  ATF’s statutory responsibility of enforcing criminal statutes related to the  illegal possession, use, transfer, or trafficking of firearms. These criteria  include: (1) Large quantities of firearms purchased by individual; (2)  Firearms suspected in trafficking, but not stolen from an FFL dealer; (3)  FFL dealers suspected of performing firearms transactions without proper  documentation; (4) Firearms purchased by suspected straw purchasers;  and (5) Other—a category that the submitting agent is to explain on the  form.
According to NTC procedures, and verified by our observations, upon  receiving an FRNP submission form, an NTC analyst reviews the form for  completeness and conducts several validation and verification steps. For  example, the analyst uses ATF’s case-management system to verify that  the investigation number on the FRNP submission form is active and that  at least one criterion was selected on the submission form. Once the  validation and verification checks are complete, the NTC analyst either  enters the firearms information into FRNP or contacts the requesting ATF  agent if information is missing or not in alignment with the criteria required  for FRNP submission.
During our review of selected fields for all 41,625 FRNP records, and a  generalizable sample of records and submission forms, we found that for  the vast majority of firearms entered, ATF abided by its policy for entries  to be associated with an active investigation. Out of the entire population  of 41,625 records reviewed, less than 1/10 of 1 percent of records were  not associated at all with an investigation number and, according to ATF  officials, were likely data-entry errors or records entered for testing or  training purposes. Moreover, based on our sample review, an estimated  96 percent of FRNP records were entered while the related criminal  investigation was open. ATF officials stated that most of the remaining  records—entered before the related investigation was open or after it was  closed—were the result of data-entry errors or the result of investigation  numbers being reopened at a later date. Additional, specific submission  criteria were required to be noted on the FRNP submission form since  November 2004. Based on our sample review, an estimated 97 percent  of FRNP submission forms from November 2004 through July 2015  included the selection of at least one criterion. For an estimated 13  percent of these—or 23 submission forms in our sample—the “Other”  criteria was selected, and all but 2 of these had an explanation for why  the firearms were entered in FRNP. For example, in 1 submission form  that contained an explanation for “Other,” business owners were  suspected of selling firearms without a license. ATF officials could not  definitively state why an estimated 3 percent of submissions from  November 2004 through July 2015 did not contain criteria selection.  Officials speculated, for example, that an NTC analyst may have obtained  the criteria selection from the requesting agent by phone or e-mail and  may not have noted his or her conversation in the FRNP file. However,  officials acknowledged that the criteria selection is an important quality  control and allows ATF the ability to audit records related to an  investigation if necessary.
ATF officials told us that only names associated with the criminal  investigation are entered in the FRNP system. These names are  generally limited to suspects and purchasers, but ATF officials  acknowledged that the names of victims or witnesses may be included in  the system if they are associated with the criminal investigation, though  this does not happen routinely. Based on our observations of FRNP  entry procedures, an NTC analyst verifies that any names on the  submission form match the names listed in the case-management system  for that particular investigation, prior to entering the information in the  FRNP system.
section_title: A Past ATF Regional Program Did Not Comply with the Appropriations Act Restriction
paragraphs: An ATF regional program conducted from 2007 through 2009 to enter  firearms into FRNP—the Southwest Border Secondary Market Weapons  of Choice (SWBWOC) Program—did not comply with the appropriations  act restriction on consolidating or centralizing FFLs’ firearms records,  because the individual firearms were not suspected of being involved in  criminal activity associated with an ATF criminal investigation. During the  course of our review, ATF reported that it planned to delete the related  data from FRNP, and ATF did so in March 2016.
According to ATF officials, the SWBWOC Program was in place in ATF’s  four southwest border field divisions in order to more effectively identify— during a trace—the purchasers of used firearms trafficked to Mexico.  The program was implemented during routine regulatory inspections of  FFLs in the region who were engaged primarily in the sale of used  firearms—generally pawnbrokers. According to ATF, used firearms sales,  referred to as “secondary market” sales, played a significant role in  firearms trafficking to Mexico, particularly certain firearms most sought by  the Mexican drug cartels, referred to as “weapons of choice.” According  to ATF officials, this program was developed to record certain firearms in  an effort to enhance ATF’s ability to trace those firearms to a retail  purchaser in the event of crime-related recoveries of the firearms. As  part of the program, during regulatory inspections, ATF investigators were  to record any specified weapons of choice that were found in the FFLs’  inventory or sold or disposed of by the FFLs within the inspection period.  According to ATF officials, the information recorded was limited to the  serial number and description of the firearm, and was not to include any  purchaser information. The firearms information was then submitted to  FRNP for all of the used firearms identified during the inspection. If the  firearm was subsequently recovered by law enforcement and submitted  for a trace, NTC’s automatic checks on the firearm description would  result in a match in the FRNP system. ATF would then be able to more  quickly identify the FFL pawn shop that previously had the firearm in its  inventory.
According to ATF officials and documentation, the program was cancelled  on October 2, 2009, following ATF’s legal review of the process by which  the firearms information entered during the program was recorded and  submitted to FRNP. ATF’s legal review determined that the program was  not consistent with the appropriations act restriction on consolidation or  centralization. According to ATF officials, the program was not reviewed  by the ATF Chief Counsel’s office prior to its initiation in June 2007. They  stated that the program’s existence was the result of incomplete  communication by ATF executives responsible for industry operations  programs with ATF’s Chief Counsel prior to the implementation of the  program. Upon learning of the program, ATF Counsel determined that  FFL information on a firearm, in and of itself—even when unaccompanied  by purchaser information—is not permitted to be collected and  consolidated without a specific basis in statute or regulation, or a direct  nexus to a law enforcement purpose, such as a criminal investigation.  The ATF Chief Counsel’s office advised that the program be immediately  terminated and, in October 2009, the program was cancelled and the  firearms information already entered into FRNP during the program was  marked as “Inactive.”
We concur with ATF’s assessment that the inclusion of firearms  information from the program in FRNP did not comply with the  appropriations act restriction. It is our view that information obtained from  an FFL about a firearm in and of itself, and unaccompanied by purchaser  information, is not permitted to be collected and consolidated within ATF  without a specific basis in statute. As a result of our review, ATF officials  deleted the records for the affected data from FRNP—855 records  relating to 11,693 firearms—in March 2016.
section_title: ATF Agents Are Able to Access FRNP Information beyond What Is Permitted by ATF Policy
paragraphs: A technical defect in eTrace 4.0 allows ATF agents to view and print  FRNP data beyond what ATF policy permits. These data include  purchaser names and suspect names in a summary format called a  Suspect Gun Summary Report. Any ATF agent with eTrace access can  view or print these reports, including up to 500 FRNP records at one time.  According to ATF officials, the eTrace defect occurred when the  contractor developing eTrace 4.0 included a global print function for  Suspect Gun Summary Reports—which can contain retail purchaser  information—that was accessible from the search results screen. In  December 2008, prior to the release of eTrace 4.0 in 2009, ATF provided  the contractor with a list of the new system’s technical issues, including  this FRNP printing defect. ATF officials explained that because all ATF  eTrace users had the appropriate security clearances, and because there  would not be a reason for ATF agents to access the Suspect Gun  Summary Reports, the print issue was not considered a high-priority  concern. However, ATF officials told us that no audit logs or access  listings are available to determine how often ATF agents have accessed  records containing purchaser information. Therefore, ATF has no  assurance that the purchaser information entered in FRNP and  accessible through eTrace is not being improperly accessed.  eTrace is available to federal, state, and local law enforcement entities  that have entered into an eTrace memorandum of understanding with  ATF. ATF agents have access to information in eTrace that is unavailable  to state and local law enforcement entities, such as FRNP data. However,  according to eTrace system documentation, ATF agents are to be limited  in their access to FRNP records. Specifically, ATF agents should only be  able to view the firearm description and the name and contact information  of the ATF case agent associated with the investigation, and not  purchaser information or FFL information. If an ATF agent wanted further  information about the FRNP data, the agent should have to contact the  case agent. ATF officials told us that ATF’s policy is intended to provide  FRNP information to ATF agents on a “need-to-know” basis in order to  protect the security of ATF investigations, and protect gun owner  information. Moreover, federal internal control standards specify that  control activities to limit user access to information technology include  restricting authorized users to the applications or functions commensurate  with assigned responsibilities.
According to ATF officials, options are limited for resolving the global print  function defect. ATF’s contract with the eTrace 4.0 developer has ended,  and therefore ATF cannot contact the developer to fix the printing issue.  ATF could have the issue resolved when a new version of eTrace,  version 5.0, is released, but there is no timeline for the rollout of eTrace  5.0. ATF officials told us that, in the short term, one method to fix the  printing issue would be to remove individuals’ names and identifying  information from the FRNP system, so it is not available for Suspect Gun  Summary Reports. The firearms information and case agent information  would remain available to all ATF agents, and ATF officials indicated that  they did not think that removing the identifying information would hamper  ATF agents’ investigations. Developing and implementing short-term and  long-term mechanisms to align the eTrace system capability with existing  ATF policy to limit access to purchaser information for ATF agents could  ensure that firearms purchaser information remains limited to those with a  need to know.
section_title: MS Complies with the Appropriations Act Restriction, but ATF Continues to Inconsistently Adhere to ATF Policy When Deleting Records
paragraphs: MS complies with the appropriations act restriction; however, ATF lacks  consistency among its MS deletion policy, system design, and policy  implementation timing. Since we reported on MS in 1996, ATF has made  minimal changes to the system itself, but the information contained in MS  has changed with the inclusion of Demand Letter 3 reports, in addition to  multiple sales reports.
subsections: section_title: Multiple Sales Reports and Demand Letter 3 Reports Maintained in MS Comply with the Appropriations Act Restriction
paragraphs: Multiple sales reports. By statute, FFLs are required to provide to ATF  a multiple sales report whenever the FFL sells or otherwise disposes of,  within any 5 consecutive business days, two or more pistols or revolvers,  to an unlicensed person. The reports provide a means of monitoring and  deterring illegal interstate commerce in pistols and revolvers by  unlicensed persons. ATF’s maintenance of multiple sales reports in MS  complies with the appropriations act restriction because of ATF’s statutory  authority related to multiple sales reports, and the lack of significant  changes to the maintenance of multiple sales reports in MS since we  found it to be in compliance in 1996.
As we reported in 1996, ATF operates MS with specific statutory authority  to collect multiple sales reports. In 1975, under the authority of the Gun  Control Act of 1968, ATF first issued regulations requiring FFLs to  prepare multiple sales reports and submit those reports to ATF. The  legislative history related to ATF’s fiscal year 1979 appropriations act  restriction did not provide any indication that Congress intended a change  in ATF’s existing practice. In 1986, a provision of FOPA codified FFLs’  regulatory reporting requirement, affirming ATF’s authority to collect  multiple sales reports. In addition, this provision required, among other  things, FFLs to forward multiple sales reports to the office specified by  ATF. Therefore, under this provision, ATF was given the statutory  authority to specify that FFLs forward multiple sales reports to a central  location. In our 1996 report, we examined MS and found that it did not  violate the prohibition on the consolidation or centralization of firearms  records because ATF’s collection and maintenance of records was  incident to its specific statutory responsibility. As we noted at that time,  multiple sales reports are retrievable by firearms and purchaser  information, such as serial number and purchaser name. We did not  identify any significant changes to the maintenance of the multiple sales  reports since we last reported on ATF’s compliance with the statutory  restriction that would support a different conclusion in connection with this  review.
Demand Letter 3 reports. In 2011, in an effort to reduce gun trafficking  from the United States to Mexico, ATF issued demand letters to FFLs  classified as dealers or pawnbrokers in four southwest border states:  Arizona, California, New Mexico, and Texas. The letter, referred to as  Demand Letter 3, required these FFLs to submit a report to ATF on the  sale or other disposition of two or more of a specific type of  semiautomatic rifle, at one time or during any 5 consecutive business  days, to an unlicensed person. Federal courts that have considered the  issue have held that ATF’s collection of Demand Letter 3 reports are  consistent with the appropriations act restriction. It is our view that ATF’s  maintenance of Demand Letter 3 reports in MS is consistent with the  appropriations act restriction in light of the statutory basis for Demand  Letter 3, the courts’ decisions, and the way in which the records are  maintained.
ATF has specific statutory authority to collect reports like Demand Letter  3 reports. As discussed, FFLs are required to maintain certain firearms  records at their places of business. By statute, FFLs may be issued  letters requiring them to provide their record information or any portion of  information required to be maintained by the Gun Control Act of 1968, as  amended, for periods and at times specified by the letter.
Some FFLs have challenged the legality of Demand Letter 3 reports for a  number of reasons, including that it did not comply with the appropriations  act restriction. Federal courts that have considered the issue have upheld  ATF’s use of Demand Letter 3 as consistent with the appropriations act  restriction. In one case before the U.S. Court of Appeals for the Tenth  Circuit, the FFL contended that the demand letter created a national  firearms registry in violation of the restriction on consolidation or  centralization. The Tenth Circuit stated that the plain meaning of  “consolidating or centralizing” does not prohibit the mere collection of  some limited information. The court went on to state that the July 2011  demand letter requested very specific information from a limited segment  of FFLs. In addition, the court pointed out that Congress authorized the  issuance of the letters in 1986, after passing the first appropriations act  restriction, and Congress could not have intended to authorize the record  collection in statute while simultaneously prohibiting it in ATF’s annual  appropriations act. In other similar cases, the courts have also held that  ATF had the authority to issue the demand letter and that ATF’s issuance  of the demand letter complied with the appropriations act restriction. In  addition, Demand Letter 3 reports are maintained in MS in an identical  manner to multiple sales reports.
section_title: ATF’s Long-Standing Struggle to Implement Its MS Deletion Policy Persists
paragraphs: Although not required by statute, ATF policy requires that firearms  purchaser names be deleted from MS 2 years after the date of the  reports, if the firearm has not been connected to a firearms trace.  However, ATF’s method to identify records for deletion is not  comprehensive and, therefore, 10,041 names that should have been  deleted remained in MS until May 2016. According to ATF officials,  because of MS system design limitations, analysts must write complex  queries to locate such names in MS. For example, since the information  needed to identify the correct records could exist in free-form fields, the  success of the queries in comprehensively identifying all appropriate  records depends on consistent data entry of several text phrases  throughout the history of the system. In addition, ATF’s queries have  inconsistently aligned with its system design—for instance, as the system  was modified and updated, the query text remained aligned with the  outdated system—and therefore these queries resulted in incomplete  identification of records to be deleted. Changes to MS to address system  query limitations would require a system-wide database enhancement,  but there is currently not an operations and maintenance support contract  in place for this system.
Moreover, even if the system could ensure that deletions capture all  required records, ATF has inconsistently adhered to the timetable of  deletions required by its policy. For example, according to ATF’s deletion  log and our verification of the log, some records entered in 1997 were not  deleted until November 2009—about 10 years after the required 2  years. As shown in table 1 below, ATF’s timing for implementing  deletions did not adhere to ATF policy directives.
As shown in table 1 below, the ATF deletion policy for MS has changed  over time including variations in the frequency of deletions (e.g., annually,  monthly, weekly), and pauses to the deletion policy because of, according  to ATF officials, litigation and requests from Congress. According to NTC  officials, delayed deletions occurred because deleting a large number of  records at once negatively affects the system, slowing system response  time or stopping entirely the larger related data system. However,  according to NTC’s deletion log and verified by our observations of NTC  system queries, deletions were conducted in average increments of  almost 100,000 records per day—representing on average a full year’s  worth of records to be deleted. In addition, ATF confirmed that a single  deletion of 290,942 records on one day in January 2011 did not affect the  system. Therefore, system constraints do not seem to be the reason for  the delayed deletion. ATF did not identify further causes for the delays in  deletions.
ATF reported that the objective for its deletion policy was primarily to  delete data that may not be useful because of its age and to safeguard  privacy concerns related to retaining firearms purchaser data. Federal  internal control standards require control activities to help ensure that  management’s directives are carried out. Additionally, information  systems and related control activities should be designed to achieve  objectives and respond to risks. Specifically, an organization’s  information system should be designed by considering the processes for  which the information system will be used. For example, to alleviate the  risk of not meeting the objectives established through the MS deletion  policy, ATF must ensure the policy is consistent with the design of the MS  data system and ATF must ensure that it meets the policy’s timeline  requirements. In September 1996, we reported that ATF had not fully  implemented its 2-year deletion requirement. During the course of our  1996 review, ATF provided documentation that it had subsequently  deleted the required records and that it would conduct weekly deletions in  the future. Similarly, as a result of our current review, according to ATF  documentation, in May 2016, the agency deleted the 10,041 records that  should have been deleted earlier. However, given that this has been a  20-year issue, it is critical that ATF develop consistency between its  deletion policy, the design of the MS system, and the timeliness with  which deletions are carried out. By aligning the MS system design and  the timeliness of deletion practices with its policy, ATF could ensure that it  maintains only useful purchaser information while safeguarding the  privacy of firearms purchasers.
section_title: Conclusions
paragraphs: ATF has an important role in combatting the illegal use of firearms, and  must balance this with protecting the privacy rights of law-abiding firearms  owners. Of the four ATF firearms data systems we reviewed that  contained firearms purchaser information, we found that certain aspects  of two of these systems violated the appropriations act restriction on  consolidating or centralizing FFL firearms records, but ATF resolved  these issues during the course of our review. With regard to ATF policies  on maintenance of firearms records, ATF should do more to ensure that  these policies are followed and that they are clearly communicated.  Specifically, providing guidance to industry members participating in A2K  for how to submit their records when they go out of business would help  ensure they submit required records to ATF. Without this clear guidance,  ATF risks not being able to locate the first purchaser of a firearm during a  trace, and thus may not be able to fulfill part of its mission. In addition,  aligning eTrace system capability with ATF policy to limit access to  firearms purchaser information in FRNP would ensure that such  information is only provided to those with a need to know. Finally, aligning  the MS system design and the timeliness of deletion practices with the  MS deletion policy would help ATF maintain only useful purchaser data  and safeguard the privacy of firearms purchasers.
section_title: Recommendations for Executive Action
paragraphs: In order to help ensure that ATF adheres to its policies and facilitates  industry compliance with requirements, we recommend that the Deputy  Director of ATF take the following three actions: provide guidance to FFLs participating in A2K for provision of out-of- business records to ATF, so that FFLs can better ensure that they are  in compliance with statutory and regulatory requirements; develop and implement short-term and long-term mechanisms to align  the eTrace system capability with existing ATF policy to limit access to  FRNP purchaser information for ATF agents; and align the MS deletion policy, MS system design, and the timeliness of  deletion practices to improve ATF’s compliance with the policy.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to ATF and DOJ on May 25, 2016 for  review and comment. On June 16, 2016, ATF provided an email  response, stating that the agency concurs with all three of our  recommendations and is taking several actions to address them.
ATF concurred with our recommendation that ATF provide guidance to  FFLs participating in A2K for provision of out-of-business records to ATF.  ATF stated that the agency is modifying its standard Memorandum of  Understanding with A2K participants to incorporate specific guidance  regarding the procedures to be followed when a participant goes out of  business. ATF also stated that, as a condition of participation, all current  and future A2K participants will be required to adopt the revised  Memorandum of Understanding. The implementation of such guidance in  the Memorandum of Understanding for A2K participants should meet the  intent of our recommendation.
ATF concurred with our recommendation that ATF develop and  implement mechanisms to align the eTrace system capability with existing  ATF policy to limit access to FRNP purchaser information for ATF agents.  ATF stated that, in the short term, the agency will delete all purchaser  information associated with a firearm entered into FRNP, and will no  longer enter any purchaser information into FRNP. ATF stated that, in the  long term, the agency will modify the Firearms Tracing System to remove  the purchaser information fields from the FRNP module, and will modify  eTrace as necessary to reflect this change. These short- and long-term  plans, if fully implemented, should meet the intent of our  recommendation.
ATF concurred with our recommendation that ATF align the MS deletion  policy, MS system design, and the timeliness of deletion practices to  improve ATF’s compliance with the policy. As we reported above, ATF  stated that the agency deleted all purchaser names from MS that should  have been deleted earlier. ATF also stated that the agency is  implementing protocols to ensure that deleting purchaser names from MS  aligns with ATF policy. If such protocols can be consistently implemented  in future years, and address both the timeliness of deletions and the  comprehensive identification of records for deletion, they should meet the  intent of our recommendation.
On June 22, 2016, DOJ requested additional time for its Justice  Management Division to review our conclusions regarding ATF’s  compliance with the appropriations act restriction and the Antideficiency  Act. As noted earlier, we solicited ATF’s interpretation of the restriction on  consolidation or centralization of records as applied to each of the  systems under review by letter of December 21, 2015, consistent with our  standard procedures for the preparation of legal opinions. ATF  responded to our inquiry on January 27, 2016, and its views are reflected  in the report. Nevertheless, DOJ stated that ATF and DOJ officials had  not followed DOJ’s own processes regarding potential violations of the  Antideficiency Act, specifically promptly informing the Assistant Attorney  General for Administration. As a result, DOJ requested additional time to  review the appropriations law issues raised by the draft report.
As explained in appendix VII, ATF’s failure to comply with the prohibition  on the consolidation or centralization of firearms records violated the  Antideficiency Act, which requires the agency head to submit a report to  the President, Congress, and the Comptroller General. The Office of  Management and Budget (OMB) has published requirements for  executive agencies for reporting Antideficiency Act violations in Circular  A-11, and has advised executive agencies to report violations found by  GAO. OMB has further advised that “f the agency does not agree that  a violation has occurred, the report to the President, Congress, and the  Comptroller General will explain the agency’s position.” We believe that  the process set forth by OMB affords DOJ the opportunity to consider and  express its views.
ATF also provided us written technical comments, which we incorporated  as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Deputy Director of  ATF, the Attorney General of the United States, and other interested  parties. In addition, the report will be available at no charge on the GAO  website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  Diana C. Maurer at (202) 512-9627 or maurerd@gao.gov, or Helen T.  Desaulniers at (202) 512-4740 or desaulniersh@gao.gov. Contact points  for our Offices of Congressional Relations and Public Affairs may be  found on the last page of this report. GAO staff who made key  contributions to this report are listed in appendix VIII.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This report addresses the following objectives:  1.  Identify the Bureau of Alcohol, Tobacco, Firearms and Explosives  (ATF) data systems that contain retail firearms purchaser data and  describe the characteristics of selected systems.  2.  Determine whether selected ATF data systems comply with the  appropriations act restriction on consolidation or centralization of  firearms records and ATF policies.
To calculate the estimated number of firearms in the United States in  2013, we used data from ATF’s February 2000 report on Commerce in  Firearms in the United States and ATF’s 2015 Annual Statistical Update  to this report. To calculate the approximate number of murders in which  firearms were involved in 2014, we used data from the Federal Bureau of  Investigation’s Uniform Crime Reports from 2014.
To address the first objective, we reviewed ATF policy and program  documents to identify ATF data systems related to firearms. For the  purposes of this report, “data systems” or “systems” refers to ATF’s data  systems and system components, including what ATF refers to as  “modules” of a larger system, and what ATF refers to as “programs”  whose associated data are contained within related systems. These  policy and program documents included, among other things, ATF orders,  system descriptions, system user manuals, system training materials, and  data submission forms. We compared this information to the systems  identified in our September 1996 report, and conducted searches of  publicly available information to develop a comprehensive and current list  of systems. In order to identify the systems and better understand them  and their contents, we spoke with ATF officials in headquarters and at  ATF’s National Tracing Center (NTC). We also discussed these systems  with ATF investigative and regulatory officials in the Baltimore and Los  Angeles field offices, who provided varying perspectives due to  geographic factors. These actions enabled us to confirm a  comprehensive list of systems, and determine the presence of retail  purchaser information within these systems.
We selected four systems for a more in-depth review: Out-of-Business  Records Imaging System (OBRIS), Access 2000 (A2K), Firearm  Recovery Notification Program (FRNP), and Multiple Sales (MS).  Selected systems, at a minimum, contained retail purchaser information  and contained original records—as opposed to systems that transmitted  information, such as a system that only pulls data from another system in  order to print a report or fill out a form. A system was more likely to be  selected if (1) it contained data unrelated to a criminal investigation, (2) a  large percentage of system records contained retail purchaser  information, (3) the retail purchaser information was searchable, or (4)  ATF initiated the system—as opposed to ATF being statutorily required to  maintain the system. See table 2 for more details.
For the selected systems, we reviewed ATF data on the number of  system records, among other things—for OBRIS and A2K for fiscal year  2015, and for FRNP and MS from fiscal years 2010 through 2015. We  assessed the reliability of these data by interviewing ATF staff  responsible for managing the data and reviewing relevant documentation,  and concluded that these data were sufficiently reliable for the purposes  of our report. We reviewed ATF policy and program documents to obtain  in-depth descriptions of these selected systems, and discussed these  systems with ATF officials. We visited NTC to observe the selected  systems in operation.
To address the second objective, we reviewed relevant laws, including  statutory data restrictions, and ATF policy and program documents  relating to ATF’s firearms tracing operations and the selected systems.  We also solicited the agency’s interpretation of the restriction on  consolidation or centralization of records as applied to each of the  systems, and interviewed ATF officials regarding the data systems’  compliance with that restriction and ATF policies. We visited NTC to  observe how selected systems’ data are collected, used, and stored. For  OBRIS, A2K, FRNP, and MS, we observed NTC analysts using the  systems during firearms traces and observed the extent to which the  systems are searchable for retail purchaser information. For OBRIS,  FRNP, and MS, we observed NTC analysts receiving and entering data  into the systems and processing the original data submissions—either  electronically or through scanning and saving documents—including  quality-control checks.
For A2K, we reviewed budgetary information to determine the source of  funding for the system for fiscal year 2008 through fiscal year 2014. We  also interviewed representatives from the contractor that manages A2K,  and 3 of 35 industry members that use A2K, to better understand how the  system functions. We selected industry members that had several years  of experience using A2K and reflected variation in federal firearms  licensee (FFL) size and type. Although our interviews with these industry  members are not generalizable, they provided us with insight on the  firearms industry’s use of A2K.
In order to evaluate the contents of FRNP for the presence of retail  purchaser information and compliance with the appropriations act  restriction and FRNP policies, we reviewed several fields of data for the  entire population of records. During our site visit, we also reviewed  additional fields of data for a generalizable sample of records and the  associated submission forms that are used to populate the records.
For this sample, we compared selected data in the system to information  on the forms, and collected information from the forms. We drew a  stratified random probability sample of 434 records from a total population  of 41,625 FRNP records entered from June 1991 through July 2015. With  this probability sample, each member of the study population had a  nonzero probability of being included, and that probability could be  computed for any member. We stratified the population by active/inactive  record status and new/old (based on a cutoff of Nov. 1, 2004). Each  sample element was subsequently weighted in the analysis to account  statistically for all the records, including those that were not selected.  Because we followed a probability procedure based on random  selections, our sample is only one of a large number of samples that we  might have drawn. Since each sample could have provided different  estimates, we express our confidence in the precision of our particular  sample’s results as a 95 percent confidence interval. This is the interval  that would contain the actual population value for 95 percent of the  samples we could have drawn. All percentage estimates from the review  of the generalizable sample of FRNP records have margins of error at the  95 percent confidence level of plus or minus 5 percentage points or less,  unless otherwise noted.
For our review of the submission forms associated with FRNP records,  we reviewed 195 forms entered into FRNP from November 2004 through  July 2015 that were sampled from the “new” stratum. Prior to November  2004, the submission forms did not include selection options for criteria  for entry into FRNP. We therefore only reviewed the more recent forms in  order to assess the presence of criteria on these forms. Our review of  these forms is generalizable to submission forms entered into FRNP from  November 2004 through July 2015. All percentage estimates from the  review of submission forms have margins of error at the 95 percent  confidence level of plus or minus 3 percentage points or less, unless  otherwise noted.
We assessed the reliability of the FRNP data by conducting electronic  tests of the data for obvious errors and anomalies, interviewing staff  responsible for managing the data, and reviewing relevant  documentation, and concluded that these data were sufficiently reliable  for the purposes of our report. For MS, we observed the process of  querying to identify particular records.
We determined the selected data systems’ compliance with the  appropriations act restriction, and compared them to multiple ATF policies  on collection and maintenance of information, and criteria in Standards for  Internal Control in the Federal Government related to control activities for  communication and for the access to and design of information systems.
We conducted this performance audit from January 2015 to June 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) Firearms- Related Data Systems
paragraphs: Data sources  FFLs send reports  to NTC on a  specified form  (ATF Form  3310.4)
Contents related to  firearms purchaser  information  Firearms information  (e.g., serial number,  model), retail  purchaser information  (e.g., name, date of  birth); FFL information  (e.g., FFL name, FFL  number)
Who can view the  information  About 396 ATF  Firearms Tracing  System (FTS)  users, primarily  NTC personnel,  and the 3,050 ATF  users, which  includes ATF  agents. ATF eTrace  users outside of  NTC are generally  to be limited to  viewing firearms  and requesting  agent information.
Exports  information to   eTrace; FIRES;  FTS (Data  related to MS are  contained in  FTS.)
Out-of-business  FFLs send  firearms  transaction  records to NTC,  specifically  acquisition and  disposition  logbooks and a  specified form  (ATF Form 4473)
Contents related to firearms  purchaser information  Retail purchaser information of  prohibited individuals who  attempted to purchase a firearm  (e.g., name); firearms information  (e.g., serial number, model)
Imports  information from   Federal Licensing  System (FLS)
National Tracing  Center (NTC)
Firearms information (e.g., serial  number, model), retail purchaser  information (e.g., name, date of  birth); federal firearms licensee  (FFL) information (e.g., FFL name,  FFL number)
ATF employees; federal,  state, local, and foreign law  enforcement agencies.  Non-ATF users have  access to information on  their own trace requests  and those from agencies  with which they have a  memorandum of  understanding.
Firearms information (e.g., serial  number, model), retail purchaser  information (e.g., name, address);  FFL information (e.g., FFL name,  FFL number)
Firearms information (e.g., serial  number, model); retail purchaser,  possessor, and associates  information (e.g., first and last  name); FFL information (e.g., city  and state)
Contents related to firearms  purchaser information  Firearms information (e.g., serial  number, model), retail purchaser  information (e.g., name, date of  birth); FFL information (e.g., FFL  name, FFL number)
Firearms information (e.g., serial  number, model), retail purchaser  information (e.g. name); FFL  information (e.g., FFL name, FFL  number) eTrace; FIRES; FTS  (Data related to  Interstate Theft are  contained in FTS.)
Firearms information (e.g., serial  number, model), retail purchaser  information (e.g., name, date of  birth); FFL information (e.g., FFL  name, FFL number). Original and  subsequent purchasers are  maintained as part of the system.
FLS; National  Firearms Act Special  Occupational Tax  System (NSOT)
Contents related to firearms  purchaser information  Firearms information (e.g., serial  number, model). Firearms  possessor information—limited to  first, middle, and last name—but  that information is not searchable.
Firearms information (e.g., serial  number, model); personal  information for individuals  including possessors, legal  owners, or individuals who  recovered the firearm (e.g., first  and last name)
Collects information  related to an individual  currently under active  criminal investigation  who is suspected of  illegally using or  trafficking firearms.
Suspect information (e.g., name,  identification numbers such as  driver’s license number)
subsections: section_title: Data system Trace
paragraphs: Contents related to firearms  purchaser information  Firearms information (e.g., serial  number, model), retail purchaser  information (e.g., name, date of  birth); FFL information (e.g., FFL  name, FFL number)
Who can view the  information  ATF employees; federal,  state, local, and foreign law  enforcement agencies.  Federal, state, local, and  foreign law enforcement  agencies only have access  to information on their own  trace requests and those  from agencies with which  they have a memorandum  of understanding.
Exports  information to   Electronic Trace  Operation Workflow  Reporting System;  eTrace; FIRES; FTS  (Data related to  Trace are contained  in FTS.)
Under the Brady Handgun Violence Prevention Act, Pub. L. No. 103-159, 107 Stat. 1536 (1993), and implementing regulations, the  Federal Bureau of Investigation, within DOJ, and designated state and local criminal justice agencies use NICS to conduct background  checks on individuals seeking to purchase firearms from FFLs or obtain permits to possess, acquire, or carry firearms. NICS was  established in 1998.  FTS does not contain original records, rather it imports data from its subsystems in order to conduct analysis.  NFRTR contains firearms purchaser information pursuant to Title 26 of the IRS code, 26 U.S.C. Chapter 53, regarding the registration and  transfers of registration taxes. Specifically, it states that there should be a central registry, called the National Firearms Registration and  Transfer Record, of all firearms as defined in the code, including machine guns, destructive devices such as bazookas and mortars, and  “other” “gadget-type” weapons such as firearms made to resemble pens.
section_title: Appendix III: Out-of-Business Records Imaging System (OBRIS)
paragraphs: Appendix III: Out-of-Business Records Imaging  System (OBRIS)
Since 1968, the Bureau of Alcohol, Tobacco, Firearms and Explosives  (ATF) has received several hundred million out-of-business records.  According to ATF officials, as of May 5, 2016 there are about 8,060 boxes  of paper records at the National Tracing Center (NTC) awaiting scanning  into digital images before they are to be destroyed. At NTC, we observed  these boxes lining the walls and stacked along cubicles and file cabinets,  as shown in figure 4. The officials stated that, according to the General  Services Administration, the facility floor will collapse if the number of  boxes in the building increases to 10,000. Therefore, when the number  of boxes approaches this quantity, NTC staff move the boxes to large  shipping containers outside. Currently, there are three containers of  boxes on the property, which contain records awaiting destruction.
Prior to digital imaging, records were housed on microfilm or in storage  boxes, and the system was referred to simply as Microfilm Retrieval  System. According to NTC officials, ATF is transitioning to digital imaging  because of the benefits of improved image resolution, speed in accessing  images, simultaneous accessibility of images to complete urgent traces,  and less voluminous storage. The digitized records also helped mitigate  the challenges of deteriorating microfilm images and maintaining the  obsolete technology of microfilm. According to officials, NTC has  completed the process of converting the microfilm records to digital  images, and officials expect that the images will become fully available to  NTC analysts for tracing during fiscal year 2016. Currently, access is  limited to a single workstation within NTC. While ATF finalizes this effort,  staff continue to access the records in the NTC microfilm archive in order  to respond to trace requests, as shown in figure 5.
Before fiscal year 1991, ATF stored the out-of-business records in boxes  with an NTC file number assigned to each federal firearms licensee  (FFL). If, during a trace, ATF determined that the FFL who sold the  firearm was out of business and had sent in its records, ATF employees  were to locate the boxes containing the records and manually search  them for the appropriate serial number. According to ATF, this was a  time-consuming and labor-intensive process, which also created storage  problems. In 1991, ATF began a major project to microfilm the out-of- business records and destroy the originals. Instead of in boxes, the out- of-business records were stored on microfilm cartridges, with the FFL  numbers assigned to them. Although this system occupied much less  space than the hard copies of the records, ATF officials said it was still  time-consuming to conduct firearms traces because employees had to  examine up to 3,000 images on each microfilm cartridge to locate a  record. The officials stated that scanning records and creating digital  images in OBRIS has sped up the ability to search for out-of-business  records during a trace. According to the officials, it takes roughly 20  minutes to complete a trace with digital images and roughly 45 minutes  using microfilm.
section_title: Appendix IV: Firearm Recovery Notification Program Submission Form
section_title: Appendix V: Multiple Sales Submission Form for Multiple Sales Reports
section_title: Appendix VI: Multiple Sales Submission Form for Demand Letter 3 Reports
section_title: Appendix VII: Legal Analysis of Compliance with the Restriction on Consolidation or Centralization of Firearms Records
paragraphs: A provision in the fiscal year 2012 appropriation for the Bureau of Alcohol,  Tobacco, Firearms and Explosives (ATF) prohibits the use of the  appropriation to consolidate or centralize records on the acquisition and  disposition of firearms maintained by federal firearms licensees (FFL).  This statutory restriction originated in the agency’s appropriation for fiscal  year 1979 and, with some modification, was made permanent in fiscal  year 2012. We reviewed whether ATF’s collection and maintenance of  acquisition and disposition records in four data systems—Out-of-Business  Records Imaging System (OBRIS), Access 2000 (A2K), Firearm  Recovery Notification Program (FRNP), and Multiple Sales (MS)— violated this restriction.
As discussed below, we considered the critical characteristics of each  data system and related ATF activities in light of the restriction and in the  context of ATF’s statutory authorities. We conclude that ATF violated the  restriction when it collected and maintained the disposition records of FFL  participants in A2K on a single server within the National Tracing Center  (NTC) after those FFLs had discontinued their operations. We also agree  with ATF’s 2009 determination that the agency violated the restriction  when it collected and maintained records of certain FFLs engaged  primarily in the sale of used firearms as part of FRNP. ATF’s failure to  comply with the restriction on consolidation or centralization also violated  the Antideficiency Act. Under section 1351 of title 31, United States Code,  the agency is required to report these violations to the President and  Congress.
subsections: section_title: Background
paragraphs: ATF, a criminal and regulatory enforcement agency within the  Department of Justice (DOJ), is responsible for the regulation of the  firearms industry and enforcement of federal statutes regarding firearms,  including criminal statutes related to the illegal possession, use, transfer,  or trafficking of firearms. One component of ATF’s criminal enforcement  mission involves the tracing of firearms used in crimes to identify the first  retail purchaser of a firearm from an FFL. To conduct a trace, the  requesting law enforcement agency must identify the manufacturer or  importer of the firearm and its type, caliber, and serial number, as well as  other information related to the recovery, crime, and possessor.  According to ATF, NTC personnel must typically use the information  provided by the law enforcement agency to contact the manufacturer or  importer to determine when and to whom the firearm in question was  sold. The manufacturer or importer may have sold the firearm to an FFL  wholesaler. In that case, NTC personnel would contact the FFL  wholesaler to determine when and to whom the firearm in question was  sold, usually to an FFL retailer. The tracing process continues until NTC  identifies the first retail purchaser who is a nonlicensee.
The Gun Control Act of 1968, as amended, established a system  requiring FFLs to record firearms transactions, maintain that information  at their business premises, and make such records available to ATF for  inspection and search under certain prescribed circumstances. This  system was intended to permit law enforcement officials to trace firearms  involved in crimes as described above while allowing the records  themselves to be maintained by the FFLs rather than by a governmental  entity. As originally enacted, the Gun Control Act required FFLs to submit  such reports and information as the Secretary of the Treasury prescribed  by regulation and authorized the Secretary to prescribe such rules and  regulations as deemed reasonably necessary to carry out the provisions  of the act.
In 1978, citing the general authorities contained in the Gun Control Act,  ATF proposed regulations that would have required FFLs to report most  of their firearms transactions to ATF through quarterly reports. Under the  proposed regulations, these FFL reports of sales and other dispositions  would not have identified a nonlicensed transferee, such as a retail  purchaser, by name and address. However, the proposed regulations  prompted concerns from those who believed that the reporting  requirements would lead to the establishment of a system of firearms  registration. Congress included in ATF’s fiscal year 1979 appropriation for  salaries and expenses a provision prohibiting the use of funds for  administrative expenses for the consolidation or centralization of certain  FFL records, or the final issuance of the 1978 proposed regulations. The  provision continues to apply, with some modifications as described below. hat no funds appropriated herein shall be available for administrative expenses in  connection with consolidating or centralizing within the Department of the Treasury the  records of receipt and disposition of firearms maintained by Federal firearms licensees or  for issuing or carrying out any provisions of the proposed rules of the Department of the  Treasury, Bureau of Alcohol, Tobacco and Firearms, on Firearms Regulations, as  published in the Federal Register, volume 43, number 55, of March 21, 1978.
The Bureau of Alcohol, Tobacco, and Firearms (BATF) has proposed implementation of  several new regulations regarding firearms. The proposed regulations, as published in the  Federal Register of March 21, 1978 would require:  (1) A unique serial number on each gun manufactured or imported into the United States.  (2) Reporting of all thefts and losses of guns by manufacturers, wholesalers and dealers.  (3) Reporting of all commercial transactions involving guns between manufacturers,  wholesalers and dealers.
The Bureau would establish a centralized computer data bank to store the above  information. It is important to note that the proposed regulations would create a central  Federal computer record of commercial transactions involving all firearms—whether  shotguns, rifles, or handguns. There are approximately 168,000 federally licensed  firearms dealers, manufacturers, and importers. It is estimated that the proposed  regulations would require submission of 700,000 reports annually involving 25 million to  45 million transactions.
It is the view of the Committee that the proposed regulations go beyond the intent of  Congress when it passed the Gun Control Act of 1968. It would appear that BATF and the  Department of Treasury are attempting to exceed their statutory authority and accomplish  by regulation that which Congress has declined to legislate.
The reference to the 1978 proposed rules was removed from the annual  provision as of the fiscal year 1994 appropriations act, but the prohibition  against using funds for administrative expenses for consolidating or  centralizing records was included in each of ATF’s annual appropriations  through fiscal year 2012 in much the same form. In fiscal year 1994, the  Treasury, Postal Service, and General Government Appropriations Act,  1994, expanded the prohibition to include the consolidation or  centralization of portions of records and to apply to the use of funds for  salaries as well as administrative expenses, stating “hat no funds  appropriated herein shall be available for salaries or administrative  expenses in connection with consolidating or centralizing, within the  Department of the Treasury, the records, or any portion thereof, of  acquisition and disposition of firearms maintained by Federal firearms  licensees” (emphasis added). “hat no funds appropriated herein or hereafter shall be available for salaries or  administrative expenses in connection with consolidating or centralizing, within the  Department of Justice, the records, or any portion thereof, of acquisition and disposition of  firearms maintained by Federal firearms licensees” (emphasis added).
The conference report accompanying the act explained that the provision  had been made permanent.
We previously considered ATF’s compliance with the restriction on  consolidation or centralization in 1996 in connection with the agency’s  Microfilm Retrieval System and Multiple Sales System. We stated that  the restriction did not preclude all information practices and data systems  that involved an element of consolidation or centralization, but that it had  to be interpreted in light of its purpose and in the context of other statutory  provisions governing ATF’s acquisition and use of information on  firearms. In this respect, our analyses reflected the well-established  principle that statutory provisions should be construed harmoniously so  as to give them maximum effect whenever possible, avoiding the  conclusion that one statute implicitly repealed another in the absence of  clear evidence to the contrary. We found that the two systems complied  with the statutory restriction on the grounds that ATF’s consolidation of  records was incident to carrying out specific responsibilities set forth in  the Gun Control Act of 1968, as amended, and that the systems did not  aggregate data on firearms transactions in a manner that went beyond  these purposes. Thus, our analysis did not turn on the presence or  absence of retail purchaser information in the system, but rather on the  extent to which the aggregation of data corresponded to a statutory  purpose. We employ a similar analytical approach, which ATF has also  adopted, in assessing the four systems under review here, taking into  account ATF’s statutory authorities and the critical characteristics of each  system.
section_title: Discussion
paragraphs: Two of the four data systems we reviewed—OBRIS and MS—do not  consolidate or centralize firearms in violation of the restriction contained  in the fiscal year 2012 appropriations act. In contrast, ATF violated the  restriction when it collected and maintained disposition records of FFL  participants in A2K on a single server at NTC after they had discontinued  their operations. ATF also violated the restriction when it collected and  maintained records of certain FFLs engaged primarily in the sale of used  firearms as part of FRNP.
OBRIS is ATF’s repository for records submitted by FFLs that have  permanently discontinued their operations, as required by the Gun  Control Act of 1968, as amended. Section 923(g)(1)(A) of title 18, United  States Code, requires each FFL to maintain such records of importation,  production, shipment, receipt, sale, or other disposition of firearms at its  place of business as prescribed by the Attorney General. Under 18  U.S.C. § 923(g)(4), when a firearms business is discontinued and there is  no successor, the records required to be maintained by FFLs must be  delivered within 30 days to ATF.
ATF’s system for maintaining the records of out-of-business FFLs for its  statutory tracing function has evolved over time in response to logistical  challenges and technological advances. Prior to fiscal year 1991, ATF  maintained out-of-business FFLs’ records in hard copy, with a file number  assigned to each FFL. During a trace, if ATF determined that a firearm  had been transferred or disposed of by an out-of-business FFL, ATF  employees manually searched the FFL’s records until they found the  records corresponding to the serial number of the firearm being traced.  According to ATF, this was a time-consuming and labor-intensive  process, and the volume of records created storage problems. In 1991,  ATF began a major project to microfilm these records and destroy the  originals. For fiscal year 1992, Congress appropriated $650,000 “solely  for improvement of information retrieval systems at the National Firearms  Tracing Center.” In fiscal year 1992, ATF began creating a  computerized index of the microfilmed records containing the information  necessary to identify whether ATF had a record relating to a firearm being  traced. The index contained the following information: (1) the cartridge  number of the microfilm; (2) an index number; (3) the serial number of the  firearm; (4) the FFL number; and (5) the type of document on microfilm,  i.e., a Firearms Transaction Record form or acquisition and disposition  logbook pages. This information was stored on a database in ATF’s  mainframe computer to allow searches. Other information, however,  including a firearms purchaser’s name or other identifying information and  the manufacturer, type, and model remained stored on microfilm  cartridges and was not computerized. Therefore, this information was not  accessible to ATF personnel through a text search.
In our 1996 report, we concluded that the Microfilm Retrieval System did  not violate the restriction on consolidation or centralization due to its  statutory underpinnings and design. ATF had initially required out-of- business FFLs to deliver their records to ATF through a 1968 regulation.  We found no indication in its legislative history that the appropriations act  restriction was intended to overturn this regulation and noted that,  historically, out-of-business records had been maintained at a central  location. We also explained that the Firearms Owners’ Protection Act of  1986 (FOPA) had codified the ATF regulation, affirming the agency’s  authority to collect this information, and that a subsequent  appropriations act had provided funding specifically for ATF’s microfilming  effort. Finally, ATF’s system of microfilmed records did not capture and  store certain key information, such as firearms purchaser information, in  an automated file. In this regard, we found that the system did not  aggregate information in a manner beyond that necessary to implement  the Gun Control Act of 1968, as amended by FOPA.
Conversion of Records.—The conferees recognize the need for the ATF to begin  converting tens of thousands of existing records of out-of-business Federal firearms  dealers from film to digital images at the National Tracing Center. Once the out-of- business records are fully converted, the search time for these records will be reduced to  an average of 5 minutes per search from the current average of 45 minutes per search.  This significant time saving will ultimately reduce overall costs and increase efficiency at  the National Tracing Center. Therefore, the conference agreement includes a $4,200,000  increase for the ATF to hire additional contract personnel to begin this conversion.
Similarly, the conference report accompanying the fiscal year 2006  appropriations act reflected the conferees’ support for ATF’s transition of  out-of-business records to OBRIS.
Since 2006, NTC has converted records submitted by FFLs discontinuing  their operations to digital images in OBRIS. Specifically, NTC sorts and  scans records provided by out-of-business FFLs, converting and storing  them in an image repository on an electronic server. Images stored in  OBRIS are generally indexed by FFL number. The records themselves  are stored as images without optical character recognition so that they  cannot be searched or retrieved using text queries, but must be searched  through the index, generally by FFL number. After narrowing down the  possible records through an index search, an NTC analyst must manually  scroll through digital images to identify the record of the particular firearm  in question.
The technological changes represented by OBRIS do not compel a  different conclusion regarding ATF’s compliance with the restriction on  consolidation or centralization from the one we reached in 1996 with  respect to the predecessor system. The statutory basis for OBRIS is the  same as for the Microfilm Retrieval System and OBRIS makes records  accessible to the same extent as that system, functioning in essentially  the same manner though with enhanced technology. As with the prior  microfilm system, users identify potentially relevant individual records  through manual review after searching an index using an FFL number, or  firearms information if available. In this regard, OBRIS, like its  predecessor, does not aggregate records in a manner beyond that  required to implement the Gun Control Act of 1968, as amended by  FOPA.
subsections: section_title: A2K
paragraphs: We assessed A2K with regard to in-business records and out-of-business  records. We conclude that A2K for in-business records complies with the  restriction on consolidation or centralization, while A2K for out-of- business records violated the restriction.
subsections: section_title: A2K In-Business Records
paragraphs: The Gun Control Act of 1968, as amended, requires FFLs to provide  firearms disposition information to ATF in response to a trace request.  Specifically, section 923(g)(7) of title 18, United States Code, requires  FFLs to respond within 24 hours to a request for records to determine the  disposition of firearms in the course of a criminal investigation. Prior to  the implementation of A2K, FFLs could only respond to such requests  manually. A2K provides manufacturer, importer, and wholesaler FFLs  with an automated alternative to facilitate their statutorily required  response to ATF requests. he conferees are aware that the Access 2000 program was initiated by ATF to improve  the efficiency and reduce the costs associated with firearms tracing incurred by Federal  Firearms Licensees (FFLs). ATF and FFL importers, manufacturers, and wholesalers form  a partnership in this effort. FFLs take their data from their mainframe computer and import  it into a stand-alone server provided by the ATF. The National Tracing Center is  connected to this server remotely by secure dial-up and obtains information on a firearm  that is subject to a firearms trace. The conferees support this program, which reduces the  administrative burdens of the FFL and allows the ATF around the clock access to the  records. The ATF currently has 36 Access 2000 partners. The conferees encourage the  ATF to place more emphasis on this program and expand the number of partners to the  greatest extent possible.
According to ATF, as of April 25, 2016, there are 35 industry members  representing 66 individual manufacturer, importer, and wholesaler FFLs  currently participating in A2K.
ATF believes that A2K “… has appropriately balanced Congressional  concerns related to the consolidation of firearm records with the necessity  of being able to access firearm information in support of its underlying  mission to enforce the Gun Control Act,” as amended. We agree. Given  the statutory underpinning and features of the system for in-business  FFLs, we conclude that ATF’s use of A2K for in-business records does  not violate the restriction on the consolidation or centralization of firearms  records. ATF’s use of A2K for in-business records is rooted in the specific  statutory requirement that FFLs respond promptly to ATF trace requests  in connection with criminal investigations. In addition, although the system  allows FFLs to respond to ATF’s trace requests virtually, ATF obtains the  same information as it would otherwise obtain by phone, fax, or e-mail  and in similar disaggregated form, that is, through multiple servers  located at individual FFLs. Moreover, industry members retain possession  and control of their disposition records and, according to ATF officials,  may withdraw from using A2K—and remove their records from the ATF- accessible servers—at any time. For these reasons, we do not view A2K  for in-business records to constitute the type of data aggregation  prohibited by the appropriations act restriction on the consolidation or  centralization of records within DOJ.
section_title: A2K Out-of-Business Records
paragraphs: During the course of our review, we found that when participating industry  members permanently discontinued their operations, the disposition data  maintained in connection with A2K was transferred to ATF, and ATF used  the data when conducting firearms traces. Specifically, when an A2K  participant went out of business, an ATF contractor remotely transferred  the data on the server to a backup disk and the industry member shipped  the backup disk with intact disposition records, as well as the blank  server, to ATF’s NTC. ATF officials placed the data from the backup disk  on a single partitioned server at NTC and accessed the data for firearms  traces using the same type of interface and URL as used while the  industry member was in business. As a result, in response to an industry  member–specific query using an exact firearm serial number, the A2K  out-of-business server would automatically generate the disposition  information related to that firearm serial number.
According to ATF, records of eight industry members were placed on the  server at NTC from as early as late 2000 through mid-2012. While ATF  estimated that there were approximately 20 million records associated  with these industry members on the server, the agency did not have a  means of ascertaining the actual number of records. The number of  records on the ATF server would have been expected to grow as  additional A2K participants discontinued their operations and provided  their backup disks to ATF. However, during the course of our review, ATF  officials told us that the agency planned to move all of the A2K records  into OBRIS and that, once converted to OBRIS images, the records  would be searchable like other OBRIS records. In January 2016, ATF  officials reported that NTC was in the process of transferring all of the  records from the A2K out-of-business records server to OBRIS and a  quality-control process was under way to verify the accuracy of the  transfer. They subsequently deleted all records from the server in March  2016.
We conclude that ATF’s use of A2K with respect to out-of-business  records violated the restriction on consolidation or centralization. In  contrast to the discrete servers in the possession of the in-business  industry members, ATF combined disposition records across industry  members on the single, though partitioned, A2K server at NTC. In  addition, the records were stored on the single A2K server in a manner  that made them more easily searchable than other out-of-business  records. Unlike OBRIS, which requires the manual review of potentially  relevant records identified through an index, the A2K server within NTC  generated records automatically in response to an industry member– specific text query, that is, exact firearm serial number. In addition,  according to NTC officials, they could have modified the structure of the  NTC server to achieve further aggregation, by programming the system to  allow text searches across a broader set of data fields. As a result, ATF  could have searched for records by name or other personal identifier.
As explained earlier, our analysis of ATF’s aggregation of firearms  records turns not on the presence or absence of retail purchaser  information, but rather on the extent to which the aggregation of data  corresponds to a statutory purpose. ATF’s maintenance of out-of- business industry members’ disposition records on a single server at NTC  was not incident to the implementation of a specific statutory requirement.  As discussed above, A2K was designed to allow in-business industry  members to respond promptly to ATF trace requests as required by 18  U.S.C. § 923(g)(7) without having to dedicate personnel to this function.  Section 923(g)(7), however, has no applicability to FFLs once they  discontinue operations. A separate statutory provision, 18 U.S.C. §  923(g)(4), applies to FFLs that permanently discontinue their operations.  ATF has long maintained a separate system—formerly the Microfilm  Retrieval System and currently OBRIS—to hold the records submitted  under that provision, and the disposition records that ATF maintained on  the NTC server were among the types of records required to be submitted  under section 923(g)(4) for which ATF had created that system.  Therefore, we find no statutory underpinning for ATF’s maintenance of  out-of-business A2K participants’ disposition records on the server at  NTC.
Our implementation of A2K included strict security protocols to limit ATF access to only  that information to which it is statutorily required, e.g., the next step in the distribution of  the traced firearm. That is, ATF would simply have access to the same information it could  obtain by calling the participating FFL. However, that calculus is altered when an FFL  ceases participation in A2K. At that point, that FFL’s records become just like any other  FFL records and, as such, must be stored in the same manner. Otherwise, records which  were formerly accessible on a discrete basis under A2K would be readily accessible in a  database which would, in our opinion based on the 1996 GAO Report, violate the  appropriation rider. Our decision, therefore, was to ensure that A2K records have the  same character and are retrievable in the same manner as any other out-of-business  records.
In addition to removing all data from the A2K out-of-business records  server, ATF officials reported that, going forward, the agency plans to  convert records of A2K participants that go out of business directly into  OBRIS images. However, they said, when such records are received by  out-of-business FFLs, the time frame for converting the records into  OBRIS images will depend on the backlog of electronic records awaiting  conversion.
Similarly, ATF officials told us that they had anticipated that A2K  participants would submit acquisition and disposition records together,  consistent with the format provided for in ATF’s regulations, for inclusion  in OBRIS. They had not expected that A2K participants would satisfy any  part of their statutory responsibility by providing their backup disks to the  agency. However, even if industry members’ submission of disposition  data on the backup disks could be said to be in furtherance of the portion  of the statutory requirement pertaining to disposition records, given the  existence and successful functioning of OBRIS, we conclude that ATF’s  maintenance of those records on the NTC server went beyond the  purposes of the Gun Control Act of 1968, as amended.
We conclude that FRNP complies with the restriction on consolidation  and centralization of firearms records when used as a tool for ATF agents  in connection with an ATF criminal investigation. However, ATF’s use of  FRNP to maintain information on firearms identified during regulatory  inspections of FFLs under the Southwest Border Secondary Market  Weapons of Choice Program (SWBWOC), as discussed below, was a  violation of the restriction.
section_title: FRNP for Criminal Investigations
paragraphs: Under section 599A of title 28, United States Code, ATF is responsible for  investigating criminal and regulatory violations of federal firearms laws,  and for carrying out any other function related to the investigation of  violent crime or domestic terrorism that is delegated to it by the Attorney  General. Among other things, ATF is responsible for enforcing federal  statutes regarding firearms, including those regarding illegal possession,  use, transfer, or trafficking. FRNP, formerly known as the Suspect Gun  Program, was established in 1991 within the Firearms Tracing System to  provide an investigative service to ATF agents conducting criminal  investigations. Through this program, ATF records information— manufacturer, serial number, and type—about firearms that have not yet  been recovered by other law enforcement authorities, but are suspected  of being involved in criminal activity and are associated with an ATF  criminal investigation. When such firearms are recovered, ATF uses the  information available through the program to notify the investigating ATF  official and to coordinate the release of trace results to other law  enforcement authorities with the ongoing ATF investigation.
To enter firearms information into the system, ATF agents investigating  potential criminal activity involving firearms must identify the firearms at  issue, the number of an open ATF criminal investigation, and at least one  of five specified criteria for using the system. The five criteria correspond  to bases for ATF investigation. ATF agents also indicate on the  submission form whether NTC should release trace results to requesters  of a trace for the firearms listed on the form. Where criminal investigations  are ongoing and FRNP records are designated as “active,” NTC will notify  the investigating ATF agent when the firearm described on the form is  recovered. In addition, where the ATF agent has indicated that NTC  should release trace information, NTC will notify the ATF agent and the  requesting law enforcement agency of trace results. Where the ATF  agent has indicated that NTC should not release trace information, the  ATF agent is notified of the trace results and determines when that  information may be released to the requesting law enforcement agency.  For criminal investigations that have been closed, the FRNP record  associated with the investigation is labeled “inactive,” although the  records may provide investigative leads, according to ATF officials. In  such cases, the ATF agent associated with the investigation is not notified  of the recovery of the identified firearms or related trace requests, and the  release of trace results to requesting law enforcement agencies proceeds  without any delay.
ATF is authorized by statute to investigate violations of federal firearms  laws. As described above, FRNP is designed for the limited purpose of  facilitating ATF’s conduct of specific criminal investigations under its  jurisdiction. The inclusion of data in FRNP requires an open ATF  investigation of an identified criminal matter, which helps to ensure that  the data are maintained only as needed to support this investigative  purpose. Further, ATF requires its agents to identify with specificity the  firearms relevant to the investigation. As we observed in 1996, the  restriction on consolidation or centralization does not preclude all data  systems that involve an element of consolidation. Where ATF adheres to  the limitations incorporated in the design of FRNP, the maintenance of  information through FRNP is incident to ATF’s exercise of its statutory  authority to conduct criminal investigations and does not involve the  aggregation of data in a manner that goes beyond that purpose. In this  respect, we conclude that it does not represent a consolidation or  centralization of records in violation of the statutory restriction.
section_title: Southwest Border Secondary Market Weapons of Choice Program
paragraphs: In response to our inquiries about FRNP data, ATF officials told us that in  2009, the ATF Chief Counsel had concluded that the agency had violated  the appropriations restriction in connection with the system. Specifically,  ATF officials told us that the agency had maintained records on the  inventories of certain FFLs in violation of the restriction, from 2007  through 2009 under ATF’s Southwest Border Secondary Market  Weapons of Choice (SWBWOC) Program. We agree with the ATF Chief  Counsel’s conclusion that its collection and maintenance of information in  connection with this program violated the restriction on the consolidation  or centralization of firearms records.
In October 2005, the governments of the United States and Mexico  instituted a cooperative effort to address surging drug cartel–driven  violence in Mexico and along the southwest border of the United States.  ATF’s main role in this initiative was to develop strategies and programs  to stem the illegal trafficking of firearms from the United States to Mexico.  ATF determined that used gun sales—referred to in the industry as  “secondary market” sales—played a significant role in firearms trafficking  to Mexico, particularly for the types of firearms most sought by the  Mexican drug cartels, known as “weapons of choice.” Accordingly, in  June 2007, the agency developed a protocol to be used during its annual  inspections of FFLs in the region engaged primarily in the sale of used  firearms. This protocol, known as the SWBWOC Program was intended  to enhance ATF’s ability to track secondary market sales. It called for ATF  investigators to record the serial number and description of all used  weapons of choice in each FFL’s inventory and those sold or otherwise  disposed of during the period covered by the inspection. Under the  protocol, the investigators forwarded the information to the relevant ATF  field division, which opened a single investigative file for all submissions  from the area under its jurisdiction and determined whether any of the  weapons had been traced since their last retail sale. After review, the field  division forwarded the information to FRNP. According to ATF, the Dallas,  Houston, and Los Angeles Field Divisions began to submit records from  the SWBWOC Program to FRNP in July 2007, and the Phoenix Field  Division began to do so in October 2007.
The SWBWOC Program was cancelled on October 2, 2009, following a  review by ATF’s Office of Chief Counsel of the process by which the  secondary market weapons of choice information had been recorded and  submitted to FRNP. The Office of Chief Counsel determined that the  SWBWOC Program was not consistent with the consolidation or  centralization restriction. It advised that information obtained from an FFL  about a firearm in and of itself and unaccompanied by purchaser  information could not be collected and consolidated absent a specific  basis in statute or regulation, or a direct nexus to discrete law  enforcement purposes such as a specific criminal investigation. The  Office of Chief Counsel found that the collection of information from FFLs  under the SWBWOC Program lacked these essential, individualized  characteristics.
We agree with ATF’s conclusion that the collection and maintenance of  firearms information from the SWBWOC Program in FRNP exceeded the  permissible scope of the appropriations act restriction. As discussed  above, our analysis of ATF’s aggregation of firearms data turns not on the  presence or absence of retail purchaser information, but rather on the  extent to which the aggregation of data corresponds to a statutory  purpose. Here, ATF collected and maintained acquisition and disposition  data without a statutory foundation based on nothing more than the  characteristics of the firearms. The collection and maintenance of  information about a category of firearms, “weapons of choice,” from a  category of FFLs, primarily pawnbrokers, did not pertain to a specific  criminal investigation within the scope of ATF’s statutory investigative  authority. Nor did it fall within the scope of ATF’s authority to conduct  regulatory inspections. For this reason, we conclude that the program  involved the type of aggregation of information contemplated by Congress  when it passed the restriction on the consolidation or centralization of  firearms records. ATF deleted the related data from FRNP in March 2016.
section_title: Multiple Sales and “Demand Letter 3” Reports
paragraphs: The Gun Control Act of 1968, as amended, requires FFLs to report  transactions involving the sales of multiple firearms. Specifically, under 18  U.S.C. § 923(g)(3)(A), an FFL is required to report sales or other  dispositions of two or more pistols or revolvers to a non-FFL at one time  or during 5 consecutive business days. Under these circumstances, the  FFL is required to report information about the firearms, such as type,  serial number, manufacturer, and model, and the person acquiring the  firearms, such as name, address, ethnicity, race, identification number,  and type of identification to ATF. ATF enters data from these reports into  the MS portion of its Firearms Tracing System so that it can monitor and  deter illegal interstate commerce in pistols and revolvers.
Our 1996 report examined the Multiple Sales System and found that it did  not violate the prohibition on the consolidation or centralization of firearms  records because the collection and maintenance of records was incident  to a specific statutory responsibility. In connection with our current review,  we observed the functioning of the present system for reports of multiple  sales. We found no changes since 1996 that would suggest a different  conclusion with respect to ATF’s compliance with the appropriations act  restriction.
As we reported in 1996, a regulatory requirement for FFLs to prepare and  provide multiple sales reports to ATF existed before the prohibition on  consolidation or centralization of firearms records was enacted in fiscal  year 1979 and there was no indication in the legislative history that the  prohibition was intended to overturn ATF’s existing practices with respect  to multiple sales. In addition, we explained that the Firearms Owners’  Protection Act had codified the ATF regulation, affirming the agency’s  authority to collect this information. FOPA’s requirement that FFLs send  the reports “to the office specified” on an ATF form suggested that ATF  could specify that the information be sent to a central location.
Our review of FOPA’s legislative history confirmed our interpretation of  the statute. When considering the passage of FOPA, Congress clearly  considered placing constraints on ATF’s maintenance of multiple sales  reports, but declined to do so. Specifically, the Senate-passed version of  FOPA prohibited the Secretary of the Treasury from maintaining multiple  sales reports at a centralized location and from entering them into a  computer for storage or retrieval. This provision was not included in the  version of the bill that was ultimately passed. In light of the above, we  reach the same conclusion as we did in 1996 and find that ATF’s use of  MS complies with the restriction on the consolidation or centralization of  firearms records.
In addition, ATF has collected and maintained information on the multiple  sales of firearms under a separate authority, 18 U.S.C. § 923(g)(5)(A).  Section 923(g)(5)(A) authorizes the Attorney General to require FFLs to  submit information that they are required to maintain under the Gun  Control Act of 1968, as amended. This provision was also included in  FOPA. Relying on this authority, ATF issues “demand letters” requiring  FFLs to provide ATF with specific information. In 2011, ATF issued a  demand letter requiring certain FFLs in Arizona, California, New Mexico,  and Texas to submit reports of multiple sales or other dispositions of  particular types of semiautomatic rifles to non-FFLs (referred to as  “Demand Letter 3” reports). These reports are submitted to ATF and  included in the MS portion of its Firearms Tracing System. According to  ATF, the information was intended to assist in its efforts to investigate and  combat the illegal movement of firearms along and across the southwest  border.
Several FFLs challenged the legality of ATF’s demand letter, asserting,  among other things, that it would create a national firearms registry in  violation of the fiscal year 2012 appropriations act restriction. In each of  the cases, the court placed ATF’s initiative in its statutory context and  held that the appropriations act did not prohibit ATF’s issuance of the  demand letter. Similar to our 1996 analyses of the Out-of-Business  Records and Multiple Sales Systems, the United States Court of Appeals  for the Fifth Circuit examined the enactment of ATF’s authority to issue  demand letters in relation to the appropriations act restriction. The court  observed that ATF’s demand letter authority was enacted as part of  FOPA and that because FOPA “clearly contemplate ATF’s collection of  some firearms records,” the appropriations provision did not prohibit “any  collection of firearms transaction records.” In this regard, the court  further noted that the plain meaning of “consolidating or centralizing” did  not prohibit the collection of a limited amount of information.
Other courts also emphasized that the ATF 2011 demand letter required  FFLs to provide only a limited subset of the information that they were  required to maintain, as opposed to the substantial amount of information  that they believed would characterize a “consolidation or centralization.”  For example, the Court of Appeals for the District of Columbia Circuit  enumerated the limitations on ATF’s 2011 collection of information, noting  that it applied to (1) FFLs in four states; (2) who are licensed dealers and  pawnbrokers; (3) and who sell two or more rifles of a specific type; (4) to  the same person; (5) in a 5-business-day period. The court found that  because ATF sent the demand letter to a limited number of FFLs  nationwide and required information on only a small number of  transactions, “the . . . demand letter does not come close to creating a  ‘national firearms registry.’” In light of the court decisions regarding  ATF’s exercise of its statutory authority in this context, we conclude that  the Demand Letter 3 initiative does not violate the restriction on the  consolidation or centralization of firearms records.
section_title: Conclusion
paragraphs: Two of the data systems under review, OBRIS and MS, comply with the  provision in ATF’s fiscal year 2012 appropriation prohibiting the use of  funds for the consolidation or centralization of firearms records. ATF  collects and maintains firearms transaction information in each system  incident to the implementation of specific statutory authority and it does  not exceed those statutory purposes. ATF’s A2K system for in-business  FFLs and its maintenance of certain firearms information pertinent to  criminal investigations in FRNP are likewise consistent with the  appropriations act restriction. However, ATF’s collection and maintenance  of out-of-business A2K records on the server at NTC violated the  restriction, as did its collection and maintenance of data from certain FFLs  as part of the SWBWOC Program. In both cases, ATF’s aggregation of  information was not supported by any statutory purpose.
ATF’s failure to comply with the prohibition on the consolidation or  centralization of firearms records also violated the Antideficiency Act.  The Antideficiency Act prohibits making or authorizing an expenditure or  obligation that exceeds available budget authority. As a result of the  statutory prohibition, ATF had no appropriation available for the salaries  or administrative expenses of consolidating or centralizing records, or  portions of records, of the acquisition and disposition of firearms in  connection with the SWBWOC Program or A2K for out-of-business  records. The Antideficiency Act requires that the agency head “shall  report immediately to the President and Congress all relevant facts and a  statement of actions taken.” In addition, the agency must send a copy of  the report to the Comptroller General on the same date it transmits the  report to the President and Congress.
section_title: Appendix VIII: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Dawn Locke (Assistant Director)  and Rebecca Kuhlmann Taylor (Analyst-in-Charge) managed this work.  In addition, Willie Commons III, Susan Czachor, Michele Fejfar, Justin  Fisher, Farrah Graham, Melissa Hargy, Jan Montgomery, and Michelle  Serfass made significant contributions to the report. Also contributing to  this report were Dominick M. Dale, Juan R. Gobel, Eric D. Hauswirth,  Ramon J. Rodriguez, and Eric Winter.