ATF, a criminal and regulatory enforcement agency within the Department of the Treasury, is responsible for providing industry regulation; collecting revenue; and enforcing federal statutes regarding firearms, explosives, alcohol, tobacco, and arson. A critical component of ATF’s criminal enforcement mission is the tracing of firearms used in crimes to identify the last known purchaser of a firearm. To accomplish its criminal enforcement responsibilities, ATF has 22 field divisions, headed by special agents in charge, located throughout the United States. To efficiently and effectively carry out its enforcement responsibilities, ATF maintains certain computerized information on firearms and firearms purchasers. Over the years, Congress has tried to balance the law enforcement need for this information with the competing interest of protecting the privacy of firearms owners. To achieve this balance, Congress has required federal firearms licensees to provide ATF certain information about firearms transactions and the ownership of firearms while placing restrictions on ATF’s maintenance and use of such data. The Gun Control Act of 1968, as amended, established a system requiring federal firearms licensees to record firearms transactions, maintain that information at their business premises, and make these records available to ATF for inspection and search under certain prescribed circumstances.The system was intended to permit law enforcement officials to trace firearms involved in crimes while allowing the records themselves to be maintained by the licensees rather than by a governmental entity. Through the use of these records, ATF provides firearms tracing services to federal, state, local, and foreign law enforcement agencies. To carry out its firearms tracing responsibilities, ATF maintains a firearms tracing operation at the National Tracing Center in Falling Waters, West Virginia. The Center traces firearms suspected of being involved in crimes to the last known purchaser to assist law enforcement in identifying suspects. Appendix II provides a detailed description and flowchart of ATF’s tracing operation. Since the passage of the Gun Control Act, Congress has enacted two provisions that place restrictions on ATF’s handling of federal firearms licensee records. Since fiscal year 1979, the annual Treasury appropriation act generally has prohibited ATF from using appropriated funds in connection with consolidating or centralizing the records of acquisition and disposition of firearms maintained by federal firearms licensees. In addition, a provision of the Firearms Owners’ Protection Act of 1986 (P.L. 99-308, 100 Stat. 449 (May 19, 1986)), codified at 18 U.S.C. 926(a), prohibits ATF from issuing any rule or regulation, after the date of that act, requiring that (1) firearms licensee records (or any portion of the contents of the records) be recorded at or transferred to a facility owned, managed, or controlled by the United States or any state or any political subdivision thereof or (2) any system of registration of firearms, firearms owners, or firearms transactions or dispositions be established. Further, section 926(a) provides that ATF’s authority to inquire into the disposition of a firearm during a criminal investigation is not restricted or expanded by this section. The act also limited ATF’s authority to require reports from licensees to those specified by statute and codified several reporting requirements that ATF had previously imposed on licensees by regulation, including those related to out-of-business licensee records and reports of multiple handgun (pistols and/or revolvers) sales. To address our objectives, we reviewed ATF documents and data and discussed ATF policies and operations with agency officials. We obtained from ATF officials descriptions of national data systems that ATF officials determined were related to firearms, including those that contained retail firearms purchaser data. Although we reviewed the descriptive data provided by ATF on the firearms-related data systems, with the exception of the Out-of-Business Records and the Multiple Sales Systems, we did not verify whether these or any other ATF data systems contained retail firearms purchaser data or observe system operations. We reviewed relevant laws and ATF regulations, legal opinions, and documents relating to ATF’s firearms tracing, out-of-business records, and multiple sale reports processing operations. We also observed and conducted some tests of these operations and discussed them with officials at ATF’s National Tracing Center. We did not review ATF’s other systems for compliance with the data restrictions. With regard to the Out-of-Business Records and Multiple Sales Systems, we did not review their compliance with other statutory requirements, such as the Privacy Act and the Computer Security Act. We reviewed relevant laws and ATF regulations, legal opinions, and other documents concerning the data restrictions. We discussed ATF’s legal interpretation of the data restrictions with ATF’s Associate Chief Counsel (Firearms and Explosives) and other headquarters and Tracing Center officials. Appendix I contains a detailed discussion of our objectives, scope, and methodology. We did our work at ATF’s headquarters in Washington, D.C., and National Tracing Center in Falling Waters, West Virginia, from August 1995 through July 1996 in accordance with generally accepted government auditing standards. We obtained comments on a draft of this report from ATF. These comments are discussed at the end of this letter and are reprinted in appendix IX. ATF officials also provided some technical comments, which we incorporated where appropriate. ATF collects and maintains data from the firearms industry to carry out its criminal and regulatory enforcement responsibilities more efficiently and effectively. ATF’s criminal enforcement responsibilities include investigating firearms-related crimes and tracing firearms used in crimes, and its regulatory responsibilities include regulating the manufacture and importation of firearms and licensing firearms dealers. ATF has established national data systems to maintain the data it collects from the firearms industry, including federal firearms licensees. To identify ATF national data systems that contain retail firearms purchaser data, we requested from ATF a description of its national data systems that relate to firearms. ATF identified and provided documentation on 14 national data systems and 4 subsystems relating to firearms. Appendix III provides a brief description of these systems and subsystems. ATF indicated that five systems and one subsystem contain retail firearms purchaser data. These are the (1) Firearms Tracing System and one of its three subsystems—the system dealing with multiple sale reports; (2) Firearms Tracking System; (3) Project Lead; (4) Out-of-Business Records System; and (5) National Firearms Act Database. Appendix IV provides a detailed description of the five systems and one subsystem. We reviewed the descriptive information provided by ATF to determine whether we agreed with its categorization of the data systems and subsystems. On the basis of that review and follow-up discussions with ATF officials, ATF recategorized several of the systems and subsystems. On the basis of the information provided by ATF, we agreed with its categorization of its data systems as presented in appendixes III and IV. The Out-of-Business Records and Multiple Sales Systems, as designed, comply with the legislative data restrictions. Also, on the basis of our review, observations, and discussions with ATF officials, we believe that ATF operates the systems consistently with their design, with one exception relating to the purging of data from the Multiple Sales System, which ATF subsequently informed us it had taken action to correct. Shortly after the passage of the Gun Control Act of 1968, ATF issued regulations requiring federal firearms licensees who permanently discontinued their businesses to forward their transaction records to ATF within 30 days following the discontinuance. This ensured that ATF had access to these records for its tracing operation. In 1986, the Firearms Owners’ Protection Act codified this regulatory reporting requirement.Accordingly, since the enactment of the Gun Control Act, ATF has maintained the out-of-business records at a central location, currently the National Tracing Center. Before fiscal year 1991, ATF maintained these records in hard copy in boxes, with a file number assigned to each firearms licensee. If ATF determined during a trace that a firearm had been sold by a firearms licensee who was out of business and had sent in its records, an ATF employee was to locate the boxes containing the records and manually search them for the appropriate serial number. According to ATF, this was a time-consuming and labor-intensive process, which also created storage problems for ATF. In 1991, ATF began a major project to microfilm these records and destroy the originals. In fiscal year 1992, ATF began using a minicomputer to create a computerized index of the microfilm records containing the information necessary to identify whether ATF had a record relating to a firearm being traced. The index contains the following information: (1) the cartridge number of the microfilm; (2) an index number; (3) the serial number of the firearm; (4) the federal firearms licensee number; and (5) the type of document on microfilm, i.e., a Firearms Transaction Record (ATF Form 4473) or acquisition and disposition logbook pages. The index information that is entered into the minicomputer is stored on a database in ATF’s mainframe computer to allow searches of the index information. The other information, including the firearms purchaser’s name or other identifying information and the firearms manufacturer, type, and model, remains stored on microfilm cartridges and is not computerized. Appendix V provides a more detailed description of the Out-of-Business Records System along with pertinent statistical data. We believe that ATF’s current Out-of-Business Records System complies with the data restrictions. With regard to 18 U.S.C. 926(a), as discussed earlier, it prohibits ATF from prescribing certain rules or regulations after the date of enactment of the Firearms Owners’ Protection Act. At the same time it added the section 926(a) restriction, Congress codified at 18 U.S.C. 923(g)(4) the then-existing regulatory requirement that licensees who permanently go out of business send their records to ATF. ATF’s current regulatory requirement concerning the out-of-business records predates the Firearms Owners’ Protection Act, and is thus not subject to section 926(a). With regard to the annual appropriation rider, in our view, the Out-of-Business Records System does not violate the general prohibition on “consolidation or centralization” of firearms acquisition and disposition records. The regulatory requirement that licensees send these records to ATF existed before the appropriation rider was first passed for fiscal year 1979, and there is no indication in the legislative history that the rider was intended to overturn ATF’s existing practices concerning the acquisition or use of licensee information. According to ATF, the out-of-business records historically have been maintained at a central location. Moreover, the Firearms Owners’ Protection Act provided ATF with specific statutory authority to collect these records. In the legislative history of the act, there is evidence that Congress considered placing constraints on ATF’s maintenance of out-of-business records, but did not do so. The Senate-passed version of the act prohibited the Secretary of the Treasury from maintaining out-of-business records at a centralized location and from entering them into a computer for storage or retrieval. This restrictive provision was dropped from the version of the bill enacted by Congress. Lastly, in fiscal year 1992, Congress appropriated $650,000 “for improvement of information retrieval systems at the National Firearms Tracing Center.” These funds were for the microfilming of the out-of-business records. For fiscal year 1995, Congress appropriated funds for the President’s firearms initiative, which included a request for funding of the Out-of-Business Records System. Congress provided these funds in the same legislation that contained the rider restricting consolidation and centralization of licensee records. According to ATF, the system solved storage and trace timing problems, thereby enhancing ATF’s tracing capabilities. At the same time, the system does not computerize certain key information, such as firearms purchaser information. In conclusion, we believe that the system for maintaining the out-of-business records does not violate either data restriction provision. (Our legal analysis of the Out-of-Business Records System is contained in app. VIII.) Furthermore, on the basis of our review of the Out-of-Business Records System documentation provided by ATF, our discussions with ATF officials, and our observation of the out-of-business records process, we believe that ATF was operating the system in a manner consistent with the way it was designed by ATF. During a visit to the Tracing Center, we observed that the Out-of-Business Records System does not permit the operator to enter the name or other identifying information of any firearm purchaser, or the type or model of any firearm. Thus, we found no evidence that ATF captures and stores firearms purchasers’ names or other identifying information from the out-of-business records in an automated file. Since 1975, federal firearms licensees have been required by regulationand subsequently by law to report all transactions in which an unlicensed person has acquired two or more pistols and/or revolvers at one time or during any 5 consecutive business days (called a multiple sale). The purpose of the multiple sale reporting requirement regulation was to enable ATF to “monitor and deter illegal interstate commerce in pistols and revolvers by unlicensed persons.” According to ATF, that purpose has remained unchanged since 1975. In an August 1993 memorandum on gun dealer licensing, the President listed a number of steps that ATF could take to ensure compliance with federal firearms licensing requirements. These steps included, among other things, increasing scrutiny of licensees’ multiple sale reports and providing automated access to those reports. In November 1995, ATF issued a new policy centralizing and computerizing multiple sale reports at its National Tracing Center. Prior to that time, ATF’s criminal enforcement field divisions maintained multiple sale reports locally. To computerize the reports, ATF developed a Multiple Sales Subsystem as part of its Firearms Tracing System so that the reports could be entered directly into the Tracing System and used for tracing purposes. As of June 30, 1996, ATF had computerized about 91,600 multiple sale reports and associated 521 firearms traces with those reports. The head of the National Tracing Center estimated that in the future the Center will receive 130,000 multiple sale reports annually. In addition to using multiple sale reports for tracing purposes, ATF also provides multiple sale report data to its criminal enforcement field divisions through Project Lead for use in developing investigative leads, such as leads on firearms traffickers, straw purchasers, and federal firearms licensees who appear to be engaged in suspicious activity. Unlike the Out-of-Business Records System, reports entered into ATF’s computerized Multiple Sales System are retrievable by firearm purchaser name. However, as part of its November 1995 policy, ATF adopted a requirement to purge firearms purchaser data in the system that were over 2 years old if they had not been linked to firearms traces. According to the Chief of the Firearms Enforcement Division, the primary reason for purging purchaser data over 2 years old is to delete data that may not be useful because of its age. In addition, the head of the Tracing Center said that ATF is sensitive for privacy reasons about retaining firearms purchaser data that may no longer be useful. Appendix VI provides a detailed description of the multiple sale reporting requirement and the data system along with pertinent statistical data. We believe that ATF’s Multiple Sales System complies with the data restrictions. As discussed earlier, the prohibitions in section 926(a) only apply to certain rules or regulations prescribed after the enactment of the Firearms Owners’ Protection Act. In the same act, Congress codified the then-existing regulatory requirement that federal firearms licensees prepare these multiple sale reports and forward them to ATF. ATF’s current regulatory requirement concerning the multiple sale reports predates the Firearms Owners’ Protection Act and thus is not subject to section 926(a). With regard to the annual appropriation rider, in our view, the Multiple Sales System does not violate the general prohibition on the “consolidation or centralization” of firearms acquisition and disposition records. The requirement that licensees prepare these reports and send them to ATF existed in regulation before the first appropriation rider was passed in fiscal year 1979, and there is no indication in the legislative history that the rider was intended to overturn ATF’s existing practices concerning the acquisition or use of licensee information. Although the multiple sale reports historically have been maintained at the field level, the provisions and legislative history of the Firearms Owners’ Protection Act, which gave ATF specific statutory authority to collect these records, indicate that ATF would not be precluded from computerizing the multiple sale reports. The act requires that licensees send the reports “to the office specified” on the ATF form. Under this provision, ATF could specify that licensees forward the multiple sale reports to a central location. In addition, the legislative history of the act indicates that Congress considered placing constraints on ATF’s maintenance of multiple sale reports but did not do so. The Senate-passed version of the Firearms Owners’ Protection Act prohibited the Secretary of the Treasury from maintaining multiple sale reports at a centralized location and from entering them into a computer for storage or retrieval. This restrictive provision was dropped from the version of the bill enacted by Congress. Lastly, for fiscal year 1995, Congress appropriated funds to implement the President’s firearms initiative, which included plans to automate multiple sale reports. Congress provided these funds in the same legislation that contained the rider restricting consolidation and centralization of licensee records. In conclusion, we believe that the Multiple Sales System does not violate either data restriction provision. (Our legal analysis of the Multiple Sales System is contained in app. VIII.) With regard to the operation of the Multiple Sales System, on the basis of our review and observations and discussions with ATF officials, we believe that ATF was, with one exception, operating the system in a manner consistent with its design. Our test of the Multiple Sales System at the Tracing Center showed that ATF’s requirement to purge firearms purchaser data over 2 years old if not linked to firearms traces had not been fully implemented. At our request, a Tracing Center computer specialist queried the system for multiple sale records with sales dates over 2 years old. The results of this query identified 2,291 records (of the over 86,000 that had been entered) that contained purchaser data for sales over 2 years old. The computer specialist indicated that he thought multiple sale purchaser data over 2 years old had been purged during the last upgrade of the Firearms Tracing System. In July 1996, the Chief of the Firearms Enforcement Division provided us with documentation stating that the affected purchaser data had been purged from the Multiple Sales System and that future purges would be performed weekly. We did not verify whether the affected purchaser data were purged and whether weekly purges were being done. In addition, ATF officials also told us that while the 2-year purge requirement pertained to the Multiple Sales System at the Tracing Center, it was not being applied to multiple sale data maintained locally by ATF criminal enforcement field divisions through Project Lead. ATF had no requirement or mechanism for purging multiple sale purchaser data over 2 years old after it was received by field divisions. The Chief of the Firearms Enforcement Division told us that ATF planned to place Project Lead on its mainframe computer in about a year. At that time, ATF plans to apply the 2-year purge requirement to multiple sale data in Project Lead. ATF’s interpretation of the data restrictions in the annual appropriation rider and 18 U.S.C. 926(a) was contained in a number of opinions and correspondence that ATF provided us during our review. Although we agreed with ATF’s interpretation of 18 U.S.C. 926(a), we believed that ATF was interpreting the data restriction contained in the annual appropriation rider too narrowly. As a result, ATF would not have reviewed its data systems and information practices to ensure compliance with the broader interpretation of the rider, as discussed below. Appendix VIII contains our detailed legal analysis. In response to a draft of this report, ATF stated it adopted the broader interpretation of the rider, had applied it to a legal review of the systems listed in appendix IV that we did not review, and is committed to applying it to record systems it might establish in the future. Previously, ATF maintained that the restrictions in section 926(a) and the appropriation rider had the same effect, and that they were intended only to preclude rules or regulations issued after the enactment of the Firearms Owners’ Protection Act that impose additional reporting requirements upon licensees. Thus, ATF viewed the data restrictions as having no application to the agency’s internal practices, i.e., they did not restrict what ATF did with information it had acquired through reporting requirements in effect before the act or through other means, such as ATF’s criminal enforcement and regulatory activities. ATF’s interpretation relied on the language and context of section 926 and related provisions (primarily section 923), as well as the language and context of the 1979 appropriation rider, which was enacted to counter the broad reporting requirements that ATF sought to impose on licensees through the 1978 proposed rulemaking. ATF maintained that the basic effect of the Firearms Owners’ Protection Act—codifying certain former regulatory reporting requirements in section 923 and restricting the agency’s authority to prescribe certain rules and regulations in section 926—was to preempt any additional reporting requirements that the agency might impose on licensees. We agreed with ATF’s interpretation of the data restrictions as far as it went; clearly the data restrictions apply to rules or regulations that would impose additional reporting requirements upon licensees. The question was whether they have any effect beyond such reporting requirements, and, in particular, whether they restrict how ATF compiles or otherwise uses firearms transaction records once they have been acquired from licensees through current reporting requirements or other means. With regard to the restriction in section 926(a), we agree that it is limited to ATF actions in the form of prescribing rules and regulations. The appropriation rider, however, contains no language that would limit its application either to prescribing rules and regulations or to imposing additional reporting requirements on licensees. Although the original version of the rider did refer to the 1978 proposed rulemaking that would have required new reporting by licensees, it was not limited to that proposal. Furthermore, beginning in fiscal year 1994, the reference to the 1978 proposal was dropped from the appropriation rider, and the language of the restriction was expanded to include “any portion” of these licensee records. In our view, given its structure and language prohibiting the use of appropriations in connection with consolidating or centralizing certain firearms licensee records within the Department of the Treasury, the rider appears to encompass ATF’s internal operations. ATF’s prior legal opinions did not analyze the rider, other than to treat it as “similar to” the section 926(a) restriction. However, we believe that the appropriation rider clearly has legal effect independent of section 926. Congress enacted it for a number of years predating the Firearms Owners’ Protection Act and has continued to enact it for each subsequent year. As referred to above, the language of the appropriation rider was expanded in fiscal year 1994 to include portions of licensee firearms records. Further, there are significant differences in the language of the two provisions—most notably, the absence from the rider of any limitation on its coverage to rules or regulations. There is no indication in the legislative history of the Firearms Owners’ Protection Act that section 926 was intended to subsume or otherwise affect the appropriation rider. Therefore, in our view, ATF’s interpretation that the appropriation rider applied only to the issuance of rules and regulations that impose additional reporting requirements on licensees, and did not reach ATF’s internal information practices, was not supported by the statutory language or legislative history of the rider. Determining the extent to which the appropriation rider restricts ATF’s internal information practices posed more difficult questions. The appropriation rider applies to “consolidating or centralizing, within the Department of the Treasury, the records, or any portion thereof, of acquisition and disposition of firearms maintained by Federal firearms licensees.” However, we do not believe that the rider precludes all information practices and data systems that involve an element of “consolidating or centralizing” licensee records. The legislative history of the rider indicates that it was originally enacted in response to an ATF proposal that was viewed as a wholesale aggregation of licensee firearms transaction records that went “beyond the intent of Congress when it passed the Gun Control Act of 1968.” There is no evidence in the legislative history that the rider was intended to overturn existing ATF information practices or data systems. Indeed, the Firearms Owners’ Protection Act, which amended the Gun Control Act and was enacted 8 years after the original rider was passed, reaffirmed several long-standing ATF information practices. The rider must be interpreted in light of its purpose and in the context of the other statutory provisions governing ATF’s acquisition and use of information contained in the Gun Control Act, as amended. Pursuant to the Gun Control Act, ATF is responsible for certain regulatory functions, such as licensing and monitoring firearms licensees, as well as certain law enforcement functions, such as the tracing of firearms. The act, as amended, contains specific statutory authorities that allow ATF to obtain certain firearms transaction data from licensees. Section 923 contains licensee recordkeeping and reporting authorities, as well as the authorities for ATF to conduct inspections and searches of licensee business premises for certain purposes. To implement these responsibilities and authorities, ATF necessarily gathers specific firearms transaction data, and must centralize or consolidate the data to some degree. However, as discussed above, section 926(a) precludes ATF from issuing rules or regulations after enactment of the Firearms Owners’ Protection Act that require the establishment of any system of registration of firearms, firearms owners, or firearms transactions or dispositions. The legislative history of the Firearms Owners’ Protection Act indicates a clear congressional concern that such a registry not be established. Therefore, to the extent that the centralization or consolidation of records is incident to carrying out a specific ATF responsibility and does not entail the aggregation of data on firearms transactions in a manner that would go beyond the purposes of the Gun Control Act of 1968, as amended, we do not believe that the rider would be violated. ATF’s Out-of-Business Records and Multiple Sales Systems comply with the data restrictions, including the restriction in the annual appropriation rider, as discussed above. However, we did not review the other data systems and subsystems ATF identified as containing firearms-related information to determine their compliance with the data restrictions. ATF’s legal interpretation of the restriction in the appropriation rider was that the restriction had no application to ATF’s internal information practices under any circumstances. Given this, ATF had not reviewed its data systems and information practices to determine whether they involved the type of centralization or consolidation of records that might be affected by the rider, as discussed above. Such a review would help provide assurance that the systems and subsystems we did not review currently comply with the rider. In response to a draft of this report, ATF (1) revised its interpretation of the rider to adopt the broader interpretation we believed was appropriate; (2) applied this interpretation to a legal review of the systems, as described in appendix IV, that we did not review; and (3) stated it will apply the new interpretation to future systems. Although it found that the current systems, as described, comply with the broader interpretation, ATF did not determine whether the systems are operating as described. Such a determination would provide fuller assurance that the systems are in compliance. We recommend that the Secretary of the Treasury require the Director of ATF to review ATF’s firearms data systems and information practices to ensure that they comply with the appropriation rider, as discussed above; and report the results of these actions to the Subcommittee in conjunction with ATF’s fiscal year 1998 budget submission. ATF provided written comments on a draft of this report. These comments are reprinted in appendix IX. Overall, ATF concurred with our findings and conclusions concerning the compliance of the Out-of-Business Records and Multiple Sales Systems with the statutory data restrictions. However, ATF disagreed with our conclusions regarding systems we did not review because it believed those systems were outside the scope of our review. Nevertheless, ATF agreed with and adopted the broader interpretation of the data restriction in the annual appropriation rider, as discussed in this report, for its existing, as well as future, systems. It also applied its revised interpretation to a legal review of the systems containing retail firearms purchaser data that we did not review and found them to be in compliance. In light of these actions ATF requested that we reconsider our recommendation. With regard to the issue of ATF’s interpretation of the data restriction contained in the annual appropriation rider, we concluded in our draft report that given ATF’s legal interpretation that the appropriation rider had no application to its internal information practices, ATF had not analyzed its data systems and information practices to determine whether they involved the type of centralization and consolidation of records that might be affected by the rider. Therefore, we concluded that ATF could not ensure that the systems and subsystems that we did not review complied with the rider; nor could ATF provide Congress with reasonable assurance that, in the future, its data systems, subsystems, and information practices would be in compliance with the rider, assuming that Congress continued to enact it. In commenting on our draft report, ATF stated that these assertions were speculative and ranged far beyond the scope of our review. We do not agree that our conclusion and recommendation go beyond the scope of our review. While we were asked to review only two systems’ compliance with the data restrictions, our third objective—to assess ATF’s overall legal interpretation of the data restrictions—covered all of its data systems and information practices. However, we did not suggest or imply that the ATF data systems and practices that we did not review were not in compliance with the law. Rather, our intention was to focus on the lack of assurance that ATF was providing related to its systems’ compliance with the restriction in the rider based on its narrow interpretation. Nevertheless, ATF stated that it “will hereafter apply GAO’s interpretation of the rider to its record systems and any future systems it might establish.” It further stated that it saw “no disadvantage to ATF in changing its position to be in conformity with the reading given by GAO since our record systems actually comply with GAO’s interpretation of the rider.” Also, as part of its written response to our draft report, ATF enclosed an August 23, 1996, opinion of the ATF Chief Counsel, whose Office reviewed those ATF data systems that contain retail firearms purchaser data (with the exception of the two systems that we reviewed) and found them to be in compliance with the rider, under the revised interpretation. The Chief Counsel’s opinion also indicated that if ATF adopted our interpretation of the rider, the Office of the Chief Counsel would, in the future, review any proposed new record system to determine compliance with the rider. We believe ATF has taken several important actions toward fulfilling the recommendation. Most notably, ATF has revised its legal analysis of the rider, applied it to the descriptions of the remaining systems that contain retail firearms purchaser information, and stated that future systems will be reviewed under the revised analysis. These actions, in our view, constitute major steps toward providing assurance that ATF is currently complying with the rider and that the agency will continue to comply with it in the future. Accordingly, we have modified our final report to reflect ATF’s actions. Although ATF has taken significant steps toward implementing our recommendation, in our view, it has not fully implemented the recommendation. ATF’s legal analysis of the description of the remaining systems that contain retail firearms purchaser information appears to apply appropriate criteria and rationale. In addition, the legal analysis discusses various general controls that ATF had in place and actions it had taken to help ensure that existing, as well as future, records systems and information practices comply with the law. However, it was not clear how these controls specifically applied to the systems discussed in ATF’s legal analysis or whether they were used to help ensure that the systems were in compliance with the data restrictions. To fully respond to our recommendation, ATF needs to provide assurance that the systems are actually operating as they were described. Thus, we believe that ATF should perform an operational review of the systems listed in appendix IV that we did not review. Therefore, we are retaining our recommendation that ATF review these systems and report the results to the House Appropriations Subcommittee. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from the date of this letter. At that time, we will send copies of the report to the Ranking Minority Member of the Subcommittee, appropriate congressional committees, the Secretary of the Treasury, the Director of ATF, and other interested parties. Copies will also be made available to others upon request. The major contributors to this report are listed in appendix X. If you have any questions about this report, please call me on (202) 512-8777. Because of concerns regarding ATF’s compliance with the legislative restrictions regarding centralizing and consolidating data from federal firearms licensee records, the Chairman of the House Subcommittee on Treasury, Postal Service, and General Government, Committee on Appropriations, requested that we review ATF’s compliance with the legislative restrictions on maintaining certain federal firearms licensee data. We agreed to (1) identify and describe the ATF data systems that contain retail firearms purchaser data and (2) determine whether ATF’s Out-of-Business Records System and Multiple Sales System comply with the legislative data restrictions. We also agreed to assess ATF’s overall legal interpretation of the legislative data restrictions. To identify and describe the ATF data systems that contain retail firearms purchaser data, we obtained from ATF headquarters officials descriptions of ATF national data systems that they determined relate to firearms. We also asked ATF to identify those national data systems that contained retail firearms purchaser data. We reviewed the provided descriptive data to determine whether we agreed with ATF’s categorization of each data system. We also interviewed appropriate ATF headquarters and National Tracing Center officials to obtain additional information and clarification concerning the data systems. However, with the exception of the Out-of-Business Records and the Multiple Sales Systems, we did not independently verify the contents of the data systems because of time constraints. At the Subcommittee’s request, we focused on assessing ATF’s Out-of-Business Records System and Multiple Sales System. These systems (1) play a significant role in the firearms tracing process, (2) contain data obtained from nonlaw enforcement sources, and (3) involve large numbers of records and reports containing data on firearms transactions and purchasers. To obtain information on the firearms tracing process and the Out-of-Business Records and Multiple Sales Systems, we interviewed officials and reviewed system documentation and other data at ATF headquarters and at ATF’s National Tracing Center in Falling Waters, West Virginia. We also observed the firearms tracing, out-of-business records, and multiple sale reports processing operations at the Center and discussed these operations with Center officials. To address whether the Out-of-Business Records and Multiple Sales Systems were in compliance with the legislative data restrictions, we reviewed relevant laws and ATF regulations, legal opinions, and documentation on the design of these systems. We also discussed ATF’s legal opinions with ATF’s Associate Chief Counsel (Firearms and Explosives) and other officials. We did not review ATF’s other systems for compliance with the data restrictions. With regard to the Out-of-Business Records and Multiple Sales Systems, we did not review their compliance with other statutory requirements such as the Privacy Act and the Computer Security Act. Furthermore, to determine whether ATF’s actual handling of the records and reports in these systems was in accord with the systems’ designs, we observed the processing and maintenance of the out-of-business records and the multiple sale reports at the Tracing Center, conducted some tests, and discussed these operations with ATF headquarters and Tracing Center officials. To determine whether ATF was implementing its requirement to purge certain firearms purchaser data from the Multiple Sales System, we conducted data entry and retrieval tests. To assess ATF’s overall legal interpretation of the legislative data restrictions and their application to ATF operations, we reviewed relevant laws and their legislative histories, ATF regulations and legal opinions, and other documentation concerning the data restrictions. We also interviewed ATF’s Associate Chief Counsel (Firearms and Explosives) and other ATF headquarters and Tracing Center officials. The Gun Control Act of 1968, as amended, requires federal firearms licensees to record firearms transactions, maintain that information at their business premises, and make such records available to ATF for inspection and search under certain prescribed circumstances. Through the use of these records, ATF provides firearms tracing services to federal, state, local, and foreign law enforcement agencies. ATF also uses the records for other law enforcement purposes. To carry out its firearms tracing responsibilities, ATF maintains a firearms tracing operation, located at the National Tracing Center in Falling Waters, West Virginia. With a staff of 45 as of July 1996, the Tracing Center tracks firearms suspected of being involved in crimes to assist law enforcement in identifying suspects. The Tracing Center receives trace requests by facsimile, telephone, and mail. To do a trace, the manufacturer and the serial number of the firearm must be known. The Tracing Center determines the ownership of firearms being traced by using documentation, such as out-of-business licensee records and multiple sale reports, which are maintained in ATF’s national data systems, and/or by contacting manufacturers, importers, wholesalers, and retailers (i.e., firearms dealers). The objective of the trace is to identify the last known purchaser of the firearm. ATF is to document each trace request and its results and provide that information to the requester. ATF considers a request completed when it traces the firearm to a retail firearms licensee or a purchaser or when it cannot identify the purchaser for various reasons. For example, the description of the firearm as submitted by the requester may not have contained sufficient information to perform a trace. Figure II.1 provides a macro flowchart of ATF’s firearms tracing process. by fax, telephone, suspect guns, multiple sales, gun serial numbers (OOBR) gun serial number? active? ATF have licensee's records? F purchaser? have records? OOBR - Out-of-business records From this point in the tracing process, an active and/or inactive manufacturer, importer, or licensee may be involved. It should also be noted that not all traces are successfully completed. Some are closed due to age of firearm, incomplete/inaccurate description of firearm, loss of licensee records, or inability to locate licensee. For fiscal years 1992 through 1995, ATF received a total of 262,984 trace requests. The number of trace requests received by ATF increased about 56 percent during this 4-year period, from 51,210 in fiscal year 1992 to 80,042 in fiscal year 1995. During this period, ATF completed a total of 243,584 traces, including those that did not result in the identification of a retail firearms licensee or purchaser. As shown in figure II.2, the number of traces completed more than doubled, from 42,980 in fiscal year 1992 to 86,215 in fiscal year 1995. During this 4-year period, ATF identified a retail firearms licensee or a purchaser of the traced firearm, on average, in about 41 percent of the completed trace requests. In fiscal year 1995, the number of completed trace requests resulting in the identification of retail licensees or purchasers increased to about 52 percent. Contains firearms data but does not identify retail firearms purchasers. Tracks firearms production and exports data that are gathered annually from licensed manufacturers and exporters for regulatory enforcement. Contains firearms data but does not identify retail firearms purchasers. Tracks inspectors’ assignments, certain performance measures, and workflow data within ATF’s Office of Regulatory Enforcement. Contains firearms data collected for criminal investigative purposes that, in some cases, may identify retail firearms purchasers. Automates the preparation of three ATF reports: Investigative Case Summary, Report of Investigation, and Property Taken Into ATF’s Custody for criminal enforcement. Contains firearms data but does not identify retail firearms purchasers. Tracks information on tax payments, including tax returns and return information, from more than 10,000 excise taxpayersfor regulatory enforcement. Contains firearms data but does not identify retail firearms purchasers. Used to manage sales information about firearms and ammunition manufacturers, who are required to pay federal excise taxes, to determine whether the proper amounts of tax were paid when due for regulatory enforcement. Contains firearms data but does not identify retail firearms purchasers. Tracks applications and permits for federal firearms and explosives licenses for regulatory and criminal enforcement. Contains firearms data that identify the consignees of firearms, who, in some cases, may be retail firearms purchasers. Tracks information on the importation of firearms and explosives into the United States and their release into commerce by the U.S. Customs Service for regulatory enforcement. Contains firearms data that identify retail firearms purchasers. Collects and tracks data on traces of firearms suspected of being involved in a crime to assist law enforcement agencies in identifying suspects for regulatory and criminal enforcement. Contains firearms data but does not identify retail firearms purchasers. Collects and tracks data on firearms stolen, or missing in inventory, from federal firearms licensees’ place of business for regulatory and criminal enforcement. Contains firearms data that identify the consignees of firearms, who, in some cases, may be retail firearms purchasers. Collects and tracks, for criminal enforcement purposes, information on thefts of firearms during interstate shipment between the manufacturer and the wholesaler, the wholesaler and the retailer, or retailers. (continued) Contains firearms data that identify retail firearms purchasers. Collects and tracks data on purchasers of two or more pistols and/or revolvers at one time or during any 5 consecutive business days for regulatory and criminal enforcement. Contains firearms data that identify retail firearms purchasers. Collects and tracks data (derived from the Firearms Tracing System) on firearms recovered in ATF’s field divisions’ geographic areas of responsibility for criminal enforcement. Allows ATF to analyze information concerning problem dealers, questionable purchasers, and other descriptive firearms data. Contains firearms data but does not identify retail firearms purchasers. Tracks all aspects of special agents’ duty time by various categories, including court time, investigative time, and leave for criminal enforcement. Also maintains information on individual cases, including information on the type of case, defendants, and seizures. Contains firearms data but does not identify retail firearms purchasers. Collects and tracks data for regulatory enforcement by name and address of subject, alleged firearms excise tax violation, action taken, business type, potential leads, investigations, product detention, and reporting offices. Contains firearms data that identify retail firearms purchasers. Collects and tracks data from applications and forms submitted by manufacturers, dealers, and owners of machine guns, destructive devices, and certain other firearms to monitor and enforce these classes of firearms for regulatory and criminal enforcement. Contains firearms data that identify retail firearms purchasers. Collects, indexes, and retrieves microfilmed copies of firearms transaction records of federal firearms licensees who have permanently gone out of business for regulatory and criminal enforcement. Contains firearms data that identify retail firearms purchasers. Analyzes firearms data contained in the Firearms Tracing System by ATF’s field divisions’ geographic areas of responsibility for their use in identifying and investigating suspected firearms traffickers, “straw” purchasers, and licensees suspected of being involved in criminal activity for regulatory and criminal enforcement. (continued) Contains firearms data but does not identify retail firearms purchasers. Tracks the tax payment records of taxpayers in certain occupations, including manufacturers of firearms and persons dealing in commodities regulated by the National Firearms Act, who are required to pay special occupational taxes for regulatory enforcement. The Criminal Enforcement Investigative Reports program is not a database. It is a word processing application that can be queried by case number, but not by name, to generate investigative reports. Although the consignees of firearms that are imported or shipped interstate could, in some cases, be retail purchasers, they cannot be specifically identified as such through the system alone, i.e., the system has no specific data field on retail firearms purchasers. See appendix IV for a detailed description. This appendix describes the five national data systems and one subsystem that ATF identified as containing sufficient data, or automated interfaces to related databases, to readily identify the retail purchaser or possessor of a specific firearm. The descriptions in tables IV.1 through IV.5 include data sources, data input, data location, authorized users, and security measures. The Firearms Tracing System collects and tracks data on traces of firearms suspected of being involved in a crime to assist law enforcement in identifying suspects. Trace data are used by law enforcement agencies worldwide. In addition, the Firearms Tracing System contains three subsystems: (1) Interstate Theft, (2) Federal Firearms Licensees Theft, and (3) Multiple Sales. As shown in tables IV.1 and IV.1a, the overall System and the Multiple Sales Subsystem contain firearms purchaser data. According to ATF, the data collected in the Firearms Tracing System are firearms trace-specific duplicates of firearms transaction data kept by licensees pursuant to 18 U.S.C. 923(g). Section 923(g) requires licensees to maintain firearms data at their place of business and to make the information in those records available to ATF for certain purposes. Specifically, section 923(g)(7) requires licensees to respond within 24 hours after the receipt of a request from the Secretary of the Treasury for information contained in their records as may be required for determining the disposition of one or more firearms in the course of a bona fide criminal investigation. Table IV.1: Characteristics of the Firearms Tracing System Data in the system include serial number, make, model, type, and caliber of firearm; trace requester’s name; reasons for the trace; possessor of the weapon at the time of recovery; place of recovery; name and address of the licensee to whom the firearm was transferred; and name, address, date of birth, and place of birth of the individual purchaser. Data are maintained on a mainframe computer system at the National Data Center in Falling Waters, West Virginia. About 40 National Tracing Center personnel have complete access to the system. About 60 contractors and special agents in certain field divisions have restricted access. In addition, ATF agents and other law enforcement personnel nationwide have electronic access to the system, through the National Law Enforcement Telecommunications Network, only for purposes of submitting a trace request. The electronic data are protected by the Resource Access and Control Facility (RACF).User access privileges are defined by the RACF administrator with the permissions approved by the National Tracing Center and user’s first line supervisor. The hard copy data are protected by provisions of ATF’s Physical Security Program order. The Multiple Sales Subsystem collects and tracks information on purchasers of two or more pistols and/or revolvers at one time or during any 5 consecutive business days. Data are used to conduct traces of firearms suspected of being used in crimes and to develop investigative leads as part of Project Lead, which is discussed later in this appendix. A provision of the Gun Control Act of 1968, as amended, 18 U.S.C. 923(g)(3)(A) requires federal firearms licensees to report these transactions. The implementing regulation is at 27 C.F.R. 178.126a. Table IV.1a: Characteristics of the Multiple Sales Subsystem Data in the system include the name, address, date of birth, place of birth, race, and sex of purchasers; the serial number, make, model, type, and caliber of firearms purchased; and the name, address and license number of the federal firearms licensee. Data are maintained on a mainframe computer at the National Data Center. About 40 National Tracing Center personnel have complete access to the system. About 60 contractors and special agents in certain field divisions have restricted access. The electronic data are protected by the RACF. User access privileges are defined by the RACF administrator with the permissions approved by the National Tracing Center and user’s first line supervisor. The hard copy data are protected by provisions of ATF’s Physical Security Program order. The Firearms Tracking System was designed to enable ATF to study firearms recovered in ATF field divisions’ geographic areas of responsibility and analyze information concerning problem dealers, questionable purchasers, and other descriptive firearms data. It was developed as an investigative tool to be used by ATF field divisions. This system was designed to be an interim system and was to be replaced by Project Lead, which is discussed next. However, as of July 1996, ATF field offices could use the Firearms Tracking System, Project Lead, or both. According to ATF, the data in this system are the same as the trace data in the Firearms Tracing System. Therefore, the statutory authority for the data collected is the same as that for the Firearms Tracing System. Table IV.2: Characteristics of the Firearms Tracking System Data in the system include the type of firearms; name of the dealer, purchaser, and possessor of traced firearms; recovery location; type of crime; quantity of firearms in a multiple sale report; and agency and project identification. Data are maintained on either the local area network server or on a personal computer hard drive. ATF special agents in about 10 field divisions have or had access to their divisions’ systems. Only ATF personnel with authorized identifications and passwords can access data in the Firearms Tracking System. Project Lead is currently a personal computer-based system designed to analyze firearms data contained in the Firearms Tracing System by ATF’s field divisions’ geographic areas of responsibility. The field divisions use the data to help identify and investigate suspected firearms traffickers, “straw” purchasers, and federal firearms licensees suspected of involvement in criminal activity. ATF plans to make Project Lead a mainframe system at the National Data Center. Since, according to ATF, the data in this system are obtained directly from the Firearms Tracing System, the statutory authority for the data collected is the same as that for the Firearms Tracing System. Data in the system are exact replicas of data in the Firearms Tracing System. This includes firearms recovered that are suspected of being involved in a crime and traced by the National Tracing Center (includes the purchasers’ or possessors’ names; multiple sales reported by licensees; names of individuals associated with the recovery of a firearm, e.g., names of people associated with a vehicle in which a firearm was recovered; and the recovery locations of firearms. Data from the Firearms Tracing System are periodically downloaded to and maintained on stand-alone computers in certain ATF field divisions. Selected ATF special agents and inspectors in the field divisions have access to data that are appropriate to their geographic area of responsibility. The electronic data are protected by users’ authorized identifications and passwords built into the Project Lead application. The hard copy data are protected by provisions of ATF’s Physical Security Program order. The Out-of-Business Records System was designed to collect, index, and retrieve microfilmed copies of firearms transactions records that federal firearms licensees have forwarded to ATF when the licensees permanently discontinued their business operations. The data are used to conduct traces of firearms suspected of being used in crimes. A provision of the Gun Control Act of 1968, as amended, 18 U.S.C. 923(g)(4), requires federal firearms licensees who permanently discontinue their business to forward their records to ATF within 30 days after the discontinuance. The implementing regulation is at 27 C.F.R. 178.127. Table IV.4: Characteristics of the Out-Of-Business Records System The microfilm system contains an exact photographic image of the firearms transaction record. The record contains, among other things, the name and address of the firearms purchaser. These records are indexed on a minicomputer. The index system contains, among other things, microfilm cartridge numbers, film frame numbers, and serial numbers of firearms recorded on each cartridge. The microfilm cartridges containing microfilmed records are maintained in file cabinets at the National Tracing Center. The computerized index data that are captured by a minicomputer are stored on a mainframe computer system at the National Data Center. About 100 National Tracing Center personnel and contractors have complete access to the system. The electronic data in the index system are protected by the RACFon the mainframe and by users’ personal identification and passwords on the minicomputer. The hard copy data are protected by provisions of ATF’s Physical Security Program order. The National Firearms Act Database contains data on certain classes of firearms, such as machine guns and destructive devices, as defined by the National Firearms Act of 1934, 26 U.S.C. Chapter 53. (This act was recodified as Title II of the Gun Control Act of 1968.) The act requires the registration of these defined categories of weapons and requires that the Secretary of the Treasury collect transfer taxes and maintain a central registry of these firearms, which is known as the National Firearms Registry and Transfer Record. (Implementing regulations are set forth in 27 C.F.R. Part 179.) ATF uses this system to monitor and enforce these classes of firearms. Federal, state, and local law enforcement agencies use the data for criminal prosecutions. Table IV.5: Characteristics of the National Firearms Act Database Data in the system include the type, model, and serial number of firearm; the name and address of the retail purchaser or possessor; and the amount of tax paid and other accounting data, such as the date the tax was paid. Electronic data are maintained on a mainframe computer at the National Data Center. ATF captures about 40 percent of the data from the applications and forms into an electronic format. Hard copies of the applications, forms, and correspondence are maintained in ATF files or on microfilm or computer disks. They are filed at ATF headquarters or the National Archives and Records Administration warehouses in the Washington, D.C., area. Fifteen National Firearms Act Branch personnel and special agents assigned to the Enforcement Operations Center of the National Communications Center, Intelligence Division, Criminal Enforcement Program, have access to the system. The electronic data are protected by RACF.User access privileges are defined by the RACF administrator with the permissions approved by the National Firearms Act Branch and user’s first line supervisor. The hard copy data are protected by provisions of ATF’s Physical Security Program order. When firearms licensees discontinue their businesses, ATF needs access to their records for tracing purposes. To ensure that it had access to these records, shortly after the passage of the Gun Control Act, ATF issued a regulation requiring federal firearms licensees who permanently discontinued their businesses to forward their records to ATF within 30 days following the discontinuance (27 C.F.R. 178.127). The Firearms Owners’ Protection Act codified this reporting requirement (18 U.S.C. 923(g)(4)). Accordingly, since the enactment of the Gun Control Act, ATF has maintained the out-of-business records at a central location, currently the National Tracing Center. Before fiscal year 1991, ATF stored the out-of-business records in boxes with a Tracing Center file number assigned to each licensee. If during a trace ATF determined that the firearms licensee who sold the firearm was out of business and had sent in his or her records, ATF employees were to locate the boxes containing the records and manually search them for the appropriate serial number. According to ATF, this was a time-consuming and labor-intensive process, which also created storage problems for ATF. In 1991, ATF began a major project to microfilm the out-of-business records and destroy the originals. Instead of in boxes, the out-of-business records were stored on microfilm cartridges, with the firearms licensee numbers assigned to them. Although this system occupied much less space than the hard copies of the records, ATF officials said it was still time consuming to conduct firearms traces because employees had to examine up to 3,000 images on each microfilm cartridge to locate a record. In fiscal year 1992, ATF began using a minicomputer to create a computerized index of the out-of-business microfilm records containing the information necessary to identify whether ATF had a record relating to a firearm being traced. The index contains the following key information: (1) the cartridge number of the microfilm; (2) an index number; (3) the serial number of the firearm; (4) the federal firearms licensee number; and (5) the type of document on microfilm, i.e., a Firearms Transaction Record (ATF Form 4473) or acquisition and disposition logbook pages. The index information that is captured by the minicomputer is then stored on a database in ATF’s mainframe computer to allow searches of the index information by an employee. The other information, including the firearms purchaser’s name or other identifying information and firearms manufacturer, type, and model, remains on the microfilm cartridges and must be viewed with a microfilm reader. Since the establishment of the computerized out-of-business records index, ATF does not begin a trace by contacting firearms manufacturers and importers. Rather it queries the Out-of-Business Records System to determine if the firearm being traced is contained in the records of an out-of-business licensee. To perform a query of the system, employees are to enter the serial number of the firearm in question into the mainframe computer’s database. If the serial number is matched with a particular out-of-business licensee record, the query will produce a list of one or more microfilm cartridges indicating the cartridge number and frame where the serial number in question may be found. After locating the appropriate cartridges, the employee is to use the location information in the index to search the microfilm frames to locate the record containing the serial number. Since the index does not associate a firearm’s serial number with the manufacturer and type or model, the employee may need to examine several frames on one or more cartridges to locate a record. After locating the record, the employee is to examine the record to identify the purchaser of the firearm. If the identified purchaser is not another licensee, the trace is considered complete. If the purchaser is another licensee, the Tracing Center is to contact the licensee. If the serial number is not located in the out-of-business records, the Tracing Center is then to contact the manufacturer or importer to determine who purchased the firearm. According to ATF officials, the indexed Out-of-Business Records System has (1) greatly reduced the need to contact manufacturers, importers, and other licensees and (2) reduced the time and cost, including storage costs, necessary to conduct firearm traces. As shown in table V.1, during fiscal years 1992 through 1995, ATF received out-of-business records from 68,660 firearms licensees. ATF officials estimated that during this period, ATF spent about $9.6 million, including the cost of contract employees (65 as of July 1996), to process and maintain out-of-business records. According to ATF officials, ATF is receiving an increased number of records primarily because the number of licensees going out of business has increased, and more of these licensees have sent in their records. The number of licensees who have gone out of business more than doubled, from 34,663 in fiscal year 1992 to 75,569 in fiscal year 1995. About 43 percent of the licensees who went out of business in fiscal year 1995 sent in their records, compared to about 25 percent in fiscal year 1992—an increase of about 75 percent. ATF officials estimated that during fiscal years 1992 through 1995, ATF microfilmed about 47 million documents contained in about 20,000 boxes. Although ATF does not systematically collect data on the number of traces involving out-of-business records, ATF officials estimated that ATF used the out-of-business records to help complete about 42 percent of all completed trace requests during this period. ATF had no information on the number of completed traces that identified retail firearms licensees or purchasers and involved the use of out-of-business records. Since 1975, federal firearms licensees have been required by regulation (27 C.F.R. 178.126a) and subsequently by law (18 U.S.C. 923(g)(3)(A)) to report all transactions in which an unlicensed person has acquired two or more pistols and/or revolvers at one time or during any 5 consecutive business days (referred to as a multiple sale). As ATF stated at the time the regulation was issued, the purpose for requiring multiple sale reports was to enable ATF to “monitor and deter illegal interstate commerce in pistols and revolvers by unlicensed persons.” The Firearms Owners’ Protection Act of 1986 codified the multiple sale regulatory reporting requirement. Also, in November 1993, under Title II of Public Law 103-159, federal firearms licensees were required to send a copy of the multiple sale report to the state or local law enforcement agency in whose jurisdiction the sale or other disposition took place. Under 18 U.S.C. 923(g)(3)(A), ATF can specify the multiple sale reporting form and designate the ATF office where the report is to be sent. Currently, federal firearms licensees are required to send multiple sale reports to the ATF criminal enforcement field division located in their respective area. Reports are to be sent no later than the close of business on the day that the multiple sale occurs. In addition, licensees are required by regulation to retain a copy of the multiple sale reports. Before November 1995, ATF required that multiple sale reports be maintained by its field divisions. According to ATF, these divisions in the past maintained multiple sale reports in a variety of ways: some used local computer information tracking systems, others used alphabetical card files, and before 1987 some used the Department of the Treasury’s Enforcement Communications System (TECS), a law enforcement data system that includes centralized databases used by Treasury and other law enforcement agencies. According to ATF policy, field divisions are to use multiple sale reports to develop investigative leads for those persons who engage in business as unlicensed firearms dealers or who transport or sell firearms illegally in interstate commerce. These reports are to provide an investigative tool to identify traffickers and other violators of federal firearms laws. In an August 1993 memorandum on gun dealer licensing, the President listed a number of steps that ATF could take to ensure compliance with federal firearms licensing requirements, including increasing scrutiny of licensees’ multiple sale reports and providing automated access to those reports. Further, according to ATF, plans to automate multiple sale reports were included in the President’s firearms initiative, and Congress appropriated fiscal year 1995 funds to implement the initiative. In November 1995, ATF began implementing a new policy to process and computerize multiple sale reports at its National Tracing Center. Field divisions were instructed to forward their multiple sale reports to the Tracing Center for processing. ATF’s decision to computerize multiple sale reports at the Tracing Center was based on a test conducted from June through October 1995. In June 1995, to provide the capability for computerizing multiple sale reports, ATF upgraded its Firearms Tracing System by developing a Multiple Sales Subsystem. This system allows the entry of multiple sale information directly into the Firearms Tracing System. ATF then tested the system by entering multiple sale reports forwarded by three field divisions. Following successful completion of the test, ATF issued its new policy. ATF decided to computerize the handling of multiple sale reports at the Tracing Center for several reasons. First, by computerizing the reports as part of ATF’s Firearms Tracing System, multiple sale information became readily available for firearms traces. When maintained locally by field divisions, multiple sale reports were not readily available for firearms tracing. Second, and most important according to the Chief of the Firearms Enforcement Division, by entering multiple sale information into the Firearms Tracing System, the information would be available to field divisions through Project Lead. ATF, through Project Lead, provides monthly firearms trace information along with multiple sale and other data on computer diskettes to its field divisions to develop investigative leads. Once the Tracing Center receives multiple sale reports from field divisions, the information is entered into the Multiple Sales System. The data entered includes (1) purchaser information such as name, address, date of birth, place of birth, race, and sex; (2) firearms identification information, including serial numbers of pistols and/or revolvers purchased; and (3) federal firearms licensee identification information. Multiple sale data in the system are retrievable by purchaser name and firearm serial number. After the information is entered into the system, the multiple sale reports are to be microfilmed, and the original reports are to be destroyed. The current ATF Form 3310.4—Report of Multiple Sale or Other Disposition of Pistols and Revolvers—showing the information requested of licensees is reproduced in appendix VII. The Tracing Center has been processing multiple sale reports received from field divisions since June 1995. Through June 1996, the Tracing Center had entered data on 91,599 multiple sale reports and had 521 firearms traces linked to multiple sale reports. The Special Agent in Charge of the National Tracing Center estimated that in the future the Center will receive 130,000 multiple sale reports annually. This official estimated that each multiple sale report includes an average of 2.3 firearms. Table VI.1 provides monthly data on the number of multiple sale reports processed at the Tracing Center along with the number of firearms linked to multiple sale reports. N/A = ATF did not maintain data. As part of its November 1995 policy to computerize multiple sale reports at the Tracing Center, ATF included a requirement for purging firearms purchaser data not identified in firearms traces. The requirement calls for purging the purchaser data not identified in a trace 2 years after the date of the sale. The remainder of the data entered for each multiple sale, such as firearms descriptive data, is not to be purged and is to remain in the system to be used as investigative intelligence. In contrast, all multiple sale data identified in firearms traces, including purchaser data, is not to be purged from the system. According to the Chief of the Firearms Enforcement Division, the primary reason for purging purchaser data over 2 years old is to delete data that may not be useful. The Special Agent in Charge of the National Tracing Center said that ATF is sensitive for privacy reasons to retaining firearms purchaser data that may have lost its utility. We were asked to evaluate ATF’s interpretation of data restrictions contained in 18 U.S.C. 926(a) and in a rider to its annual appropriation act. We have reviewed the relevant laws, legislative history, and ATF legal opinions and met with ATF lawyers regarding their interpretation. Set forth below are the relevant statutory provisions, our analysis of ATF’s interpretation of these provisions, and our analysis of the application of these restrictions to the two ATF data systems that we reviewed in detail, the Out-of-Business Records System and the Multiple Sales System. Although we agree with ATF’s interpretation of 18 U.S.C. 926(a), we believe that ATF’s interpretation of the restriction in its annual appropriation was too narrow. However, we found that the two data systems that we reviewed did not violate the data restrictions. The Gun Control Act of 1968 established a system requiring federal firearms licensees to record firearms transactions, maintain that information at their business premises, and make such records available to ATF for inspection and search under certain prescribed circumstances. This system was intended to permit law enforcement officials to trace firearms involved in crimes while allowing the records themselves to be maintained by the licensees rather than by a governmental entity. As originally enacted, the Gun Control Act required licensees to submit such reports and information as the Secretary of the Treasury prescribed by regulation and authorized the Secretary to prescribe such rules and regulations as deemed reasonably necessary to carry out the provisions of the act. “hat no funds appropriated herein shall be available for administrative expenses in connection with consolidating or centralizing within the Department of the Treasury the records of receipt and disposition of firearms maintained by Federal firearms licensees or for issuing or carrying out any provisions of the proposed rules of the Department of the Treasury, Bureau of Alcohol, Tobacco and Firearms, on Firearms Regulations, as published in the Federal Register, volume 43, number 55, of March 21, 1978.” “The Bureau of Alcohol, Tobacco, and Firearms (BATF) has proposed implementation of several new regulations regarding firearms. The proposed regulations, as published in the Federal Register of March 21, 1978 would require: “(1) A unique serial number on each gun manufactured or imported into the United States. “(2) Reporting of all thefts and losses of guns by manufacturers, wholesalers and dealers. “(3) Reporting of all commercial transactions involving guns between manufacturers, wholesalers and dealers. “The Bureau would establish a centralized computer data bank to store the above information. It is important to note that the proposed regulations would create a central Federal computer record of commercial transactions involving all firearms—whether shotguns, rifles, or handguns. There are approximately 168,000 federally licensed firearms dealers, manufacturers, and importers. It is estimated that the proposed regulations would require submission of 700,000 reports annually involving 25 million to 45 million transactions. “It is the view of the Committee that the proposed regulations go beyond the intent of Congress when it passed the Gun Control Act of 1968. It would appear that BATF and the Department of Treasury are attempting to exceed their statutory authority and accomplish by regulation that which Congress has declined to legislate.” While the reference to the 1978 proposed rules was later dropped, the general prohibition against the centralization or consolidation of records has been included in each of ATF’s annual appropriations since fiscal year 1979. The fiscal year 1996 appropriation rider prohibits the consolidation or centralization of “the records, or any portion thereof, of acquisition and disposition of firearms maintained by Federal firearms licensees” within the Department of the Treasury. “(a) The Secretary may prescribe only such rules and regulations as are necessary to carry out the provisions of this chapter, including—“(1) regulations providing that a person licensed under this chapter, when dealing with another person so licensed, shall provide such other licensed person a certified copy of this license; “(2) regulations providing for the issuance, at a reasonable cost, to a person licensed under this chapter, of certified copies of his license for use as provided under regulations issued under paragraph (1) of this subsection; and “(3) regulations providing for effective receipt and secure storage of firearms relinquished by or seized from persons described in subsection (d)(8) or (g)(8) of section 922. “No such rule or regulation prescribed after the date of the enactment of the Firearms Owners’ Protection Act may require that records required to be maintained under this chapter or any portion of the contents of such records, be recorded at or transferred to a facility owned, managed, or controlled by the United States or any State or any political subdivision thereof, nor that any system of registration of firearms, firearms owners, or firearms transactions or dispositions be established. Nothing in this section expands or restricts the Secretary’s authority to inquire into the disposition of any firearm in the course of a criminal investigation.” (Emphasis supplied.) This data restriction was one of several amendments to the Gun Control Act made by FOPA to limit ATF’s authority over licensees and their records. For example, FOPA amended section 923 of title 18 to provide that licensed “importers, manufacturers, and dealers shall not be required to submit to the Secretary reports and information with respect to such records [they are required to maintain] and the contents thereof, except as expressly required by this section.” The act went on to codify in section 923 several reporting requirements that ATF previously had imposed on licensees by regulation, including those related to out-of-business licensee records and reports of multiple handgun sales. ATF’s interpretation of the data restrictions in the annual appropriation rider and section 926(a) was contained in a number of opinions and correspondence that ATF provided to us during the course of the audit. These opinions generally address whether the data restrictions prohibit the establishment of a specific data system or apply to information gathered during the course of ATF audits of a licensee’s compliance with recordkeeping requirements. On the basis of its interpretation of the two provisions, as set forth below, ATF concluded in each instance that the provisions did not apply to the systems or information collections at issue. Essentially, ATF maintained that the restrictions in section 926(a) and the appropriation act rider have the same effect, and that they only were “intended to preclude future [post-FOPA] regulations imposing additional reporting requirements upon licensees.” Thus, ATF viewed the data restrictions as having no application to the agency’s internal information practices—i.e., they did not restrict what ATF did with information it had acquired from licensees through pre-FOPA reporting requirements or other means. ATF’s interpretation relied on the language and context of section 926 and related provisions (primarily section 923), as well as the language and context of the 1979 appropriation rider, which was enacted to counter the broad reporting requirements that ATF sought to impose on licensees through the 1978 proposed rulemaking. ATF maintained that the basic effect of FOPA—codifying certain former regulatory reporting requirements in section 923 and restricting the agency’s authority to prescribe rules and regulations in section 926—was to preempt any additional reporting requirements that the agency might impose on licensees. ATF also cited the principle of deference to be accorded an agency’s interpretation of laws that it administers. We agreed with ATF’s interpretation of the data restrictions as far as it went; clearly the data restrictions apply to rules or regulations that would impose additional reporting requirements upon licensees. The question was whether they have any effect beyond such reporting requirements, and, in particular, whether they restrict how ATF compiles or otherwise uses firearms transaction records once they have been acquired from licensees through current reporting requirements or other means. With regard to the restriction in section 926(a), we agree with ATF that it is limited to prescribing rules and regulations. The appropriation rider, however, contains no language that would limit its application either to prescribing rules and regulations or to imposing additional reporting requirements on licensees. The original version of the rider did refer to the 1978 proposed rulemaking, but it was not limited to that proposal. The reference to the 1978 proposal was dropped in fiscal year 1994. Moreover, given its structure and language—prohibiting the use of appropriations in connection with consolidating or centralizing certain records within the Department of the Treasury—the rider appears to encompass ATF’s internal operations. The ATF opinions we reviewed did not analyze the appropriation rider, other than to treat it as “similar to” the section 926 restriction. However, we believe that the appropriation rider clearly has legal effect independent of section 926. Congress enacted it for a number of years predating FOPA and has continued to enact it for each subsequent year. In fact, the language of the appropriation rider was expanded in fiscal year 1994 to include portions of licensee firearms records. There also are significant differences in the language of the two provisions—most notably, the absence from the rider of any limitation on its coverage to rules or regulations. Also, there is no indication in the legislative history of FOPA that section 926 was intended to subsume or otherwise affect the appropriation rider. Finally, the appropriation rider was originally intended to prevent ATF from obtaining and computerizing large volumes of information on firearms transactions in a manner that was viewed as “accomplish by regulation that which Congress has declined to legislate.” It would be incongruous to conclude that the appropriation rider would not reach efforts to accomplish the same result through means other than regulatory requirements imposed on licensees. Therefore, in our view, ATF’s interpretation that the appropriation rider applied only to the issuance of rules and regulations that impose additional reporting requirements on licensees, and did not reach ATF’s internal information practices, was not supported by the statutory language or legislative history of the rider. Determining the extent to which the appropriation rider restricts ATF’s internal information practices poses more difficult questions. The appropriation rider applies to “consolidating or centralizing, within the Department of the Treasury, the records, or any portion thereof, of acquisition and disposition of firearms maintained by Federal firearms licensees.” However, we do not believe that the rider precludes all information practices and data systems that involve an element of “consolidating or centralizing” licensee records. As discussed above, the legislative history of the rider indicates that it was originally enacted in response to an ATF proposal that was viewed as a wholesale aggregation of licensee firearms transaction records that went “beyond the intent of Congress when it passed the Gun Control Act of 1968.” There is no evidence in the legislative history that the rider was intended to overturn existing ATF information practices or data systems. Indeed, FOPA, which amended the Gun Control Act and was enacted 8 years after the original rider was passed, reaffirmed several long-standing ATF information practices. The rider must be interpreted in light of its purpose and in the context of the other statutory provisions governing ATF’s acquisition and use of information contained in the Gun Control Act, as amended. Pursuant to the Gun Control Act, ATF is responsible for certain regulatory functions, such as licensing and monitoring firearms licensees, as well as certain law enforcement functions, such as the tracing of firearms. The act, as amended, contains specific statutory authorities that allow ATF to obtain certain firearms transaction information from licensees. Section 923 contains licensee recordkeeping and reporting authorities, as well as the authorities for ATF to conduct inspections and searches of licensee business premises for certain purposes. To implement these responsibilities and authorities, ATF necessarily gathers specific firearms transaction data and must centralize or consolidate the data to some degree. “the Committee wishes to emphasize that, notwithstanding any other provision of law, the authority granted under 18 U.S.C. 923(g)(3), (4) and (5), as well as that contained in paragraph (1), as amended, are not to be construed to authorize the United States or any state or political subdivision thereof, to use the information obtained from any records or forms which are required to be maintained for inspection or submission by licensees under Chapter 44 to establish any system of registration of firearms, firearms owners, or firearms transactions or dispositions.” Therefore, to the extent that the centralization or consolidation of records is incident to carrying out a specific ATF responsibility and does not entail the aggregation of data on firearms transactions in a manner that would go beyond the purposes of the Gun Control Act of 1968, as amended, we do not believe that the rider would be violated. We reviewed two ATF data systems, the Out-of-Business Records System and the Multiple Sales System, to determine if they comply with the data restrictions. We found that the systems do not violate the restrictions. Shortly after the passage of the Gun Control Act of 1968, ATF issued regulations requiring firearms licensees who permanently discontinued their businesses to forward their records to ATF within 30 days following the discontinuance. In 1986, FOPA codified this regulatory reporting requirement. According to ATF, prior to 1991 the out-of-business records were maintained at a central location in boxes, with a file number assigned to each firearms licensee. If ATF determined during a trace that a firearm had been sold by a firearms licensee who was out of business, an ATF employee manually searched the records for the appropriate serial number. According to ATF, this was a time-consuming and labor-intensive process, and the volume of records created storage problems. In 1991, ATF began a major project to microfilm these records. In fiscal year 1992, ATF established a computerized index of the microfilm records. The index contains the following information: (1) the cartridge number of the microfilm, (2) an index number, (3) the serial number of the firearm, (4) the federal firearms licensee number, and (5) the type of document on microfilm. The other information on the microfilm frames, including the firearms purchaser’s name or other identifying information, remains stored on the microfilm and is not computerized. The Out-of-Business Records System is described in detail in appendix V. We believe that ATF’s Out-of-Business Records System does not violate the data restrictions. As noted previously, 18 U.S.C. 926(a) prohibits ATF from prescribing certain rules or regulations after the date of enactment of FOPA. At the same time it added the section 926(a) restriction, Congress codified at 18 U.S.C. 923(g)(4) the then-existing regulatory requirement that licensees who permanently go out of business send these records to ATF. ATF’s current regulatory requirement concerning the out-of-business records predates FOPA and, thus, is not subject to section 926(a). With regard to the annual appropriation rider, in our view, the Out-of-Business Records System does not violate the general prohibition on “consolidation or centralization” of firearms acquisition and disposition records. The regulatory requirement that licensees send these records to ATF existed before the appropriation rider was first passed for fiscal year 1979, and there is no indication in the legislative history that the rider was intended to overturn ATF’s existing practices concerning the acquisition or use of licensee information. According to ATF, the out-of-business records historically have been maintained at a central location. Moreover, FOPA provided ATF with specific statutory authority to collect these records. In the legislative history of FOPA, there is evidence that Congress considered placing constraints on ATF’s maintenance of out-of-business records but did not do so. The Senate-passed version of FOPA prohibited the Secretary of the Treasury from maintaining out-of-business records at a centralized location and from entering them into a computer for storage or retrieval. This restrictive provision was dropped from the version of the bill enacted by Congress. Lastly, in fiscal year 1992, Congress appropriated $650,000 “for improvement of information retrieval systems at the National Firearms Tracing Center.” These funds were for the microfilming of the out-of-business records. For fiscal year 1995, Congress appropriated funds for the President’s firearms initiative, which included a request for funding of the Out-of-Business Records System. Congress provided these funds in the same legislation that contained the rider restricting consolidation and centralization of licensee data. According to ATF, the system solved storage and trace timing problems, thereby enhancing ATF’s tracing capabilities. At the same time, the system does not computerize certain key information, such as firearms purchaser information. In conclusion, we believe that the system for maintaining the out-of-business records does not violate either data restriction provision. Since 1975, federal firearms licensees have been required by regulation and subsequently by law to report all transactions in which an unlicensed person has acquired two or more pistols and/or revolvers at one time or during any 5 consecutive business days (referred to as a multiple sale). The purpose of the multiple sale reporting requirement was to enable ATF to “monitor and deter illegal interstate commerce in pistols and revolvers by unlicensed persons.” According to ATF, the multiple sale reports have historically been maintained at local ATF field divisions. In November 1995, ATF issued a new policy to centralize and computerize multiple sale reports at its National Tracing Center. The Multiple Sales Subsystem is described in detail in appendix VI. We believe that ATF’s Multiple Sales System complies with the data restrictions. As discussed earlier, the prohibitions in section 926(a) only apply to certain rules or regulations prescribed after the enactment of FOPA. In the same act, Congress codified the then-existing regulatory requirement that federal firearms licensees prepare these multiple sale reports and forward them to ATF. ATF’s current regulatory requirement concerning the multiple sale reports predates FOPA and, thus, is not subject to section 926(a). With regard to the annual appropriation rider, in our view, the Multiple Sales System does not violate the general prohibition on the “consolidation or centralization” of firearms acquisition and disposition records. The requirement that licensees prepare these reports and send them to ATF existed in regulation before the first appropriation rider was passed in fiscal year 1979, and there is no indication in the legislative history that the rider was intended to overturn ATF’s existing practices concerning the acquisition or use of licensee information. Although the multiple sale reports historically have been maintained at the field level, the provisions and legislative history of FOPA, which gave ATF specific statutory authority to collect these records, indicate that ATF would not be precluded from computerizing the multiple sale reports. FOPA requires that licensees send the reports “to the office specified” on the ATF form. Under this provision, ATF could specify that licensees forward the multiple sale reports to a central location. In addition, the legislative history of the act indicates that Congress considered placing constraints on ATF’s maintenance of multiple sale reports but did not do so. The Senate-passed version of FOPA prohibited the Secretary of the Treasury from maintaining multiple sale reports at a centralized location and from entering them into a computer for storage or retrieval. This restrictive provision was dropped from the version of the bill enacted by Congress. Lastly, for fiscal year 1995, Congress appropriated funds to implement the President’s firearms initiative, which included plans to automate multiple sale reports. Congress provided these funds in the same legislation that contained the rider restricting consolidation and centralization of licensee data. In conclusion, we believe that the current Multiple Sales System does not violate either data restriction provision. The following is GAO’s comment on ATF’s August 23, 1996, letter. 1. Concurrent with ATF’s Chief Counsel’s review of the unaudited systems in appendix IV, ATF’s Office of Science and Information Technology recategorized several of the ATF data systems discussed in appendix III. One of these systems, the Firearms Explosives and Import System, was determined not to identify retail firearms purchasers and thus we deleted it from appendix IV. Jan B. Montgomery, Assistant General Counsel Rosemary Healy, Senior Attorney The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 6015 Gaithersburg, MD 20884-6015 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (301) 258-4066, or TDD (301) 413-0006. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO reviewed various aspects of the Bureau of Alcohol, Tobacco, and Firearms' (ATF) operations, focusing on ATF compliance in meeting specific legislative restrictions in 18 U.S.C. 926(a) regarding federal firearms licensee data. GAO found that: (1) ATF identified and described 14 national data systems and 4 subsystems that relate to firearms; (2) according to ATF, five systems and one subsystem contain data that readily identify retail purchasers or possessors of specific firearms; (3) the Out-of-Business Records System contains records that federal firearms licensees are required by statute to forward to ATF within 30 days following a permanent discontinuance of their business; (4) the Multiple Sales System contains data from reports that federal firearms licensees are required by statute to send to ATF showing sales or other dispositions of two or more pistols and/or revolvers to an unlicensed person at one time or during any 5 consecutive business days; (5) the two systems, as designed, comply with the data restrictions and do not violate the appropriation rider prohibition against consolidating or centralizing licensee records; (6) on the basis of GAO's review, observations, and discussions with ATF officials, it believes that ATF operated the two systems consistently with their design, with one exception relating to the Multiple Sales System; (7) GAO agrees with ATF's view of section 926(a), but GAO believes that ATF's interpretation of the annual appropriation rider was too narrow; (8) ATF contended that both section 926(a) and the appropriation rider restricted it from issuing rules and regulations imposing additional reporting requirements on licensees but did not restrict what it did internally with information it otherwise acquired; (9) GAO agrees that the restriction in section 926(a) limits ATF only from prescribing certain rules or regulations, but the appropriation rider contains no language that would limit its application either to prescribing rules and regulations or to imposing additional reporting requirements on licensees; (10) GAO believes that the rider has legal effect independent of section 926; (11) GAO does not believe that the rider precludes all information practices and data systems that involve an element of "consolidating or centralizing" licensee records; (12) to the extent that the centralization or consolidation of firearms transaction records is incident to carrying out a specific ATF responsibility and does not entail the aggregation of data on firearms transactions in a manner that would go beyond the purposes of the Gun Control Act of 1968, as amended, GAO does not believe that the rider would be violated; and (13) given its legal position on the limited scope of the rider, ATF had not systematically analyzed its data systems and information practices to give appropriate effect to the appropriation rider.