ATF, a criminal and regulatory enforcement agency within the Department of the Treasury, is responsible for providing industry regulation; collecting revenue; and enforcing federal statutes regarding firearms, explosives, alcohol, tobacco, and arson. A critical component of ATF’s criminal enforcement mission is the tracing of firearms used in crimes to identify the last known purchaser of a firearm. To accomplish its criminal enforcement responsibilities, ATF has 22 field divisions, headed by special agents in charge, located throughout the United States. To efficiently and effectively carry out its enforcement responsibilities, ATF maintains certain computerized information on firearms and firearms purchasers. Over the years, Congress has tried to balance the law enforcement need for this information with the competing interest of protecting the privacy of firearms owners. To achieve this balance, Congress has required federal firearms licensees to provide ATF certain information about firearms transactions and the ownership of firearms while placing restrictions on ATF’s maintenance and use of such data. The Gun Control Act of 1968, as amended, established a system requiring federal firearms licensees to record firearms transactions, maintain that information at their business premises, and make these records available to ATF for inspection and search under certain prescribed circumstances.The system was intended to permit law enforcement officials to trace firearms involved in crimes while allowing the records themselves to be maintained by the licensees rather than by a governmental entity. Through the use of these records, ATF provides firearms tracing services to federal, state, local, and foreign law enforcement agencies. To carry out its firearms tracing responsibilities, ATF maintains a firearms tracing operation at the National Tracing Center in Falling Waters, West Virginia. The Center traces firearms suspected of being involved in crimes to the last known purchaser to assist law enforcement in identifying suspects. Appendix II provides a detailed description and flowchart of ATF’s tracing operation. Since the passage of the Gun Control Act, Congress has enacted two provisions that place restrictions on ATF’s handling of federal firearms licensee records. Since fiscal year 1979, the annual Treasury appropriation act generally has prohibited ATF from using appropriated funds in connection with consolidating or centralizing the records of acquisition and disposition of firearms maintained by federal firearms licensees. In addition, a provision of the Firearms Owners’ Protection Act of 1986 (P.L. 99-308, 100 Stat. 449 (May 19, 1986)), codified at 18 U.S.C. 926(a), prohibits ATF from issuing any rule or regulation, after the date of that act, requiring that (1) firearms licensee records (or any portion of the contents of the records) be recorded at or transferred to a facility owned, managed, or controlled by the United States or any state or any political subdivision thereof or (2) any system of registration of firearms, firearms owners, or firearms transactions or dispositions be established. Further, section 926(a) provides that ATF’s authority to inquire into the disposition of a firearm during a criminal investigation is not restricted or expanded by this section. The act also limited ATF’s authority to require reports from licensees to those specified by statute and codified several reporting requirements that ATF had previously imposed on licensees by regulation, including those related to out-of-business licensee records and reports of multiple handgun (pistols and/or revolvers) sales. To address our objectives, we reviewed ATF documents and data and discussed ATF policies and operations with agency officials. We obtained from ATF officials descriptions of national data systems that ATF officials determined were related to firearms, including those that contained retail firearms purchaser data. Although we reviewed the descriptive data provided by ATF on the firearms-related data systems, with the exception of the Out-of-Business Records and the Multiple Sales Systems, we did not verify whether these or any other ATF data systems contained retail firearms purchaser data or observe system operations. We reviewed relevant laws and ATF regulations, legal opinions, and documents relating to ATF’s firearms tracing, out-of-business records, and multiple sale reports processing operations. We also observed and conducted some tests of these operations and discussed them with officials at ATF’s National Tracing Center. We did not review ATF’s other systems for compliance with the data restrictions. With regard to the Out-of-Business Records and Multiple Sales Systems, we did not review their compliance with other statutory requirements, such as the Privacy Act and the Computer Security Act. We reviewed relevant laws and ATF regulations, legal opinions, and other documents concerning the data restrictions. We discussed ATF’s legal interpretation of the data restrictions with ATF’s Associate Chief Counsel (Firearms and Explosives) and other headquarters and Tracing Center officials. Appendix I contains a detailed discussion of our objectives, scope, and methodology. We did our work at ATF’s headquarters in Washington, D.C., and National Tracing Center in Falling Waters, West Virginia, from August 1995 through July 1996 in accordance with generally accepted government auditing standards. We obtained comments on a draft of this report from ATF. These comments are discussed at the end of this letter and are reprinted in appendix IX. ATF officials also provided some technical comments, which we incorporated where appropriate. ATF collects and maintains data from the firearms industry to carry out its criminal and regulatory enforcement responsibilities more efficiently and effectively. ATF’s criminal enforcement responsibilities include investigating firearms-related crimes and tracing firearms used in crimes, and its regulatory responsibilities include regulating the manufacture and importation of firearms and licensing firearms dealers. ATF has established national data systems to maintain the data it collects from the firearms industry, including federal firearms licensees. To identify ATF national data systems that contain retail firearms purchaser data, we requested from ATF a description of its national data systems that relate to firearms. ATF identified and provided documentation on 14 national data systems and 4 subsystems relating to firearms. Appendix III provides a brief description of these systems and subsystems. ATF indicated that five systems and one subsystem contain retail firearms purchaser data. These are the (1) Firearms Tracing System and one of its three subsystems—the system dealing with multiple sale reports; (2) Firearms Tracking System; (3) Project Lead; (4) Out-of-Business Records System; and (5) National Firearms Act Database. Appendix IV provides a detailed description of the five systems and one subsystem. We reviewed the descriptive information provided by ATF to determine whether we agreed with its categorization of the data systems and subsystems. On the basis of that review and follow-up discussions with ATF officials, ATF recategorized several of the systems and subsystems. On the basis of the information provided by ATF, we agreed with its categorization of its data systems as presented in appendixes III and IV. The Out-of-Business Records and Multiple Sales Systems, as designed, comply with the legislative data restrictions. Also, on the basis of our review, observations, and discussions with ATF officials, we believe that ATF operates the systems consistently with their design, with one exception relating to the purging of data from the Multiple Sales System, which ATF subsequently informed us it had taken action to correct. Shortly after the passage of the Gun Control Act of 1968, ATF issued regulations requiring federal firearms licensees who permanently discontinued their businesses to forward their transaction records to ATF within 30 days following the discontinuance. This ensured that ATF had access to these records for its tracing operation. In 1986, the Firearms Owners’ Protection Act codified this regulatory reporting requirement.Accordingly, since the enactment of the Gun Control Act, ATF has maintained the out-of-business records at a central location, currently the National Tracing Center. Before fiscal year 1991, ATF maintained these records in hard copy in boxes, with a file number assigned to each firearms licensee. If ATF determined during a trace that a firearm had been sold by a firearms licensee who was out of business and had sent in its records, an ATF employee was to locate the boxes containing the records and manually search them for the appropriate serial number. According to ATF, this was a time-consuming and labor-intensive process, which also created storage problems for ATF. In 1991, ATF began a major project to microfilm these records and destroy the originals. In fiscal year 1992, ATF began using a minicomputer to create a computerized index of the microfilm records containing the information necessary to identify whether ATF had a record relating to a firearm being traced. The index contains the following information: (1) the cartridge number of the microfilm; (2) an index number; (3) the serial number of the firearm; (4) the federal firearms licensee number; and (5) the type of document on microfilm, i.e., a Firearms Transaction Record (ATF Form 4473) or acquisition and disposition logbook pages. The index information that is entered into the minicomputer is stored on a database in ATF’s mainframe computer to allow searches of the index information. The other information, including the firearms purchaser’s name or other identifying information and the firearms manufacturer, type, and model, remains stored on microfilm cartridges and is not computerized. Appendix V provides a more detailed description of the Out-of-Business Records System along with pertinent statistical data. We believe that ATF’s current Out-of-Business Records System complies with the data restrictions. With regard to 18 U.S.C. 926(a), as discussed earlier, it prohibits ATF from prescribing certain rules or regulations after the date of enactment of the Firearms Owners’ Protection Act. At the same time it added the section 926(a) restriction, Congress codified at 18 U.S.C.