Firearms Data:

ATF Did Not Always Comply with the Appropriations Act Restriction and Should Better Adhere to Its Policies

GAO-16-552: Published: Jun 30, 2016. Publicly Released: Aug 1, 2016.

Additional Materials:

Contact:

Diana C. Maurer
(202) 512-9627
maurerd@gao.gov

 

Helen T. Desaulniers
(202) 512-4740
desaulniersh@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

What GAO Found

To carry out its criminal and regulatory enforcement responsibilities, the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has 25 firearms-related data systems, 16 of which contain retail firearms purchaser information from a federal firearms licensee (FFL)—such as firearms importers and retailers. GAO selected 4 systems for review that are used in the firearms tracing process, based on factors such as the inclusion of retail purchaser information and original data.

The Out-of-Business Records Imaging System (OBRIS) stores nonsearchable images of firearms records from out-of-business FFLs. Such FFLs are required by law to provide their records to ATF.

Access 2000 (A2K) provides servers for National Tracing Center (NTC) personnel to electronically search participating FFLs' records at their premises for firearms disposition information during a trace.

The Firearm Recovery Notification Program (FRNP) maintains information on firearms that have not yet been recovered by law enforcement, but are suspected of being involved in criminal activity and are associated with an ATF criminal investigation.

Multiple Sales (MS) includes firearms information from multiple sales reports. FFLs are required by law to report to ATF sales of two or more revolvers or pistols during 5 consecutive business days. ATF policy requires that certain information in MS be deleted after 2 years if the firearm has not been connected to a trace.

Of the 4 data systems, 2 fully comply and 2 did not always comply with the appropriations act restriction prohibiting consolidation or centralization of FFL records. ATF addressed these compliance issues during the course of GAO's review. ATF also does not consistently adhere to its policies. Specifically:

OBRIS complies with the restriction and adheres to policy.

A2K for in-business FFL records complies with the restriction. A2K for out-of-business FFL records did not comply with the restriction because ATF maintained these data on a single server at ATF. Thus, ATF deleted the records in March 2016. In addition, ATF policy does not specify how, if at all, FFLs may use A2K records to meet out-of-business record submission requirements. Such guidance would help ensure they submit such records.

FRNP generally complies with the restriction. However, a 2007 through 2009 program using FRNP did not comply. ATF cancelled this program in 2009 and deleted the related data in March 2016. Also, a technical defect allows ATF agents to access FRNP data—including purchaser data—beyond what ATF policy permits. Aligning system capability with ATF policy would ensure that firearms purchaser data are only provided to those with a need to know.

MS complies with the restriction, but ATF inconsistently adheres to its policy when deleting MS records. Specifically, until May 2016, MS contained over 10,000 names that were not consistently deleted within the required 2 years. Aligning the MS deletion policy with the timing of deletions could help ATF maintain only useful MS purchaser data and safeguard privacy.

Why GAO Did This Study

ATF is responsible for enforcing certain criminal statutes related to firearms, and must balance its role in combatting the illegal use of firearms with protecting the privacy rights of law-abiding gun owners. As part of this balance, FFLs are required to maintain firearms transaction records, while ATF has the statutory authority to obtain these records under certain circumstances. ATF must also comply with an appropriations act provision that restricts the agency from using appropriated funds to consolidate or centralize FFL records.

GAO was asked to review ATF's compliance with this restriction. This report (1) identifies the ATF data systems that contain retail firearms purchaser data and (2) determines whether selected ATF data systems comply with the appropriations act restriction and adhere to ATF policies. GAO reviewed ATF policy and program documents, observed use of data systems at NTC, reviewed a generalizable sample of one system's records, and interviewed ATF officials at headquarters and NTC.

What GAO Recommends

GAO recommends that ATF provide guidance to FFLs participating in A2K on the provision of records to ATF when they go out of business; align system capability with ATF policy to limit access to FRNP firearms purchaser information for ATF agents; and align timing and ATF policy for deleting MS records. ATF concurred with our recommendations.

For more information, contact Diana C. Maurer at (202) 512-9627 or maurerd@gao.gov, or Helen Desaulniers at (202) 512-4740 or desaulniersh@gao.gov.

Recommendations for Executive Action

  1. Status: Closed - Implemented

    Comments: In September 2016, ATF stated that it would develop guidance to better ensure compliance with out-of-business record restrictions. In addition, ATF reported that it revised memorandums of understanding with participants to incorporate procedures participant should follow when going out of business. In February 2017, ATF sent out guidance to current A2K participants that specified how an FFL participating in A2K should provide its records to ATF upon going out of business. In March 2017, ATF provided its updated memorandum of understanding with instructions for provision of out-of-business records to ATF. The guidance that ATF has provided should help to ensure that ATF adheres to its policies and facilitates industry compliance with requirements.

    Recommendation: In order to help ensure that ATF adheres to its policies and facilitates industry compliance with requirements, the Deputy Director of ATF should provide guidance to FFLs participating in A2K for provision of out-of-business records to ATF, so that FFLs can better ensure that they are in compliance with statutory and regulatory requirements.

    Agency Affected: Department of Justice: Bureau of Alcohol, Tobacco, Firearms and Explosives

  2. Status: Closed - Implemented

    Comments: In September 2016, ATF reported that it took steps to limit access to FRNP purchaser information. Specifically, ATF stated that it changed FRNP policy to prohibit entering purchaser information into the system and deleted historical purchaser information. In addition, ATF stated that it will remove the purchaser information field within FRNP to align the system capacity with the updated FRNP policy during the next system upgrade. In March 2017, ATF provided documentation of its change in procedure to collect FRNP purchaser information. In July 2017, ATF confirmed that it deleted historical purchaser information from FRNP. ATF's changes in its procedure and deletion of historical purchaser information ensure that FRNP purchaser information access is limited, consistent with ATF policy.

    Recommendation: In order to help ensure that ATF adheres to its policies and facilitates industry compliance with requirements, the Deputy Director of ATF should develop and implement short-term and long-term mechanisms to align the eTrace system capability with existing ATF policy to limit access to FRNP purchaser information for ATF agents.

    Agency Affected: Department of Justice: Bureau of Alcohol, Tobacco, Firearms and Explosives

  3. Status: Open

    Comments: In September 2016, ATF reported that it deleted all purchaser names within those multiple sale records GAO identified as having been retained beyond time limits specified by ATF?s policy. In addition, ATF stated that it is in the process of implementing protocols to ensure that purging purchaser names within multiple sale records aligns with ATF policy. As of March 2017, ATF reported changing its query code to result in an improved match ratio with the MS system. In July 2017, ATF reiterated its deletion of affected purchaser names and its change in query code. However, given the longstanding nature of this issue, ATF needs to provide more documentation to demonstrate that the change in query code will identify all records eligible for deletion.

    Recommendation: In order to help ensure that ATF adheres to its policies and facilitates industry compliance with requirements, the Deputy Director of ATF should align the MS deletion policy, MS system design, and the timeliness of deletion practices to improve ATF's compliance with the policy.

    Agency Affected: Department of Justice: Bureau of Alcohol, Tobacco, Firearms and Explosives

 

Explore the full database of GAO's Open Recommendations »

Oct 12, 2017

Sep 26, 2017

Sep 7, 2017

Jul 31, 2017

Jul 26, 2017

Jul 24, 2017

Jun 28, 2017

Apr 26, 2017

Looking for more? Browse all our products here