Firearms Data: ATF Did Not Always Comply with the Appropriations Act Restriction and Should Better Adhere to Its Policies
Highlights
What GAO Found
To carry out its criminal and regulatory enforcement responsibilities, the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has 25 firearms-related data systems, 16 of which contain retail firearms purchaser information from a federal firearms licensee (FFL)—such as firearms importers and retailers. GAO selected 4 systems for review that are used in the firearms tracing process, based on factors such as the inclusion of retail purchaser information and original data.
The Out-of-Business Records Imaging System (OBRIS) stores nonsearchable images of firearms records from out-of-business FFLs. Such FFLs are required by law to provide their records to ATF.
Access 2000 (A2K) provides servers for National Tracing Center (NTC) personnel to electronically search participating FFLs' records at their premises for firearms disposition information during a trace.
The Firearm Recovery Notification Program (FRNP) maintains information on firearms that have not yet been recovered by law enforcement, but are suspected of being involved in criminal activity and are associated with an ATF criminal investigation.
Multiple Sales (MS) includes firearms information from multiple sales reports. FFLs are required by law to report to ATF sales of two or more revolvers or pistols during 5 consecutive business days. ATF policy requires that certain information in MS be deleted after 2 years if the firearm has not been connected to a trace.
Of the 4 data systems, 2 fully comply and 2 did not always comply with the appropriations act restriction prohibiting consolidation or centralization of FFL records. ATF addressed these compliance issues during the course of GAO's review. ATF also does not consistently adhere to its policies. Specifically:
OBRIS complies with the restriction and adheres to policy.
A2K for in-business FFL records complies with the restriction. A2K for out-of-business FFL records did not comply with the restriction because ATF maintained these data on a single server at ATF. Thus, ATF deleted the records in March 2016. In addition, ATF policy does not specify how, if at all, FFLs may use A2K records to meet out-of-business record submission requirements. Such guidance would help ensure they submit such records.
FRNP generally complies with the restriction. However, a 2007 through 2009 program using FRNP did not comply. ATF cancelled this program in 2009 and deleted the related data in March 2016. Also, a technical defect allows ATF agents to access FRNP data—including purchaser data—beyond what ATF policy permits. Aligning system capability with ATF policy would ensure that firearms purchaser data are only provided to those with a need to know.
MS complies with the restriction, but ATF inconsistently adheres to its policy when deleting MS records. Specifically, until May 2016, MS contained over 10,000 names that were not consistently deleted within the required 2 years. Aligning the MS deletion policy with the timing of deletions could help ATF maintain only useful MS purchaser data and safeguard privacy.
Why GAO Did This Study
ATF is responsible for enforcing certain criminal statutes related to firearms, and must balance its role in combatting the illegal use of firearms with protecting the privacy rights of law-abiding gun owners. As part of this balance, FFLs are required to maintain firearms transaction records, while ATF has the statutory authority to obtain these records under certain circumstances. ATF must also comply with an appropriations act provision that restricts the agency from using appropriated funds to consolidate or centralize FFL records.
GAO was asked to review ATF's compliance with this restriction. This report (1) identifies the ATF data systems that contain retail firearms purchaser data and (2) determines whether selected ATF data systems comply with the appropriations act restriction and adhere to ATF policies. GAO reviewed ATF policy and program documents, observed use of data systems at NTC, reviewed a generalizable sample of one system's records, and interviewed ATF officials at headquarters and NTC.
Recommendations
GAO recommends that ATF provide guidance to FFLs participating in A2K on the provision of records to ATF when they go out of business; align system capability with ATF policy to limit access to FRNP firearms purchaser information for ATF agents; and align timing and ATF policy for deleting MS records. ATF concurred with our recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Bureau of Alcohol, Tobacco, Firearms and Explosives | In order to help ensure that ATF adheres to its policies and facilitates industry compliance with requirements, the Deputy Director of ATF should provide guidance to FFLs participating in A2K for provision of out-of-business records to ATF, so that FFLs can better ensure that they are in compliance with statutory and regulatory requirements. |
In September 2016, ATF stated that it would develop guidance to better ensure compliance with out-of-business record restrictions. In addition, ATF reported that it revised memorandums of understanding with participants to incorporate procedures participant should follow when going out of business. In February 2017, ATF sent out guidance to current A2K participants that specified how an FFL participating in A2K should provide its records to ATF upon going out of business. In March 2017, ATF provided its updated memorandum of understanding with instructions for provision of out-of-business records to ATF. The guidance that ATF has provided should help to ensure that ATF adheres to its policies and facilitates industry compliance with requirements.
|
| Bureau of Alcohol, Tobacco, Firearms and Explosives | In order to help ensure that ATF adheres to its policies and facilitates industry compliance with requirements, the Deputy Director of ATF should develop and implement short-term and long-term mechanisms to align the eTrace system capability with existing ATF policy to limit access to FRNP purchaser information for ATF agents. |
In September 2016, ATF reported that it took steps to limit access to FRNP purchaser information. Specifically, ATF stated that it changed FRNP policy to prohibit entering purchaser information into the system and deleted historical purchaser information. In addition, ATF stated that it will remove the purchaser information field within FRNP to align the system capacity with the updated FRNP policy during the next system upgrade. In March 2017, ATF provided documentation of its change in procedure to collect FRNP purchaser information. In July 2017, ATF confirmed that it deleted historical purchaser information from FRNP. ATF's changes in its procedure and deletion of historical purchaser information ensure that FRNP purchaser information access is limited, consistent with ATF policy.
|
| Bureau of Alcohol, Tobacco, Firearms and Explosives | In order to help ensure that ATF adheres to its policies and facilitates industry compliance with requirements, the Deputy Director of ATF should align the MS deletion policy, MS system design, and the timeliness of deletion practices to improve ATF's compliance with the policy. |
In September 2016, ATF reported that it deleted all purchaser names within those multiple sale records GAO identified as having been retained beyond time limits specified by ATF's policy. In August 2018, ATF aligned its deletion policy and code to query MS. These changes should address issues related to identifying purchaser names to be deleted. In September 2019, ATF reinstituted its deletion practices after a litigation hold preventing ATF from purging MS records was lifted. As of January 2020, ATF has demonstrated adherence to its policy of deleting of records on a monthly basis. Through these actions ATF has met the intent of the recommendation.
|