“hat no funds appropriated herein or hereafter shall be available for salaries or  administrative expenses in connection with consolidating or centralizing, within the  Department of Justice, the records, or any portion thereof, of acquisition and  disposition of firearms maintained by Federal firearms licensees.”

	ATF Has 16 Data Systems That Contain Retail Firearms Purchaser Data; Selected Systems Are Involved in Tracing Process

		ATF Has 16 Systems with Retail Purchaser Data

ATF collects and maintains data from the firearms industry to carry out its  criminal and regulatory enforcement responsibilities, and has established  25 national ATF data systems relating to firearms to maintain the data it  collects. Of these 25 data systems, the following 16 data systems contain  retail firearms purchaser information:  1. Access 2000 (A2K)  2. Multiple Sales (MS)  10. Out-of-Business Records Imaging System (OBRIS)  15. This includes all  acquisition and disposition logbooks, firearms transactions records—such  as Form 4473 that contains purchaser information—and other required  records. The other two data  systems did not always comply with the restriction, although ATF  addressed the compliance issues during the course of our review. Specifically:
OBRIS complies with the appropriations act restriction and adheres to  ATF policies. Further,  FRNP generally adheres to ATF policies, but a technical defect allows  ATF agents to view and print FRNP data beyond what ATF policy  permits. FFLs are specifically required to submit records to ATF when  going out of business, and the system limits the accessibility of key  firearms records information, such as retail purchaser data. A2K for Out-of-Business Records Did Not Comply with the Appropriations Act Restriction, and ATF Could Provide Clearer Guidance

Beginning in 2000, ATF maintained A2K disposition data from out-of- business industry members on a single partitioned server within NTC, and  removed the records from the server in March 2016. A Past ATF Regional Program Did Not Comply with the Appropriations Act Restriction

An ATF regional program conducted from 2007 through 2009 to enter  firearms into FRNP—the Southwest Border Secondary Market Weapons  of Choice (SWBWOC) Program—did not comply with the appropriations  act restriction on consolidating or centralizing FFLs’ firearms records,  because the individual firearms were not suspected of being involved in  criminal activity associated with an ATF criminal investigation. MS Complies with the Appropriations Act Restriction, but ATF Continues to Inconsistently Adhere to ATF Policy When Deleting Records

MS complies with the appropriations act restriction; however, ATF lacks  consistency among its MS deletion policy, system design, and policy  implementation timing. As discussed, FFLs are required to maintain certain firearms  records at their places of business. ATF’s Long-Standing Struggle to Implement Its MS Deletion Policy Persists

Although not required by statute, ATF policy requires that firearms  purchaser names be deleted from MS 2 years after the date of the  reports, if the firearm has not been connected to a firearms trace. Conclusions

ATF has an important role in combatting the illegal use of firearms, and  must balance this with protecting the privacy rights of law-abiding firearms  owners. Specifically, providing guidance to industry members participating in A2K  for how to submit their records when they go out of business would help  ensure they submit required records to ATF. In addition,  aligning eTrace system capability with ATF policy to limit access to  firearms purchaser information in FRNP would ensure that such  information is only provided to those with a need to know. Recommendations for Executive Action

In order to help ensure that ATF adheres to its policies and facilitates  industry compliance with requirements, we recommend that the Deputy  Director of ATF take the following three actions: provide guidance to FFLs participating in A2K for provision of out-of- business records to ATF, so that FFLs can better ensure that they are  in compliance with statutory and regulatory requirements; develop and implement short-term and long-term mechanisms to align  the eTrace system capability with existing ATF policy to limit access to  FRNP purchaser information for ATF agents; and align the MS deletion policy, MS system design, and the timeliness of  deletion practices to improve ATF’s compliance with the policy. 2. Determine whether selected ATF data systems comply with the  appropriations act restriction on consolidation or centralization of  firearms records and ATF policies. Appendix IV: Firearm Recovery Notification Program Submission Form

Appendix V: Multiple Sales Submission Form for Multiple Sales Reports

Appendix VI: Multiple Sales Submission Form for Demand Letter 3 Reports

Appendix VII: Legal Analysis of Compliance with the Restriction on Consolidation or Centralization of Firearms Records

A provision in the fiscal year 2012 appropriation for the Bureau of Alcohol,  Tobacco, Firearms and Explosives (ATF) prohibits the use of the  appropriation to consolidate or centralize records on the acquisition and  disposition of firearms maintained by federal firearms licensees (FFL). Through this program, ATF records information— manufacturer, serial number, and type—about firearms that have not yet  been recovered by other law enforcement authorities, but are suspected  of being involved in criminal activity and are associated with an ATF  criminal investigation. ATF deleted the related data from FRNP in March 2016. § 923(g)(3)(A), an FFL is required to report sales or other  dispositions of two or more pistols or revolvers to a non-FFL at one time  or during 5 consecutive business days.
Why GAO Did This Study

ATF is responsible for enforcing certain criminal statutes related to firearms, and must balance its role in combatting the illegal use of firearms with protecting the privacy rights of law-abiding gun owners. As part of this balance, FFLs are required to maintain firearms transaction records, while ATF has the statutory authority to obtain these records under certain circumstances. ATF must also comply with an appropriations act provision that restricts the agency from using appropriated funds to consolidate or centralize FFL records.
GAO was asked to review ATF's compliance with this restriction. This report (1) identifies the ATF data systems that contain retail firearms purchaser data and (2) determines whether selected ATF data systems comply with the appropriations act restriction and adhere to ATF policies. GAO reviewed ATF policy and program documents, observed use of data systems at NTC, reviewed a generalizable sample of one system's records, and interviewed ATF officials at headquarters and NTC.

What GAO Found

To carry out its criminal and regulatory enforcement responsibilities, the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has 25 firearms-related data systems, 16 of which contain retail firearms purchaser information from a federal firearms licensee (FFL)—such as firearms importers and retailers. GAO selected 4 systems for review that are used in the firearms tracing process, based on factors such as the inclusion of retail purchaser information and original data.
The Out-of-Business Records Imaging System (OBRIS) stores nonsearchable images of firearms records from out-of-business FFLs. Such FFLs are required by law to provide their records to ATF.
Access 2000 (A2K) provides servers for National Tracing Center (NTC) personnel to electronically search participating FFLs' records at their premises for firearms disposition information during a trace.
The Firearm Recovery Notification Program (FRNP) maintains information on firearms that have not yet been recovered by law enforcement, but are suspected of being involved in criminal activity and are associated with an ATF criminal investigation.
Multiple Sales (MS) includes firearms information from multiple sales reports. FFLs are required by law to report to ATF sales of two or more revolvers or pistols during 5 consecutive business days. ATF policy requires that certain information in MS be deleted after 2 years if the firearm has not been connected to a trace.
Of the 4 data systems, 2 fully comply and 2 did not always comply with the appropriations act restriction prohibiting consolidation or centralization of FFL records. ATF addressed these compliance issues during the course of GAO's review. ATF also does not consistently adhere to its policies. Specifically:
OBRIS complies with the restriction and adheres to policy.
A2K for in-business FFL records complies with the restriction. A2K for out-of-business FFL records did not comply with the restriction because ATF maintained these data on a single server at ATF. Thus, ATF deleted the records in March 2016. In addition, ATF policy does not specify how, if at all, FFLs may use A2K records to meet out-of-business record submission requirements. Such guidance would help ensure they submit such records.
FRNP generally complies with the restriction. However, a 2007 through 2009 program using FRNP did not comply. ATF cancelled this program in 2009 and deleted the related data in March 2016. Also, a technical defect allows ATF agents to access FRNP data—including purchaser data—beyond what ATF policy permits. Aligning system capability with ATF policy would ensure that firearms purchaser data are only provided to those with a need to know.
MS complies with the restriction, but ATF inconsistently adheres to its policy when deleting MS records. Specifically, until May 2016, MS contained over 10,000 names that were not consistently deleted within the required 2 years. Aligning the MS deletion policy with the timing of deletions could help ATF maintain only useful MS purchaser data and safeguard privacy.

What GAO Recommends

GAO recommends that ATF provide guidance to FFLs participating in A2K on the provision of records to ATF when they go out of business; align system capability with ATF policy to limit access to FRNP firearms purchaser information for ATF agents; and align timing and ATF policy for deleting MS records. ATF concurred with our recommendations.