Legally Armed: June 2017

By Teresa G. Ficaretta, Esq. & Johanna Reeves, Esq.

GAO Rings the Alarm Bell on ATF’s Adherence to Restrictions on Information Collection

Individuals who purchase firearms from federal firearms licensees (FFLs) are often anxious over the potential release of personal information and firearm purchase information recorded on certain forms the FFL is required to keep. What happens to the personal information and firearms information on these government forms? Does the government put the information about purchasers and firearms into a centralized database or system of registration?

Last year, the Government Accountability Office (GAO) issued a report on the Bureau of Alcohol, Tobacco, Firearms and Explosives’ (ATF’s) data restrictions titled, “FIREARMS DATA—ATF Did Not Always Comply with the Appropriations Act Restriction and Should Better Adhere to Policies.”

This article will examine the checks and balances Congress put in place to prevent the ATF from establishing a firearm registration system with centralized purchaser information. We will then review the effectiveness of these checks and balances as reported by the GAO in its June 2016 report to Congress.

I. LEGAL BACKGROUND

Under the Gun Control Act of 1968 (GCA), FFLs must create and maintain records of firearms transactions and make these records available to the ATF for inspection which can be warrantless under certain circumstances. The required records include the Form 4473, which contains the buyer’s personal information, such as name, residence address, date of birth, race and ethnicity, answers to questions focused on the buyer’s eligibility to possess a firearm, as well as the make, model and serial number of the firearm purchased. Additionally, when an FFL sells more than one handgun (pistol or revolver) to a non-licensee, either in the same transaction or within five consecutive business days, the FFL must submit the Report of Multiple Sale or Other Disposition to the ATF and designated state police or local law enforcement. The multiple sale report form also contains personal information about the buyer as well as the make, model and serial number of the particular firearms purchases.

To carry out its responsibilities under the GCA, the ATF maintains computerized information on firearms transactions derived from the Form 4473 and multiple sales reports. Because the information includes a buyer’s personal information and the make, model and serial number of firearms purchased, Congress has attempted to balance the ATF’s responsibilities under the GCA with the privacy rights of firearms owners. One way Congress has influenced the ATF’s ability to consolidate or centralize FFL records has been through restricting the agency’s use of appropriated funds for this activity. This restriction has been included in each of the ATF’s appropriation laws from 1979-2011. It became permanent through enactment of the Consolidated and Further Continuing Appropriations Act of 2012.

Another control on the ATF’s ability to consolidate firearms information is in the GCA itself, which Congress added when it enacted the Firearms Owners Protection Act of 1986. Section 926(a) (18 U.S.C. § 926(a)) prohibits the ATF from issuing rules or regulations that require FFL records “be recorded at or transferred to a facility owned, managed, or controlled” by the federal, state or local government. Section 926(a) also expressly prohibits the establishment of any system of registration of firearms, firearms owners or firearms transactions.

Although the above provisions appear to prohibit the ATF from centralizing all FFL records, both Congress and the federal courts have recognized important exceptions. For example, information required or incidental to the ATF carrying out its mission to administer and enforce the federal firearms laws is exempt from data restrictions.

The ATF is also authorized to collect, consolidate and centralize data that Congress has expressly authorized by statute. This includes:

• Multiple Sale Reports. FFLs are required by statute to provide a multiple sale report to the ATF whenever the FFL sells within any five consecutive business days, two or more pistols or revolvers to an unlicensed person. The multiple sale reports go to the ATF’s National Tracing Center (NTC) and are used as leads to detect firearms trafficking. The ATF began computerizing multiple sale reports in 1995, but because this is a statutory provision enacted by Congress, the ATF’s centralization and computerization of information on the multiple sale reports do not violate the data restrictions outlined in this article. However, an important part of the program is the ATF’s policy of deleting firearms purchaser names from the multiple sale database two years after the date of sale if the firearms listed on the form are not connected to a firearms trace.

• Out of Business Records. FFLs who discontinue business are required by statute to submit to the ATF all required records, including Form 4473, within 30 days after discontinuing business. The records are sent to the NTC and are imaged for use in tracing crime guns recovered by law enforcement agencies. This is another consolidation of records specifically authorized by Congress which does not violate the data restrictions. In order to avoid any appearance that the agency is using out-of-business records to create a system of gun registration, the ATF images these records as non-searchable images, meaning they cannot be searched through character recognition using text queries. Information on particular firearms or purchasers will only be accessed if the record is required for a firearm trace.

• Demand Letters. As we discussed in our previous “Legally Armed” article titled, “ATF’s Demand Letter Program – Alive and Well Since 2000” (Vol. 21, No. 2), the ATF has the authority under the GCA to require FFLs to report firearms record information to the ATF when requested to do so by letter. So-called “demand letters” may be issued by the ATF field or Headquarters personnel. Demand letters may require information on particular types of firearms, such as used guns, and it may be limited to a particular timeframe. The most recent demand letter program the ATF adopted was in 2011 requiring dealers located in the border states of Arizona, California, New Mexico and Texas to submit a report to the ATF on the sale of two or more semiautomatic rifles having certain specified characteristics. Data from this program, called “Demand Letter 3,” is included in the multiple sale database. Litigation challenging the ATF’s demand letters has failed, with federal courts consistently holding that the GCA does not prohibit the ATF from requiring that FFL records be sent to the agency. Federal court decisions held that the prohibitions on centralizing and consolidating FFL records do not prohibit the ATF from collecting this information.

• A2K Program. Under the GCA, FFLs must respond to an ATF firearms trace request within 24 hours of receiving the request. When the ATF receives a trace request from a law enforcement agency, the ATF contacts the manufacturer, distributor(s) and retail FFLs in the chain of distribution to determine the first retail purchaser of record. The ATF contacts FFLs by phone, fax or e-mail. This process can be time-consuming for FFLs, particularly large manufacturers and distributors who deal in a high-volume of firearms. Consequently, the ATF created the A2K program in 1995 at the request of industry members as a voluntary program providing more efficient responses to trace requests. The participating industry member uploads electronic firearms disposition records (including Form 4473) onto a server that the ATF owns and maintains. The server is located at the facility of the industry member and provides a secure web interface through which authorized ATF personnel can search disposition records for firearms that are the subject of a trace request. Records are searchable by firearm serial number only, and if a record for a firearm is located, the ATF can then request the Form 4473 for that particular firearm transaction. A2K dramatically reduces the cost of firearms tracing for the 35 industry members currently using A2K. The A2K program does not violate the data restrictions on centralizing and consolidating FFL records because the records remain the property of the FFL, the server is on the FFL’s facility, and the ATF accesses records only if a firearm requires tracing.

• Firearms Recovery Notification Program (FRNP). The FRNP was established in 1991 as a criminal investigative service to ATF agents. The program creates and maintains a database of firearms not yet recovered by law enforcement agencies but suspected of being involved in criminal activity. ATF agents submit information into this database to flag a particular firearm so if it is recovered and traced at a later date the requesting agent will be notified. For example, an ATF agent may recover a firearm during a law enforcement operation and discover it was part of a multiple sale with another firearm. The ATF agent may then enter the other firearm into FRNP because of its association with the recovered firearm and its possible connection to trafficking. If the firearm is later recovered, this evidence could be used to support a firearms trafficking case. Information in FRNP does not violate the restrictions on centralizing and consolidating FFL records because it is incident to carrying out one of the primary purposes of the GCA, to investigate and deter violent crimes committed with firearms.

II. GAO REPORT OF JUNE 2016

On August 1, 2016, the GAO published its report on the ATF’s data restrictions titled, “FIREARMS DATA—ATF Did Not Always Comply with the Appropriations Act Restriction and Should Better Adhere to Policies.” The report, dated June 30, 2016, is available on the GAO website at www.gao.gov/products/GAO-16-552.

The GAO identified 16 ATF databases with retail firearms purchaser data and selected the programs outlined above for an in-depth review of whether the ATF’s data collection and maintenance practices comply with Congress-imposed data restrictions and the agency’s own internal policies. We discuss the GAO
findings in turn.

1. GAO Conclusion: ATF Failed to Delete Purchaser Names from Multiple Sale Reports After Two Years

GAO’s review of the multiple sales database revealed that the ATF was not vigilant about deleting purchaser names two years after the date of the reports, assuming the firearm has not been connected to a trace. GAO auditors determined that 10,041 names that should have been deleted remained in the database until May 2016. ATF officials explained to auditors that the system design limitations, which require analysts to write complex queries to locate purchaser names in the database, are not always successful in identifying and removing names. The GAO report also noted that auditors determined that some multiple sale records entered in 1997 were not deleted until November 2009, about 10 years after the required two-year timeframe. The ATF’s explanation for this delay was that deleting a large number of records at once adversely affects the firearms tracing system because it slows the system response time or shuts it down entirely. GAO did not find this explanation credible, noting that the agency’s deletion log indicated the ATF is able to delete almost 100,000 records per day without adversely affecting the system. Accordingly, the GAO concluded that system constraints do not seem to be the reason for the delayed deletion of purchaser names.

2. GAO Conclusion: Out-Of-Business Records System Complies with Data Restrictions

The GAO Report states that out-of-business records are integral to the firearms tracing process. This is because in 35%-38% of firearms trace requests, at least one entity in the chain of distribution has gone out of business. Accordingly, the GAO concluded that the ATF must be able to access out-of-business records to trace the firearm. The report indicates that since 2006, the ATF has scanned out-of-business records as TIFF (Tagged Image File Format) images and stores them in the Out-of-Business Records Imaging System (OBRIS). As stated above, the records are images that cannot be searched with text queries. When the ATF receives electronic records from an FFL going out of business, it converts the files to non-searchable records consistent with paper OBRIS records.

ATF policies require OBRIS records be indexed by FFL number and chronologically by month and year. When there is a firearm trace, an NTC analyst first locates the FFL in the license number index. Once the FFL records are located, the analyst then manually searches the records to narrow the scope by date to records more likely to contain the firearm being traced. The NTC analyst then manually skims through each record in the group until locating the relevant information. It may be necessary to search thousands of pages of records to find the record matching the trace request. This resource-intensive process ensures that no system of registration has been created.

GAO auditors concluded that OBRIS complies with the appropriations act restrictions and adheres to all ATF data policies.

3. GAO Conclusion: The A2K Program for Out-of-Business FFLs Did Not Comply with Data Restrictions

The GAO Report found that beginning in 2000, the ATF maintained A2K disposition data from out-of-business FFLs on a single partitioned server within the NTC. The report noted that maintaining disposition records in this manner violated the appropriations restriction because the agency was centralizing or consolidating FFL records in a manner that was not authorized by the GCA. The report noted that the ATF should have treated A2K participants who went out of business in the same manner as other FFLs, which would require deleting the data on the server and obtaining out-of-business records directly from the FFL.

The GAO Report stated that maintaining the A2K disposition records on an ATF server located at the NTC clearly violated the appropriations restriction. By maintaining the out-of-business disposition information on a server, it could be accessed in the same manner as in-business A2K participants. The report states that, although records were only retrievable by an exact serial number search, in accordance with ATF A2K policy, it would have been technically possible for the ATF to reconfigure the server to allow records to be queried by any field, including purchaser name. This ability brings the data much closer to a system of registration of firearms purchasers in violation of the letter and spirit of the appropriations restriction. When auditors discovered this violation, the ATF began a process of transferring data from the out-of-business A2K records into the out-of-business system as digital images. The ATF deleted the information from the server in March 2016.

The GAO Report recommended that information provided to A2K participants clearly specifies
how out-of-business records should be provided to the agency so that future violations of the appropriations restriction do not occur.

4. GAO Conclusion: FRNP Complies with Restrictions, but One Regional Program Fails

The GAO concluded that FRNP generally complies with the appropriations restriction and adheres to ATF internal policies on retention of firearms purchaser information. The GAO found that gathering information on firearms suspected of a connection to a crime is limited in scope to carry out the ATF’s criminal enforcement mission. The ATF established criteria for adding particular firearms to the FRNP database, which include: (1) large quantities of firearms purchased by an individual; (2) firearms suspected in trafficking but not stolen from an FFL; (3) FFLs suspected of conducting firearms transactions without proper documentation; (4) firearms purchased by suspected straw purchasers, and (5) other—a category that the submitting agent must explain on the form. GAO auditors found that the vast majority of firearms were entered in accordance with the foregoing criteria.

However, auditors identified an ATF regional program conducted from 2007-2009, the “Southwest Border Secondary Market Weapons of Choice Program,” (SWBWOC) did not comply with data restrictions. This is because none of the firearms entered into the database was suspected of being involved in criminal activity associated with an ATF criminal investigation. According to ATF officials, the SWBWOC Program was in place in the ATF’s four southwest border field divisions to more effectively identify the purchasers of used firearms in Mexico. During routine regulatory enforcement inspections of FFLs in these states, ATF investigators recorded information about specified “weapons of choice” in the FFLs’ inventories or sold by the FFLs during the inspection period. The ATF stated that the information recorded was limited to the serial number and description of the firearm and did not include any purchaser information. The firearms information was then entered into FRNP for all of the specified weapons identified during the inspection. If the firearm was subsequently recovered by law enforcement and submitted for a trace, the ATF would identify this record in the system before contacting the manufacturer. The ATF would then be able to quickly identify the FFL that previously had the firearm in inventory.

ATF officials advised GAO that the program was cancelled in October 2009, following the ATF’s legal review of the process by which the information was acquired. However, although the information in FRNP was labeled as “inactive,” it was not deleted. ATF officials notified GAO that the 855 records from the SWBWOC program were deleted from FRNP
in March 2016.

III. CONCLUSIONS

The GAO Report on firearms data restrictions provides firearms owners with good news and bad news. The good news is that for most of the firearms and purchaser data the agency collects, the ATF has not created a system of firearms registration or a database of firearms owners. The bad news is that the ATF has problems complying with some of the data retention periods for purchaser information from multiple sales reports. This confirms the concern of some handgun purchasers that buying two or more handguns from an FFL will result in their names being in a government database forever. In addition, the NTC needs to clarify to A2K participants that the agency will not maintain firearms disposition information after the participants go out of business and then needs to make sure it follows through on that assurance.

Finally, ATF field division personnel should receive regular, mandatory training on data restrictions and the general prohibition on the creation of new databases with purchaser and firearms information. It is important for every ATF employee to understand the sensitivity of this information and the critical responsibility of the agency, as an arm of the federal government, to exercise its authority and power to access to such information fairly, responsibly and in line with the United States Constitution.

The information contained in this article is for general informational and educational purposes only and is not intended to be construed or used as legal advice or as legal opinion. You should not rely or act on any information contained in this article without first seeking the advice of an attorney. Receipt of this article does not establish an attorney-client relationship.

About the authors

Johanna Reeves is the founding partner of the law firm Reeves & Dola, LLP in Washington, DC (www.reevesdola.com). For more than 10 years she has dedicated her practice to advising and representing U.S. companies on compliance matters arising under the federal firearms laws and U.S. export controls. Since 2011, Johanna also has served as Executive Director for the FireArms Import/Export Roundtable (F.A.I.R.) Trade Group (http://fairtradegroup.org). In 2016, Johanna was appointed by the U.S. Department of State, Bureau of Political-Military Affairs to serve on the 2016-18 Defense Trade Advisory Group (DTAG).

Teresa Ficaretta is an expert on ATF regulations under the Gun Control Act, the National Firearms Act, the Arms Export Control Act and federal explosives laws. Before joining Reeves & Dola in 2013, Teresa served as legal counsel to the ATF for 26 years, followed by two years as Deputy Assistant Director in Enforcement Programs and Services. Teresa was elected partner to Reeves & Dola in January 2016.

Both Johanna and Teresa can be reached at 202-683-4200 or at [email protected].