Gun Control: Implementation of the National Instant

Gun Control: Implementation of the National Instant Criminal Background
Check System (Letter Report, 02/29/2000, GAO/GGD/AIMD-00-64).

Pursuant to a congressional request, GAO provided information on a wide
variety of topics related to the permanent provisions (phase II) of the
Brady Handgun Violence Prevention Act, focusing on: (1) statistics on
background checks, denials, and appeals; (2) enforcement actions; (3)
the National Instant Criminal Background Check System's (NICS)
operations; and (4) pawnshop issues.

GAO noted that: (1) almost 9 million background checks were conducted
during the first year of NICS operations; (2) the Federal Bureau of
Investigation (FBI) conducted about half of these background checks, and
designated state agencies conducted the other half; (3) approximately
three-quarters of the background checks done by the FBI resulted in the
federal firearms licensees' being allowed to immediately transfer the
firearms to the potential buyers; (4) the remainder of the FBI
background checks were delayed to allow FBI NICS examiners research time
to establish a basis for making proceed or deny determinations; (5) the
FBI reported (on the basis of a sample of delayed transactions
researched by selected examiners) that for about 80 percent of the
delayed transactions, the examiners made a proceed or a deny
determination within 2 hours; (6) the remainder of the delayed
transactions, 20 percent, took hours or days to reach a determination,
generally because the FBI examiners needed to contact local or state
resources for additional information; (7) depending upon the
circumstances, there are various enforcement actions that the federal
government can take against individuals who do not acknowledge their
prohibited status on the firearm-purchase form; (8) for example,
individuals who knowingly falsify their status on this form can be
criminally prosecuted under federal law; (9) nationally, for fiscal year
1999, Executive Office for U.S. Attorney (EOUSA) data indicate that
2,272 defendants charged for alleged firearms related false-statement
violations and alleged possession violations were convicted and that 43
percent of these defendants received a sentence in excess of 5 years;
(10) EOUSA could not specifically identify how many of these cases
involve Brady-related charges; (11) although NICS has been operational
for 15 months, it has yet to be authorized as secure in accordance with
the Department of Justice's own requirements, and attempts to do so have
been delayed; (12) further delays in authorizing NICS will expose the
system and the data it processes about individuals to unnecessary risk;
and (13) therefore, it is extremely important that the FBI fulfill its
commitment to authorize NICS by March 31, 2000.

--------------------------- Indexing Terms -----------------------------

REPORTNUM: GGD/AIMD-00-64
TITLE: Gun Control: Implementation of the National Instant
Criminal Background Check System
DATE: 02/29/2000
SUBJECT: Law enforcement information systems
Gun control law
Firearms
State law
Law enforcement agencies
Federal aid for criminal justice
Crimes or offenses
IDENTIFIER: FBI National Instant Criminal Background Check System
NCIC 2000 System
FBI Interstate Identification Index
FBI Integrated Automated Fingerprint Identification System
DOJ National Criminal History Improvement Program

******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO report. Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
** A printed copy of this report may be obtained from the GAO **
** Document Distribution Center. For further details, please **
** send an e-mail message to: **
** **
** **
** **
** with the message 'info' in the body. **
******************************************************************

United States General Accounting Office
GAO

Report to the Honorable Craig Thomas

U.S. Senate

February 2000

GAO/GGD/AIMD-00-64

GUN CONTROL
Implementation of the National Instant Criminal

Background Check System

Ordering Copies of GAO Reports
The first copy of each GAO report and testimony
is free. Additional copies are $2 each. Orders
should be sent to the following address,
accompanied by a check or money order made out
to the Superintendent of Documents, when
necessary. VISA and MasterCard credit cards are
accepted, also. Orders for 100 or more copies to
be mailed to a single address are discounted 25
percent.
Order by mail:
U.S. General Accounting Office
P.O. Box 37050
Washington, DC 20013
or visit:
Room 1100
700 4th St. NW (corner of 4th and G Sts. NW)
U.S. General Accounting Office
Washington, DC
Orders may also be placed by calling (202) 512-
6000 or by using fax number (202) 512-6061, or
TDD (202) 512-2537.
Each day, GAO issues a list of newly available
reports and testimony. To receive facsimile
copies of the daily list or any list from the
past 30 days, please call (202) 512-6000 using a
touch-tone phone. A recorded menu will provide
information on how to obtain these lists.
Viewing GAO Reports on the Internet
For information on how to access GAO reports on
the INTERNET, send e-mail message with "info" in
the body to:
[email protected]
or visit GAO's World Wide Web Home Page at:
http://www.gao.gov

Reporting Fraud, Waste, and Abuse in Federal
Programs
To contact GAO FraudNET use:
Web site:
http://www.gao.gov/fraudnet/fraudnet.htm
E-Mail: [email protected]
Telephone: 1-800-424-5454 (automated answering
system)

United States
General Accounting Office
Washington, D.C. 20548-0001
Official Business
Penalty for Private Use $300
Address Correction Requested

Bulk Rate
Postage & Fees Paid
GAO
Permit No. G100

(184425)

Contents
Page 181GAO/GGD/AIMD-00-64 Gun Control: Implementation of NICS
Letter 1

Appendix I 22
Overview of Firearm-
Purchase Application and
Background Check Process
Background 22
Questions and Responses Regarding the 32
Process in Which the FFL Contacts the
FBI

Appendix II 34
Statistics on Background
Checks, Denials, and
Appeals Under the
National Instant
Criminal Background
Check System
Number of Background Checks 34
Number of Denials 35
Number of Appeals 37

Appendix III 39
Federal Enforcement
Policies and Results
Regarding Falsified
Firearm-Purchase Forms
Federal Enforcement Policies 39
Prosecutions, Fugitive Arrests, and 43
Firearm Retrievals

Appendix IV 52
Operations of the
National Instant
Criminal Background
Check System
NICS Architecture 52
Capacity Management 58
System Availability 59
Transaction Response Time 64
Retention of Records 71
Program Monitoring Activities 77
System Security Authorization 78
Exemption From the Privacy Act 80
Making NICS Fingerprint-based Rather 82
Than Name-based
Appendix V 83
Background Checks
Regarding Owner
Redemptions of Pawned
Firearms
Background 83
Under Current Law, Owner Redemptions 83
of Pawned Firearms Are Subject to
NICS Background Checks
Although Not Separately Identified, 86
Multiple Pawn Transactions Are
Included in NICS Statistics

Appendix VI 87
Objectives, Scope, and
Methodology
Objectives 87
Overview of Our Scope and Methodology 87

Appendix VII 95
GAO Contacts and Staff
Acknowledgments
GAO Contacts 95
Acknowledgments 95

Tables Table II.1: Number of NICS Background 34
Checks Conducted by the FBI and
Designated State Agencies (Nov. 30,
1998, Through Nov. 30, 1999)
Table II.2: Reasons for Handgun 36
Purchase Denials Under Phase I of the
Brady Act (Jan. 1, 1998, Through Nov.
29, 1998)
Table II.3: Results of FBI NICS 36
Background Checks (Nov. 30, 1998,
Through Nov. 30, 1999)
Table II.4: Number of FBI Denials (and 37
Reasons) Under NICS (Nov. 30, 1998,
Through Nov. 30, 1999)
Table II.5: Number of Appeals of FBI 37
Denials (and Results) Under NICS
(Nov. 30, 1998, Through Nov. 30,
1999)
Table II.6: Reasons for Successful 38
Appeals of FBI Denials Under NICS,
January Through November 1999
Table III.1: Enforcement Status of 43
NICS Referrals Received by ATF Field
Offices for Investigation (as of
Sept. 30, 1999)
Table III.2: Firearms-Related Cases 44
Handled by U.S. Attorneys, Fiscal
Year 1999
Table III.3: Federal Firearms-Related 45
Cases Completed by U.S. Attorneys,
Fiscal Year 1999
Table III.4: Enforcement Status of 49
NICS Delayed Denials Referred to ATF
Field Offices for Investigation (as
of Dec. 31, 1999)
Table IV.1: NICS Availability and 60
Downtime, by Month (Nov. 30, 1998
Through Nov. 30, 1999)
Table IV.2: Call Center Availability 61
and Downtime, by Month (Nov. 30, 1998
Through Nov. 30, 1999)
Table IV.3: Sources of NICS 63
Unscheduled Outages, by Component
(Dec. 1998 Through Sept. 1999)
Table IV.4: Percentage of Call Center 66
Telephone Calls Answered (Nov. 30,
1998, Through Nov. 30, 1999)
Table IV.5: FBI Immediate Proceed and 68
Delay Responses (Nov. 30, 1998,
Through Nov. 30, 1999)

Figures Figure I.1: State and Territory 24
Participation in the National Instant
Criminal Background Check System (as
of Feb. 1, 2000)
Figure I.2: Flowchart of NICS 26
Background Checks Conducted by the
FBI
Figure I.2 (cont.) 27
Figure I.3: Flowchart of NICS 28
Background Checks Conducted by
Designated State Agencies
Figure IV.1: Simplified Diagram of 54
NICS Architecture
Figure IV.2: Primary Components 64
Contributing to NICS' Unscheduled
Outages for the Period of December
1998 through September 1999

Abbreviations

ASI Alternate Search Id
ATF Bureau of Alcohol, Tobacco and Firearms
EOUSA Executive Office for U.S. Attorneys
FBI Federal Bureau of Investigation
FFL Federal Firearms Licensee
IAFIS Integrated Automated Fingerprint
Identification System
III Interstate Identification Index
NCIC National Crime Information Center
NICS National Instant Criminal Background
Check System
NIST National Institute of Standards and
Technology
NLETS National Law Enforcement
Telecommunications System
NRA National Rifle Association
NSD National Security Division
NTN NICS Transaction Number
NYSIIS New York State Identification and
Intelligence System
OMB Office of Management and Budget
ORI Originating Agency Id
PC personal computer
SGI Silicon Graphics, Inc.
TCP/IP Transmission Control Protocol/Internet
Protocol

GUN CONTROL Implementation of the National Instant Criminal Background Check
System GAO/GGD/AIMD-00-64

B-284250

Page 16GAO/GGD/AIMD-00-64 Gun Control: Implementat
ion of NICS
B-284250

February 29, 2000

The Honorable Craig Thomas
United States Senate

Dear Senator Thomas:

This report responds to your request for
information on a wide variety of topics related to
the permanent provisions (phase II) of the Brady
Handgun Violence Prevention Act (Brady Act).1 On
November 30, 1998, the Brady Act's permanent
provisions went into effect with implementation of
the National Instant Criminal Background Check
System (NICS). Managed by the Federal Bureau of
Investigation (FBI), this computerized system is
used to make presale background checks for
purchases2 from federal firearms licensees (FFL)
of all firearms, not just handguns.

Under NICS, as the name implies, Congress expected
that most background checks would be performed
instantly, without a waiting period. Also, under
phase II of the Brady Act implementation, if law
enforcement is unable to complete the background
check within 3 business days,3 the sale is allowed
to proceed-that is, proceed by default. Appendix I
presents an overview of the firearms purchase
application and background check procedures under
NICS. Depending on the willingness of their state
governments to act as NICS liaisons, licensed
firearms dealers contact either the FBI or
designated state agencies (e.g., state police) to
initiate background checks. At the time of our
review, the FBI was responsible for conducting
presale background checks involving (1) both
handgun and long gun (e.g., rifles and shotguns)
permits or purchases from licensed dealers in 24
states and (2) long-gun permits or purchases from
licensed dealers in 11 other states.4

As agreed with your office, in obtaining
information on NICS-related topics, we focused on
background checks conducted by the FBI's NICS
Program Office.5 Specifically, we collected
information related to the following four topics:

� Statistics on background checks, denials, and
appeals. We obtained overview statistics regarding
the number of background checks by type (i.e.,
handguns versus long guns), number of purchase
denials, and number of appeals of denials.

� Enforcement actions. Regarding individuals
who allegedly falsify their status on firearm-
purchase applications, we identified applicable
federal policies, procedures, and results
concerning follow-up enforcement actions, such as
referrals for investigations and prosecutions.

� NICS operations. Regarding computer system
operations or implementation, we answered the
various questions you asked about system
architecture, capacity management, system
availability, transaction response time, retention
of records, monitoring activities, system security
authorization, certain exemptions from the Privacy
Act of 1974,6 and the prospect of making NICS a
fingerprint-based system rather than a name-based
system.

� Pawnshop issues. We identified whether (1)
owner redemptions of pawned firearms are subject
to background checks and (2) multiple instances of
pawning and subsequently redeeming the same
firearm by one owner require a background check
for each transaction (and, if so, how these
multiple transactions are accounted for or
reported in NICS workload statistics).

The following section provides an overview of the
time that it takes the FBI to conduct background
checks under NICS and summarizes the information
we collected on the four topics. It also contains
the FBI's views on how NICS operations could be
improved. Additional information on the four
topics is provided in the appendixes.

Results in Brief

Results
FBI data show that for the majority (about 72
percent, as of Nov. 30, 1999) of firearm-purchase
background checks conducted by the FBI, NICS
provided approval responses within 30 seconds
after the purchaser's identifying information was
input into the system. The remaining 28 percent of
the background checks had delayed responses,
according to FBI data. From a sample of delayed
responses handled by an ad hoc selection of
examiners, the FBI concluded that most of these
responses (80 percent) were resolved within 2
hours or less and that the remainder (20 percent)
required several hours or days to resolve.

Statistics on Background Checks, Denials, and
Appeals
During the first year of NICS operations (Nov. 30,
1998, through Nov. 30, 1999) the FBI and
designated state agencies conducted about 8.8
million background checks using NICS (see app.
II). About 66 percent of the checks involved long
guns, about 32 percent involved handguns, and
about 1 percent involved dual transactions (both
long guns and handguns).7 About half of the total
background checks were conducted by the FBI, and
the remainder were conducted by designated state
agencies. Further, as of November 30, 1999, FBI
data showed the following:

� About 2 percent (81,006) of the FBI's 4.4
million background checks resulted in denials.
That is, the potential buyer was found to be
disqualified under federal or state law from
possessing a firearm because, for example,
criminal history records showed a felony
conviction.
� About 17 percent (13,989) of the FBI's
denials were appealed by the denied purchasers to
the FBI.
� About 22 percent (2,710) of the 12,301
appeals, on which a final decision had been
reached, were successful, that is, the denials
were reversed by the FBI.

Enforcement Actions
Follow-up enforcement regarding individuals
who do not acknowledge their prohibited status on
firearm-purchase forms can involve various actions
(see app. III). For example:

� According to the Bureau of Alcohol, Tobacco
and Firearms (ATF), while each denial does not
necessarily indicate that there has been a
violation of federal law, ATF is authorized to
investigate individuals who receive a denial to
determine if these individuals have violated
federal firearms laws. For example, under federal
law, an individual who knowingly falsifies his or
her status on the firearm-purchase form can be
criminally prosecuted and, if convicted, sentenced
to imprisonment, community confinement, or home
detention, depending on the individual
circumstances. For various reasons, including
insufficient evidence and resource limitations,
not all of the purchasers denied by the FBI are
investigated and prosecuted. To determine which
cases to pursue, ATF and U.S. Attorneys' Offices
have established screening criteria or guidelines,
with the highest priority placed on cases
involving active and potential violent offenders.
According to ATF, for the period of November 30,
1998, through September 30, 1999, transactions
denied by the FBI or designated state agencies had
led ATF to open 380 criminal investigations.
Nationally, Executive Office for U.S. Attorneys
(EOUSA) data show that, in fiscal year 1999, 2,272
defendants-charged for alleged firearms-related
false-statement violations under 18 U.S.C.
922(a)(6) and/or alleged possession violations
under 18 U.S.C. 922(g) or 922(n)-were convicted,
and that sentences ranged from probation to life,
with 43 percent of these defendants receiving a
sentence in excess of 5 years. EOUSA could not
specifically identify how many of these cases
involved "Brady-related" charges, that is, how
many cases resulted from follow-up enforcement
actions regarding individuals who were denied
purchasing firearms from licensed dealers on the
basis of background checks conducted under Brady
Act requirements. EOUSA officials said that
Department of Justice databases do not capture the
facts of the cases in which 922(a)(6), 922(g), and
922(n) charges are brought so as to distinguish
Brady cases from non-Brady cases.8

� If the background check indicates that the
prospective purchaser is a fugitive (i.e., an
outstanding arrest warrant exists), applicable law
enforcement agencies can attempt to arrest the
individual. According to the FBI, NICS has
resulted in firearm-purchase denials to 2,230
fugitives as of November 30, 1999-and, although no
comprehensive statistics are available, some of
these individuals subsequently have been arrested
as a result of having been identified by the
background check process.

� Law enforcement may need to retrieve a
firearm from a prohibited individual when (1) the
3-day background check period has elapsed; (2)
pursuant to a "default-proceed" response from
NICS, the FFL allows a purchaser to obtain a
firearm; and (3) a subsequent research of records
indicates that the individual is disqualified by
federal or state law from possessing a firearm. As
of December 31, 1999, ATF headquarters reported
that it had received referral notifications from
the FBI and applicable state authorities that
3,353 prohibited individuals had obtained firearms
as a result of default proceeds under NICS,9 and
that it had subsequently opened criminal
investigations on 110 of these individuals. ATF
further reported that as of September 30, 1999, it
had retrieved firearms from 442 prohibited persons
. In September 1999, the Department of the
Treasury announced it had assembled a special law
enforcement team with members from ATF, the U.S.
Customs Service, the Internal Revenue Service, and
the U.S. Secret Service. The team was to focus on
investigating a backlog of NICS referrals
involving firearms that had been transferred as a
result of default proceeds. According to ATF
officials, this temporary program formally ended
on September 30, 1999. However, ATF data indicate
that a backlog of over 800 delayed denials again
existed as of December 31, 1999. In commenting on
a draft of this report in early February 2000, ATF
headquarters officials said that these delayed
denials were processed and referred to field
offices, where investigations are being assigned
and worked as a priority. Treasury officials
stated they would consider reinstituting the
program if they believe ATF field offices again
need temporary assistance. However, Treasury and
Justice officials noted that the number of delayed
denials-which require considerable investigative
effort on ATF's part-could be minimized by other
means, such as focusing on efforts to have more
complete information in criminal history records
and allowing more time to complete background
checks.

NICS Operations
In states where a state agency does not serve as a
NICS liaison, licensed firearms dealers are to
initiate a background check on firearms transfers
by using a toll-free telephone number to contact
an FBI Call Center. The Call Centers are linked to
the FBI's NICS Operations Center to provide
capability to search NICS' three national
databases: (1) the National Crime Information
Center 2000 (NCIC 2000),10 which, among other
things, contains files on wanted persons
(fugitives) and persons subject to protection
orders; (2) the Interstate Identification Index
(III),11 which is an index-pointer system for state
criminal history records; and (3) the NICS Index,
which contains other disqualifying records (e.g.,
information regarding such persons as aliens
illegally or unlawfully in the country,
individuals who have been dishonorably discharged
from the armed forces, and other persons
prohibited by federal law from receiving or
possessing a firearm).

Summary information on key aspects of NICS
operations is as follows (see app. IV):

� NICS architecture. The Brady Act required
that the Attorney General establish NICS and that
the system (1) assign a unique identification
number (a NICS transaction number (NTN)), to each
transfer; (2) provide the firearms licensee with
the NTN; and (3) destroy all proceed records in
the system (other than the NTN and the date that
the NTN was assigned). 12 According to the NICS
documentation we reviewed and FBI officials we
interviewed, NICS satisfies these congressionally
mandated functions.13

� Capacity management. The FBI uses a capacity
management program to ensure that the Call Centers
are sufficiently staffed to handle the forecasted
volume of searches. The FBI has established a
combined Call Center workload requirement of
13,500 searches per day, on average, and up to
27,000 per day during peak times. The workload
volume has been 27,000 searches or fewer per day,
through November 30, 1999, with 1 exception,
according to FBI data.

� System availability. According to the FBI
official responsible for NICS operations, the FBI
has specified a NICS availability requirement of
98 percent for components of NICS delivered by the
contractor (e.g., NICS servers)-meaning that the
FBI expects these components of NICS to operate
satisfactorily 98 percent of the time during the
scheduled 17-hour operating period. The FBI also
uses this availability requirement as a baseline
against which to compare actual availability of
all NICS components. The FBI calculates actual
system availability by (1) quantifying the number
of minutes that the system is operating
satisfactorily during the scheduled 17-hour
operating period and (2) dividing this total by
the number of minutes that the system is expected
to be operational (i.e., 17 hours, or 1,020
minutes, per day, 7 days a week). According to FBI
data, for the period of November 30, 1998, through
November 30, 1999, NICS met the 98-percent
availability requirement in one-third of the
months and did not meet the requirement in the
remaining two-thirds of the months. In those
months that NICS did not meet the requirement,
availability ranged from 92 percent to 97.7
percent, with an average of 95.4 percent.

� Transaction response time. One measure of
responsiveness is the length of time taken by the
FBI to provide licensed firearms dealers with a
decision on the results of background checks. FBI
Call Center performance statistics indicated that
the average length of time that the firearms
licensee was on the telephone with a Call Center
contract staff decreased from 3 minutes and 12
seconds in December 1998 to 2 minutes and 40
seconds in November 1999. During these telephone
exchanges, a Call Center contract staff is to
provide the licensee with either a proceed
response or a delayed response. Call Center
contract staff do not provide denied responses
because these contract personnel are not
authorized to review criminal history records. FBI
staff (examiners) at the NICS Operations Center
are to research the delayed transactions to
determine whether the records indicate that a
proceed response or a denied response should be
provided. In June 1999, the FBI reported (on the
basis of a sample of delayed transactions
researched by an ad hoc selection of examiners)
that about 80 percent of the delayed transactions
were resolved within 2 hours and that the
remainder required hours or days to resolve
because FBI examiners may have needed to contact
local or state sources.14

� Retention of records. The Brady Act prohibits
the FBI from establishing a federal firearms
registry and, in general, requires the destruction
of proceed transactions. By regulation, proceed
files are to be destroyed no more than 6 months
after the transfer is allowed to proceed. Pending
changes in regulations would lower this retention
period to 90 days. In our September 1999 visit to
the NICS Operations Center, we observed that the
FBI had documented purge procedures. For a small
nonprojectable sample of days (i.e., for purges
scheduled to be conducted for 15 days in May and
June, 1999),15 we reviewed contractor log books
indicating that purges had been conducted. Both
FBI and ATF officials stated that the temporary
retention of NICS transaction information provides
an "audit log" database that is essential for
ensuring that NICS is used only for intended
purposes. Additionally, the FBI explained that it
uses the audit log to oversee and improve NICS
operations.

� Program monitoring activities. The NICS
Program Office has an Internal Assessment Group
that is responsible for monitoring the Office's
implementation of policies and procedures. In
August 1999, to develop procedures for monitoring
or auditing the Program Office's compliance with
purge requirements, the Internal Assessment Group
conducted a pilot study at the Office. After these
procedures are finalized, the Internal Assessment
Group is expected to use the procedures to conduct
periodic audits of the Program Office.

� System security authorization. The Office of
Management and Budget (OMB) requires federal
agencies to authorize information systems before
their operation.16 Justice similarly requires
computer systems that process classified or
sensitive information to be authorized.17 Justice
further allows authorizing authorities to grant
interim approval to process sensitive information
on a system before the completion of security
plans and authorization.

The FBI did not authorize NICS before it began
operations on
November 30, 1998. System authorization was not
obtained, according to FBI officials, due to
insufficient time and resources to formally test
security controls between the date that the FBI
received the system from the contractor and the
congressionally mandated date for system
operation. However, while a formal test of
security controls was not conducted, the security
officer responsible for NICS' authorization stated
that a subset of NICS' security requirements was
assessed and a number of vulnerabilities were
disclosed.

The FBI requested an interim approval to operate
NICS from the FBI's National Security Division
(NSD), which is the FBI's authorization authority.
According to an NSD representative, the interim
approval was granted for 1 year beginning November
30, 1998. However, according to the security
officer responsible for NICS authorization, all
authorization requirements (e.g., certification
testing) were not completed during the interim
period because of competing priorities, such as
the authorization of NCIC 2000 and the Integrated
Automated Fingerprint Identification System
(IAFIS). According to Justice, the completion of
security testing was overshadowed by more urgent
issues directly impacting NICS' ability to
function; therefore, security testing was delayed.
On December 2, 1999, NSD extended the interim
approval to operate NICS through April 2000.
According to the security officer, security
testing for NICS was completed on December 21,
1999. The FBI plans to obtain full authorization
by
March 31, 2000.

However, because of the system vulnerabilities
that were identified before NICS went operational
and the delays experienced to date in authorizing
the system, the FBI continues to lack an adequate
basis for knowing whether NICS assets (hardware,
software, and data) are sufficiently secure and
are not vulnerable to corruption and unauthorized
access.

Accordingly, if NICS is not authorized as planned
by March 31, 2000, we are recommending that the
Attorney General have the FBI Director report on
the cause and impact of the delay, and the FBI's
plan to achieve immediate authorization.

� Exemption from the Privacy Act. The Privacy
Act of 1974 imposes various requirements on
federal agencies, including a requirement that
agencies allow an individual to access his or her
records (containing personally identifiable
information) and permit the individual to request
the correction of any information that the
individual believes is not accurate, relevant,
timely, or complete. However, the act also allows
agencies to exempt themselves from certain
specific requirements of the act. For example, the
act allows agencies to exempt any system of
records from the access and correction of
information requirements if the records involve
investigatory material compiled for law
enforcement purposes. In its regulations exempting
the FBI's NICS, Justice noted, among other things,
that (1) access to records in the system would
compromise ongoing investigations or constitute a
potential danger to the health or safety of law
enforcement personnel and (2) NICS itself provides
an alternative procedure for amending erroneous
records resulting in transfer denials.

� Making NICS fingerprint-based rather than
name-based. FBI officials told us that the FBI had
no plans to make NICS a fingerprint-based
system-that is, the FBI had no plans to change
NICS so that database matches would be made using
fingerprints rather than the individual's name and
other personal descriptors.

Pawnshop Issues
Under current law, owner redemptions of
pawned firearms are subject to background checks
(see app. V). Treasury's appropriation act
language for fiscal years 1999 and 2000 both
contain a specific requirement that pawnshop
redemptions of firearms be subject to background
checks under NICS. Under ATF regulations, multiple
pawn-and-redemption transactions of the same
firearm by one owner require a new background
check each time the owner redeems the firearm.

FBI Observations Regarding System Improvements
NICS operations could be improved, according
to the FBI, if (1) more disposition records were
automated, (2) licensed firearms dealers were
provided electronic access to NICS, (3) more or
all states functioned as liaisons for conducting
background checks using NICS, and (4) more
research time was allowed for background checks.

Automating Disposition Records
The FBI has concluded that about 5 percent of
the background check inquiries handled by the FBI
take more than 2 hours or days to complete,
primarily because arrest disposition information
(such as whether the arrest resulted in a
conviction) is not fully automated in all states.
According to the FBI, to increase awareness and
encourage states to expeditiously provide
disposition information, the agency has undertaken
various outreach initiatives, such as sending FBI
representatives to attend state court-clerk
conferences.

A longer term and more comprehensive federal
effort is a grant program (the National Criminal
History Improvement Program) administered by the
Bureau of Justice Statistics. Through this
program, the federal government has provided
funding in recent years to help states automate
and upgrade the quality and completeness of
criminal records. One of the grant program's
priorities for fiscal year 1999 was to increase
state participation in III since, as stated in the
program announcement, such participation is
critical to ensuring that the most accurate and
complete criminal records are available instantly
for, among other things, the NICS firearm checks.
Federal grant obligations under this program
totaled $292.5 million during fiscal years 1995
through 1999. Additionally, 5 percent of the funds
awarded to states each year under the Byrne
Formula Grants Program are to be used for
improving criminal justice records.18

As previously mentioned, the improvement of
criminal history records is a long-term effort. In
July 1991, for instance, a federal study reported
that, nationwide, an estimated one-third of the
final outcomes (dispositions) of arrest cases was
missing from criminal history records.19 More
recently, in April 1999, the Bureau of Justice
Statistics published the results of an updated
survey on states' criminal history record
repositories. That survey, which inquired about
the status of records as of calendar year-end
1997, found that 26 states reported having 60
percent or more of their final dispositions
recorded. Twenty-two of these states reported
having 70 percent or more of their final
dispositions recorded, and 11 of these states
reported having 80 percent or more of their final
dispositions recorded.20 Regarding NICS, the rate
of criminal record quality improvement will be a
major pacing factor in decreasing the size of the
delay category needing more than 2 hours or days
for resolution (5 percent of all transactions).

Providing Electronic Access to NICS
The FBI, in its final rule (Oct. 30, 1998)
implementing NICS, noted that:

". in the near future, the FBI will make
electronic access available to . [licensed
firearms dealers]. This access will essentially
allow [dealers] to conduct background checks 24
hours a day except during minimal periods of
system maintenance."21

At the time of our review, licensed firearms
dealers did not have electronic access to the NICS
Operations Center. However, FBI officials told us
that the FBI is considering providing FFLs with
Internet access to the NICS Operations Center.
That is, via the Internet, FFLs would be able to
(1) send purchaser information (e.g., name and
date of birth) to NICS and (2) receive a proceed
or a delayed response. The FBI officials noted
that providing dealers with electronic access
would result in cost savings for the FBI through,
for example, possible reductions in the Call
Centers' staff. The Call Centers had a fiscal year
1999 operating budget of $16 million.22

This electronic access mode would be an
alternative to using the telephone and would not
be intended to give FFLs a direct link or access
path to sensitive information in NCIC 2000, III,
or NICS Index. Nevertheless, providing FFLs with
access to the NICS Operations Center via the
Internet requires that the FBI first identify
Internet-related security risks and complexities
and then implement the appropriate controls. For
example, issues to address include (1) ensuring
that FFLs access only the authenticated NICS Web
site, (2) authenticating the identity of FFLs, (3)
adequately protecting data during sessions, and
(4) ensuring that FFLs exercise controls over the
electronic data similar to what they exercise over
the current paper records (e.g., ATF forms). FBI
officials told us that applicable security risks
would be recognized and appropriately incorporated
into any plans involving Internet access to the
NICS Operations Center.

Encouraging States to Be Full Participants
At the time of our review-due to funding
concerns or other reasons-35 states were either
nonparticipants or partial participants in NICS.
However, about 50 percent of the background checks
were done by the FBI and about 50 percent were
done by designated state agencies, as of November
30, 1999. According to the FBI, NICS was designed
with the hope that as many states as possible
would be full participants-that is, designated
state law enforcement agencies (rather than the
FBI) would perform the background checks under
NICS. An FBI official told us that the NICS
Operations Center was designed originally to have
only 15 computer terminal workstations; but, due
to the lack of state agency participation, the
center now has about 300 workstations. This large
number of workstations has strained the capacity
of the center's network servers. To mitigate the
risks associated with this strain, FBI officials
told us the following:

� The FBI had implemented a distributed
architecture late in 1999. By moving some
processes onto a "middle-tier" of services,
overall performance of the system was enhanced.
This modification allowed the FBI to handle
unprecedented workloads in November and December,
1999.
� The FBI is looking at a full architecture
upgrade during 2000 that would address long-term
capacity and growth concerns.

According to the FBI, the functioning of NICS
would be more effective and efficient if more
states were full participants. For instance, FBI
officials noted that state law enforcement
agencies

� have access to more current criminal history
records and more data sources (particularly
regarding noncriminal disqualifiers, such as
mental hospital commitments) from their own states
than does the FBI, and
� have a better understanding of their own
state laws and disqualifying factors.

However, given the 1997 Supreme Court decision in
Printz v. U.S. (521 U.S. 898),23 states presumably
cannot be required or mandated to conduct
background checks under NICS. On the other hand,
as the Supreme Court has recognized elsewhere,
Congress, in general, may impose reasonable
conditions on the receipt of federal funds by
states.24

In any event, any consideration of
encouraging all states to be full participants in
NICS must necessarily recognize the following
factors:

� States have competing fiscal priorities that
may preclude either initiating or expanding their
role in NICS without federal financial support.
� States that operate as partial participants
in NICS (by conducting background checks on
handgun purchasers) may have little interest in
expanding their responsibilities to long guns,
which traditionally have been viewed as less of a
public safety risk than handguns.
� Some states may encounter difficulties in
conducting timely or complete background checks
for a variety of reasons, including a lack of
resources or expertise.

Allowing More Research Time for Background Checks
Under permanent Brady, if the background check is
not completed within 3 business days, the sale of
the firearms is allowed to proceed by default, or
a "default proceed." FBI and Justice officials
indicated that NICS could be improved by extending
the maximum time allowed for conducting background
checks to minimize the number of default-proceed
transactions.

Default-proceed transactions involving individuals
later determined by the FBI to be prohibited by
law from possessing firearms totaled 2,519 during
the first 10 months of permanent Brady, according
to FBI data. Such transactions increase concerns
over public safety and also place demands on law
enforcement resources in retrieving the firearms.
According to FBI officials, default proceeds
occurred primarily because many states' automated
criminal history records did not show the
disposition (e.g., acquittals or convictions) of
felony arrests, and manual efforts to find such
information took longer than 3 business days.
According to FBI data for these 2,519 transfers,
an average of 25 business days elapsed between the
initial NICS inquiry and the date the FBI
determined that the purchase should have been
denied.

Scope and Methodology
Generally, regarding NICS statistics and
operational issues, we focused on data centrally
available from the FBI's NICS Operations Center.
We observed the center's ongoing operations,
interviewed managers, obtained statistical data on
background checks and operations, and reviewed
applicable manuals and other operational guidance.
To determine enforcement policies, procedures, and
results regarding individuals who falsify their
status on firearm-purchase forms, we interviewed
responsible officials at Justice, EOUSA, and ATF.
Regarding pawnshop issues, we reviewed relevant
legislative provisions and regulations and
interviewed ATF and FBI officials. Also, we
obtained FBI officials' views on how NICS
operations could be improved. We used data that
were supplied by the agencies.

We performed our work from May 1999 to
February 2000, in accordance with generally
accepted government auditing standards. Appendix
VI presents more information about our objectives,
scope, and methodology.

Conclusions
Almost 9 million background checks were
conducted during the first year of NICS
operations. The FBI conducted about half of these
background checks, and designated state agencies
conducted the other half. Approximately three-
quarters of the background checks done by the FBI
resulted in the FFLs' being allowed to immediately
transfer the firearms to the potential buyers. The
remainder of the FBI background checks were
delayed to allow FBI NICS examiners research time
to establish a basis for making proceed or deny
determinations. The FBI reported (on the basis of
a sample of delayed transactions researched by
selected examiners) that for about 80 percent of
the delayed transactions, the examiners made a
proceed or a deny determination within 2 hours.
The remainder of the delayed transactions (20
percent) took hours or days to reach a
determination, generally because the FBI examiners
needed to contact local or state sources for
additional information.

Depending upon the circumstances, there are
various enforcement actions that the federal
government can take against individuals who do not
acknowledge their prohibited status on the firearm-
purchase form. For example, individuals who
knowingly falsify their status on this form can be
criminally prosecuted under federal law.
Nationally, for fiscal year 1999, EOUSA data
indicate that 2,272 defendants charged for alleged
firearms-related false-statement violations under
18 U.S.C. 922(a)(6) and/or alleged possession
violations under 18 U.S.C. 922(g) or 922(n) were
convicted, and that 43 percent of these defendants
received a sentence in excess of 5 years. EOUSA
could not specifically identify how many of these
cases involved Brady-related charges.

Although NICS has been operational for 15 months,
it has yet to be authorized as secure in
accordance with Justice's own requirements, and
attempts to do so have been delayed. Further
delays in authorizing NICS will expose the system
and the data it processes about individuals to
unnecessary risk. Therefore, it is extremely
important that the FBI fulfill its commitment to
authorize NICS by March 31, 2000.

Recommendation
Regarding system security, we recommend that the
Attorney General direct the FBI Director to take
appropriate actions to report to the Attorney
General and the Department's congressional
authorizing committees if NICS is not authorized
as planned by March 31, 2000. At a minimum, the
report should include the causes for the delays,
the impact on the FBI's ability to protect NICS
assets, and revised plans for ensuring immediate
authorization.

Agency Comments and Our Evaluation
On January 21, 2000, we provided a draft of this
report for comment to the Department of Justice
and the Department of the Treasury.

On February 9, 2000, Justice's Audit Liaison
Office (Justice Management Division) provided us
with a written response indicating that the draft
had been reviewed and commented on by
representatives of the FBI, the Bureau of Justice
Statistics, the Office of Justice Programs, EOUSA,
the Office of Policy Development, and the Office
of the Deputy Attorney General.

Justice did not indicate whether it agreed with
our recommendation. Generally, its comments
involved technical clarifications and/or updated
information, which we incorporated in this report
where appropriate. For example, in written
comments, EOUSA provided updated federal
prosecution statistics involving false-statement
violations of 18 U.S.C. 922(a)(6) and firearms-
possession violations of 18 U.S.C. 922(g) and
922(n).

On February 7, 2000, Treasury's Office of Finance
and Administration (Office of Under Secretary for
Enforcement) orally advised us that the draft had
been reviewed by relevant Treasury components,
including the Office of General Counsel, the
Office of Policy Development, the Office of
Professional Responsibility, and ATF. These
reviewers generally had no comments on the draft,
with one exception. Specifically, ATF provided
written comments providing information regarding
the number and status of delayed denials. This
information has been incorporated in this report
where appropriate.

As we arranged with your office, unless you
publicly announce this report's contents earlier,
we plan no further distribution until 30 days
after the date of this report. We will then send
copies to relevant congressional committees; the
Honorable Janet Reno, Attorney General; the
Honorable Louis Freeh, FBI Director; the Honorable
Lawrence Summers, Secretary of the Treasury; and
the Honorable John Magaw, ATF Director. We will
also provide copies to other interested parties
upon request.

If you or your staff have any questions about
this report or wish to discuss the matter further,
please contact Laurie E. Ekstrand at (202) 512-
8777, Randolph C. Hite at (202) 512-6240, Danny R.
Burton at (214) 777-5700, or Deborah A. Davis at
(202) 512-6240. Other key contributors are
acknowledged in appendix VII.

Sincerely yours,

Laurie E. Ekstrand
Director, Administration of
Justice Issues
General Government Division

Randolph C. Hite
Associate Director, Governmentwide
and Defense Information Systems
Accounting and Information Management
Division

_______________________________
1 The Brady Act, Public Law 103-159 (1993),
amended the Gun Control Act of 1968 (P.L. 90-618).
The interim provisions (phase I) of the Brady Act
went into effect February 28, 1994, for handgun
purchases only and allowed law enforcement
officers up to a maximum of 5 business days to
conduct presale background checks for evidence of
felony convictions or other disqualifying
information.
2 NICS background checks are to be performed in
connection with firearms transfers involving
federal firearms licensees and are not to be
limited to firearms sales (63 Fed. Reg. 58303,
58306 (1998)). When we use the term "potential
buyer" or "potential purchaser," we are also
referring to other potential firearms recipients,
such as individuals redeeming pawned firearms.
3"Business day" is defined by federal regulation
as a 24-hour day (beginning at 12:01 a.m.) during
which state offices are open in the state in which
the proposed firearm transaction is to take place
(63 Fed. Reg. 58303, 58307 (1998)).
4 In the other 15 states, licensed firearms
dealers are to contact the state police or other
designated state agencies that are to conduct the
NICS background check and determine whether the
transfer would violate state or federal law. As
discussed in appendix V, pawnshop redemptions are
also subject to NICS background checks.
5 The NICS Program Office components are (1) two
Call Centers (staffed with contract personnel)
located in Uniontown, PA, and Moundsville, WV, and
(2) the NICS Operations Center (staffed with FBI
examiners) located in the FBI's Criminal Justice
Information Services complex in Clarksburg, WV.
6 Public Law 93-579 (1974).
7 Percentages do not add to 100 due to rounding.
8 See tables III.2 and III.3 in appendix III.
9 According to FBI procedure, the agency's
examiners at the NICS Operations Center are to
notify ATF headquarters of all default-proceed
cases in which firearms have been transferred to
prohibited individuals.
10 On July 11, 1999, NCIC 2000, which replaced
NCIC, became operational.
11 III became operational in the 1980s. III was
made a segment of the Integrated Automated
Fingerprint Identification System, which became
operational on July 28, 1999.
12 The FBI established, by regulation, that proceed
files will be destroyed no more than 6 months
after the transfer is allowed to proceed.
13 The National Rifle Association and other
plaintiffs have filed a lawsuit contending that
proceed records should be destroyed
immediately-that is, the plaintiffs contend that
such records should not be retained for any length
of time. The district court dismissed the
complaint; the plaintiffs appealed that dismissal.
Because this issue is in litigation, we are not
addressing the merits of the competing arguments.
14 According to the FBI, its examiners actively
research delayed transactions for up to 20 days.
If the FBI receives disposition information after
20 days, the examiner is to complete the
transaction. For instance, if the information
demonstrates that the purchaser is prohibited, a
retrieval and/or a status change is to occur. FBI
officials said that, after 20 days, some delayed
transactions are not resolved. This category
represents about 2 percent of the FBI's background
checks under NICS.
15 According to FBI documentation, the first purge
under NICS was run on May 16, 1999.
16 OMB Circular A-130 requires federal agencies to
authorize their information systems for
processing. "Authorize processing" is defined as
the authorization granted by a management official
for a system to process information. Some agencies
refer to this as accreditation.
17 Telecommunications and Automated Information
Systems Security, Department of Justice Order
2640.2C, June 25, 1993.
18 Crime Technology: Federal Assistance to State
and Local Law Enforcement (GAO/GGD-99-101, June 7,
1999), pp. 29 and 31.
19 Automated Record Checks of Firearm Purchases:
Issues and Options, Office of Technology
Assessment, OTA-TCT-497 (Washington, D.C.: U.S.
Government Printing Office, July 1991), p. 1.
20 Survey of State Criminal History Information
Systems, 1997, Bureau of Justice Statistics, (NCJ
175041), April 1999, p. 2.
21 63 Fed. Reg. 58303, 58305 (1998).
22 For fiscal year 1999, the FBI's operating budget
for NICS (including the Call Centers) was $42
million.
23 In Printz v. U.S., the Supreme Court ruled that
the Brady Act's interim (phase I) provision
commanding the chief law enforcement officer of
each local jurisdiction to conduct background
checks was unconstitutional in that it compelled
state officers to execute federal law.
24 New York v. U.S., 505 U.S. 144, 165 (1992);
South Dakota v. Dole, 483 U.S. 203, 206 (1987).

Appendix I
Overview of Firearm-Purchase Application and
Background Check Process
Page 27GAO/GGD/AIMD-00-64 Gun Control: Implementat
ion of NICS
This appendix provides a general overview of
firearm-purchase application and background check
procedures under the National Instant Criminal
Background Check System (NICS), which is managed
by the Federal Bureau of Investigation (FBI). The
procedures apply to the Brady Act's phase II, or
permanent provisions, which became effective
November 30, 1998. Federal firearms licensees
(FFL)-particularly retail sales outlets-have a key
role in helping to ensure the integrity of the
background check process by verifying the identity
of the purchaser and relaying the purchaser's
personal identification information to the FBI or
to a designated state agency.1

Background
Depending on the willingness of their state
government to act as a NICS liaison, FFLs contact
either the FBI or a designated state agency to
initiate background checks on individuals
purchasing firearms.2 Generally, depending upon
the state in which the FFL is conducting business
and the type of weapon purchased, there are three
methods of performing background checks:

� In the 24 "nonparticipant" states in which
the state government has declined to designate a
point of contact or liaison for conducting
background checks, the FFLs are to contact the FBI
to initiate a background check on all firearms
transfers (permits or purchases). In addition to
24 states, this category also includes the
District of Columbia, Puerto Rico, and the U.S.
Virgin Islands.
� In the 15 "full participant" states, FFLs are
to contact a designated state agency (e.g., state
police), which is to make the NICS background
check and determine whether the transfer or
issuance of a permit would violate state or
federal law.
� In the remaining 11 "partial participant"
states, FFLs are to contact (1) the FBI for
background checks on long-gun purchases or permits
or (2) a designated state agency for background
checks on handgun purchases or permits.

Figure I.1 illustrates which states and
territories are in each of the three participation
categories as of February 1, 2000.

Figure I.1: State and Territory Participation in
the National Instant Criminal Background Check
System (as of Feb. 1, 2000)

Source: FBI data.

As previously discussed, FFLs contact either the
FBI or a designated state agency for a NICS
background check. Figure I.2 illustrates the
background check process in which the FFL contacts
the FBI, and figure I.3 illustrates the process in
which the FFL contacts a designated state agency.

Figure I.2: Flowchart of NICS Background Checks
Conducted by the FBI

Figure I.2 (cont.)

aNICS contract personnel are not authorized to
review actual criminal history records. The
database query results seen by these personnel are
simply an indicator that there either is no match
(therefore, a proceed) or a potential match on one
or more of the databases (therefore, a delay).
bThe retrieval actions are discussed in appendix
III of this report.
Source: GAO analysis of FBI data.

Figure I.3: Flowchart of NICS Background Checks
Conducted by Designated State Agencies

aIf after 3 business days the FFL has not been
notified of the background check results, the FFL
may transfer the firearm, unless a state statute
provides for a period greater than 3 business
days.
bStates are to have a process whereby denied
individuals may appeal the denial.
Source: GAO analysis of FBI data.

Although the two processes presented in figures
I.2 and I.3 are similar in that both entities use
NICS in the background check process, the
following narrative sections relate specifically
to the former (fig. I.2), that is, the process in
which the FFL contacts the FBI.

The FBI's NICS Program Office is responsible for
conducting the background checks and consists of
the following components:

� Two Call Centers staffed with contract
personnel are located in Uniontown, PA, and
Moundsville, WV. FFLs are to use a toll-free
telephone number to contact a Call Center.
� The NICS Operations Center (located in the
FBI's Criminal Justice Information Services
complex in Clarksburg, WV) consists of two groups
of FBI legal instrument examiners-(1) research and
analysis and (2) customer service.

Firearm Buyer Must Complete ATF Form 4473
Purchasers of any firearm type (both handguns and
long guns) from FFLs are subject to a presale
background check. The prospective purchaser
initiates the process by completing the Bureau of
Alcohol, Tobacco and Firearms' (ATF) Form 4473
(Firearms Transaction Record). Basically, in
completing this form, the individual is certifying
that he or she is not prohibited by federal law
from purchasing a firearm.

On the ATF Form 4473, the prospective buyer must
also provide the following descriptive data: (1)
name; (2) sex; (3) height; (4) weight; (5) race;
(6) residence address; (7) date of birth; (8)
place of birth; and (9) at the prospective buyer's
option, Social Security number or other
identification numbers, such as alien registration
number or military number. The FFL is to verify
the identity of the buyer by examining a valid
form of identification that contains a photograph
of the buyer.

FFL Contacts FBI Call Center Contract Staff, Who
Queries National Databases
After the ATF Form 4473 is completed, the FFL uses
a toll-free telephone number to contact an FBI
Call Center. Upon receiving the telephone request
for a background check, the Call Center's contract
staff are to verify the caller's FFL number and
code word, initiate a name-based search, and
provide a NICS transaction number (NTN)3 for a
valid inquiry. Some of the descriptive data
provided on the ATF Form 4473 are to be provided
to the Call Center contract staff and are searched
against the records contained in the NICS' three
relevant national databases as follows:

National Crime Information Center 2000 (NCIC
2000).4 NCIC 2000 is the nation's most extensive
computerized criminal justice information system.
It consists of a central computer located in the
FBI's Criminal Justice Information Services
complex, Clarksburg, WV; dedicated
telecommunications lines; and a coordinated
network of federal and state criminal justice
information systems. The NCIC 2000 system contains
files on the following subjects, among others:

� The wanted persons file contains information
on persons for whom a federal warrant, felony
warrant, or serious misdemeanor warrant is
outstanding, including domestic and foreign
warrants.
� The protection order file contains
information on restraining orders issued for the
purpose of preventing violent or threatening acts
or harassment against another person. Active
orders that contain a Brady Act indicator of "yes"
are prohibitors.

Interstate Identification Index (III).5 Managed by
the FBI, III is an index-pointer system for the
interstate exchange of criminal history records.
III records include information on persons who are
indicted for, or have been convicted of, a crime
punishable by imprisonment for a term exceeding 1
year or have been convicted of a misdemeanor crime
of domestic violence.

NICS Index. Managed by the FBI, this database
contains information provided by federal and state
agencies about certain persons prohibited under
federal law6 from receiving or possessing a
firearm. The NICS Index is separate and apart from
NCIC and III, and all records in the NICS Index
are disqualifying records and will prohibit the
sale of a firearm. More specifically, the NICS
Index contains records on persons who

� were discharged from the armed forces under
dishonorable conditions,
� have renounced their U.S. citizenship,
� have been unlawful users of or addicted to
any controlled substance,7
� have been adjudicated as a mental defective
or have been committed to a mental institution,8
� are known aliens and are illegally or
unlawfully in the United States or certain aliens
admitted under a nonimmigrant visa, or
� have been denied the purchase of a firearm in
accordance with federal laws.

On the basis of a consolidated search of the three
national databases, the FBI Call Center is to
provide the FFL with one of the following two
possible one-word responses:9

� Proceed. This response is to be provided if
no record that might be a match is found in the
NCIC 2000, III, and NICS Index databases.

� Delayed. This response is to be provided if
the search finds a potentially matching record.10 A
delayed response to the FFL indicates that it
would be unlawful to transfer the firearm until
receipt of a follow-up proceed response or the
expiration of 3 business days, whichever occurs
first.11 Delayed means that more research is
required before a proceed or a denied response can
be given.
For each delayed response, FBI staff are to
conduct research to verify that the matching
record applies to the potential buyer and to
determine if the potential buyer is disqualified
by federal or state law from possessing a firearm.
This practice exists because Call Center contract
staff are not authorized to review criminal
history records; instead, FBI staff (examiners) at
the NICS Operation Center are to conduct the
necessary research of each delayed response to
determine whether records indicate that a proceed
response or a denied response should be provided.

Questions and Responses Regarding the Process in
Which the FFL Contacts the FBI
Using a question-and-response format (as
illustrated in fig. I.2), this section provides
further information about the firearm-purchase
application and background check process in which
an FFL contacts the FBI.

Question 1
Does the query indicate that the potential
firearm buyer may be ineligible?

Possible Response
No: If the database query finds no records
indicating ineligibility, the Call Center contract
staff is to (1) provide a proceed response to the
FFL and (2) also provide the FFL with an NTN,
which is to be recorded on the ATF Form 4473.
After receiving the proceed response from the FBI,
the FFL can transfer the firearm to the buyer.

Yes: If the database query finds records
indicating possible ineligibility, the Call Center
contract staff is to (1) inform the FFL that the
transaction is delayed, (2) provide the FFL with
an NTN to be recorded on the ATF Form 4473, and
(3) obtain the FFL contact person's name and
telephone number so that he or she may receive the
results of the FBI's additional research. Then, as
previously mentioned, because Call Center contract
staff are not authorized to review criminal
history records, FBI staff (examiners) at the NICS
Operations Center are to conduct the necessary
research to determine eligibility.

According to FBI officials, most delayed
responses are the result of the computer search
identifying existing criminal history records.
Delays that take extensive research generally
occur when the search identifies criminal records
showing an arrest for a potentially disqualifying
offense but containing no information about the
outcome or result. For example, there may be a
record showing a felony-related arrest with no
final disposition, such as whether the case was
dismissed or resulted in a conviction.

Question 2
Does the research indicate that the buyer is
ineligible?

Possible Response
No: If the research finds no records
indicating ineligibility, the FBI is to provide
the FFL with a proceed response, and the FFL can
then transfer the firearm to the buyer.

Yes: If the research does find records
indicating ineligibility, the FBI is to provide
the FFL with a denied response. In turn, the FFL
is to inform the buyer of the denial and provide
the buyer with appeal instructions.

The FFL is not to transfer the firearm until
receipt of a proceed response from the NICS
Operations Center or expiration of 3 business days
(excluding the day on which the query was made),
whichever comes first. If 3 business days lapse
before the NICS Operations Center has notified the
FFL that the firearm purchase should be denied and
the FFL transfers the firearm, the FBI is to
initiate steps to have the firearm retrieved (see
app. III for further discussion of firearm
retrievals).

Question 3
Does the buyer appeal the denial?

Possible Response
No: If the buyer does not appeal the denial,
no further action is required of the FBI. The FBI
noted, however, that if it were to receive
information that would change a denial
determination to a proceed it would correct the
criminal history records.

Yes: The appeal must be made in writing by
the appellant. An FBI analyst is to review the
appeal.

Question 4
Is the denial reversed on appeal?

Possible Response
No: If the denial is not reversed on appeal,
the FBI is to inform the buyer and is not required
to take any further action.

Yes: If the denial is reversed on appeal, the
FBI is to inform the buyer. If fewer than 30 days
have elapsed since completion of the ATF Form
4473, the FFL can transfer the firearm to the
buyer. However, if 30 or more days have elapsed,
the buyer must submit another ATF Form 4473 to
initiate an updated background check. When an
appeal results in a proceed determination, the
NICS records are to be updated to avoid having
future denials based on the same information.

_______________________________
1 NICS background checks are to be performed in
connection with firearms transfers and are not to
be limited to firearms sales (63 Fed. Reg. 58303,
58306 (1998)). When we use the term "potential
buyer" or "potential purchaser," we are also
referring to other potential firearms recipients,
such as individuals redeeming pawned firearms.
2 Federal law prohibits persons from purchasing a
firearm if they (1) have been convicted of, or are
under indictment for, a felony; (2) are fugitives
from justice; (3) are unlawful users of, or
addicted to, any controlled substance; (4) have
been adjudicated as mental defectives or have been
involuntarily committed to a mental institution;
(5) are illegal or unlawful aliens, or certain
other aliens admitted to the United States under a
nonimmigrant visa; (6) have been dishonorably
discharged from the military; (7) have renounced
their U.S. citizenship; (8) are subject to certain
domestic violence restraining orders; or (9) have
been convicted of a domestic violence misdemeanor.
3The NTN is generated by the NICS computer. Each
NTN is to be a unique number assigned to each
valid background check inquiry received by NICS.
The primary purpose of NTNs is to provide a means
of associating inquiries to NICS with the
responses provided by NICS to FFLs. The NTNs are
further discussed in appendix IV.
4NCIC 2000, which replaced NCIC, became
operational on July 11, 1999.
5III became operational in the 1980s. III was
made a segment of the Integrated Automated
Fingerprint Identification System, which became
operational on July 28, 1999.
6Records on individuals denied under state law,
but who are not prohibited under federal law, are
not to be entered into the NICS Index. Also, any
record entered into the NICS Index must be removed
if the record is overturned through the appeal
process (discussed later in this appendix).
7Under federal law, a drug-related arrest without
a conviction normally will not prohibit a person
from purchasing a firearm. However, according to
the FBI, persons who have had multiple arrests
(regardless of disposition) for use or possession
of a controlled substance within the past 5 years,
if the most recent arrest occurred within the past
year, are prohibited.
8According to the FBI, (1) individuals committed
to a mental institution by a court, board,
commission, or other lawful authority; (2) a
person found to be insane in a criminal case; (3)
a person found to be mentally incompetent to stand
trial; or (4) a person found not guilty by reason
of mental responsibility are prohibited. In
contrast, persons suffering from mental illness
who have voluntarily committed themselves or been
committed by a personal physician, family members,
or a friend are not disqualified by law from
possessing firearms.
9Neither response provided to the FFL is to
contain any details of the information in the
records checked by the system.
10A delayed response is also to be given in the
event that a search of the databases is not
completed within the time limit (normally a 30-
second limit). These delays are to be resolved by
the FBI after the database search is complete.
11"Business day" is defined by federal regulation
as a 24-hour day (beginning at 12:01 a.m.) during
which state offices are open in the state in which
the proposed firearm transaction is to take place
(63 Fed. Reg. 58303, 58307 (1998)).

Appendix II
Statistics on Background Checks, Denials, and
Appeals Under the National Instant Criminal
Background Check System
Page 38GAO/GGD/AIMD-00-64 Gun Control: Implementat
ion of NICS
This appendix presents NICS statistics on the
number of background checks, including a
quantification of checks associated with handguns
versus long guns; the number of denials, by
prohibited categories; and the number of appeals
of denials. Unless otherwise indicated, the NICS
statistics involve only those background checks
conducted by the FBI and not those conducted by
designated state agencies. As discussed in
appendix I, the FBI conducts NICS background
checks of purchasers of (1) handguns and long guns
for 24 states1 and (2) long guns for 11 other
states. Designated state agencies conduct the NICS
background checks for (1) handguns in 11 states
and (2) handguns and long guns in 15 states. To
provide a comparative perspective, the section on
denials also presents Brady Act phase I (interim
provisions or pre-NICS) statistics.

Number of Background Checks
During the first year of NICS operations
(Nov. 30, 1998, through Nov. 30, 1999), the FBI
and designated state agencies conducted about 8.8
million NICS background checks. As table II.1
shows, the FBI conducted about 50 percent of these
background checks, and designated state agencies
conducted the other 50 percent of the checks.

Table II.1: Number of NICS Background Checks
Conducted by the FBI and Designated State Agencies
(Nov. 30, 1998, Through Nov. 30, 1999)
Month/Year Number of NICS Total Percent
background checks
FBI Designated
state
agencies
December 1998a 506,554 386,286 892,840 10.2%
January 1999 275,486 315,869 591,355 6.7
February 1999 326,676 369,647 696,323 7.9
March 1999 353,509 399,574 753,083 8.6
April 1999 305,584 341,128 646,712 7.4
May 1999 264,536 311,736 576,272 6.6
June 1999 262,668 306,825 569,493 6.5
July 1999 285,991 303,485 589,476 6.7
August 1999 339,891 363,503 703,394 8.0
September 1999 425,848 382,779 808,627 9.2
October 1999 510,376 435,325 945,701 10.8
November 1999 545,172 459,161 1,004,33 11.4
3
Total 4,402,29 4,375,318 8,777,60 100.0
1 9
Percent 50.2% 49.8% 100.0% -
aThe numbers shown for December 1998 include
transactions for November 30, 1998, which was the
first day of NICS operations.
Source: FBI data.
For the first year of NICS operations, FBI data
showed that FBI and designated state agencies'
background checks2 involved the following types of
firearms:

� About 32 percent involved only handgun
transactions.
� About 66 percent involved only long guns.
� About 1 percent involved handguns and long
guns.3

Number of Denials
The following two sections provide a comparative
perspective on the number of background check
denials. That is, for a pre-NICS period, the first
section shows the number of denials and the denial
rate (i.e., denials as a percentage of inquiries);
the second section presents similar information
for inquiries under NICS.

Pre-NICS Denials
According to Bureau of Justice Statistics'
national estimates for the pre-NICS portion of
calendar year 1998 (Jan. 1, 1998, through Nov. 29,
1998), about 2,384,000 presale background checks
of handgun-purchase applicants were conducted and,
of this total, about 70,000 (or about 3 percent)
were denied.4

As table II.2 shows, the most prevalent reason for
denial was that the applicant was either under
felony indictment or had been convicted of a
felony (about 63 percent). The existence of
domestic violence records that involved a
misdemeanor conviction was the second most common
reason for denial (about 10 percent).

Table II.2: Reasons for Handgun Purchase Denials
Under Phase I of the Brady Act (Jan. 1, 1998,
Through Nov. 29, 1998)
Reasons for denials Percentage of denials
under phase I
of the Brady Act
Felony (indictment or 63.3%
conviction)
Domestic violence 9.9
misdemeanor conviction
State law prohibition 6.6
Fugitive 6.1
Domestic violence 3.4
restraining order
Drug addiction 0.9
Mental illness or 0.7
disability
Local law prohibition 0.3
Othera 8.8
Total 100.0%
a The category of "other" includes illegal aliens,
persons discharged from the armed services
dishonorably, persons who have renounced their
U.S. citizenship, and other unspecified persons.
Source: BJS data.

FBI Denials Under NICS
As table II.3 shows, during the first year of
NICS operations, the FBI reported that it had
handled about 4.4 million NICS background checks.
Of this total, about 81,000 (or about 2 percent)
resulted in denials.

Table II.3: Results of FBI NICS Background Checks
(Nov. 30, 1998, Through Nov. 30, 1999)
Results of FBI NICS
background checks background checks
Number Percent
Proceeds 4,216, 95.8%
314
Denials 81,006 1.8
Othera 104,97 2.4
1
Total 4,402, 100.0%
291
aThe category of "other" includes various statuses
or results. For example, some potential handgun
purchasers were not residents of the state in
which they attempted to purchase the handgun.
Also, some transactions had to be canceled and
initiated again because the FFL provided incorrect
information to the Call Center contract staff.
Source: FBI data.

Table II.4 shows that most (about 70 percent)
of the FBI's denials (through Nov. 30, 1999) were
based on criminal history records showing felony
indictments or convictions.

Table II.4: Number of FBI Denials (and Reasons)
Under NICS (Nov. 30, 1998, Through Nov. 30, 1999)
FBI denials
under NICS
Reasons for denials Number Percent
Felony (indictment or conviction) 56,554 69.8%
Domestic violence misdemeanor 9,055 11.2
conviction
Drug addictiona 3,072 3.8
Domestic violence restraining 2,653 3.3
order
Fugitive 2,230 2.8
Illegal/Unlawful alienb 440 0.5
Mental illness or disability 70 0.1
Dishonorable discharge 48 0.1
Citizenship renunciation 0 0
Otherc 6,884 8.5
Total 81,006 100.1%
Note: Percentages do not add to 100 due to
rounding.
aThis category includes persons who are unlawful
users of, or addicted to, any controlled
substance.
bThis category includes aliens who are illegally
or unlawfully in the United States, or certain
other aliens admitted to the United States under a
nonimmigrant visa.
cThe category of "other" includes denials due to a
state, rather than a federal prohibitor; denials
for fugitives for whom a record was not in NCIC;
and other noncriminal prohibitors (e.g.,
protection orders).
Source: FBI data.

Number of Appeals
As table II.5 shows, 13,989 (or about 17
percent) of the FBI's 81,006 total denials were
appealed as of November 30, 1999. As further
shown, 2,710 (or 22 percent) of the appeals on
which a decision had been made were
successful-that is, the denials were reversed.

Table II.5: Number of Appeals of FBI Denials (and
Results) Under NICS (Nov. 30, 1998, Through Nov.
30, 1999)
Appeals of FBI
denials
Results of appealsa Numbe Percent
r
Successful (denial reversed) 2,710 22.0%
Not successful (denial not 9,591 78.0
reversed)
Total decided appeals 12,30 100.0%
1
Note: The number of denials was 81,006, and about
17 percent of the denials were appealed as of
November 30, 1999.
aOf the total appeals (13,989), 1,688 were
awaiting a decision as of November 30, 1999.
Source: FBI data.

Many of the appeals were successful because
the denials were based on FBI examiner errors,
such as misinterpretation of state statutes or
records, according to the FBI. As table II.6
shows, this reason accounted for 42 percent of the
successful appeals for the period of January 1999
through November 1999. According to FBI officials,
however, trend data show that FBI examiners are
making fewer errors, resulting in fewer successful
appeals or overturned denials.

Table II.6: Reasons for Successful Appeals of FBI
Denials Under NICS, January Through November 1999
Month/Year FBI examiner Record missing Applicant Otherd Total
errora informationb misidentifiedc number
Numbe Percent Number Percent Number Percent Number Percent
r
January 1999 221 52.7% 116 27.7% 46 11.0% 36 8.6% 419
February 128 51.6 80 32.3 12 4.8 28 11.3 248
1999
March 1999 44 36.1 23 18.9 9 7.4 46 37.7 122
April 1999 83 48.8 61 35.9 17 10.0 9 5.3 170
May 1999 40 31.5 55 43.3 14 11.0 18 14.2 127
June 1999 53 39.3 57 42.2 21 15.6 4 3.0 135
July 1999 70 36.8 70 36.8 30 15.8 20 10.5 190
August 1999 59 36.2 60 36.8 34 20.9 10 6.1 163
September 48 36.6 50 38.2 20 15.3 13 9.9 131
1999
October 1999 32 30.5 42 40.0 25 23.8 6 5.7 105
November 41 26.8 57 37.3 42 27.5 13 8.5 153
1999
January 819 41.7% 671 34.2% 270 13.8% 203 10.3% 1,963
Through
November,
1999
Note 1: These monthly counts are based on the date
the appeal decision was made. The categorizations
were made by the FBI. The total number of
successful appeals in this table is less than the
number in table II.5 because the FBI originally
did not track the reasons for all successful
appeals.
Note 2: Percentages may not add to 100 due to
rounding.
aThe examiner had the relevant information;
however, he or she misinterpreted the information.
bThe database record was not complete. For
example, the record did not indicate that the
individual's firearms rights had been restored or
record had been expunged, or that the individual
had received a pardon.
cAt least two of the personal identifiers matched
between the information on the ATF Form 4473 and
the database record. However, the record was for
an individual other than the potential firearm
purchaser based on subsequent fingerprint
comparison.
d The following is an example of "other" reasons
for successful appeals: the database record did
not reflect that (1) the original charges, which
would have disqualified the individual from
possessing a firearm, were reduced or (2) the
individual was found guilty of an offense that was
not a prohibitor to possessing a firearm.
Source: FBI data.

_______________________________
1In addition to these states, the FBI also
conducts background checks involving residents of
the District of Columbia, Puerto Rico, and the
U.S. Virgin Islands. As applicable, these three
jurisdictions are included in the statistical
tables presented in this appendix.
2 The FBI data segregating background checks by
type of firearm showed a total of about 7.5
million checks. This total excluded FBI and
designated state agency checks done for permits
and administrative purposes.
3 Percentages do not add to 100 due to rounding.
4 "Presale Handgun Checks, the Brady Interim
Period, 1994-98," Bureau of Justice Statistics
Bulletin (NCJ 175034), BJS, June 1999.

Appendix III
Federal Enforcement Policies and Results Regarding
Falsified Firearm-Purchase Forms
Page 50GAO/GGD/AIMD-00-64 Gun Control: Implementat
ion of NICS
The attempted purchase of a firearm by an
individual who knowingly provides false
information on a firearm purchase application can
be a federal felony offense. A prospective
purchaser of firearms from a federally licensed
dealer must complete the ATF Form 4473, which
requires answers to questions about whether the
individual is prohibited from lawfully purchasing
or possessing a firearm. When the prospective
purchaser has answered "no" to these questions,
the dealer is required to contact NICS for a
background search.

NICS statistics presented in appendix II show that
thousands of firearm-purchase applicants have
received a denied response. According to ATF,
while each denial does not necessarily indicate
that there has been a violation of federal law,
ATF is authorized to investigate individuals who
receive a denial to determine if these individuals
have violated federal firearms laws. That is, 18
U.S.C. 922(a)(6) makes it unlawful for individuals
to knowingly make false statements to licensed
firearms dealers in connection with the attempted
acquisition of a firearm. Further, 18 U.S.C.
922(g) and 922(n) make it unlawful for prohibited
persons to receive or possess firearms-for
example, in instances where a false statement to a
licensed dealer results in the firearm being
transferred.

A felony conviction under either statute can
result in a sentence of up to 10 years in federal
prison. However, Justice officials noted the
following:

� While 10 years are authorized by statute,
federal sentencing guidelines control what is
actually meted out.
� For felons without extensive criminal
histories, a sentence typically would not be
anything close to 10 years.
� Under some circumstances, the defendant may
not receive a term of any significant
imprisonment. In some cases, a sentence may be
limited to probation, or may be split between
incarceration and home detention or community
confinement, depending on the individual
circumstances.

Federal Enforcement Policies
Regarding the Brady Act, the development and
implementation of federal law enforcement policies
involve interaction and coordination among (1) the
Department of the Treasury and its directly
relevant component, ATF, and (2) the Department of
Justice and its components, particularly the
Executive Office for U.S. Attorneys (EOUSA) and
U.S. Attorneys' Offices located in the 94 federal
judicial districts. As the lead agency for the
enforcement of federal firearms laws, ATF is
responsible for investigating criminal attempts to
evade the Brady Act's requirements and ensuring
that firearms remain out of the hands of
prohibited persons. U.S. Attorneys are responsible
for prosecuting individuals charged with
violations of federal criminal law, including
federal firearms violations involving the Brady
Act.

Attorney General Guidance
In November 1998, EOUSA provided Brady Act
prosecutive guidance-developed in September 1998
by the Attorney General's Advisory Committee's
Subcommittee on Organized and Violent Crime-to all
U.S. Attorneys. The guidance stated that thousands
of potential Brady false-form cases would likely
reach ATF field offices annually, and that the
system "would grind to a halt if ATF investigated
all the denials." Therefore, before November 30,
1998, to establish local guidelines for the
referral of cases for prosecution in each federal
judicial district, each U.S. Attorney was directed
to meet with the applicable ATF field office
special agent-in-charge and consult with other law
enforcement leaders in the community.

In establishing Brady Act (phase II or NICS-
related) prosecution guidelines, the Advisory
Subcommittee recommended that U.S. Attorneys
consider the following underlying factors:

� As a general matter, U.S. Attorneys should
make every effort to increase the number of Brady
false-form prosecutions (from the current annual
level of 50 cases).1
� Brady false-form prosecutions should be
incorporated into the respective U.S. Attorney's
Office overall antiviolent crime strategy to
remove dangerous offenders from the street.

Because each federal judicial district has its own
antiviolent crime strategy, each office's
prosecution guidelines will be different. However,
the Advisory Subcommittee identified some
categories of cases that should be addressed in
guidelines for all U.S. Attorneys' Offices. For
instance, the Advisory Subcommittee encouraged
each U.S. Attorney's Office to have guidelines
covering potential defendants who pose a
significant threat not being addressed by state or
local law enforcement.

ATF Screening and Investigations
Under current procedures, the FBI's NICS
Operations Center is to provide ATF with
information on all FBI-generated denials, and ATF
is to screen the data for possible follow-up
investigation and prosecution. After receiving the
information on NICS denials, ATF is to conduct two
levels of screening to determine which cases
should be investigated. As explained in the
following sections, the first-level screening
takes place at ATF headquarters, and the second-
level screening occurs in applicable ATF field
offices. Most NICS referrals to ATF field offices
were closed without prosecution.

ATF Headquarters Initially Screens NICS Denials
and Makes Referrals to Field Offices
In the first-level screening of NICS denials, ATF
headquarters staff are to consider various
criteria in deciding which cases to refer to field
offices for further investigation and possible
prosecution by U.S. Attorneys. The screening
criteria include whether the denied purchaser's
criminal history has records of violent felonies,
serious drug trafficking, or prior firearms
convictions. The screening criteria were
established to act as a threshold for initiating
criminal investigations of potential violations of
18 U.S.C. 922(a)(6).

According to ATF data, as of September 30, 1999,
ATF headquarters staff had screened 70,618 denials
made by the FBI under NICS. Of this total, ATF
headquarters decided that 47,797 denials (68
percent) did not merit referring to the field.
However, the other 22,821 (32 percent) were
referred to applicable ATF field offices. Most of
these referrals were based on criminal history
records involving either violent felonies/serious
drug trafficking (33 percent) or domestic violence
misdemeanors (44 percent).

ATF Field Offices Decide Which Referrals Merit
Investigating and Forwarding to U.S. Attorneys
Regarding second-level or field-office screening,
in April 1999, ATF headquarters provided its field
offices Brady Act enforcement guidance (revised in
June 1999) to clarify ATF's responsibility for
pursuing Brady violations within certain
established criteria. This guidance specified, in
part, the following:

� All ATF field offices should dedicate
resources to the enforcement of Brady violations,
and NICS should be included in each office's
strategic objectives. Each office should
prioritize its NICS investigations against other
investigative needs as the local violent crime
problem dictates.

� Priority consideration should be given to
referrals in which a firearm has been transferred
to a prohibited person. For these referrals, ATF
field agents should coordinate with local law
enforcement agencies to initiate investigations
and take the appropriate steps for removing
firearms from the possession of the prohibited
person. Options for removal include seizure by law
enforcement; voluntary abandonment to law
enforcement; or transfer to a nonprohibited third
party, such as the licensed dealer who sold the
firearm.
� Other referrals meeting ATF and U.S. Attorney
guidelines should be processed according to the
severity of disqualifying convictions, the
presence of multiple attempts to purchase
firearms, and the availability of ATF field office
resources.
� ATF field offices should contact their
respective U.S. Attorney's Office and document
what guidelines have been established regarding
the prosecution of NICS cases.
We reviewed copies of investigative/prosecutive
guidelines from ATF's 23 field offices (all except
Atlanta, which had oral guidelines). Many of the
guidelines were general in nature, with the local
U.S. Attorney agreeing to consider NICS-related
prosecutions on a case-by-case basis. In some
guidelines, the U.S. Attorney agreed to consider
any cases meeting ATF's national screening
criteria. Typically, the guidelines were broadly
written so that almost any legitimate NICS-related
case could be considered for prosecution.

Almost Half of All NICS Referrals to ATF Field
Offices Were Closed Without Investigation or
Prosecution
According to ATF officials, the agency does
not make referrals for prosecution solely on the
basis of the computerized records check conducted
by the FBI. That is, ATF takes additional steps to
confirm the person's prohibited status. These
steps usually involve obtaining an authenticated
copy of court records. Further, even a seemingly
valid prohibiting offense must be researched to
determine if the person's civil rights (to possess
a firearm) have been restored-by pardon, formal
petition, expungement of the record, or state law.
Finally, if there is still a valid prohibiting
factor and the case falls within the local U.S.
Attorney guidelines, the agent is to take
appropriate steps to build the case for
prosecution-that is, obtain fingerprints,
interview subjects, obtain necessary
documentation, and prepare the case-referral
report.

ATF officials also emphasized the complexity and
time involved in reviewing and investigating NICS
denials to prepare them for referral to the U.S.
Attorney for prosecution. These officials
estimated that total case preparation time can
range from 1 week to 6 months, depending on the
workload of the special agent and the complexity
of the case. Moreover, even after the
investigation is completed, the case may not be
accepted for prosecution if the U.S. Attorney
thinks, for example, that the evidence is weak or
that the case has limited jury appeal.

According to ATF data, as of September 30,
1999, ATF field offices had received 20,1952 NICS-
related denials made by the FBI, screened by ATF
headquarters, and referred to the field for
investigation. Another 11,097 NICS-related denials
had been received by ATF field offices directly
from designated state law enforcement agencies,3
for a total of 31,292 NICS referrals. Table III.1
shows the following:

� Most (16,077 or 51 percent) of the referrals
were pending preliminary review by ATF field
agents.
� Another 15,072 of the referrals (or 48
percent) had been preliminarily reviewed by ATF
field agents and were closed without further
investigation or prosecution, mainly because the
cases reportedly did not meet U.S. attorney
guidelines in the applicable jurisdiction.
� Another 380 referrals (about 1 percent) had
been preliminarily reviewed, and ATF
investigations were ongoing.

Table III.1: Enforcement Status of NICS Referrals
Received by ATF Field Offices for Investigation
(as of Sept. 30, 1999)
Status of NICS denials ATF field
referred for investigation offices
Number of Percent
NICS
referrals
Received by ATF field offices 31,292 100%
Pending preliminary review 16,077 51
Closed 15,072 48
U.S. Attorney guidelines not 14,087 -
met
No prosecutive merit 613 -
U.S. Attorney declined 372 -
Open for investigation 380 1
Pending prosecution a a
Note: These data were summarized by ATF
headquarters from individual reports submitted by
ATF field offices. Due to data quality problems,
the number of NICS referrals received by ATF field
offices (31,292) does not equal the number of
referrals processed by the field offices. That is,
the sum of the referrals pending preliminary
review (16,077), referrals closed (15,072), and
referrals open for investigation (380) does not
total to 31,292.
aNo ATF nationwide data were available on NICS
referrals pending prosecution.
Source: ATF headquarters data.

Prosecutions, Fugitive Arrests, and Firearm
Retrievals
Follow-up enforcement actions on falsified
firearms purchase forms can result in prosecutions
of the individuals, the identification and arrest
of fugitives, and the retrieval of firearms from
prohibited individuals.

Federal Prosecutions
As presented in the following sections, we
obtained national federal prosecution data from
EOUSA, visited U.S. Attorneys' Offices in four
major cities, and obtained an overview perspective
from Justice.

National Prosecution Data
Table III.2 presents fiscal year 1999 summary
statistics regarding federal prosecutions
involving violations of relevant firearms-related
provisions. As shown:

� During fiscal year 1999, U.S. Attorneys filed
278 cases (309 defendants) involving alleged false-
statement violations of 18 U.S.C. 922(a)(6). At
fiscal yearend, 316 cases (346 defendants) were
pending.
� Also, during fiscal year 1999, U.S. Attorneys
filed another 3,401 cases (3,783 defendants)
involving alleged firearms-possession violations
of 18 U.S.C. 922(g) and 21 cases (24 defendants)
involving alleged firearms-possession violations
of 18 U.S.C. 922(n). At fiscal year-end, 3,371
cases (3,897 defendants) were pending under
section 922(g), and 21 cases (25 defendants) were
pending under section 922(n).

As noted in table III.2, EOUSA could not
specifically identify how many of these cases
involved Brady-related charges, that is, how many
cases resulted from follow-up enforcement actions
regarding individuals who were denied purchasing
firearms from licensed dealers based on background
checks conducted under Brady Act requirements.

Table III.2: Firearms-Related Cases Handled by
U.S. Attorneys, Fiscal Year 1999
Title 18, U.S. Cases filed in Pending cases
Code fiscal year 1999 at
fiscal 1999
year-end
Section
922(a)(6)a
Number of cases 278 316
Number of 309 346
defendants
Section 922(g)b
Number of cases 3,401 3,371
Number of 3,783 3,897
defendants
Section 922(n)b
Number of cases 21 21
Number of 24 25
defendants
aAccording to EOUSA officials, although persons
who make a knowing false material statement on ATF
Form 4473 would most likely be charged under 18
U.S.C. 922(a)(6), not all persons charged under
this statute would necessarily have made the type
of false statement generally referred to as a
"Brady false form." Also, Department of Justice
databases do not capture the facts of the cases in
which 922(a)(6) charges are brought so as to
distinguish Brady false-form cases from other
cases involving false statements in the attempted
acquisition of a firearm. For these reasons,
EOUSA officials could not state that all of the
922(a)(6) charges that have been brought are Brady-
related.
b According to EOUSA officials, Department of
Justice databases do not capture the facts of the
cases in which 922(g) and (n) charges are brought
so as to distinguish Brady cases from non-Brady
cases.
Source: EOUSA data.

Table III.3 presents national federal prosecution
data regarding firearms-related cases that were
completed during fiscal year 1999. As shown:

� During fiscal year 1999, U.S. Attorneys
completed 155 cases (185 defendants) involving
alleged false-statement violations of 18 U.S.C.
922(a)(6). Of the total 185 defendants, 144 were
found guilty, and 125 of these received prison
sentences.
� Also, during fiscal year 1999, U.S. Attorneys
completed another 2,511 cases (2,774 defendants)
involving alleged firearms-possession violations
of 18 U.S.C. 922(g) and 26 cases (28 defendants)
involving alleged firearms-possession violations
of 18 U.S.C. 922(n). Of the 2,774 defendants in
the section 922(g) cases, 2,105 defendants were
found guilty, and 2,006 of these received prison
sentences. Of the 28 defendants in the section
922(n) cases, 23 defendants were found guilty, and
19 of these received prison sentences.

As noted in table III.3, EOUSA could not
specifically identify how many of these cases
involved Brady-related charges, that is, how many
cases resulted from follow-up enforcement actions
regarding individuals who were denied purchasing
firearms from licensed dealers on the basis of
background checks conducted under Brady Act
requirements.

Table III.3: Federal Firearms-Related Cases
Completed by U.S. Attorneys, Fiscal Year 1999
Cases completed False- Firearms-
and results statement possession
violations
18 U.S.C. violations
922(a)(6)a
18 18 U.S.C.
U.S.C. 922(n)b
922(g)b
Total cases
completed
Number of cases 155 2,511 26
Number of defendants 185 2,774 28
Number of defendants 144 2,105 23
found guilty
Number of defendants 125 2,006 19
sentenced to
prison
aAccording to EOUSA officials, although persons
who make a knowing false material statement on ATF
Form 4473 would most likely be charged under 18
U.S.C. 922(a)(6), not all persons charged under
this statute would necessarily have made the type
of false statement generally referred to as a
"Brady false form." Also, Department of Justice
databases do not capture the facts of the cases in
which 922(a)(6) charges are brought so as to
distinguish Brady false-form cases from other
cases involving false statements in the attempted
acquisition of a firearm. For these reasons,
EOUSA officials could not state that all of the
922(a)(6) charges that have been brought are Brady-
related.
bAccording to EOUSA officials, Department of
Justice databases do not capture the facts of the
cases in which 922(g) and (n) charges are brought
so as to distinguish Brady cases from non-Brady
cases.
Source: EOUSA data.

According to Justice officials, for
defendants charged and found guilty under these
three statutes in fiscal year 1999, sentences
ranged from probation to life in prison, with 43
percent of the defendants receiving a sentence in
excess of 5 years.

Our Visits to Four U.S. Attorneys Offices
During our fall 1999 visits to U.S. Attorneys
Offices in 4 cities-Atlanta, Dallas, Denver, and
Seattle-federal prosecutors identified 13 Brady-
related cases that had been accepted for
prosecution-all in the Northern Judicial District
of Texas (Dallas). For each of the four locations,
the numbers of Brady-related cases declined and
accepted for prosecution were as follows:

� Atlanta. At the time of our visit in
September 1999, the U.S. Attorney had received
three Brady cases for prosecution and declined
them because of lack of jury appeal. The U.S.
Attorney had agreed to consider 27 other cases
that were pending ATF investigation.
� Dallas. At the time of our visit in October
1999, the U.S. Attorney had received 14 Brady
cases for prosecution. Of these cases, 1 was
declined (lack of jury appeal), and 13 were
accepted for prosecution. Of the 13 cases accepted
for prosecution, 4 cases resulted in convictions
(with sentences ranging from 10 to 30 months); 1
case resulted in an acquittal; 2 cases were
dismissed by the judge; and 4 cases were awaiting
trial. The other two cases involved fugitives from
justice.
� Denver. At the time of our visit in October
1999, the U.S. Attorney had received two Brady
cases for prosecution, both of which were
declined. The U.S. attorney had agreed to consider
30 other cases that were pending ATF
investigation.
� Seattle. At the time of our visit in October
1999, the U.S. Attorney had not received any Brady
cases for prosecution. However, the U.S. Attorney
had asked ATF for full investigations on 19 cases.

Overview Perspective From Justice Department
As previously noted, NICS guidance (provided by
the Attorney General's Advisory Subcommittee to
U.S. Attorneys) stated that every effort should be
made to increase the number of Brady prosecutions.
However, NICS guidance also notes that prosecuting
each and every one of the NICS-related denials
(assuming they were all valid denials) may not be
realistic.

Rather than overburden the federal system, Justice
has stated that it considers the prosecution of
firearms violations to be a joint federal/state
effort. According to statements by the Deputy
Attorney General in 1999:4

� Justice has made a conscious decision to work
with state and local partners by having the
federal government concentrate on high-level gun
offenders (e.g., repeat offenders) so that state
and local law enforcement can concentrate on other
firearms offenses.
� The result has been that, while federal
firearms prosecutions5 decreased from 1992 to
1998, federal and state prosecutions combined
increased by 22 percent during this period.
� Also, the number of higher-level gun
offenders prosecuted in the federal system-those
receiving prison sentences longer than 5
years-increased more than 34 percent from 1992 to
1998.

More recently, a January 2000 Justice press
release stated that:

� Regarding charges under the Gun Control Act
of 1968 (18 U.S.C. 922 or 924), federal
prosecutors brought 5,500 firearms cases against
7,057 defendants in 1999, compared to 4,391 cases
against 5,876 defendants in 1998.
� The 1999 data indicate a 25.3-percent
increase in the number of federal firearms cases
and a 20.1-percent increase in the number of
defendants compared to 1998.

Arrests of Fugitives
According to NICS Operations Center
procedure, when a background check identifies a
wanted person, an FBI examiner is to contact the
originating law enforcement agency to confirm that
the arrest warrant is still in effect. Upon
confirmation that the warrant is still valid, the
FBI examiner is to provide the purchaser's
identifying information to the originating agency.
Also, the FBI examiner is to notify the applicable
state police headquarters in the state of
purchase. This notification can be done by either
telephone or the National Law Enforcement
Telecommunications System (NLETS), depending on
the severity of the warrant charge. For example,
for a murder, rape, or kidnapping warrant, a
telephone call is to be made immediately, with an
NLETS message to follow. If the charge appears to
be of a lesser degree, the FBI examiner is to send
an NLETS message only. Once the notification has
been made, the appropriate state or local law
enforcement agency can then seek to apprehend the
individual.

According to NICS Operations Center data
covering the first year of permanent Brady-through
November 30, 1999-about 3 percent (2,230) of the
FBI's total NICS denials (81,006) were based on
outstanding arrest warrants identified in the NCIC
database. Also, FBI has reported that an
indeterminate number of other NICS-related denials
were based on outstanding non-NCIC arrest
warrants.6

According to the FBI, not only has NICS
prevented over 2,000 wanted persons from
purchasing firearms, but NICS examiners have also
contacted federal, state, and local law
enforcement agencies to provide information that
resulted in their apprehension. Examples of such
arrests include the following:

� A person wanted for 8 years in Michigan for
aggravated assault against a family member was
arrested in Texas and was awaiting extradition (as
of July 1999).
� A person wanted in Indiana for aggravated
assault with a gun was arrested by the West
Virginia State Police while still at the gun
dealer's store.
� A person wanted in California for obstructing
a court order and violating parole was apprehended
in Washington state and extradited to California.

Gun Retrieval Actions
According to FBI procedure, when a NICS
examiner discovers (after 3 business days have
elapsed) that the subject should have been denied,
the examiner must call the firearms dealer to
determine if the firearm has been transferred to
the prohibited individual. If the transfer has
taken place, that individual is then illegally in
possession of a firearm, and the NICS Operations
Center's Firearms Retrieval Team is to notify (1)
the local police department, as determined by the
purchaser's address, and (2) ATF headquarters.

Most NICS Delayed Denials Referred to ATF Field
Offices Were Closed Without Investigation or
Prosecution
According to ATF data, for the period
beginning November 30, 1998, through December 31,
1999-a time period covering the first 13 months of
NICS operations-ATF headquarters received referral
notifications (from the FBI and applicable state
authorities) that 3,353 prohibited individuals had
received firearms. Under ATF's firearm-retrieval
policy, these so-called "delayed denials"7 were
then forwarded by ATF headquarters to the
appropriate field office for further review or
investigation. Table III.4 shows that, according
to ATF:

� Most (2,425 or 72 percent) of the delayed
denials had been closed by ATF field offices for
various reasons. For example, in 713 cases, ATF
field agents were unable to confirm the
individuals' prohibited status.
� Another 818 of the delayed denials (or 24
percent) were pending preliminary review by ATF
field offices.
� Another 110 delayed denials (3 percent) had
been preliminarily reviewed, and ATF
investigations were ongoing.

Table III.4: Enforcement Status of NICS Delayed
Denials Referred to ATF Field Offices for
Investigation (as of Dec. 31, 1999)
Status of NICS delayed ATF field offices
denials referred for
investigation
Number of Percent
NICS delayed
denials
Received by ATF field 3,353 100%
offices
Pending preliminary 818 24
review
Closed 2,425 72
Prohibited status not
confirmed (713)
No prosecutive merit
(513)
U.S. Attorney declined
(253)
Other (946)a
Open for investigation 110 3
Pending prosecution b b
Note: Percentages do not add to 100 due to
rounding.
aThis category includes referrals that were
forwarded to a local law enforcement agency;
referrals where the firearm was later retrieved or
transferred to a nonprohibited third-party, with
no further investigative action taken; and older
referrals for which ATF does not know the reason
for closure.
bNo ATF nationwide data were available on NICS
delayed denials pending prosecution.
Source: ATF headquarters data.

Firearms Retrieved From Over 400 Prohibited
Persons
As of August 31, 1999, Treasury and ATF reported
that firearms had been retrieved from 300
prohibited persons. As part of the retrieval
process, ATF had referred 47 of these cases to
local law enforcement for further investigation
and opened 34 criminal investigations, with the
intention of referring these cases for federal
prosecution. By September 30, 1999, ATF data
indicated that the number of firearms
retrieved-either abandoned to or seized by law
enforcement, or transferred to a nonprohibited
third-party-had increased to 442.

Treasury Department/ATF Announce Effort to Address
Delayed Denial Backlog
In a September 1999 report on implementation of
the Brady Act,8 the Treasury Department and ATF
announced that 60 special agents from Treasury
agencies-20 each from the U.S. Customs Service,
Internal Revenue Service, and Secret Service-were
being detailed temporarily to help ATF field
offices respond to a backlog of delayed denials
that were pending investigation at that time. The
report also noted the following:

". [I]n a number of these cases, the individual
may not be prohibited under Federal law. . In some
cases, the person is prohibited under State law,
and thus NICS correctly denied the transaction. In
other cases, the computerized records check
accurately revealed that an individual was
convicted of a felony; however, the database does
not reveal that the individual subsequently
received a restoration of civil rights under State
law. Thus, many of these situations are
unavoidable, given the fact that no computerized
database will contain all the information
necessary in order to make the complex
determination as to whether an individual has
Federal firearms disabilities."

Treasury's comments are consistent with what we
found during our work at ATF field offices. The
following example from Colorado illustrates why
some delayed denials do not result in the firearm
being retrieved or the purchaser being prosecuted:
For a Colorado firearm-purchase transaction, the
NICS background check showed a criminal record
with a third-degree misdemeanor assault in
Colorado. The NICS examiner contacted the county
court to determine if the assault involved
domestic violence. The examiner was then told the
purchaser also had an outstanding warrant for
failure to comply with a court-ordered community
service sentence. The transaction was denied
(after more than 3 business days) on the basis of
the outstanding warrant. After receiving the case,
the ATF Denver field agent reviewed the NICS case
history report and the associated criminal
records. The agent then contacted the local court
to confirm facts about the misdemeanor assault,
which was not related to domestic violence, and,
thus, was not a federal disqualifier. The agent
further determined, after review of the
outstanding warrant, that the purchaser was not a
fugitive as defined for NICS purposes, because
there was no evidence he had left the state to
avoid prosecution or testimony in a court
proceeding. Therefore, the ATF agent determined
the purchaser was not legally prohibited from
purchasing a firearm.

According to ATF headquarters officials, the
temporary use of special agents from other
Treasury components formally ended on September
30, 1999. Of approximately 900 backlogged delayed
denials at the outset, about 720 had been worked
through and resolved, with the remainder
reassigned to ATF field agents as part of their
normal workload. As previously noted, however, ATF
data indicate that a backlog of over 800 delayed
denials again existed as of December 31, 1999. In
commenting on a draft of this report in early
February 2000, ATF headquarters officials said the
following:

� These delayed denials have been processed by
ATF headquarters and referred to field offices,
where the denials are being assigned and worked as
a priority.
� Many of these referrals are in various stages
of completion, but the overall status has not been
reported back to ATF headquarters.

Treasury officials stated they would consider
reinstituting the program of using special agents
from other Treasury components if ATF field
offices again need temporary investigative
assistance. However, Treasury and Justice
officials noted that the number of delayed
denials-which require considerable investigative
effort on ATF's part-could be minimized by other
means, such as focusing on efforts to have more
complete information in criminal history records
and allowing more time to complete background
checks.

_______________________________
1 DOJ officials told us that the annual level of
cases indicated in the guidance was an estimate
and was not based on specific data.
2According to ATF officials, this number of
denials (20,195) is slightly lower than the number
(22,821) previously discussed because it reflects
data summarized by ATF headquarters from reports
submitted by ATF field offices, while the previous
number is based on headquarters-generated
screening data.
3See appendix I for more details about state law
enforcement agency participation in NICS.
4See (1) the testimony at a May 27, 1999, hearing
before the Subcommittee on Crime, Committee on the
Judiciary, House of Representatives, and (2)
Justice's October 21, 1999, news briefing.
5 Generally, "federal firearms prosecutions" refer
to charges brought under the Gun Control Act of
1968, as amended (18 U.S.C. 922 or 924). As
previously mentioned, 18 U.S.C. 922 involves false-
statement and firearms-possession cases. Under 18
U.S.C. 924, charges can involve, for example,
persons who use or carry a firearm in relation to
any crime of violence or drug trafficking crime.
6A non-NCIC warrant is one that has been entered
into a state or local computer system but has not
been reported to the FBI's NCIC database. The FBI
does not track denials that were based on this
category separately.
7ATF also refers to these notifications as
"immediate action referrals."
8Implementation of the Brady Law, Department of
the Treasury and ATF, September 1999.

Appendix IV
Operations of the National Instant Criminal
Background Check System
Page 79GAO/GGD/AIMD-00-64 Gun Control: Implementat
ion of NICS
This appendix addresses the requester's questions
regarding NICS architecture, capacity management,
system availability, transaction response time,
retention of records, monitoring activities,
system security authorization, certain Privacy Act1
exemptions, and making NICS a fingerprint-based
system.

NICS Architecture
NICS was established to provide FFLs, that is, gun
dealers, with information regarding prospective
gun buyers' eligibility to lawfully purchase
firearms. FFLs initiate background checks either
by contacting one of two FBI Call Centers or the
respective designated state agency.2 The Call
Centers or designated state agencies, in turn,
conduct automated searches of the following three
FBI-managed databases:

� NCIC 2000, which contains approximately
700,000 records on wanted persons and subjects who
have protective and/or restraining orders.
� III, which contains approximately 34.7
million criminal records.
� NICS Index, which at the time of our review
contained about 1 million records provided by
federal and state agencies about persons
prohibited under federal law from receiving or
possessing a firearm.3

What Is the NICS' Functional Architecture?
When FFLs contact the FBI's Call Center or
designated state agency, they provide their FFL
number4 and code word and descriptive information
about the prospective buyer, such as name; sex;
residence address; date of birth; and Social
Security number or other identification number, if
supplied by the buyer.5 The Call Center or state
agency enters the buyer's information into the
NICS' computer to initiate the database search.
After the search is completed, NICS informs the
Call Center or state agency whether to "proceed"
with or "delay" the purchase, and it provides the
Call Center or designated state agency with the
NTN for that particular transaction. Most of the
time (about 72 percent) according to FBI data,
NICS responds within 30 seconds with a "proceed,"
which means that no disqualifying information was
found in the three databases. In these instances,
the FFL can complete the sale.

In cases where FFLs contact the FBI's Call
Centers, disqualifying or potentially
disqualifying information identified by NICS is
forwarded to the FBI Operations Center where an
FBI employee, known as a NICS examiner, reviews
the information to determine whether the
prospective buyer is precluded from purchasing the
firearm. In making this determination, the NICS
examiner may contact state and/or local law
enforcement agencies to obtain additional
information on the prospective buyer. According to
FBI data that are based on a sample of delayed
responses from an ad hoc selection of examiners,
NICS provides a definitive proceed/deny response
back to 80 percent of the initial delay responses
within 2 hours.

If the examiner's research indicates that the
buyer is ineligible, the examiner informs the FFL
that the transaction has been denied and provides
the FFL with a telephone number to call for
further information. If the NICS examiner does not
contact the FFL within 3 business days, the FFL
can sell the gun to the prospective buyer. If the
NICS examiner later concludes that the prospective
buyer is precluded from purchasing the gun, the
FBI notifies ATF, which reviews the case for
investigation. Also, the FBI transfers information
to ATF on denial transactions that have been
overturned. The FBI transfers these daily extracts
(denials and overturned decisions) to the ATF
twice a week via common courier.

What Is the NICS' Technical Architecture?
The NICS system and the NICS Operations Center
reside at the FBI data center in Clarksburg, WV.
The two FBI Call Centers are located in Uniontown,
PA, and Moundsville, WV.

NICS system hardware includes (1) two Silicon
Graphics, Inc. (SGI) Challenge Servers, which
process NICS searches (one is a primary server and
the other is a backup server); (2) one SGI RAID
Disk Storage System, which provides storage for
the NICS Index; (3) one StorageTek 9714
Autochanger Tape Library, which is used for file
back up; (4) Compaq Deskpro Firewall servers,
which provide system security; (5) over 300 UNIX
workstations; (6) personal computers (PC); and (7)
other peripheral devices, such as Hewlett Packard
printers.

Figure IV.1: Simplified Diagram of NICS
Architecture

Source: GAO analysis of FBI data.

NICS is a three-tier, client-server-based
architecture. The three tiers are the client,
which provides the interface for users to request
services to be performed by the server; the
controller, which controls the flow of information
between the client and the server; and the server,
which stores the NICS Index, audit log, and other
data in a relational database.

The NICS server and workstation application run on
the UNIX operating system, with the Call Center
PCs operating in Windows NT. The NICS database is
a relational database using an Oracle database
management system. In addition to the NICS Index,
the NICS database software includes:

� Audit log, which is used to store data on all
NICS gun-purchase transactions. The originating
NICS search request is logged with an NTN. On a
daily basis, the FBI is to destroy all proceed
transaction records over 170 days old, except the
NTN and the date the NTN was assigned. The audit
log includes a table that is used to store a list
of the purged NTNs. Once the data are purged from
the rest of the audit log tables, the NTN and
assigned NTN date are stored in the
"NICS_Purged_NTN" table to establish that a record
existed.

� Notification table, which identifies whether
a state has requested notification for an out-of-
state purchase of a long gun, and the Originating
Agency Id (ORI) to notify.

� FFL list, which stores information received
from ATF on FFLs, including FFL number, active
status, password, business name, and address.

� Alternate Search Id (ASI) List, which
identifies all valid ASIs and gives a Service
Provider6 the ability to perform a search without
entering a valid FFL number.

� ORI list, which identifies all valid ORIs and
is used to authenticate an ORI during the course
of a transaction.

� Administrative file, which stores information
on Service Provider logins and privileges.

NICS uses a 3COM Ethernet CoreBuilder 5000 switch
that functions as the network communications hub
and controls the network traffic to and from the
NICS system. The primary communications protocol
is Transmission Control Protocol/Internet Protocol
(TCP/IP), which is used to communicate between the
NICS' servers and the Call Centers, the NICS
Operations Center, the NCIC 2000 database, the III
database, and on-line designated state agencies.
NICS uses dedicated T1 lines between the FBI Call
Centers and the NICS servers. In addition, NICS
communicates through the NCIC 2000 communication
interface to access the NCIC 2000 and III
databases and the on-line designated state
agencies.

What Has the FBI Done to Ensure That NICS Operates
as Intended by Congress?
The Brady Handgun Violence Prevention Act7
required that the Attorney General establish NICS.
The act also required that the system assign a
unique identification number (NTN) and provide
FFLs with that number, and destroy all proceed
records in the system regarding the call (other
than the identifying number and the date the
number was assigned) and all records in the system
relating to the person or the transfer.

According to NICS' functional and technical
architecture documents and FBI officials, NICS
satisfies the congressionally mandated functions
by assigning an NTN for each transaction and
providing the NTN to the FFL at the time the
system provides a proceed or delay response. In
addition, the NICS' architecture documents
indicate that the system includes a purge routine,
which when executed by the system operator,
destroys all proceed transaction records, except
the NTN and the date the NTN was assigned.8 As
discussed later in this appendix, a lawsuit has
been filed that contends that the proceed
transaction records should be destroyed
immediately-that they not be retained for any
length of time. The district court dismissed the
complaint; the plaintiffs appealed that dismissal.
Because this issue is in litigation, we are not
addressing the merits of the competing arguments.

Capacity Management
We focused our inquiries on the FBI's capacity
management program for staffing the Call Centers,
the volume of background checks done by the Call
Centers, and the volume of calls to the Call
Centers.

Does the FBI Have a Capacity Management Program?
FBI officials told us that a capacity management
program is used for managing the staffing levels
at the Call Centers to ensure that the volume of
NICS searches can be handled. The officials added
that various parameters, such as the FBI's service
goal of answering 80 percent of telephone calls
within 20 seconds and the number of telephone
calls forecasted, have been incorporated into the
software used to make Call Center staffing levels
and work shifts determinations.

What Have Been the Trends in Capacity Utilization?
FBI officials stated that because they staff to
forecasted volume and because the actual volume of
NICS searches has been less than the forecasted
volume, the Call Centers initially were slightly
overstaffed. The Call Centers' staff has been
reduced on two occasions. According to the NICS
Acting Operations Manager, the FBI has not
encountered difficulties in hiring staff for the
Call Centers.

What Volume of Transactions (Normal and Peak) Is
the System Designed to Handle?
The FBI established a NICS workload
requirement of 13,500 searches per day, on
average, and up to 27,000 searches per day during
peak times from the Call Centers. During the first
year of NICS operations, the FBI reported that the
Call Centers performed more than 27,000 searches
on 1 day. For almost 90 percent of the days during
January through August 1999, the Call Centers'
search volume was fewer than 13,500 per day. For
the months of December 1998 and September,
October, and November, 1999, on about 70 percent
of the days, the Call Centers conducted between
13,500 and 27,000 searches per day. According to
the FBI, these were months wherein the search
volumes were expected to be high because of the
hunting and holiday-buying seasons.

How Accurate Have the Predictions Been Relating to
the Volume of Incoming Transactions?
The FBI forecasts Call Center telephone call
volume in half-hour increments. It receives
reports on forecasted versus actual call volume on
half-hour, daily, weekly, and monthly increments.
On the basis of these reports, for each month,
December 1998 through November 1999, forecasted
volume exceeded actual volume. The percentage of
actual calls to forecasted calls ranged from a low
of about 52 percent in January 1999 to a high of
about 97 percent in October 1999. Overall, for the
first year of NICS operations, actual call volume
was about three-quarters of the forecasted call
volume, according to FBI data.

FBI officials told us that they have revised
the forecasted Call Center telephone call volume
on the basis of actual call volume, calling
patterns, and speculation that some states will be
changing from doing the background checks
themselves through designated state agencies to
having the FBI conduct the checks through the Call
Centers.

System Availability
System availability can be defined as the
time that a system is operating satisfactorily,
expressed as a percentage of the time that the
system is required to be operational. The FBI, in
its final rule (Oct. 1998) implementing NICS,
stated that the NICS Operations Center,9 would be
open for business 7 days a week, 17 hours each day
as follows:

"The final rule retains the FBI business hours of
9:00 a.m. to 2:00 a.m. [eastern time]. It is
understood that some places of business are open
during hours during which the NICS Operations
Center is unavailable. However, the FBI is
servicing retail stores in seven different time
zones and has attempted to define its business
hours to cover the peak sales times in each zone." 10

How Does the FBI Measure System Availability, and
What Is NICS' System Availability Requirement?
According to the FBI official responsible for
NICS operations, the FBI has specified a NICS
availability requirement of 98 percent for
components of NICS delivered by the contractor
(e.g., NICS servers). The FBI expects these
components of NICS to operate satisfactorily 98
percent of the time during the scheduled 17-hour
operation period (i.e., that the system will
experience no more than 20.4 minutes of
unscheduled downtime each day). The FBI also uses
this availability requirement as a baseline
against which to compare actual availability for
all NICS components. NICS Operations Center
officials told us that they calculate actual
system availability by (1) quantifying the number
of minutes that the system is operating
satisfactorily during the scheduled 17-hour
operating period and (2) dividing this total by
the number of minutes that the system is expected
to be operational (i.e., 17 hours or 1,020 minutes
per day, 7 days a week).

What Was Actual NICS System Availability for the
Period November 30, 1998, Through November 30,
1999?
Table IV.1 shows reported NICS availability
for the period November 30, 1998, through November
30, 1999. NICS met or exceeded its availability
requirement of 98 percent in one-third of the
months during this period. NICS did not meet its
requirement for the remaining two-thirds, with
availability ranging from 92 percent to 97.7
percent, or an average of 95.4 percent. According
to Justice officials, NICS' overall availability
is affected by its dependence on other FBI
controlled systems-namely IAFIS/III and NCIC
2000-to complete transaction checks. Often, when
these systems experience difficulties, NICS cannot
function.

Table IV.1: NICS Availability and Downtime, by
Month (Nov. 30, 1998 Through Nov. 30, 1999)
Month/Year NICS NICS unscheduled
availability downtimea
(percentage
of time)
Percentag Amount of time
e
of time
December 96.9% 3.1% 16 hours, 17
1998b minutes
January 94.7 5.3 27 hours, 55
1999 minutes
February 96.7 3.3 15 hours, 40
1999 minutes
March 1999 98.3 1.7 8 hours, 53
minutes
April 1999 98.8 1.2 5 hours, 52
minutes
May 1999 98.5 1.5 7 hours, 59
minutes
June 1999 99.5 0.5 2 hours, 37
minutes
July 1999 92.0 8.0 42 hours, 18
minutes
August 1999 95.1 4.9 25 hours, 40
minutes
September 95.8 4.2 21 hours, 26
1999 minutes
October 97.7 2.3 12 hours, 6
1999 minutes
November 94.4 a5.6 28 hours, 46
1999 minutes
December 96.5% 3.5% 215 hours, 29
1998 b - minutes
November
1999
aDowntime is the amount of time during normal
business hours that the designated state agencies'
or Call Centers' processing was down; therefore,
they were unable to complete NICS background
checks.
bIncludes November 30, 1998, which was the first
day of NICS operations. Availability for the first
day was 91.9 percent.
Source: FBI data.

Table IV.2 shows the reported availability of just
the Call Centers. The pattern is similar to the
one in table IV.1. The difference between the two
tables is that table IV.2 accounts for only the
time the Call Centers were taken out of operation
during normal business hours. Table IV.2 does not
include the time when designated state agencies
were unable to conduct background checks, while
the Call Centers were able to conduct checks.

Table IV.2: Call Center Availability and
Downtime, by Month (Nov. 30, 1998 Through Nov. 30,
1999)
Month/Year NICS NICS unscheduled
availability downtimea
(percentage
of time)
Percentag Amount of time
e
of time
December 97.2% 2.8% 14 hours, 27
1998b minutes
January 94.8 5.2 27 hours, 18
1999 minutes
February 97.5 2.5 11 hours, 59
1999 minutes
March 1999 98.4 1.6 8 hours, 24
minutes
April 1999 98.9 1.1 5 hours, 41
minutes
May 1999 98.5 1.5 7 hours, 54
minutes
June 1999 99.5 0.5 2 hours, 21
minutes
July 1999 92.0 8.0 41 hours, 56
minutes
August 95.2 4.8 25 hours, 19
1999 minutes
September 95.8 4.2 21 hours, 23
1999 minutes
October 97.7 2.3 12 hours, 3
1999 minutes
November 94.4 5.6 28 hours, 42
1999 minutes
December 96.6% 3.3% 207 hours, 27
1998 b - minutes
November
1999
Note: Percentages do not add to 100 due to
rounding.
aDowntime is the amount of time during normal
business hours that the Call Centers processing
was down; therefore, the Call Centers were not
available to the FFLs for background checks.
bIncludes November 30, 1998, which was the first
day of NICS operations. Call Center availability
for the first day was 91.9 percent.
Source: FBI data.

FBI officials noted that they are unable to
provide FFLs with advance notice of NICS outages
that occur during normal business hours because
the FBI does not know in advance when the outages
will occur. The officials stated that when the
NICS Operations Center's business hours changed
from 9 a.m. through 2 a.m. to 8 a.m. through 1
a.m., the FBI notified those FFLs that had
previously called the Call Centers for a
background check between 1 a.m. and 2 a.m. of the
change in business hours.

How and When Is Routine System Maintenance
Performed?
According to an FBI official, routine maintenance
is done by the FBI contractor with technical
assistance from the FBI. These maintenance
activities include creating backup tapes, running
the "NICS daily" (database maintenance for system
performance), loading data, and purging records
from the audit log and the NICS Index.
Additionally, the majority of scheduled and
unscheduled system maintenance is performed during
the 7-hour period when NICS is off-line.

Is the Nighttime Shutdown Period the Appropriate
Time to Conduct Routine Maintenance?
According to the FBI, the nighttime shutdown
period is the appropriate time to conduct routine
maintenance. FBI NICS managers explained that the
maintenance strategy is to perform routine
maintenance daily during the 7-hour window when
NICS is off-line. Also, the managers noted that,
when possible, the more time-intensive activities
(such as loading federal data) are run during
nonpeak operational hours so as not to impact
system performance.

What Have Been the Sources of NICS Unscheduled
Outages, and What Steps Have Been Taken to Correct
Them and to Prevent Future Occurrences?
From December 1998 through September 1999, the FBI
identified more than 360 unscheduled outages
associated with NICS. According to the FBI, these
outages were not evenly distributed, but rather
occurred during particular months. The greatest
number of days with system outages occurred during
December 1998, with most occurring during the
first week of NICS. We grouped these outages into
eight major components. Table IV.3 shows these
components and the associated unscheduled outages,
by percent. The table also provides examples of
FBI descriptions of the source/cause and
resolution for each of these components.

Table IV.3: Sources of NICS Unscheduled Outages,
by Component (Dec. 1998 Through Sept. 1999)
Component Examples
Percentage of

unscheduled

outages
Source/Cause Resolution
IAFIS/III An FBI data center NICS system
38.0% official called NICS administrators restarted
officials to let them the NICS application.
know that IAFIS/III
was about to fail.
NCIC/IAFIS/ NCIC and IDAS/IIIb Call Center and states
IIIa 8.6 stopped responding. NICS were back in service, and
received numerous error Operations resumed
messages from NCIC 2000. searches and record
After confirming the requests.
problem with NCIC 2000,
NICS began shutdown
procedures.
NCICa NCIC front end was not Unknown FBI actions were
23.5 working. taken to resolve NCIC
front-end problem.
Contractor help desk sent
a broadcast message out
to NICS operations to
stop searches and record
requests.
NICS Oracle stopped NICS system administrator
13.0 responding on the forced the NICS system to
NICS system. use the backup server.
Oracle database
administrator verified
proper database
functioning.
Tuxedorc Tuxedo queue for Select Rebooted all NICS
5.8 NTN was abnormally high. workstations and
This Tuxedo process restarted the Select NTN
is only accessed by NICS Tuxedo server.
Operations.
Call Call Center proceed rate NICS system administrator
Centers 5.8 was at 0%. took operations offline;
problem corrected itself
before states or Call
Centers were removed.
NICS/Tuxedo Lost the entire NICS Used secondary server
1.7 application. during troubleshooting
Tuxedo processes exited process. Restarted NICS
and restarted application.
unexpectantly. Oracle
and Tuxedo
errors.
Other Communications (T1) line Contractor and service
3.6 was not responding. provider contacted to
correct T1 lines;
contractor rebooted
Clarksburg router.
Total
100.0
aAs previously mentioned, NCIC 2000 replaced NCIC
on July 11, 1999. This reference to NCIC means
either NCIC or NCIC 2000.
bThe Identification Division Automated Services
(IDAS) system was replaced by IAFIS on July 28,
1999. III formerly was a segment of IDAS and now
is a segment of IAFIS.
cThe FBI uses Tuxedo to communicate requests for
processing from the client to the server, monitor
and control usage of server processes, control
communications between server processes, and
manage which server resources respond to client
requests.
Source: GAO analysis of FBI data.

On the basis of our review of the FBI-described
system outages, IAFIS, III, and/or NCIC problems
were the sources for over two-thirds of the NICS
system outages, as illustrated in figure IV.2.

Figure IV.2: Primary Components Contributing to
NICS' Unscheduled Outages for the Period of
December 1998 through September 1999

aThese components were NICS, Tuxedo, Call Centers,
NICS/Tuxedo, and other.
Source: GAO analysis of FBI data.

Transaction Response Time
This section discusses the following three
measures of response time:

� the percentage of callers to the FBI Call
Centers' background check telephone lines that did
not abandon their telephone calls;
� the percentage of telephone calls to the FBI
Call Centers' background check lines that were
answered within 20 seconds; and
� the length of time it took either the FBI
Call Centers or the NICS Operations Center to
provide FFLs with a final response, that is, to
proceed with or to deny the firearm transaction.

Does the FBI Have the Capability to Measure
"Dropped" Telephone Calls?
The FBI can and does measure telephone calls
to the FBI Call Centers that are dropped. The FBI
refers to such calls as "abandoned" calls and it
defines an abandoned call as one in which the
caller (i.e., an FFL) chooses to disconnect while
in the hold queue.

Monthly, What Have Been the Types and Extent of
Access Problems, Such as Busy Signals and
Abandoned Calls?
According to FBI officials, callers to the
Call Centers are not to receive busy signals.
Instead, if FBI Call Center contract staff do not
answer an incoming call when the caller selects
the background check option, the call is placed in
a hold queue until a staff person is available to
handle the call.

FBI officials told us they knew of only two
instances in which callers to the Call Centers got
busy signals due to NICS operations problems. The
first instance was November 30, 1998, (the first
day NICS was operational) when the Call Centers
did not have enough T111 lines to handle the volume
of calls. The second instance occurred when the
Call Centers' long-distance carrier had problems
that resulted in busy signals. The FBI officials
added that callers may have gotten busy signals at
other times, but the cause would have been carrier
problems at the local (the callers') level. With
the exception of the two instances of busy
signals-and system outages (previously
discussed)-the officials said that the FBI has not
identified any problems with callers getting
through to the Call Centers.

Regarding abandoned calls, table IV.4
provides data on the number of calls to the Call
Centers and the number of calls in which the
caller abandoned the call while in a hold queue as
reported by the FBI. Table IV.4 also shows the
percentage of telephone calls to the Call Centers
that was answered, by month (i.e., the number of
calls answered12 divided by the total calls
attempted). For the first 7 months of operation,
the percentage of calls answered ranged from 98.1
percent to 99.9 percent. For July 1999 through
September 1999, the percentage of calls answered
fell to under 98 percent. In October and November,
1999, the percentage of calls answered again rose
to over 98 percent.

According to FBI officials, high numbers of
abandoned calls generally have occurred
immediately following system outages, such as
those that occurred from July through September,
1999, as a result of the NCIC and III upgrades.
The officials explained that during an outage, the
Call Centers are taken out of service and FFLs are
unable to contact the Call Centers. Once NICS is
back in service and the Call Centers are reopened,
the Call Centers are flooded with calls that queue
up waiting for an available staff member to handle
the call. FFLs that do not want to wait in the
queue hang up and "abandon" their call. After long
outages, these officials said, it is logical to
assume that call abandonment is exacerbated by
FFLs who call repeatedly and hang up until the
call is handled promptly. However, the FBI
officials added, there is no way to determine the
exact reasons an FFL decided to abandon a call.
Furthermore, the FBI officials said that
minimizing outages should result in fewer
abandoned calls.

These officials also said that trends in call
arrival patterns can affect the Call Centers'
ability to handle incoming calls. The officials
noted that recent trends have shown that a higher
percentage of calls have been arriving late in the
afternoon and early evening.

Table IV.4: Percentage of Call Center Telephone
Calls Answered (Nov. 30, 1998, Through Nov. 30,
1999)
Month/Year Calls Calls Calls Percenta
attempted abandoned answered ge
of calls
answered
December 1998a 533,759 10,041 523,718 98.1%
January 1999 264,145 3,993 260,152 98.5
February 1999 310,718 436 310,282 99.9
March 1999 330,704 1,048 329,656 99.7
April 1999 293,646 4,046 289,600 98.6
May 1999 252,453 1,567 250,886 99.4
June 1999 253,680 1,264 252,416 99.5
July 1999 266,239 6,224 260,015 97.7
August 1999 244,353 5,084 239,269 97.9
September 1999 408,303 20,913 387,390 94.9
October 1999 473,453 8,312 465,141 98.2
November 1999 511,608 8,352 503,256 98.4
December 1998a - November 1999 4,143,061 71,280 4,071,78 98.3%
1
Note 1: This table combines data from the two FBI
Call Centers.
Note 2: Not all of the calls attempted are for
background checks, according to FBI officials. For
instance, NICS Operations Center staff
periodically call the Call Centers to monitor Call
Center availability. Additionally, not all calls
for background checks result in a background check
being conducted by the Call Centers. For example,
if an FFL does not provide the code word that
matches the FFL's identification number, the call
is to be transferred to the NICS Operations Center
(customer service staff) to complete the
background check.
aThis time frame includes November 30, 1998, which
was the first day of NICS operations. According to
FBI data, the percentage of calls answered on the
first day was 93.8 percent.
Source: FBI data.

The FBI has a goal that at least 80 percent of the
calls to the Call Centers be answered within 20
seconds. FBI officials said that this goal has
generally been achieved. However, the officials
also commented that the goal was not met on
several days when NICS experienced significant
technical difficulties.

What Procedures Did the FBI Implement to Track
Such Problems?
The NICS Operations Center receives daily Call
Center performance reports. These reports contain
data by one-half-hour increments on, among other
things, the call arrival and call abandonment
rates and percentage of calls answered within 20
seconds.

How Effective Have Those Procedures Been in
Reducing or Eliminating the Problems?
As previously mentioned, on the first day of
NICS operations (Nov. 30, 1998), some callers to
the FBI Call Centers did receive busy signals.
However, FBI officials told us that additional T1
lines were immediately installed; thus, by the
second day of operations (Dec. 1, 1998) the busy-
signal problem was resolved.

Also, the officials commented that, by using
the daily reports showing call arrival and
abandonment rates, staffing at Call Centers are
adjusted (on an ongoing basis) to better cover
call peak times. Additionally, limited use of
overtime has been approved to handle unexpected
spikes in call arrival patterns.

Due to NICS Inaccessibility, What Were the
Estimated Financial Costs or Lost Sales That Small
Retail Firearms Businesses in the United States
Incurred During the Peak 1998 Christmas Selling
Season?
We found no reliable nationwide data on the
financial costs or estimated retail sales lost, if
any, during the first month of NICS
implementation. In response to our inquiries,
industry officials-from the National Rifle
Association, National Association of Arms Shows,
National Pawnbrokers Association, and National
Association of Federally Licensed Firearms
Dealers-told us that gun dealers were adversely
affected during the first month of NICS
implementation, as a result of system crashes and
Call Center inaccessibility. However, it is
unclear to what extent, if any, these problems
resulted in delayed or deferred sales versus lost
sales. As previously discussed, busy signals and
system outages did occur on the first day of NICS
implementation (Nov. 30, 1998), which limited
access to NICS for some customers and resulted in
a higher percentage of abandoned calls. However,
for the first full month of implementation (Dec.
1998), the percentage of abandoned calls was
generally consistent with the overall percentage
for the first year of operation.

What Trend Data Are Available Regarding the Number
(and Percentage) of Applications That Have
Experienced Delays Under NICS?
Trend data are available from the FBI on
delayed background checks that the FBI NICS
Operations Center and the Call Centers performed.
The FBI does not have data on delayed background
checks that were performed by designated state
agencies.

FFLs who have their background checks done by
the FBI initiate this process through an FBI Call
Center. The FBI Call Center contract staff are to
either provide the FFLs with a response to proceed
with the firearm transfer or to delay the
transfer. If the NICS background check does not
identify any potentially disqualifying information
(i.e., no potentially matching records were
identified through the three database searches),
the Call Center contract staff are to tell the FFL
that the transfer may proceed (i.e., an immediate
proceed). If a potentially disqualifying record is
identified or a database is unable to complete its
search within 30 seconds, the Call Center contract
staff are to tell the FFL to delay the transfer. A
delay response means that it would be unlawful for
the FFL to transfer the firearm until it receives
a proceed response or until the expiration of 3
business days, whichever comes first.

According to FBI data, between November 30,
1998, and November 30, 1999, about 72 percent of
the background checks conducted by the FBI were
immediate proceeds. The remaining 28 percent were
delays. As seen in table IV.5, the percentage of
delayed transactions by month has ranged from
about 26 to 32 percent.

Table IV.5: FBI Immediate Proceed and Delay
Responses (Nov. 30, 1998, Through Nov. 30, 1999)
Month/Year Immediate
proceed Delay
Number Percent Number Percent
December 1998a 367,34 73.1% 135,128 26.9%
2
January 1999 193,11 71.3 77,699 28.7
0
February 1999 234,93 72.5 89,088 27.5
6
March 1999 258,17 73.6 92,680 26.4
6
April 1999 224,09 73.8 79,418 26.2
3
May 1999 193,55 73.9 68,220 26.1
8
June 1999 194,01 74.4 66,796 25.6
7
July 1999 191,21 68.3 88,755 31.7
2
August 1999 244,09 72.4 92,893 27.6
7
September 1999 304,81 72.2 117,421 27.8
2
October 1999 360,13 71.3 145,072 28.7
4
November 1999 378,29 71.5 150,524 28.5
7
December 1998a - 3,143, 72.3% 1,203,694 27.7%
November 1999 784
Note: The total number of background checks in
this table is less than the total number of FBI-
performed background checks shown in table II.1
(4,402,291). Table IV.5 does not include checks
that the FBI started, canceled, and started again
as a new check because, for example, the FFL
corrected a piece of information he or she had
provided to a Call Center staff. In these
instances, NICS does not allow information for
running a background check to be changed once it
has been entered into the system.
aThis time frame includes November 30, 1998, the
first day of NICS operations. According to FBI
data, for the first day, 65 percent of the
transactions were proceeds, and 35 percent were
delays.
Source: FBI data.

FBI data showed that the average talk time
(i.e., length-of-call time) of these telephone
calls13 to the Call Centers has decreased from 3
minutes and 12 seconds in December 1998,14 to 2
minutes and 30 seconds in June 1999. The average
talk time of these calls increased for the months
of July 1999 to November 1999 by 12 seconds or
less. While the FBI does not have an average
length-of-call or talk-time goal for the Call
Centers, FBI officials told us that they closely
monitor length-of-call statistics. These officials
said that when they identify anomalies in the
daily statistics, they question the Call Centers'
contractors for the reason(s) for these anomalies.

What Was the Average Time of Such Delays, and What
Were the Reasons for the Delays?
Transactions that receive a delay response by
the FBI Call Centers are sent electronically to
the NICS Operations Center where they are to be
researched by FBI employees known as NICS
examiners. According to the FBI, these examiners
review the record(s) identified through the NICS
search to determine whether the record(s)

� is complete,
� matches the potential buyer, and
� contains disqualifying arrest and disposition
information.

The FBI developed information on the length of
time it has taken examiners to research delayed
transactions. FBI officials stated that the
delayed transactions that they analyzed were
selected from the delay queue from an ad hoc
sample of examiners for a 1-day period. The
officials said that because the delay transactions
were selected at random for each examiner, the
results of the study provided valid indicators of
the time required to resolve delayed transactions.
The FBI concluded that for about 80 percent of the
delayed transactions (or 22 percent of all
transactions), FBI examiners took 2 hours or less
from the time that they received the transaction
information to provide the FFL with a proceed or
deny response. The FBI explained that when the
information needed to finish the background check
was available electronically, the examiner
completed the background check within 2 hours.

The FBI also concluded that it took more than
2 hours to provide the FFL with a proceed or deny
response for the remaining 20 percent of the
delayed transactions (or 5 percent of all
transactions). The FBI stated that in these
instances, the examiners had to contact state or
local entities to obtain information to complete
the record-generally disposition information.
According to the FBI, about 40 percent of these
transactions took no more than 3 calendar days to
complete, and an additional 20 percent took
between 3 and 10 calendar days to complete. We
note, however, that the reliability of these
percentages (40 percent and 20 percent) is
uncertain because the calculations are based on
incomplete data. That is, for transactions
involving FBI contacts with state or local
entities, the FBI examiners did not always
annotate applicable file comments showing contacts
and/or resolution dates.

How Do the Number (and Percentage) and Time of
Delays Under NICS Compare to Those of State
Systems, Particularly Virginia's and Georgia's
Systems?
Virginia was the first state to implement a
point-of-sale system for checking the criminal
records of individuals buying handguns. Under
Virginia's system, which was implemented in
November 1989 (9 years earlier than NICS),
licensed dealers in the state call a toll-free
number at Virginia State Police headquarters in
Richmond.

Since NICS' implementation on November 30,
1998, Virginia has been a full-participant state
in the system (see app. I). That is, in Virginia,
before selling a handgun or a long gun, FFLs are
to contact the Virginia State Police, who are to
conduct a background check to determine whether
the transfer would violate state or federal law.
During our June 1999 visit to Richmond, Virginia
State Police officials commented that NICS was
developed based on Virginia's system. Also, the
officials provided us with background check
statistics, which indicated that the state's
results (regarding, e.g., delays) were similar to
those of the FBI under NICS. More specifically,
comparative data showed the following:

� Number (and percentage) of delays. For the 9-
month period of January through September, 1999,
Virginia Firearms Transaction Program statistics
showed 129,740 background check transactions and
that 34,417 (26.5 percent) of the total were
initially delayed.15 This percentage is similar to
the delayed response rate (28 percent) reported by
the FBI for its background checks under the first
year of NICS.

� Time of delays. Regarding Virginia's initial
delay statistics for the first 9 months of 1999,
according to Virginia State Police officials, (1)
the majority of the initial nonapproval responses
were resolved within minutes and (2) the remaining
transactions requiring additional research were
generally resolved in 8 to 16 hours. Regarding the
FBI's delayed responses under the first year of
NICS, FBI data indicated that (1) the majority
were resolved within 2 hours or less and (2) the
remaining transactions required more than 2 hours
to resolve, mainly because arrest dispositions
were not available electronically.

As in Virginia, Georgia has an instant background
check system, which is run by the Georgia Bureau
of Investigation. For calendar year 1999,
statistics show that the Georgia Bureau of
Investigation conducted 252,807 background checks
involving firearms (handguns and long guns). About
94 percent of these checks (238,389) resulted in
approvals of sales. Of the total approvals, 59
percent were immediate, according to the
statistics, while the other 41 percent required
additional research (however, the time required
was not specified). About 96 percent of checks
done by the FBI (from Nov. 1998 through Nov. 1999)
resulted in approvals. While not directly
comparable to the Georgia Bureau of Investigation
on the percentage of immediate approvals, we note
that of the total number of background checks done
by the FBI during this period, about 72 percent
were immediate approvals.16

What Has the FBI Done to Ensure That the NICS Name
Search Software Operates at Optimal Performance?
The name search software that NICS uses to
identify potential matches in III, NCIC 2000, or
the NICS Index is based on the New York State
Identification and Intelligence System (NYSIIS)
Phonetic Code. NICS also uses a date-of-birth
match that is based on the month and day of birth,
with the year of birth using a window of plus or
minus 1 year. According to an FBI official, the
FBI is exploring putting a filter between NCIC
2000 and NICS that would eliminate certain types
of matches from the NYSIIS search that would not
be relevant to a NICS background check denial.

Retention of Records
The Brady Act both prohibits the FBI from
establishing a federal firearms registry and
requires, in general, the destruction of proceed
(approved) transaction records. According to the
FBI's final rule implementing NICS:

� The FBI will not establish a federal firearms
registry.
� The FBI will retain records of approved
transactions in an audit log (the NICS audit log)
for a limited time solely for the purpose of
satisfying the separate Brady Act requirement of
ensuring the privacy and security of NICS and the
proper operation of the system.17

What Measures Have Been Taken to Ensure That NICS
Information Is Not Used to Establish a National
Registry?
In responding to this question, FBI officials
emphasized that no national registry of firearm
owners exists and that the FBI has no intention of
creating one. The officials also noted the
following:

� NICS is incapable of establishing such a
registry because it does not have information
about the make, model, or serial numbers of the
firearms sold, nor does it have information about
whether the sales actually occurred.
� The decentralized nature of NICS, with law
enforcement agencies in various states conducting
background checks, would make collection of
information for a national registry impossible.

The FBI has developed various procedures to ensure
the destruction of data-excluding the NTN and the
date that the NICS search was run (the NTN
creation date)-for background check transactions
that did not result in a denial or that were
denied and successfully appealed. These NICS
transaction data are in (1) electronic format,
such as the NICS database and backup tapes, and
(2) hard-copy format, such as notes or files
maintained by FBI examiners and other employees.

Regarding the NICS database, FBI officials
explained that as part of the nightly maintenance
procedures, the NICS system administrator is to
execute a purge of all approved or proceed
transactions that are 170 days old,18 that is, 170
days after the firearm transfer was allowed.
Pending changes in regulation would lower the
retention period to 90 days. Our review of the
NICS' source code and variable tables showed that
the purge routine is documented in the NICS'
system documentation.

During a visit to the NICS Operations Center,
we verified that the FBI does have written purge
procedures for the system administrator. We
observed, for example, that the contractor's on-
line maintenance requirements include a purge
function. We also reviewed system administrator
log book entries for a limited, nonprojectable
number of days (i.e., the last 12 days in May 1999
and 3 days in late June 1999) that indicated
purges had been conducted.19 In addition, this
documentation indicated that the initial purge was
conducted on May 16, 1999, several days before the
6-month retention period allowed by regulation.
FBI officials told us that the first purge routine
was conducted early to allow time to correct
problems before expiration of the 6-month
retention period.

In conducting further testing at the NICS
Operations Center, we judgmentally selected one
"create date" (Jan. 17, 1999)-that is, a date 6
months or more earlier than our September 28 and
29, 1999, visit to the center. At our request,
while we observed the process, the contractor
staff used the computerized system to generate a
list of all NTNs created on January 17, 1999.
Then, from that list of several thousand NTNs, we
judgmentally selected five NTNs. Again, while we
observed, the contractor staff input the five NTNs
into the system to determine if any personal
identification information was available for
retrieval. In each instance, the monitor screen
did not display any such information.

FBI officials explained that the NICS
database is backed up onto tapes routinely. The
NICS Operations Center keeps up to nine full
backups. As each new backup is created, the oldest
backup data are overwritten. Because the purge
routine is run based on 170 days, FBI officials
said the backup tapes do not contain data on
proceed transactions more than 180 days old.

Regarding hard-copy data purges, FBI
officials told us that all NICS Program Office
employees were sent a memorandum specifying purge
requirements. In addition, the NICS Operations
Center developed a matrix that listed the types of
items to be purged (e.g., case history printouts,
incoming disposition fax cover sheets, and appeals
tickler system documents). Once every quarter,
each FBI employee with access to NICS background
information must sign a statement certifying that
the employee has purged all applicable information
and data using appropriate methods. We reviewed a
copy of each of these documents-the memorandum,
the matrix, and the employee certification
statement.

If NICS Is Not Currently in Full Compliance, What
Would Be the Cost of Any Modifications Needed to
Achieve System Compliance?
As discussed herein, the FBI believes that
NICS operations fully comply with applicable law.
However, the National Rifle Association (NRA), and
other plaintiffs, have filed a lawsuit20
contending, among other things, that any retention
period for records on lawful firearm purchasers is
a violation of federal law. The plaintiffs allege
that the Brady Act and other statutory provisions
require the "immediate destruction" of such
records. In January 1999, the NRA's request for a
preliminary injunction was denied in the U.S.
District Court for the District of Columbia. In
July 1999, the district court dismissed the NRA's
complaint. The NRA filed an appeal of the
dismissal in December 1999. Because these issues
are in litigation, we did not address the merits
of the competing arguments.

Relating to the cost to perform immediate
purges of approved firearms transactions, in a
December 1998 affidavit related to the lawsuit, an
FBI employee who served as project manager for
NICS, commented that such reprogramming of NICS
would take a minimum of 6 months time and cost at
least $1.5 million or possibly in excess of $2
million.

FBI officials also provided information on
how the immediate destruction of firearms
transaction data would affect operations. The
officials stated, for example, that without these
data, the FBI could not

� identify FFLs who provided Call Center
contract staff with information for a background
check different from the information on the ATF
Form 4473;
� look up previous background check
transactions to determine, for example, why a
background check on an individual one week
resulted in a proceed and a check another week
resulted in a delay or a deny; or
� perform assessments on the quality of NICS
examiners' proceed and deny determinations.

These officials explained that the FBI or ATF has
used the firearms transaction data for the
purposes previously noted. For example, using this
transaction information in its normal FFL audit
processes, ATF has identified discrepancies
between information provided on the ATF Form 4473
and the background information provided to the
Call Center staff. Also, the officials said that
FFLs have brought to the FBI's attention
situations in which a background check on an
individual one week resulted in a proceed and a
check another week resulted in a delay or a deny.
The officials said if the background check that
resulted in the proceed determination was made
less than 170 days ago, they could retrieve data
on that transaction to determine why the first
background check was a proceed and the subsequent
one was not (e.g., the FFL may not have provided
the exact same data to the Call Center for each
transaction).

Does NICS Contain Extraneous Data That Are
Unnecessary for Determining Whether Federal
Disqualifiers Exist?
According to FBI officials, NICS does not
contain extraneous data unnecessary for law
enforcement purposes, such as determining whether
federal disqualifiers exist. The officials noted
that, while information contained in NICS is used
to identify prohibited persons, some of the
records predate NICS and are used for other law
enforcement purposes. Specifically, as previously
discussed in appendix I, NICS provides access to
three national databases-NCIC 2000, III, and the
NICS Index. The NCIC21 and III databases predate
NICS and have long been generally used for law
enforcement purposes. Because these two databases
contain criminal history information, misdemeanor
as well as felony records may be included. A Brady-
related background check against these databases
generates a "hit" on any records, not just
disqualifying records. For example, background
checks against these databases generate a hit
(and, in turn, a delayed response to the FFL) if
the prospective purchaser has either a felony or a
misdemeanor record, even though the latter may not
be a disqualifier. For each delayed response, an
FBI examiner is to review applicable records and
determine whether the transaction should proceed
or result in a deny response.

The third database (the NICS Index) was
created specifically for NICS and is to contain
noncriminal justice records only on individuals
prohibited by law from possessing firearms-for
example, illegal aliens, persons involuntarily
committed to a mental institution, persons who
have renounced their citizenship, and persons who
have been dishonorably discharged from the armed
forces. As noted in appendix I, records on
individuals denied under state law, but who are
not prohibited under federal law, are not to be
entered into the NICS Index. Also, any record
entered into the NICS Index must be removed if the
record is overturned through the appeal process.

Are the NTNs Randomly Generated, and Do They Point
to Any Identifying Records?
NTNs are seven-digit, alpha-numeric strings
that are created for each transaction. According
to the FBI, NTNs are not generated on the basis of
any of the information contained in incoming
transactions. Furthermore, the FBI said that,
although not randomly generated, the NTNs do not
point to any identifying records once the audit
log is purged.

According to FBI officials, the NTNs are
created by converting an assigned "base 10" number
into a 7-digit, alpha-numeric string. These
officials stated that the first assigned number
was an arbitrary number. Each subsequent
transaction's assigned number increases by one.
This number is converted into an alpha-numeric
string using a "base 30" approach in which 30
characters (alphabetic and numeric) are available
for use.22

What Are the Specific Reasons for Retaining an
Audit Log of Nonblocked Transactions?
In its final rule implementing NICS, the FBI
gave the following reasons for retaining a
temporary log of background check transactions
that allow a firearm transfer to proceed
(nonblocked transactions):

"In order to meet her responsibility to maintain
the integrity of Department [of Justice] systems,
. the Attorney General must establish an adequate
system of oversight and review. Consequently, the
FBI has proposed to retain records of approved
transactions in an audit log for a limited period
of time solely for the purpose of satisfying the
statutory requirement of ensuring the privacy and
security of the NICS and the proper operation of
the system. Although the Brady Act mandates the
destruction of all personally identified
information in the NICS associated with approved
firearms transactions (other than the identifying
number and the date the number was assigned), the
statute does not specify a period of time within
which records of approvals must be destroyed. The
Department attempted to balance various interests
involved and comply with both statutory
requirements by retaining such records in the NICS
Audit Log for a limited, but sufficient, period of
time to conduct audits of the NICS..By auditing
the system, the FBI can identify instances in
which the NICS is used for unauthorized purposes,
such as running checks of people other than actual
gun transferees, and protect against the invasions
of privacy that would result from such misuse.
Audits can also determine whether potential
handgun purchasers or FFLs have stolen the
identity of innocent and unsuspecting individuals
or otherwise submitted false identification
information, in order to thwart the name check
system. The Audit Log will also allow the FBI to
perform quality control checks on the system's
operation by reviewing the accuracy of responses
given by the NICS record examiners to gun
dealers."23

Both FBI and ATF officials emphasized to us
that the temporary retention of NICS transaction
information provides an audit log database that is
essential for ensuring that NICS is used only for
intended purposes. For example, during a 2-week
period in 1999, ATF conducted a NICS-compliance
pilot project in one metropolitan area by
comparing firearms dealers' records with audit log
information. ATF has reported finding several
instances of violations, such as (1) some
transfers of firearms were made without a
background check and (2) some records were
falsified to incorrectly show a proceed response.
On the basis of these results, ATF plans to use
audit log information to conduct inspections in
other areas of the country.

FBI officials also described how they use the
audit log to improve or oversee NICS operations.
These uses include the following:

� To reduce research time. When an examiner
receives a transaction to research because the
NICS search resulted in a potential database
match, the examiner is to search the audit log to
determine if research had previously been done on
this individual through a prior background check.24
If research had been done previously, the examiner
can use this information in making a determination
as to whether the firearm transaction should
proceed or be denied.

� To assess proceed/deny determinations made by
NICS examiners. The NICS Program Office Internal
Assessment Group (discussed later) has begun
assessing responses NICS examiners gave to FFLs.
The group used the audit log to obtain a list of
transactions worked by each examiner from which it
selected ones to review, to determine, in part,
whether the examiner made the proper decision.

Program Monitoring Activities
Generally, any government agency that handles
sensitive, personal identifying information should
be expected to have a monitoring system or
assessment program in place for ensuring that such
information is not misused. Under NICS, such
monitoring or assessment is particularly important
regarding the requirement that personal
identifying information on approved transactions
be purged at or before expiration of the
applicable retention period specified by
regulation.

What Internal or External Assessment Programs Does
the FBI Have in Place to Monitor NICS Operations?
The NICS Program Office has an Internal
Assessment Group that is staffed with five people.
Among other things, this group is to (1) assess
the NICS Operations Center's implementation of
policies and procedures, (2) monitor NICS
performance data, and (3) provide relevant
feedback to the appropriate FBI staff.

Additionally, according to FBI officials, the
following actions have been taken or are planned
to ensure that all information-other than the NTN
and the date that the NICS search was run-are
purged for transactions that did not result in a
denial or that were denied and successfully
appealed:

� All NICS Program Office employees were sent a
memorandum that specified purge requirements.
Also, once every quarter, each FBI employee with
access to NICS background information must sign a
statement certifying that the employee has purged
all applicable information and data using
appropriate methods.

� In August 1999, to develop procedures for
assessing compliance with purge requirements, the
Internal Assessment Group conducted a pilot study
of the NICS Program Office's purge procedures.
After the assessment procedures are finalized, the
Internal Assessment Group is expected to use them
to determine whether the purge procedures are
effective and in compliance with federal
regulations.

� The role of another monitoring component-the
audit unit within the FBI's Criminal Justice
Information Services Division-may be expanded to
cover NICS purge requirements. This unit is
responsible for biennially (every other year)
visiting each state to assess state law
enforcement agency compliance with guidelines for
using and safeguarding NCIC information. In
reference to those states that have elected to
serve as liaisons under NICS, the FBI is
considering whether to expand the audit unit's
role to include reviewing the states' compliance
with the NICS purge requirements.

System Security Authorization
To ensure the security of automated systems, the
Office of Management and Budget (OMB) requires
federal agencies to authorize25 information systems
before their operation and to reauthorize systems
at least every 3 years thereafter. As part of
this authorization process, OMB requires that
agencies consider risk when deciding what security
controls to implement and to follow National
Institute of Standards and Technology (NIST)
guidance in specifying, designing, testing, and
accepting appropriate technical security controls.26
Among other things, NIST recognizes the importance
of conducting a risk assessment and using this
assessment to specify that system security
requirements are correctly defined and
appropriate/cost-effective security controls are
developed and implemented, and that agencies
conduct formal testing of system security controls
to validate that they are operating as intended.
Our work with leading organizations also
emphasizes the need to perform and document risk
assessments.27 Leading organizations document the
results of risk assessments for various reasons,
including holding managers accountable for
decisions made and establishing a permanent record
so that risk assessment records were available to
serve as a starting point for subsequent risk
assessments.

Justice guidance similarly requires that computer
systems that process classified or sensitive
information be authorized.28 Before authorizing
computer systems, Justice requires that its
components (1) conduct and document risk analysis
and risk management actions, (2) conduct and
document certification tests, (3) prepare a system
security plan, (4) prepare and test contingency
plans, and (5) prepare a summary of compliance
with security requirements and a statement of
residual risk for the authorizing authority. In
addition, Justice allows authorizing authorities
to grant interim approval to process sensitive
information on a system before the completion of
security plans and authorization, provided that
(1) measures to prevent compromise, loss, misuse,
or unauthorized alteration of sensitive
information are implemented and (2) a schedule to
accomplish the accreditation is developed and
implemented.

Did the FBI Follow a System Security Authorization
Process for NICS in Accordance With Applicable
Guidance?
According to the security officer responsible for
NICS authorization, the FBI considered risk before
defining system security requirements for NICS.
The security officer stated that risk was an
ongoing topic of discussion throughout NICS'
requirement and design definition phases.
However, a documented risk assessment was not
developed and the security officer could not
provide any other verifiable evidence that an
assessment was performed.

According to the security officer, FBI/NICS
program and security representatives defined a set
of minimum security requirements for NICS, which
were derived from the FBI's internal security
policy29 and the Integrated Automated Fingerprint
Identification System's (IAFIS) security
requirements. These requirements were used as the
basis for specifying the security controls
implemented in NICS. The security officer further
stated that while a formal test of security
controls was not conducted, a subset of NICS'
security requirements was assessed in October and
November 1998, and several vulnerabilities were
disclosed. FBI officials were unable to provide
any evidence that these vulnerabilities had been
addressed.

Further, the FBI did not authorize NICS before it
became operational on November 30, 1998. This was
not done, according to FBI officials, because
there was not enough time and resources to
formally test security controls between the time
that the FBI received the system from the
contractor and the congressionally mandated date
for system operation. On November 24, 1998, the
FBI requested an interim approval to operate NICS
from the FBI's National Security Division (NSD),
which is the FBI's authorization authority.
According to an NSD representative, NSD granted
the interim approval on January 23, 1999, for 1
year beginning November 30, 1998. According to
the security officer responsible for NICS
authorization, all authorization requirements
(e.g., certification testing) were not completed
during the interim period because of competing
priorities, such as the authorization of NCIC 2000
and IAFIS. According to Justice officials, the
completion of security testing was overshadowed by
more urgent issues directly impacting the system's
ability to function; therefore, security testing
was delayed. As a result, on December 2, 1999, NSD
extended the interim approval to operate through
April 2000.

According to the security officer, security
testing for NICS was completed on December 21,
1999. The test results are to document gaps, if
any, between the NICS' security requirements and
the security capabilities and are to be used to
identify existing vulnerabilities and residual
risk. The FBI intends to then determine whether
the residual risk is acceptable to the authorizing
official and, if not, whether it is cost-effective
to correct the vulnerabilities. The FBI plans to
obtain full authorization for NICS by March 31,
2000.

In light of the system vulnerabilities that were
identified before the system went operational and
the delays experienced to date in authorizing the
system, the FBI continues to lack an adequate
basis for knowing whether NICS assets (hardware,
software, and data) are sufficiently secure and
are not vulnerable to corruption and unauthorized
access.

Exemption From the Privacy Act
The Privacy Act of 1974,30 in general, has
various provisions that federal agencies must
follow regarding records containing personally
identifiable information. These provisions include
agency recordkeeping requirements, disclosure-
related provisions and restrictions, and access
and amendment provisions. For example, the Privacy
Act requires agencies to, among other things,
allow an individual to gain access to his or her
records and permit the individual to request the
correction of information that the individual
believes is not accurate, relevant, timely, or
complete. If the agency declines to amend the
record in accordance with the individual's
request, the agency must inform the individual as
to the reason for its refusal as well as permit
the individual to request a review of such
refusal.

The Privacy Act also, however, permits
agencies to exempt themselves from certain
specific requirements of the act. For example, the
act allows agencies to exempt any system of
records from certain Privacy Act requirements if
the system of records is investigatory material
compiled for law enforcement purposes. Agencies
exempting record systems from Privacy Act
requirements must include a statement explaining
the reasons why such records are to be exempted
from a provision of the act.

Regarding Erroneous Data Generated by NICS, Has
the FBI Exempted Itself From the Safeguards of the
Privacy Act? If So, Why?
The Department of Justice has exempted the
FBI's NICS from certain Privacy Act requirements,
including the access to records and correction of
information provisions. In its exempting
regulations, Justice gave the following reasons:

� An individual's access to records in the
system would compromise ongoing investigations,
reveal investigatory techniques and confidential
informants, invade the privacy of persons who
provide information in connection with a
particular investigation, or constitute a
potential danger to the health or safety of law
enforcement personnel.

� To require the FBI to amend information
thought to be not accurate, timely, relevant, and
complete would create an impossible administrative
burden--because of the nature of the information
collected and the essential length of time it is
maintained--by forcing the agency to continuously
update its investigations attempting to resolve
these issues.

Justice also noted, in its exempting regulations,
that individuals concerned with the accuracy,
timeliness, or completeness of records maintained
about them remain free to avail themselves of any
means for access or amendment applicable to the
record sources, and that record contributors have
a continuing responsibility to delete or update
contributions determined to be invalid or
incorrect (see 28 CFR 25.5(b)). Justice further
noted that NICS itself provides an alternative
procedure for amending erroneous records resulting
in transfer denials (see 28 CFR 25.10). This NICS
procedure is designed to implement a Brady Act
requirement regarding the correction of erroneous
system information. The Brady Act, in general,
provides that prospective purchasers may submit to
the Attorney General information to correct,
clarify, or supplement records of the system. The
Brady Act further provides that after receipt of
such information, the Attorney General shall
immediately consider the information, investigate
the matter further, and correct all erroneous
federal records relating to the prospective
purchaser and give notice of the error to any
federal department or agency or any state that was
the source of such erroneous records.

What Would Be the Estimated Costs of Adhering to
the Privacy Act?
FBI officials commented it is difficult to
quantify the additional administrative expenses
that the FBI would incur if Justice had not
exempted NICS from certain Privacy Act provisions.
The officials opined, however, that the expenses
"would be considerable."

Making NICS Fingerprint-based Rather Than Name-
based
Background checks under NICS are name-based
rather than fingerprint-based. NICS identifies
database matches using an individual's name and
other personal descriptors, such as date of birth,
sex, and state of residence, rather than the
individual's fingerprints. However, there has been
congressional interest in the latter. For
instance, a recent Senate bill would have required
the Attorney General to study the feasibility of
developing (1) a single fingerprint convicted
offender database in the federal criminal records
system maintained by the FBI and (2) procedures
under which a licensed firearm dealer may
voluntarily transmit to NICS single digitalized
fingerprints for prospective firearms purchasers.31

Are There Any Plans or Intent to Add Fingerprints
to the System?
FBI officials told us that the FBI had no
plans to make NICS a fingerprint-based system. The
officials noted, however, that fingerprints are an
important part of the NICS appeals procedure.
Fingerprints may be used during this procedure to
determine if the individual making the appeal is
the person who was actually arrested/convicted.

If So, What Are the Specific Justifications?
This question is not applicable, given that
the FBI had no plans for making NICS a fingerprint-
based system.

What Are the Operational Implications and the
Estimated Costs?
According to FBI officials, making NICS a
fingerprint-based system would present a variety
of logistical and technical challenges. In
explanation, the officials noted that:

� NICS would require a total redesign to (1)
collect fingerprints at the point of sale and (2)
use those fingerprint images as part of the
automated search for matches against prohibited
individuals.
� Not all prohibited individuals have
fingerprints on file.
� Auditing the integrity of fingerprint
information collected would present challenges.

_______________________________
1Public Law 93-579 (1974).
2See appendix I for additional information on
designated state agencies.
3Records on individuals denied under state law,
but not prohibited under federal law, are not to
be entered into the NICS Index. Also, any record
entered into the NICS Index must be removed if the
record is overturned through the appeal process.
4ATF assigns the numbers to the FFLs and is to
provide a list of valid FFL numbers to the FBI.
5This information is captured on ATF Form 4473,
the Firearms Transaction Record.
6Service Providers include FBI analysts,
supervisors, and system administrators.
7Public Law 103-159 (1993).
8The FBI, by regulation, established that proceed
files be purged and destroyed after not more than
6 months.
9The Call Centers are to be open the same hours as
the Operations Center, according to FBI officials.
1063 Fed. Reg. 58303, 58305 (1998). Beginning May
1, 1999, the FBI temporarily changed the
Operations Center's business hours to 8 a.m. to 1
a.m. eastern time to more efficiently meet demand.
11 According to the FBI, T1 lines are digital
trunks with 24 channels per trunk. They stated
that the system has 23 T1 circuits for incoming
calls to the Call Centers that allow 552 incoming
calls at one time.
12That is, the caller was connected to a Call
Center contract staff. A background check may or
may not have been completed.
13The talk time or length-of-call time is the
amount of time that the Call Center contract staff
is on the telephone with the FFL plus about 5
seconds after the call for the Call Center staff
to get prepared for the next call, according to
FBI officials.
14This includes talk time for November 30, 1998,
the first day of NICS operations.
15Virginia refers to these transactions as "initial
nonapprovals."
16 These figures on percentage of background checks
are not directly comparable because the Georgia
data were based on the total number of approvals,
whereas the FBI data were based on the total
number of background checks.
1763 Fed. Reg. 58303 (1998).
18According to FBI officials, the purge is based on
170 days rather than 180 days because the FBI
maintains the backup tapes for the NICS database
for the previous 9 days.
19 The log book entries indicated that the purge
had been conducted on 14 of the 15 days we
reviewed. FBI officials said that the purge is
based on 170 days, which is less than the 6-month
time period established in the regulations. Thus,
the officials explained that the FBI can still be
in compliance with the regulations if, on any
given night, the purge routine is not run due to
maintenance problems or other reasons.
20NRA, Inc., et al. v. Reno (Civ. A. No. 98-2916
JR), U.S. District Court for the District of
Columbia.
21As previously noted, on July 11, 1999, NCIC 2000
replaced NCIC.
22FBI officials noted that by using a higher base,
such as base 30, large base 10 numbers can be
expressed in significantly fewer characters.
2363 Fed. Reg. 58303, 58304 (1998).
24Records on proceed transactions are to be
maintained in the audit log not more than 6
months. Records on denied transactions are to be
maintained in the audit log for 10 years.
25 OMB Circular A-130 requires federal agencies to
authorize their information systems for
processing. "Authorize processing" is defined as
the authorization granted by a management official
for a system to process information. Some
agencies refer to this as accreditation.
26 An Introduction to Computer Security: The NIST
Handbook (NIST Special Publication 800-12,
undated); and Guide for Developing Security Plans
for Information Technology Systems (NIST Special
Publication 800-18, Dec. 1998).
27 Information Security Risk Assessment: Practices
of Leading Organizations (GAO/AIMD-00-33, Nov.
1999).
28 Telecommunications and Automated Information
Systems Security, Department of Justice, June 25,
1993.
29 Manual of Investigative Operations Guide, FBI
Automated Data Processing and Telecommunications
(ADPT) Security Policy, FBI, Part II, Section 35.
30Public Law 93-579 (1974).
31S. 254 was passed by the Senate but rejected by
the House.

Appendix V
Background Checks Regarding Owner Redemptions of
Pawned Firearms
Page 86GAO/GGD/AIMD-00-64 Gun Control: Implementat
ion of NICS
According to the National Pawnbrokers Association,
there are 12,000 or more pawnshops in the United
States, and at any given time, there are an
estimated 3 million firearms held in pawnshop
vaults. The requester asked us to address the
following questions:

� Are owner redemptions of pawned firearms
classified as transactions subject to background
checks through NICS? If so, what is the rationale
for doing so?

� Do multiple instances of pawning and
subsequently redeeming the same firearm by one
owner require a background check for each
transaction? If so, how are these multiple
transactions accounted for or reported in NICS
workload statistics?
Background
As of July 1999, there were about 106,000 FFLs in
the United States, according to ATF data.1
Although there are nine categories of
FFLs-including manufacturers, importers, and
collectors-firearms dealers and pawnbrokers
comprised about 79 percent of the licensed
universe. A pawnbroker needs a federal firearms
license to accept firearms into pawn. A pawnbroker
with a federal firearms license may sell new
firearms as well as used firearms that are not
redeemed from pawn. According to the National
Pawnbrokers Association:

� There are currently between 12,000 and 14,000
pawnshops operating throughout the United States.
� Over the course of a year, an estimated 10
million firearms are taken in by pawnshops and
their whereabouts reported to local police.
� At any given time, there are an estimated 3
million firearms held in pawnshop vaults.

Under Current Law, Owner Redemptions of Pawned
Firearms Are Subject to NICS Background Checks
Under current law, owner redemptions of pawned
firearms are subject to background checks. More
specifically, Treasury's appropriation act
language for fiscal years 1999 and fiscal year
2000 both contain a specific requirement that
pawnshop redemptions of firearms be subject to
background checks under NICS.

Previous History Regarding the Application of
Brady Act Background Checks to Pawnshop
Redemptions
Previously, as enacted in 1993, interim Brady
required background checks for the transfer of all
handguns from a licensed dealer to an unlicensed
individual. The interim Brady provisions did not
specifically exempt pawnshop redemptions from the
background check requirement. According to ATF's
Office of Chief Counsel:

� Long before passage of the Brady Act,
pawnshop redemptions were considered transactions
that were subject to provisions of the Gun Control
Act of 1968. This interpretation was upheld in
1974 by the Supreme Court.2
� Without a specific statutory amendment to the
Brady Act, pawnshop redemptions are considered
transactions subject to the background check
requirement.

However, in 1994, the background check provisions
of interim Brady were amended by the Violent Crime
Control and Law Enforcement Act of 1994,3 which
specifically exempted from background checks any
firearms transactions involving "the return of a
handgun to the person from whom it was received."
Under this language, in general, the redemption of
pawned handguns was exempted from the background
check requirement during Brady's phase I period.

Permanent Brady Does Not Exempt Pawnshop
Redemptions
The permanent Brady provisions contained no
specific exemption of pawnshop redemptions from
the requirement for a background check.

In February 1998, ATF published a notice of
proposed rulemaking to implement the requirements
placed on FFLs by permanent Brady.4 In the notice,
ATF proposed that permanent Brady's instant
background check requirements would apply to the
redemption of pawned firearms. Subsequently,
during the public comment period, 338 respondents
submitted comments disagreeing with ATF's
interpretation that the permanent provisions of
Brady apply to the redemption of a pawned firearm.
Many of the commenters argued that the Brady Act
was intended to apply only to the sale of a
firearm and not to the redemption of a pawned
firearm. A national trade association representing
3,600 pawnbrokers suggested that Congress did not
intend to cover the redemption of a pawned firearm
and that the term "transfer" in Brady referred to
a transfer of title. The association contended,
for instance, that the 1994 amendment of interim
Brady by the Violent Crime Control and Law
Enforcement Act indicated congressional intent to
not apply background check requirements to pawn
loans under permanent Brady.

After considering the arguments raised by the
commenters, ATF concluded in its final rule that
the permanent provisions of Brady do apply to the
redemption of a pawned firearm for the following
reasons:

� The redemption of a pawned firearm has always
been treated as a disposition under the Gun
Control Act of 1968, and ATF Form 4473 (Firearms
Transaction Record) has always been required for
such redemptions. Therefore, a redeemed firearm is
a "transfer" within the meaning of the permanent
provisions of Brady.
� The Supreme Court has held that the
redemption of a pawned firearm was an acquisition
within the meaning of the Gun Control Act.5 Thus,
there is no basis for exempting the redemption of
a pawned firearm from the permanent provisions of
Brady.
� Unlike the 1994 statutory amendment of
interim Brady, there is no provision in permanent
Brady that specifically exempts transactions
involving the return of a firearm to the person
from whom it was received.

Accordingly, as published in October 1998, the ATF
final rule does not exempt pawnshop redemptions
from the background check provisions of permanent
Brady.6 ATF officials further explained that:

� The 1994 statutory amendment that exempted
pawnshop redemptions from background checks
applied to the provisions of interim Brady-18
U.S.C. 922(s)-which expired on November 29, 1998.
� On November 30, 1998, the provisions of
permanent Brady-18 U.S.C. 922(t)-went into effect.
Because the pawnshop exemption was an amendment to
18 U.S.C. 922(s), this exemption expired along
with the other provisions of interim Brady.
� Regarding permanent Brady, current
appropriations act language requires background
checks for pawnshop redemptions of firearms. Even
if such appropriations act language is not
included in future appropriations acts, absent a
specific amendment, under ATF interpretation, the
background check requirement will continue under
permanent Brady-18 U.S.C. 922(t)-and ATF's
implementing regulations.

ATF officials noted that, at the same time ATF was
making its final regulatory decision, Congress
passed Treasury's fiscal year 1999 appropriations
act.7 This act contained a specific requirement
that pawnshop redemptions be subject to background
checks under NICS. This requirement is also
contained in Treasury's fiscal year 2000
appropriations act.8 The appropriation act
language also provides that a pawnbroker may
complete an optional NICS check at the time a
firearm is offered as collateral for a loan. If
the optional check results in a denial, however,
the dealer must notify law enforcement within 48
hours of receiving the denial notice. This
optional check is in addition to the mandatory
NICS check required at the time a firearm is
redeemed from pawn.

Although Not Separately Identified, Multiple Pawn
Transactions Are Included in NICS Statistics
As previously discussed, under current federal
law, each time a firearm is redeemed from a
pawnshop, a background check must first be
requested and conducted through NICS. Therefore,
under ATF regulations, multiple pawn and
redemption transactions of the same firearm by one
owner would require a new background check each
time the owner redeemed the firearm from pawn.

Currently, for statistical reporting purposes,
NICS does not differentiate between inquiries made
for (1) retail sales of firearms and (2) owner
redemptions of pawned firearms. Rather, each NICS
inquiry is treated the same for statistical
reporting purposes.

According to FBI officials, NICS currently
contains no "purpose code" that would specifically
identify pawnshop-related background checks, as
opposed to other NICS checks (e.g., retail sales).
Also, NICS is not currently able to differentiate
between the optional background checks done when a
firearm is offered as collateral for a loan and
the mandatory checks that are to be done when the
firearm is redeemed from pawn. In addition, NICS
cannot tell which pawnshop queries actually
resulted in the physical transfer of the firearm
to the individual.

In response to our inquiries, FBI officials told
us that, eventually, NICS will be able to identify
pawnshop-related transactions for statistical
reporting purposes. The officials explained that a
"program change request" has been initiated to add
a "purpose code" to the computerized system-a
purpose code to specifically identify background
checks involving pawnshop-related transactions.

_______________________________
1 As we have previously reported, the number of
FFLs has declined steadily since its peak of about
260,700 in April 1993, largely due to increased
ATF enforcement, additional application
requirements, and higher licensing fees. See,
Federal Firearms Licensees: Various Factors Have
Contributed to the Decline in the Number of
Dealers (GAO/GGD-96-78, Mar. 29, 1996).
2 Huddleston v. United States, 415 U.S. 814
(1974).
3 Public Law 103-322 (1994).
4 63 Fed. Reg. 8379 (1998).
5 Huddleston v. United States, 415 U.S. 814
(1974).
6 63 Fed. Reg. 58272 (1998).
7 Omnibus Consolidated Emergency Supplemental
Appropriations Act for Fiscal Year 1999, Public
Law 105-277 (1998).
8 Treasury and General Government Appropriations
Act, 2000. Public Law 106-58 (1999).

Appendix VI
Objectives, Scope, and Methodology
Page 89GAO/GGD/AIMD-00-64 Gun Control: Implementat
ion of NICS
Objectives
We were asked to address various questions or
concerns regarding NICS statistics, enforcement
actions, system operations, and pawnshop issues:

� Statistics on background checks, denials, and
appeals. Obtain overview statistics regarding (1)
types of background checks (i.e., handguns versus
long guns), (2) purchase denials, and (3)
successful appeals of denials.
� Enforcement actions. Regarding individuals
who allegedly falsify their status on firearm-
purchase applications, identify applicable federal
policies, procedures, and results with respect to
follow-up enforcement actions, such as referrals
for investigations and prosecutions.
� NICS operations. Regarding system operations
or implementation, answer various questions
regarding system architecture, capacity
management, system availability, transaction
response time, records retention, system security
authorization, system monitoring, certain Privacy
Act of 1974 exemptions, and addition of
fingerprints to the system. (The specific
questions from the requester are listed below.)
� Pawnshop issues. Identify whether (1) owner
redemptions of pawned firearms are subject to
background checks and (2) multiple instances of
pawning and subsequently redeeming the same
firearm by one owner require a background check
for each transaction (and, if so, how these
multiple transactions are accounted for or
reported in NICS workload statistics).

Overview of Our Scope and Methodology
Generally, regarding NICS statistics and
operational issues, we focused on data centrally
available from the Federal Bureau of
Investigation's (FBI) NICS Operations Center,
which is located in Clarksburg, WV. The center
conducts presale background checks involving (1)
all firearms, both handguns and long guns,
purchased from licensed dealers in 24 states and
(2) long guns purchased from licensed dealers in
11 other states. As discussed in appendix I, the
24 states are referred to as nonparticipants in
NICS, and the 11 states are referred to as partial
participants. In the other 15 states (full
participants), licensed dealers are to contact a
designated state point of contact (e.g., state
police), who is to conduct the NICS check. We
contacted applicable officials in two of these
states-Georgia and Virginia-to obtain information
about their background check systems. We selected
these two states because they operate instant
check systems similar to NICS, and these systems
were in place when NICS became operational.

Regarding enforcement actions, we interviewed
responsible officials at Justice, EOUSA, and ATF.
Regarding pawnshop issues, we reviewed relevant
legislative provisions and regulations and
interviewed ATF and FBI officials.

The following sections present more
information about our scope and methodology for
each of the respective objectives or topics. In
responding to these objectives, we used data that
were supplied by the agencies.

Scope and Methodology of Our Work Regarding
Statistics on Background Checks, Denials, and
Appeals
For the first year of NICS operations (Nov. 30,
1998, through Nov. 30, 1999), we obtained various
NICS statistics, such as (1) the number of
background checks and queries involving long guns
versus handguns; (2) the number of denials,
arrayed by prohibited categories; and (3) the
number of denials successfully appealed.

As previously mentioned, we relied mainly on data
centrally available from the FBI's NICS Operations
Center. The center provided us with national
statistics on the number of NICS-related
background checks, showing

� the number of checks conducted by the FBI for
nonparticipant states (handguns and long guns) and
partial-participant states (long guns) and
� the number of checks conducted by designated
state agencies in the full-participant states
(handguns and long guns) and the partial-
participant states (handguns).

Beyond these aggregate numbers, however, the
center did not have access to all NICS-related
national statistics, such as the number of denials
by prohibited categories and the number of denials
successfully appealed. Rather, regarding these
types of data, the center was able to provide us
with statistics covering only those background
checks conducted by the FBI and not those
conducted by designated state agencies in full-
participant and partial-participant states.

Also, to provide a broader perspective, we
contacted the Bureau of Justice Statistics to
obtain information about background checks
conducted under interim Brady Act provisions. The
Bureau of Justice Statistics has published three
reports covering Brady's interim (phase I) period.1

Scope and Methodology of Our Work Regarding
Enforcement Actions
We contacted Justice, Treasury, the FBI, ATF,
and EOUSA to identify applicable federal
enforcement policies, procedures, and results
regarding individuals who falsify their status on
firearm-purchase applications-ATF Form 4473
(Firearms Transaction Record). For instance, we
obtained relevant information on referrals for
investigations and prosecutions as well as
information on arrests of fugitives and the extent
of firearm-retrieval actions under NICS.

Again, we focused on centrally available
information, beginning with the number of firearm-
purchase denials made by the FBI that then are to
be forwarded to ATF's NICS Branch. We interviewed
officials at this component to identify ATF
headquarters' criteria for screening the firearm-
purchase denials and making referrals to ATF field
offices. Similarly, we visited ATF field offices
in four major metropolitan areas (see the next
paragraph) to discuss local criteria for further
screening firearm-purchase denials, initiating
investigations, and referring cases to U.S.
Attorneys' Offices for prosecution. In each of
these four locations, we also met with U.S.
Attorney Office staff to discuss prosecution
policies and, if applicable, the number of cases
prosecuted and the results.

The four major metropolitan areas we visited were
Atlanta, GA; Dallas, TX; Denver, CO; and Seattle,
WA. Generally, we judgmentally selected these
locations on the basis of two factors. First,
each location has both an ATF field office and a
U.S. Attorney Office. Second, the locations
reflect a mix of state participation in NICS.
More specifically, Georgia is a full participant
in NICS; Colorado began as a full participant,
then switched to the nonparticipant category, and
now is back to being a full participant; Texas is
a nonparticipant state; and Washington is a
partial-participant state.

During our contacts with FBI and ATF officials, we
also inquired about follow-up enforcement polices,
procedures, and results regarding the following
two types of situations:

� The background check shows that the firearm-
purchase applicant is a fugitive, that is, the
subject of an outstanding arrest warrant.
� The firearm was transferred to a person
prohibited by law from receiving or possessing a
firearm. This type of transfer can occur when the
FBI determines-after 3 business days have passed
since the background search was requested (a
default proceed)-that the individual is prohibited
from possessing a firearm.

Scope and Methodology of Our Work Regarding NICS
Operations
In addition to having various telephone
discussions with officials at the FBI's NICS
Operations Center, we made three visits to the
center in 1999-June 8 and 9, September 28 and 29,
and October 12 and 13. During our visits, we
interviewed applicable managers and reviewed
relevant documents to obtain answers to the
requester's questions enumerated below. Given the
number and breadth of the questions and the need
to report within relatively short time frames, we
largely relied on testimonial and documentary
evidence provided by the FBI. Thus, we did not
fully or independently verify all of the answers.
However, regarding the topic of records retention,
we determined whether system documentation
included procedures for purging personal
identification information before or at expiration
of the allowed retention period specified by
regulation. We also conducted some limited or
nonprojectable testing of such purges. The team
performing this work included staff with
information management technology backgrounds.

More specific details about the scope and
methodology of our work regarding the various
aspects of NICS operations are as follows.

NICS Architecture
Requester questions. (1) What is the NICS'
functional architecture? (2) What is the NICS'
technical architecture? (3) What has the FBI done
to ensure that NICS operates as intended by
Congress?

To describe the system architecture, we reviewed
several key documents, including the NICS' Element
Software Design Document, the NICS' Element
Specification document, the NICS' Element
Interface Control Document, interface flowcharts,
and the draft NICS' Contingency Plan. In addition,
we toured the FBI's NICS Operations Center in West
Virginia. To supplement our document analyses, we
interviewed key NICS operations officials and
contractor representatives responsible for
designing, modifying, implementing, and operating
NICS. To determine what the FBI has done to ensure
that NICS operates as intended by Congress, we
reviewed the Brady Act to identify the
congressionally mandated functions. We also
interviewed key NICS operations officials.

Capacity Management
Requester questions. (1) Does the FBI have a
capacity management program? (2) What have been
the trends in capacity utilization? (3) What
volume of transactions (normal and peak) is the
system designed to handle? (4) How accurate have
been the predictions relating to the volume of
incoming transactions?

At the NICS Operations Center, we discussed these
questions with responsible FBI officials,
including the Operations Manager and Assistant
Operations Managers.

System Availability
Requester questions. (1) How does the FBI measure
system availability, and what is NICS' system
availability requirement? (2) What was actual
NICS system availability for the period November
30, 1998, through November 30, 1999? (3) How and
when is routine system maintenance performed? (4)
Is the nighttime shutdown period the appropriate
time to conduct routine maintenance? (5) What
have been the sources of NICS unscheduled outages,
and what steps have been taken to correct them and
prevent future occurrences?

We discussed these questions with FBI officials at
the NICS Operations Center. In doing so, we
obtained information showing the amount of
downtime (in minutes) for each month. We also
discussed with FBI officials the reasons for
unscheduled outages and steps they have taken to
correct such outages, and we reviewed applicable
documentation.

Transaction Response Time
Requester questions. (1) Does the FBI have the
capability to measure "dropped" telephone calls?
(2) Monthly, what have been the types and extent
of access problems, such as busy signals and
abandoned calls? (3) What procedures did the FBI
implement to track such problems? (4) How
effective have those procedures been in reducing
or eliminating the problems? (5) Due to NICS
inaccessibility, what were the estimated financial
costs or lost sales that small retail firearms
businesses in the United States incurred during
the peak 1998 Christmas selling season? (6) What
trend data are available regarding the number (and
percentage) of applications that have experienced
delays under NICS? (7) What was the average time
of such delays, and what were the reasons for the
delays? (8) How do the number (and percentage)
and time of delays under NICS compare to those of
state systems, particularly Virginia's and
Georgia's systems? (9) What has the FBI done to
ensure that the NICS name search software operates
at optimal performance?

We discussed applicable questions with (1) FBI
managers at the NICS Operations Center; (2)
representatives of interest or industry groups,
such as the National Rifle Association; the
National Association of Federally Licensed
Firearms Dealers; the American Shooting Sports
Council; the National Shooting Sports Foundation;
Gun Owners of America; the National Association of
Arms Shows, Inc.; and the National Pawnbrokers
Association; (3) Virginia State Police officials
in Richmond, VA; and (4) Georgia Bureau of
Investigation officials in Decatur, GA. We
obtained FBI Call Center statistics-the number of
calls attempted, answered, and abandoned
(dropped)-which we used to calculate monthly
percentages of calls answered. Also, we obtained
trend statistics regarding delayed responses
provided by the FBI to firearms dealers.

Retention of Records
Requester questions. (1) What measures have been
taken to ensure that NICS information is not used
to establish a national registry? (2) If NICS is
not currently in full compliance, what would be
the cost of any modifications needed to achieve
system compliance? (3) Does NICS contain
extraneous data that are unnecessary for
determining whether federal disqualifiers exist?
(4) Are the NTNs randomly generated, and do they
point to any identifying records? (5) What are
the specific reasons for retaining an audit log of
nonblocked transactions?

We reviewed Brady Act requirements and the
implementing regulations. During our September
and October, 1999, visits to the NICS Operations
Center, we identified what policies and procedures
were in place for purging records regarding both
(1) the computerized database or system, including
backup tapes, and (2) paper records, such as notes
or files maintained by FBI examiners and other
employees. While on-site we did the following:

� We asked one of the SAIC contractor staff to
pull up on his monitor screen the on-line
maintenance requirements so that we could observe
whether these requirements included a purge
function.
� We reviewed the NICS' Element Software Design
Document and the NICS' Element Specification
document to determine whether the purge function
was included as one of the system design
functions. Also, we reviewed the source code and
purge routine table to determine whether the purge
function was designed to delete data not more than
6 months after the transfer was allowed.
� For a small nonprojectable sample of days
(i.e., the last 12 days in May 1999 and 3 days in
late June 1999), we reviewed operations
documentation-that is, the operator's log of
nightly routine maintenance procedures-for
indications that purges had been conducted. The
NICS Operations Center did not know in advance of
our visit which days we intended to select for
testing.
� We judgmentally selected one date at least 6
months before the date of our visit to the NICS
Operations Center (Jan. 17, 1999) whereby all
approved transactions should have been purged. At
our request, we observed while contractor staff
had the computer generate a list of all NTNs
created on January 17, 1999. From that list, we
judgmentally selected five NTNs. Again, while we
observed, we had contractor staff input these NTNs
into the computerized system to determine if any
personal identification information could be
retrieved from these records.

Also, during our visit to the NICS Operations
Center, we discussed purge requirements with FBI
staff in two separate groups: (1) the NICS
Program Office Internal Assessment Group and (2)
the Criminal Justice Information Services Division
Audit Unit. We discussed the assessment or audit
work these groups had done and reviewed relevant
policy statements and other corroborating
documentation. We did not independently evaluate
the scope or methodology of the work done by these
groups.

Program Monitoring Activities
Requester question. What internal or external
assessment programs does the FBI have in place to
monitor NICS operations?

During our September 1999 visit to the NICS
Operations Center, we discussed this question with
FBI officials in the two separate groups
previously mentioned.

System Security Authorization
Requester question. Did the FBI follow a system
security authorization process for NICS in
accordance with applicable guidance?

To address this question, we reviewed applicable
guidance, including OMB Circular A-130, An
Introduction to Computer Security: The NIST
Handbook (NIST Special Publication 800-12), and
the Guide for Developing Security Plans for
Information Technology Systems (NIST Special
Publication 800-18). We also reviewed the FBI's
security policy, internal memorandums, and the
security plan for the NICS Operations Center and
the Call Centers. To supplement our document
analyses, we interviewed key NICS security
officials.

Exemptions From the Privacy Act of 1974
Requester questions. (1) Regarding erroneous data
generated by NICS, has the FBI exempted itself
from certain safeguards of the Privacy Act? If
so, why? (2) What would be the estimated costs of
adhering to the Privacy Act?

To address these questions, we (1) interviewed
appropriate agency officials, (2) reviewed
pertinent provisions of the Privacy Act, and (3)
reviewed applicable Federal Register notices of
proposed and final rules regarding the exemption
of NICS from certain provisions of the Privacy
Act.

Making NICS Fingerprint-based Rather Than Name-
based
Requester questions. (1) Are there any plans or
intent to add fingerprints to the system? (2) If
so, what are the specific justifications? (3)
What are the operational implications and the
estimated costs?

To address these questions, we interviewed FBI
officials at the NICS Operations Center.

Scope and Methodology of Our Work Regarding
Pawnshop-related Issues
To address the questions about owner redemptions
of firearms from pawnshops, we reviewed (1)
relevant provisions of the Brady Act, including
applicable amendments, and Treasury's fiscal year
1999 and 2000 appropriation acts and (2) Treasury
and ATF documentation, including proposed and
final rules for implementing Brady Act provisions.
Also, we discussed these issues with (1) officials
in ATF's Office of Chief Counsel and the
Regulations Division and (2) representatives of
the National Pawnbrokers Association. Further, we
contacted the FBI's NICS Operations Center to
determine the extent, if any, to which the system
captures statistical information regarding
pawnshop-related transactions.

_______________________________
1These Bureau of Justice Statistics reports are
entitled: Presale Firearm Checks (NCJ 162787),
February 1997; Presale Handgun Checks, 1997 (NCJ
171130), June 1998; and Presale Handgun Checks,
the Brady Interim Period, 1994-98 (NCJ 175034),
June 1999.

Appendix VII
GAO Contacts and Staff Acknowledgments
Page 95GAO/GGD/AIMD-00-64 Gun Control: Implementat
ion of NICS
GAO Contacts
Laurie E. Ekstrand, (202) 512-8777
Randolph C. Hite (202) 512-6240

Acknowledgments
In addition to the persons named above, David
P. Alexander, Monica Anzaldi, Scott A. Binder,
Felicia M. Bradley, Danny R. Burton, Philip D.
Caramia, Deborah A. Davis, Geoffrey R. Hamilton,
Madhav S. Panwar, Mary Lane Renninger, Chuck
Roney, Dennise R. Stickley, and Ellen Wolfe made
key contributions to this report.

*** End of Document ***