Input:
	Background

Radiological material is used throughout the world for medical and  industrial purposes. Possession of this material within the United States  requires a license from NRC or from one of the 37 Agreement States to  which NRC has relinquished regulatory responsibility. NRC and  Agreement States issue two types of licenses authorizing the possession  and use of radiological materials: specific licenses and general licenses.  Specific licenses are issued for devices that typically contain larger  quantities of radiological material, such as medical equipment used to  treat cancer, cameras used for industrial radiography, and moisture and  density gauges used in construction. Devices approved for use under a  general license, by contrast, such as luminous exit signs, normally  contain relatively small quantities of radiological material. Such devices  are designed with inherent safety features, are widely available  commercially, and do not require NRC or Agreement State approval to  possess. Not all radiological material requires an NRC license for  possession. For example, there is naturally occurring radioactive material  in ceramics, fertilizers, and granite tile that does not require a license.  This report focuses on radiological material that requires specific licenses  for possession and use.
Beyond requiring specific licenses for possession of radiological material,  NRC may also require a general or specific license to import such  material. Generally, NRC will issue an import license when the recipient  of the material is authorized to receive and possess the material being  imported.
When issuing licenses for the possession of radiological material, NRC  and Agreement States take steps to ensure companies are legitimate.  Specifically, NRC and Agreement State officials are to conduct pre- licensing visits with all unknown applicants, using detailed screening  criteria. According to NRC, the purpose of the site visit is to have a face- to-face meeting with the applicant to determine whether there is a basis  for confidence that the applicant will use the radiological materials sought  as represented in the application when the applicant receives the license.  NRC has established a 14-point checklist to guide pre-licensing site visits  and has developed a list of questions and activities related to each  applicant’s business operations, facility, radiation safety operations, and  personnel qualifications, to scrutinize the applicant and provide a basis for  confidence that the applicant will use the radiological material as specified  in the license.
In 2003, the International Atomic Energy Agency published a system— which NRC adopted in 2004—that ranks quantities of individual  radionuclides into one of five categories on the basis of their potential to  harm human health. Under this system, a given radionuclide is  considered dangerous when gathered in sufficient quantity and in close  enough proximity to people to cause direct human health effects. A  category 1 quantity, if not safely managed or securely protected, is likely  to cause permanent injury to a person who handles or is otherwise in  contact with it for more than a few minutes. Being close to this amount of  unshielded material for a period of a few minutes to an hour will probably be fatal. A category 2 quantity, if not safely managed or securely  protected, can cause permanent injury to a person who handles or is  otherwise in contact with it for a short time (minutes to hours). Being close  to this amount of unshielded radioactive material for a period of hours to  days can be fatal. A category 3 quantity, if not safely managed or  securely protected, can cause permanent injury to a person who handles  or is otherwise in contact with it for some hours. Being close to this  amount of unshielded radioactive material for a period of days to weeks  can be fatal. Category 4 and 5 quantities are unlikely to cause permanent  injury.
In addition to categorizing radionuclides on the basis of their potential to  harm human health, NRC has identified 16 radionuclides that are  sufficiently attractive for use in a dirty bomb or for other malicious  purposes. These 16 radionuclides of concern, shown in table 1, warrant  enhanced security and protection measures—such as cameras, alarms,  and other physical security measures—under NRC regulations.
Radiological material is imported into the United States by both express  consignment couriers arriving by air and air cargo carriers. Express  consignment couriers, such as FedEx, move cargo for the public under  express commercial services and provide door-to-door delivery. Air cargo  carriers transport radiological material in cargo containers on commercial  airlines. We have previously reported on the disparity in portal monitor  deployment between the express consignment and air cargo  environments. There are dozens of portal monitors in U.S. airports  servicing express couriers, but few servicing air cargo carriers.  According to CBP officials, handheld monitors are used to scan  radioactive material at airports where portal monitors are not available.
The CBP mission includes the border enforcement of the customs,  immigration, and agriculture laws and regulations of the United States  and enforcement on behalf of numerous federal agencies. The mission  includes enforcement of the laws relating to the importation and  exportation of merchandise into and out of the United States. In addition,  the agency’s mission includes denying entry to terrorists and their  weapons and criminals and their contraband. CBP’s Office of Field  Operations is responsible for passenger and cargo processing activities  related to border security, trade, immigration, and agricultural inspection  at the nation’s air, sea, and land ports of entry. Prior to importing goods  into the United States, information is submitted to CBP declaring the  contents of shipments. This information includes, among other things, a  description of goods, the name of the recipient, the port of entry, and a  tariff code that classifies goods.
CBP uses various data systems to track shipments into the United States  and identify shipments for license verification. According to CBP, the  Automated Commercial Environment is the primary system for processing  shipments entering the United States, and it enables the government to  make determinations about whether to admit goods into the country. The  data stored in the Automated Commercial Environment are also used to  ensure proper duty is collected for imported goods. CBP officials also  view Automated Commercial Environment data in CBP’s Automated  Targeting System, which is a decision support tool that analyzes  shipment data to assess risk and identify potential violations. The  Automated Targeting System includes automated alerts, which notify  CBP officials when they need to take additional actions before shipments  can be released. Information about NRC and Agreement State licenses  for radiological material is included in NRC’s Web-Based Licensing  System, which includes information about NRC and Agreement State  licenses for category 1 and 2 quantities of radiological material. In  addition, the Web-Based Licensing System includes up-to-date  information on all NRC and six Agreement States’ specific licenses,  including licenses that authorize possession of radiological material below  the category 2 threshold. However, licenses for quantities of material  below the category 2 threshold issued by 31 Agreement States are not  kept in the system. The CBP data systems used to identify shipments for  license verification are listed in table 2.

	CBP’s Policies and Procedures Require License Verification for Imported Radiological Material

CBP has implemented a policy and procedures requiring CBP officials at  airports to contact experts within a centralized CBP office to verify  licenses for radiological material being shipped into the United States.  Specifically, CBP issued its “Radiation Detection Standard Operating  Procedures Directive” policy in March 2014, outlining when CBP officials  at ports of entry are required to contact internal experts at CBP’s  Teleforensic Center who possess the technical expertise to verify that  NRC and Agreement State licenses for radiological materials are  legitimate. The function of the Teleforensic Center is to provide field  CBP officials with assistance in resolving scientific and technological  questions, including detection, isolation, and control of potential threats  that may result from the presence of chemical, biological, radiological, or  nuclear materials. The Teleforensic Center is staffed with scientists with  expertise in a range of scientific disciplines, including chemistry, biology,  explosives, radiological science, and nuclear science. The Teleforensic  Center has established a hotline to receive requests for license  verification, among other things, and the experts are available 24 hours a  day, 7 days a week.
CBP’s 2014 policy requires CBP personnel to verify the legitimacy of  NRC and Agreement State licenses for all commercial imports of  industrial and medical radionuclides that require a license from NRC or  one of the 37 Agreement States. To implement this policy, CBP has  established procedures for private-sector entities and CBP. These  procedures, which apply equally to all quantities and types of licensable  radiological material, can be broken down into three parts: submission of  paperwork, identification of material, and verification of the license by  experts in the Teleforensic Center, as outlined in figure 1.
Once the shipment information is entered into the Automated Commercial  Environment, CBP data systems identify which shipments of radiological  material require license verification. Specifically, CBP’s Automated  Targeting System uses certain information to identify shipments requiring  license verification. Details about this information are omitted from this  report because they were deemed to be sensitive by CBP. Once  shipments are flagged as containing licensable radiological material, an  alert is sent to CBP officials at the airport informing them that the material  requires a license from NRC or an Agreement State. The alert outlines  the steps the officials need to take to verify that the license is legitimate.  Among other things, the alert explicitly states the phone number for  contacting the Teleforensic Center and includes instructions for handling  the material. According to CBP procedures, CBP officials are not allowed  to release the shipment until they receive approval from the Teleforensic  Center.
Officials at the Teleforensic Center primarily use NRC’s Web-Based  Licensing database to verify the legitimacy of licenses granted by NRC.  However, as we’ve previously reported, licenses for some radiological  material that are granted by Agreement States are not kept in that  database, requiring the center’s experts to also call specific points of  contacts at Agreement States to verify these licenses. CBP officials told  us that Agreement State offices typically are not open 24 hours a day, 7  days a week, occasionally requiring CBP to hold shipments until an  official can be reached. In addition to consulting the Web-Based  Licensing database and contacting Agreement State officials to verify  licenses, experts at the Teleforensic Center can also request additional  information from CBP officials at the airports. After the experts verify that  a license is legitimate, they give approval to the CBP officials at the  airport to release the shipment. CBP officials at the airport then document  the release. CBP officials at the four airports we visited and experts at the  Teleforensic Center told us that it typically takes 30 to 90 minutes to verify  a license, but it can take longer if the experts have to consult with an  Agreement State. If a license cannot be verified, the shipment is returned  to the sender or, in the case of an illegal shipment, seized and referred to  proper law enforcement officials, as outlined in the policy.

	CBP Has Not Verified All Licenses as Required by Its Policy and Procedures

CBP has not verified all licenses for radiological materials as required in  its policy and procedures. During the 21-month period we reviewed, CBP  personnel at airports across the country did not verify the legitimacy of a  significant number of shipments CBP considered as containing potentially  dangerous radiological material. CBP officials at two of the four airports  we visited may not have verified the legitimacy of licenses for many of the  shipments of radiological material imported during the 21-month period,  which was not consistent with CBP policy. After we brought this issue to  CBP’s attention, it issued additional guidance. However, this guidance  was not clear and caused confusion at the two airports we visited where  actions continued to be taken that were not consistent with CBP policy.

		CBP Is Not Consistently Implementing Its Procedures, Potentially Leaving Many Shipments of Radiological Material Unverified

CBP officials did not verify the legitimacy of licenses for many of the  shipments of radiological material imported from January 1, 2015, to  September 30, 2016. We found that during this time frame, CBP officials  stationed at airports nationwide did not make the required calls to verify  licenses for a significant number of shipments of radiological material  identified by CBP as requiring license verification—leaving many licenses  unverified over this 21-month period. These shipments came through  airports across the United States and, according to CBP officials we  interviewed, arrived by both express courier and air cargo companies.
At two of the four airports we visited, we observed that CBP officials were  taking actions that were consistent with CBP policy. Specifically, we noted  the following:
At one airport, officials responsible for reviewing shipments of  imported radiological material told us that they call the Teleforensic  Center whenever they receive an alert from CBP’s data system,  consistent with CBP policy. In addition, the officials said that they  send any requested information to the Teleforensic Center and wait  for approval from the center before releasing shipments.
At another airport, officials responsible for reviewing shipments of  imported radiological material told us that they also call the  Teleforensic Center whenever they receive an alert and only release  shipments upon receiving approval.
However, at the remaining two airports we visited, officials responsible for  reviewing shipments of imported radiological material took actions that  were not consistent with CBP policy to verify the legitimacy of radiological  shipments entering the country. As a result, officials at these airports had  not verified hundreds of licenses as required under CBP’s policy because  the officials misunderstood what they were required to do. In discussions  with these officials, some described taking actions that were not  consistent with the license verification requirements. Details about the  extent of verification are omitted from this report because the information  was deemed to be sensitive by CBP.
At one airport, CBP officials told us they typically verify licenses on- site without calling the Teleforensic Center. This airport had more than  100 shipments of licensable radiological material during the 21-month  period for which CBP provided data, but officials only made a few  calls to the Teleforensic Center to verify licenses during this time,  leaving many shipments of material unverified. Instead of calling the  Teleforensic Center as required, the CBP officials said that they  reviewed the shipment paperwork and looked for anomalies. CBP  officials said that they undertake this paperwork review regardless of  the risk of the radiological material in the shipment. For example, they  said they would use this approach to verify licenses for category 1  materials, which NRC and the International Atomic Energy Agency  classify as likely to cause permanent injury to a person who comes  into contact with them. The officials told us that they call the  Teleforensic Center only when there is something wrong with the  shipment. Officials at CBP headquarters told us that this procedure  does not comply with their verification policy and would not be  effective.
At the second airport, CBP officials we interviewed told us that license  verification was conducted by private-sector express couriers  overseas, negating the need for officials at the port of entry to call the  Teleforensic Center. The CBP officials at the airport believed that a  Memorandum of Understanding (MOU) between CBP and private  companies delegates responsibility to express couriers to scan  material with radiation detection equipment. These CBP airport  officials said that express couriers also verify licenses as part of this  process. However, the MOU between CBP and express couriers does  not address the verification of licenses for radiological shipments.  CBP headquarters officials we interviewed told us that the airport’s  practice does not comply with the agency’s verification policy and  confirmed that the Teleforensic Center is the only entity that can verify  licenses. The headquarters officials also reiterated to us that license  verification is not conducted by overseas private-sector companies.  Officials we interviewed from an express courier that ships  radiological material also told us that they do not verify licenses. This  airport made few calls to the Teleforensic Center to verify licenses  during the 21-month period, according to the data provided to us by  CBP.

		CBP Issued Additional Guidance, but This Guidance Did Not Initially Improve Compliance

In February 2017, we briefed CBP headquarters officials on our findings  from the site visits to the four airports. We included in our briefing a  summary of findings from our site visits and information on the number of  calls made by CBP officials to verify licenses. At this meeting, CBP  headquarters officials indicated that they would look into why calls were  not made. Subsequently, in March 2017, in response to this briefing, CBP  headquarters issued additional guidance to remind all field officials of  CBP’s license verification policy. The guidance states that CBP officials  must contact the Teleforensic Center to verify the license for all  shipments of licensable radiological material. In addition, the guidance  states that shipments may not be released from the airport until experts at  the Teleforensic Center have completed verification of the license. The  guidance was issued in the form of a “muster”—a type of memorandum  addressed to all CBP field offices to emphasize CBP policy. Once such a  memorandum is issued, CBP relies on local officials to interpret and pass  along this information to those working directly with the shipments.  According to CBP officials, the guidance was communicated to managers  and then the managers communicated this information to front-line staff  through weekly meetings and informal discussions.
However, the muster was not successful in correcting previous  misconceptions at the two airports we visited where officials’ actions were  not consistent with CBP policy and the muster did not fully resolve their  noncompliance with CBP policy. In part this was because, according to  officials, they found the muster confusing. In April and May 2017, several  weeks after CBP issued the muster, we contacted officials at the four  airports we previously visited. Based on interviews with CBP officials at  the two airports where actions were not consistent with CBP policy before  the muster, we determined that they were continuing to take actions that  were not consistent with CBP policy after they received the muster. For  example, CBP officials at one of the two airports said they were  continuing to conduct license verification without the assistance of the  Teleforensic Center. Officials at this airport told us that they believed their  actions were consistent with the policy, even though they had not altered  their actions in response to the muster. Similarly, at the other airport  where actions were not consistent with the CBP policy before the muster,  officials told us again that license verification can be conducted overseas  by express couriers, citing the MOU allowing express couriers to scan  material with radiation detection equipment. When we discussed the  content of the muster with CBP officials in headquarters in June 2017,  they acknowledged the muster was confusing and stated it needed to be  further clarified. Subsequent to our June 2017 meeting with CBP officials,  they provided additional data that suggested an increase in calls to the  Teleforensic Center. In July 2017, CBP officials told us they planned to  issue additional clarifications. Subsequently, in November 2017, CBP  issued an additional muster emphasizing its policy to call the Teleforensic  Center for all shipments of licensable radiological material.
CBP headquarters officials told us that they were unaware, until we  informed them, that selected airports were not calling the Teleforensic  Center to verify licenses and that licenses were not being verified for  some imported radiological material. This is because CBP does not have  a mechanism, such as a monitoring system, to ensure that all required  license verifications are occurring. Such a system could also conduct  checks to ensure CBP officials are following agency policy. The challenge  to creating such a system is that CBP houses the data necessary to  create it in separate systems that do not communicate with each other,  and these systems are currently run by different offices with differing  missions within CBP. Federal standards for internal control state that  management should establish and operate monitoring activities to monitor  the internal control system and evaluate the results. Until CBP develops  a monitoring system to help ensure that CBP officials comply with the  license verification policy, the agency will not have reasonable assurance  that it can identify activities that are inconsistent with its policy and take  corrective action as necessary.

	CBP Policies and Procedures Are Not Effective at Ensuring Only Properly Licensed Radiological Material Is Imported

CBP policies and procedures are not effective at ensuring that only  properly licensed radiological material is imported into the United States.  Specifically, CBP’s procedures for identifying licensable radiological  material do not ensure that all shipments of radiological material are  identified and verified, resulting in the exclusion of a significant number of  shipments that possibly contained radioactive material during the 21- month period we reviewed. Moreover, CBP’s current policy and  procedures treat all radiological shipments with the same level of scrutiny  and do not target resources based on the risk of the material. Details  about these issues are omitted from this report because the information  was deemed to be sensitive by CBP.

		CBP’s Procedures Do Not Ensure That All Shipments of Radiological Material Are Identified and Verified

CBP procedures for identifying licensable radiological material do not  effectively implement its policy to verify the license for all shipments of  licensable radiological material. We identified the following issues that  result in limitations in CBP’s procedures.
Specifically, the data system that CBP uses to implement its procedures  does not sufficiently identify all shipments of potentially dangerous  radiological materials. To implement its procedures, the agency chose to  use an existing data system designed to process all types of imports into  the United States. This system uses general customs information to  identify the contents of shipments. Consequently, of the 44,152  shipments that could contain licensable radiological material, the system  alerted CBP officials that they were required to verify relatively few  licenses from January 1, 2015, to September 30, 2016.
In addition, CBP’s license verification procedures do not currently target  the higher-risk radiological materials. CBP’s method for identifying the  contents of shipments does not include information that describes the  quantity of radiological material. Specifically, categories 1, 2, and 3  quantities of radiological material can cause permanent injury or death to  a person in contact with them for some period of time. As a result,  according to a senior CBP official, it is safer to assume all shipments of  radiological material are dangerous until proven otherwise.
Federal standards for internal control recommend that agencies design  control activities to achieve objectives and respond to risks. Until CBP  develops a robust system that can identify all shipments of radiological  material that pose risk, it will not have reasonable assurance that it has  the appropriate policies and procedures necessary to verify licenses for  these shipments. Furthermore, as we reported in December 2016, an  essential element of enterprise risk management is to examine risks  considering both the likelihood of the risk and the impact of the risk on the  mission, in order to help prioritize risk response. Although CBP officials  recognize that their current system and procedures have limitations and  do not allow them to fully implement the agency policy to verify all  shipments of radiological material that enter the United States, we found  that they have not developed a system nor revised their procedures to  address the issues we identified. Of particular concern is that CBP has not conducted a comprehensive assessment of (1) the information not  currently included in the automated alert to determine what additional  information would indicate shipments that may contain dangerous  material or (2) how to create a more risk-based approach that  distinguishes between higher- and lower-risk categories of radiological  materials. Until it conducts such an assessment, CBP will not know how  to adjust its current procedures to ensure that it is identifying all  shipments of potentially dangerous radiological material and targeting its  limited resources to those that pose the greatest risk.

	Conclusions

CBP has implemented a policy and procedures intended to ensure that  the tens of thousands of shipments of potentially dangerous radiological  material imported through U.S. airports each year are properly licensed.  However, CBP’s procedures do not effectively implement CBP’s policy of  ensuring that only properly licensed radiological material gains entry to  the United States. This is because CBP does not have a monitoring  system to help ensure that CBP officials at airports nationwide are  complying with the license verification policy. Until CBP develops such a  system, the agency will not have reasonable assurance that it can identify  activities that are inconsistent with its policy and take corrective action as  necessary.
In addition, CBP’s procedures for identifying licensable radiological  material do not ensure that all shipments of radiological material are  identified and verified. This is the result of CBP’s automated alert, which  currently does not include all relevant information needed to identify such  shipments. Additionally, CBP procedures do not distinguish between  high-risk categories of radiological materials and lower-risk categories;  therefore CBP cannot target its limited resources to the shipments that  pose the greatest risk. CBP has not conducted a comprehensive  assessment of the information not currently included in the automated  alert and does not know which shipments pose the greatest risk. A  comprehensive assessment could help CBP gain a better understanding  of information not currently included in the automated alert, and it could  better position the agency to make appropriate changes to its existing  system and procedures, as well as target its limited resources toward the  quantities of material that pose the greatest risk.

	Recommendations for Executive Action

We are making the following three recommendations to CBP:
The Commissioner of CBP should develop a monitoring system to  help ensure that CBP officials comply with license verification policies  and procedures. (Recommendation 1)
The Commissioner of CBP should conduct a comprehensive  assessment of information not included in the automated alert to  determine what information is needed to identify licensable  radiological material. (Recommendation 2)
The Commissioner of CBP should develop a system that better  identifies shipments of radiological material that pose the greatest risk  and revise CBP’s policies and procedures as necessary to verify  licenses for these shipments. (Recommendation 3)

	Agency Comments

We provided a draft of this product to the Department of Homeland  Security (DHS) and NRC for review and comment. DHS provided written  comments, reproduced in appendix I, in which it concurred with our three  recommendations. DHS stated that it will take the following actions,  among others, to address our recommendations: (1) include a monitoring  process in an updated version of its policy addressing license verification,  (2) conduct a comprehensive assessment of information not included in  the automated alert to determine what information is associated with  dangerous material, and (3) develop an intelligence-driven process that  identifies shipments of radiological materials that pose the greatest threat.  In addition, DHS and NRC provided technical comments, which we  incorporated as appropriate.
We are sending copies of this report to the appropriate congressional  committees, the Secretary of Homeland Security, the Chairman of the  U.S. Nuclear Regulatory Commission, and other interested parties. In  addition, the report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact me at (202) 512-3841 or trimbled@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page   of this report. GAO staff who made significant contributions to this report  are listed in appendix II.

Appendix I: Comments from the Department of Homeland Security

Appendix II: GAO Contact and Staff Acknowledgments

	GAO Contact

	Staff Acknowledgments

In addition to the individual named above, Ned Woodward, Assistant  Director; Jeffrey Barron; Richard Burkard; Kendall Childers; Cindy Gilbert;  Cynthia Norris; Danny Royer; Jerry Sandau; Travis Schwartz; and Kiki  Theodoropoulos made key contributions to this report.

Output:
Why GAO Did This Study

Thousands of shipments containing radiological material enter the United States each year through airports across the country. Radiological material is used in various medical and industrial applications, and possession requires a license from the Nuclear Regulatory Commission (NRC) or one of the 37 states to which NRC has relinquished licensing authority. Failure to verify the licenses could allow terrorists to acquire radiological material for a dirty bomb, which uses explosives to disperse the material.
GAO was asked to review CBP policies and procedures related to license verification. This report examines, among other things, (1) the extent to which CBP follows its policies and procedures, and (2) the effectiveness of these policies and procedures. GAO reviewed relevant policies and procedures, analyzed CBP data related to radiological material shipments and license verification, interviewed CBP and NRC officials, and selected four airports to visit based on expected traffic of radiological shipments.

What GAO Found

U.S. Customs and Border Protection (CBP) agency officials at U.S. airports have not verified the legitimacy of all licenses for imported radiological materials as required by CBP's policy. The policy requires CBP officials, when alerted, to verify licenses by calling experts in a centralized CBP office. CBP officials at two of four airports GAO visited said they were calling as required. However, CBP officials at the other two airports did not verify many licenses from January 1, 2015, through September 30, 2016, and headquarters officials were unaware of non-compliance with CBP policy. Also, GAO found that during this time frame nationwide, CBP officials were alerted to verify licenses for a significant number of shipments of licensable radiological material for all U.S. airports, but they did not make all the required calls—leaving numerous shipments potentially unverified over this 21-month period. This situation occurred because CBP does not have a monitoring system to ensure that officials make license verification calls as required. Until CBP develops a monitoring system for license verification, it will not have reasonable assurance that it can identify activities inconsistent with its policy and take corrective action.
CBP procedures cannot effectively implement the agency's policy that its officials verify all radiological material shipments imported into the United States. The procedures are not effective for this policy in part because they rely on automated alerts that are based on some but not all relevant information that could indicate potentially dangerous radiological material. Consequently, CBP's current system and procedures cannot ensure that all such materials will be identified. Under federal internal control standards, agencies are to design control activities to achieve objectives and respond to risks. However, CBP does not have the information it needs to develop a robust system or revise its procedures because it has not conducted a comprehensive assessment of the information not included in its automated alert system. In particular, CBP has not assessed relevant information not currently included in the automated alert or how to create a more risk-based approach that distinguishes between higher- and lower-risk quantities of radiological materials. Without such an assessment, CBP may be unable to develop a system or procedures that best support its policy for verifying imported radiological materials.
This is a public version of a sensitive report GAO issued in September 2017. Information CBP deemed sensitive has been omitted.

What GAO Recommends

GAO recommends that CBP develop a monitoring system to help ensure that CBP officials comply with the agency's license verification policy, conduct an assessment to determine relevant information that is not included in the automated alerts, and develop a system that allows it to identify shipments of greatest risk. CBP concurred with GAO's three recommendations and outlined actions to implement those recommendations.


Input:
	Background

ATF is one of several DOJ law-enforcement components, including the  Federal Bureau of Investigation (FBI) and the Drug Enforcement  Administration (DEA), responsible for fighting violent crime. ATF is the  lead agency charged with enforcing federal firearms laws and regulating  the firearms industry. ATF is also responsible for investigating criminals  and criminal organizations that use firearms, arson, or explosives in  violent criminal activity.
ATF investigates and combats violent crime related to firearm trafficking,  criminal possession and use of firearms, and the diversion of firearms  from legal commerce. This work includes law-enforcement operations and  intelligence gathering and analysis. For example, special agents  investigate reports of prohibited individuals acquiring or attempting to  acquire firearms from private sellers in order to avoid background checks  that would otherwise be required if purchasing through an FFL. According  to ATF officials, intelligence analysts may help agents by gathering  information from the public social-media profiles of individuals under  investigation. In addition, ATF investigates reports of individuals engaging  in the business of dealing firearms without a license, thereby  circumventing background-check, record-keeping, and other  requirements.

		Statutes and Regulations

The National Firearms Act of 1934 (NFA) and the Gun Control Act of  1968 (GCA) are the primary federal laws that regulate the manufacture,  sale, distribution, and possession of firearms. There are no laws that  specifically regulate firearms transactions facilitated by the Internet.  Rather, firearms transactions facilitated by the Internet are subject to the  same legal requirements and regulations as traditional firearms sales.

			National Firearms Act of 1934, as Amended

The NFA defines the specific types of firearms and components subject to  the provisions of the act based on the firearm’s function, design,  configuration, or dimensions. For example, the NFA applies to machine  guns, short-barreled rifles, short-barreled shotguns, and silencers. The  NFA requires these firearms and components to be registered with ATF.  The lawful transfer of firearms and components subject to the NFA  generally requires ATF approval, a process that involves the submission  of application forms, fingerprints, and photographs to ATF, as well as  payment of a transfer tax. Transfers outside of this ATF-approval process  are generally illegal.

			Gun Control Act of 1968, as Amended

The GCA, the main federal statute applicable to firearms such as  handguns, shotguns, and rifles, requires all persons engaged in the  business of manufacturing, importing, or dealing in firearms to become an  FFL through ATF. The GCA defines a person “engaged in the business”  as a dealer of firearms as someone who “devotes time, attention, and  labor to dealing in firearms as a regular course of trade or business with  the principal objective of livelihood and profit through the repetitive  purchase and resale of firearms.” The definition excludes individuals  who make “occasional” sales or purchases to enhance a personal  collection or for a hobby or who sell all or part of a personal collection of  firearms. The GCA requires that FFLs maintain records of all their gun  sales. These records are used, among other purposes, to trace a firearm  recovered by law-enforcement officials from its first sale by the  manufacturer or importer through the distribution chain to the first retail  purchaser, in order to provide law-enforcement agencies with  investigative leads.
As amended by the Brady Handgun Violence Prevention Act, the GCA  generally requires FFLs to contact the FBI’s National Instant Criminal  Background Check System (NICS) prior to transferring a firearm to a  nonlicensed individual. During a NICS background check, the buyer  provides the FFL with appropriate identification, such as a valid driver’s  license. The FFL submits descriptive data, including the buyer’s name  and date of birth, to NICS, which searches three national databases  containing criminal history and other relevant records to determine  whether federal or state law prohibits the person from receiving or  possessing a firearm. The transfer may proceed if NICS informs the FFL  that it has no information indicating that the transfer would be in violation  of law, or if 3 business days have elapsed without notification that the  transfer would violate the law. The GCA prohibits individuals from  knowingly making a false statement intended to deceive FFLs with  respect to any fact material to the lawfulness of the sale, such as a  person claiming that he or she is the actual buyer of a firearm and not  acquiring the firearm on behalf of another person, when in fact he or she  is purchasing the firearm with the intent to transfer it to a prohibited  person. This type of transaction is often referred to as a “straw purchase.”
In addition, the GCA establishes the categories of persons generally  prohibited from shipping, transporting, receiving, or possessing firearms  and ammunition. Specifically, persons are prohibited from shipping,  transporting, receiving, or possessing a firearm if they (1) have been  convicted of a felony; (2) are a fugitive from justice; (3) are an unlawful  user of or addicted to any controlled substance; (4) have been committed  to a mental institution or judged to be mentally defective; (5) are aliens  illegally or unlawfully in the United States, or certain other aliens admitted  under a nonimmigrant visa; (6) have been dishonorably discharged from  the military; (7) have renounced their U.S. citizenship; (8) are under a  qualifying domestic violence restraining order; or (9) have been convicted  of a misdemeanor crime of domestic violence. In addition, federal law  prohibits persons under felony indictment from shipping, transporting, or  receiving a firearm.
Individuals who are not engaged in the business of dealing in firearms  may not legally sell firearms to other unlicensed individuals under certain  circumstances. For example, a transaction between unlicensed  individuals would be illegal if the seller knows or has reasonable cause to  believe that the buyer is legally prohibited from possessing firearms or is  a resident of a different state than the seller. If the seller is not aware of  these circumstances, the seller may transfer the firearm to the buyer  without any record-keeping or background-check requirements.
Nonprohibited, nonlicensed individuals may legally purchase firearms  through an FFL or through individual private sales with residents of the  same state. Regardless of whether an FFL is involved in an Internet- facilitated firearm purchase, if a seller knows or has a reasonable cause  to believe that the prospective recipient is prohibited from possessing  firearms, the seller must not transfer the firearm. See figure 1.
As outlined in figure 1, the Internet can facilitate legal purchases either  through FFLs or through nonlicensed private sellers. For purchases  through an FFL, an individual orders a firearm online, and generally  completes the transaction process in person. The FFL submits the  required paperwork to ATF. A background check is processed directly by  NICS or through a state government that checks NICS. Unless denied by  the background check, the transaction is completed. If the individual is  purchasing the firearm from an FFL in another state, the original FFL will  transfer the firearm to an FFL in the state the buyer resides in to complete  the transaction. If both the buyer and seller are residents of the same  state, transfers between private nonlicensed parties facilitated by the  Internet without the involvement of an FFL may be lawful. The firearm  may be transferred in person between the buyer and the seller, or, if the  firearm is a shotgun or rifle, it may be mailed intrastate between the  individuals. The seller has no record-keeping obligations, and no NICS  background check is performed on the buyer. However, a nonlicensed  individual is usually prohibited from directly transferring a firearm to a  person who the transferor knows or had reasonable cause to believe is  residing in another state. In addition, it is usually illegal for any  nonlicensed individual to transport into or receive in the state where he  resides any firearm purchased or otherwise obtained outside that state.  Therefore, interstate transactions between two nonlicensed individuals  are likely to be illegal unless an FFL becomes a party to the transaction.  For a legal transaction between residents of different states, the seller  must send the firearm to an FFL in the buyer’s state. The FFL submits  the paperwork, a background check is processed, and, unless denied by  the background check, the FFL transfers the firearm to the buyer.

		Internet Firearm Marketplaces

Potential gun buyers can view firearm advertisements and make  purchases from the following categories of websites: major retailers,  online retailers, online auctions and marketplaces, online classified  listings, online forums and social media networks, and Dark Web  websites. According to ATF reports, major retailers and online retailers  meet the definition of firearm dealers and therefore must be FFLs in order  to operate. To see how purchases may be facilitated by various Internet  marketplaces, see figure 2.

		Prior Reporting on Internet Firearms Sales

GAO, DOJ, and the Congressional Research Service (CRS), as well as a  gun-control advocacy group, have reported on the issue of Internet  firearm sales since the early 2000s. In 2001 we reported the results of our  undercover inquiries to private individuals who advertised firearms online.  We attempted to purchase firearms from two of these individuals. Both  individuals were willing to complete the transactions in person, though we  did not complete the sales.
Also in 2001, as part of a larger report on reducing gun violence, DOJ  identified issues related to firearms sales facilitated by the Internet.  Among the issues outlined in the report was the possibility prohibited  individuals may use the Internet to acquire firearms. The report also  stated that the Internet may facilitate illegal sales by individuals selling  firearms commercially without a license. The report stated that  enforcement mechanisms must be established to prevent prohibited  individuals from obtaining firearms through the Internet and to make sure  that both FFLs and nonlicensed sellers follow existing law when  conducting sales through the Internet. The report noted that ATF was  working to establish a unit to identify and respond to criminal violations  involving the Internet and other new computer technology and worked  with other federal law-enforcement agencies to establish enforcement  mechanisms to prevent prohibited individuals from obtaining firearms  through the Internet and to make sure both FFLs and nonlicensed sellers  follow existing law when conducting sales through the Internet.
In 2012, CRS reported on Internet firearm and ammunition sales. The  report outlined the extent to which federal law regulates the sale of  firearms via the Internet, which is not treated as legally distinct from sales  not facilitated by the Internet. CRS noted that this situation has raised  concerns about the possibility of increased violation of federal firearm  laws and about challenges that law-enforcement agencies may face when  attempting to investigate violations of these laws.
Additionally, a prior report by an advocacy group explored how the  Internet may facilitate firearm sales to prohibited individuals. However,  the report described how prohibited individuals may use the Internet to  find firearms for sale and then to conduct face-to-face transactions. The  report did not demonstrate how prohibited individuals may have firearms  mailed directly to them, thus circumventing the FFL purchase process, or  otherwise break the law. Representatives from the investigative  organization that performed this work stated that they did not break the  law when performing their testing.

	ATF Takes Various Actions to Enforce Firearm Regulations Related to Prohibited Firearm Transactions Facilitated by the Internet

		ATF Does Not Distinguish between In-Person Sales and Sales Facilitated by the Internet when Enforcing Firearms Statutes and Regulations

As we noted above, there are no specific statutes or regulations  pertaining to Internet firearms transactions. Hence, ATF does not  distinguish between private firearms transactions taking place in person  versus those that use the Internet to facilitate the sale. Licensed and  nonlicensed sellers use the Internet to facilitate firearm sales in a variety  of ways. Major retailers with a federal firearms license enable customers  to browse available firearms on their websites but require transactions to  be made in person at the store. Online retailers with a federal firearms  license advertise firearms online and transfer the firearm to the purchaser  through either a storefront that qualifies as an FFL or another FFL in the  buyer’s state. Online auction and marketplace websites, online  classifieds, and online forums also facilitate sales between buyers and  both licensed and nonlicensed sellers. Depending on the website,  potential buyers can search for firearms nationwide or narrowed down to  city or zip code. According to ATF, searching capabilities can affect  whether transactions among nonlicensed individuals are more likely to  occur in person or through an FFL as well as the potential for illegal  activity to occur.
A private sale between two nonlicensed individuals would have an  unlawful component if, for example, (1) the seller knows or has  reasonable cause to believe that the buyer is legally prohibited from  possessing firearms or is a resident of a different state; (2) the seller is  engaged in the business of dealing in firearms without a license; or (3) the  item is an NFA-restricted weapon. ATF officials who oversee Internet- related investigations said that it is not possible to monitor private  firearms transactions coordinated over the Internet as they take place.  Federal law does not require the seller in a private firearm transaction to  conduct a background check or otherwise process paperwork through  ATF.

		ATF Developed an Internet Investigations Center to Help Identify Individuals Unlawfully Transferring Firearms Using the Internet

According to ATF officials, in 2012 the agency created a national center  for Internet-related investigations, now known as the Internet  Investigations Center (Center). ATF officials noted that, as an example  of its activities, field agents who perform work involving the Internet will  coordinate with the Center to ensure they have the necessary training to  operate online in an undercover capacity. The Center has access to a  variety of tools to facilitate Internet investigations. Much of the Center’s  software that is used to analyze online content for investigations is free  and open source. For example, according to ATF officials, using free  open-source software allows analysts to glean information from public  websites without violating users’ privacy rights.
ATF officials stated that the Center investigates buyers and sellers who  use the Internet to facilitate illegal firearms transactions. The officials with  the Center noted that these investigations are generally reactive, meaning  that the Center initiates them after receiving a tip or a request from a field  agent. For example, in November 2014 the Center received a tip from a  person who was selling firearms on an online firearms marketplace and  was suspicious of a prospective buyer attempting to obtain a pistol  without involving an FFL. The Center identified the prospective buyer and  engaged in an undercover operation in which the individual agreed to  provide the undercover agent with components designed to turn pistols  and rifles into fully automatic firearms in exchange for a pistol and cash.  The undercover agent and the buyer met in person and completed the  transaction. ATF agents arrested the buyer at the scene, and he was later  sentenced to 33 months in prison.
ATF officials said the agency frequently receives tips about nonlicensed  sellers engaging in the business of firearms. For example, ATF  investigated a nonlicensed seller who posted more than 280 firearms for  sale on multiple online firearms marketplaces; purchased at least 54  firearms; and sold at least 51 firearms at a profit. The seller, who was also  found to have made straw purchases for other buyers, was sentenced in  August 2010 to 2 years in prison. For additional examples of ATF  enforcement actions involving sales facilitated by the Internet, please see  appendix II.
According to ATF officials, the Center also performs investigative work on  the Dark Web, which requires knowledge of the Internet and investigative  techniques. For example, ATF analysts must understand virtual currency,  such as Bitcoin values. They must also know what sellers are charging for  their products, because prices on the Dark Web “skyrocket” due to the  criminal nature of the merchandise. In addition, the analysts learn  common terms associated with firearm culture, in order to communicate  with users engaged in criminal activity.
ATF officials with the Center also noted that investigations might involve  both the Surface Web and the Dark Web. For example, to identify an  anonymous user on the Dark Web, the Center works to establish the  user’s “digital footprint” on the Surface Web. In some cases, users might  conduct illegal activity on the Dark Web but might then go to the Surface  Web, such as a social-networking website with chat forums on a wide  variety of topics, and discuss their illegal activity. From there, analysts  can link the user to other social-media accounts, where the user may post  a photo showing a street sign or other characteristics to help investigators  narrow the user’s location. The ATF officials with the Center noted that  posts on some websites contain meta-data, which includes geo-coding  that helps the analysts identify where posts originated.
ATF issued the Firearms and Internet Transactions Intelligence  Assessment Report in April 2016 to provide information and analysis in  the area of online firearm sales, including both legal and illegal  transactions. The report highlighted several key findings about how  firearm transactions are facilitated by the Internet. Specifically, the ATF  analysis of the online marketplaces for firearms demonstrated the ease  with which individuals can choose to circumvent the generally applicable  law in this arena. Within the report, ATF detailed a market analysis of  firearms transactions, including Surface Web and Dark Web  marketplaces. Firearms transactions that occur on the Dark Web are  more likely to be conducted in person or via the mail or common carrier,  versus through an FFL. Additionally, the report noted that it appears that  the price of a firearm increases as the transaction becomes more covert  or when parties attempt to subvert laws and regulations. According to  ATF staff, they plan to update the report when there is a significant shift in  Internet gun trafficking. The ATF officials with the Center said they have  not determined the frequency with which updated reports will be issued  but they do not plan to update it annually.

		ATF Enforces Firearms Laws through Regulatory Inspections of Licensed Firearms Dealers to Detect Prohibited Firearms

To enforce the NFA, GCA, and related firearms regulations, ATF carries  out a variety of regulatory activities. For example, ATF monitors the  firearms industry from manufacture and importation through retail sale.  Specifically, ATF Industry Operations Investigators determine whether  FFL applicants are qualified to engage in firearms commerce through  routine inspections and regulatory oversight. Industry Operations  Investigators also routinely inspect FFLs to ensure continued compliance  with statutes and regulations. ATF officials stated that investigators  conduct compliance inspections of FFLs—who must renew their licenses  every 3 years. ATF conducts these inspections at least once during the 3- year licensing period. Additionally, ATF officials stated that as part of  each inspection, officers will review all sales transactions an FFL has  made in the last 12 months and analyze the data for aberrant patterns.  Based on a review of DOJ Office of Inspector General documentation and  our own observations during an FFL inspection, we determined that,  during these inspections, ATF performs an inventory of the FFL’s firearms and checks it against the  FFL’s inventory to ensure that firearm transactions reconcile with the  firearm inventory;  reviews the FFL’s records of background checks for purchases  processed through NICS;  checks the prior year’s Firearms Transaction Record forms, which  document acquisition and disposition information that ATF uses to  trace firearms involved in crimes; and  reviews sales records to ensure that the FFL has recorded  appropriate tax information.
While ATF investigators routinely monitor firearms transactions of FFLs,  the agency does not monitor private firearms transactions among  nonlicensed individuals. As noted above, private sales among  nonlicensed individuals who are residents of the same state are not  subject to record-keeping or background-check requirements, so ATF  does not have a means by which to monitor these sales as they take  place.

		ATF Law-Enforcement Operations Investigate Firearm-Related Crimes, Including Those Facilitated by the Internet

One aspect of the enforcement work undertaken by ATF agents is to  investigate reports of individuals engaging in the business of dealing in  firearms without a license. According to agency officials with the ATF  Violent Crime Intelligence Unit, as part of these investigations, agents  gather information about a suspect’s firearm transactions. On the basis of  the activity detected, agents will determine whether the extent of the sales  history is significant enough to warrant further action.
In fiscal years 2014–2016, ATF made 322 arrests for engaging in the  business of dealing in firearms without a license. These figures represent  all arrests, as ATF does not identify or track whether transactions were  facilitated by the Internet. During the same time, ATF also made 53  arrests for charges related to the unlawful interstate transfer of firearms,  204 arrests for charges related to the sale of firearms to a prohibited  person, and 12,586 arrests for charges related to the possession of a  firearm by a prohibited person. These arrests may include but are not  limited to Internet-related investigations. According to documentation  provided by ATF, 89 percent of the defendants in these arrests received a  conviction. See table 1.

	Agents Purchased Two Firearms on the Dark Web, but Covert Attempts to Illegally Purchase Firearms on the Surface Web Were Unsuccessful Agents Successfully Purchased Two Firearms on the Dark Web

Our agents successfully purchased two firearms from sellers we located  on a Dark Web marketplace as a result of seven total attempts. ATF  officials stated that the Dark Web is completely anonymous and is  designed to facilitate criminal activity online. Further, an ATF report states  that most used firearms are sold via the online auctions, online  marketplaces, and on the Dark Web as compared to the Surface Web. In  the seven attempts, our agents did not disclose any information indicating  they were prohibited from possessing a firearm. In the five attempts  where we did not ultimately purchase a firearm, the prospective seller  stopped responding to our inquiries, stated the firearm was no longer for  sale, refused to use an escrow account for payment, or experienced  technical problems using the Dark Web marketplace. The first weapon  that we purchased was an AR-15 rifle, which is a semiautomatic firearm.  The serial number on the firearm was obliterated. The Dark Web seller  shipped the dismantled weapon directly to the undercover address  provided by our agent. It is unlawful for any person to possess or ship in  interstate commerce a firearm which has had the importer’s or  manufacturer’s serial number removed, obliterated, or altered, if the  individual had such knowledge about the serial number. Additionally,  because the firearm was shipped across state lines, the seller may not  have been a resident of the same state as our agent. We did not confirm  whether the seller notified the shipping company that the package  contained a firearm. Any of these circumstances—removing a serial  number, selling to a resident of a different state, or failing to properly  notify the shipping company that the shipment contained a firearm—if  proven, would likely violate federal law. A photo of the weapon can be  seen in figure 3.
The second weapon we purchased was an Uzi, which is an Israeli-made  semiautomatic firearm, and was advertised as a fully automatic firearm.  See photo in figure 4.
If the firearm meets the NFA’s definition of a machine gun, the seller’s  prior possession of the Uzi, and the shipment to our agent, likely violated  federal law. Generally, only machine guns that were lawfully possessed  prior to May 19, 1986, may continue to be possessed and transferred,  with ATF approval, if they are registered in accordance with the NFA.
We are referring information regarding our two Dark Web purchases to  applicable law-enforcement agencies to inform any ongoing investigations  for any further action they deem appropriate.

		All of Our Attempts to Illegally Purchase Firearms from Private Sellers on the Surface Web Were Unsuccessful

Our covert testing involving GAO agents attempting to purchase firearms  illegally on the Surface Web were unsuccessful. Specifically, private  sellers on Surface Web gun forums and in classified ads were unwilling to  sell a firearm to our agents that self-identified as being prohibited from  possessing a firearm. In our 72 attempts to purchase firearms from  private sellers on the Surface Web, 56 sellers refused to complete a  transaction once we revealed that either the shipping address was across  state lines or that we were prohibited by law from owning firearms. The  scenarios we applied to the purchases were derived from provisions in  the GCA. The five scenarios disclosed status information that would  disqualify our agents from purchasing a firearm. For example, in one  scenario we stated that we were a convicted felon; in another scenario,  we informed the seller that we had a dishonorable discharge from the  military. In these 56 attempts, 29 sellers refused because they would  not ship a firearm and 27 refused after we presented the scenario.  Furthermore, in five of these attempts, the accounts we set up on several  forums were frozen by the websites, which prevented us from using them  after we disclosed our prohibited status or requested interstate shipment  and attempted to make a purchase.
In the 11 remaining attempts, we encountered private sellers that  appeared to have scammed us, or attempted to scam us, after we  disclosed our prohibited status or asked to avoid using an FFL. In two of  these instances, we made a payment and never received the firearm or a  refund. In the remaining nine attempted scams, our agents determined  that the seller may not be legitimate and therefore did not complete the  purchase. For example, in one attempt, the agent conducted investigative  research on the seller and found evidence suggesting that the seller may  be involved in online fraud. As a result, the agent did not follow through  with the purchase attempt. ATF does not have jurisdiction over fraud  cases so, when it encounters such circumstances, the agency may refer  the case to the Joint Support and Operations Center or to local or state  law-enforcement agencies or may encourage the victim to file a police  report. The results of our attempts on the Surface Web are summarized in  figure 5.

	Agency Comments

We provided a draft of this report to ATF and DOJ on October 31, 2017,  for review and comment.  ATF provided technical comments, which we  incorporated as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Deputy Director of  ATF and other interested parties. In addition, the report will be available  at no charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  Seto Bagdoyan at (202) 512-6722 or bagdoyans@gao.gov, or Wayne  McElrath at (202) 512-2905 or mcelrathw@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff who made key contributions to  this report are listed in appendix III.

Appendix I: Methods for Performing GAO Covert Testing

	Scope

For our covert attempts to buy firearms on the Internet, we performed  tests on both the Dark Web and the Surface Web to compare and  contrast how transactions are completed. For the tests, our agents  employed undercover identities and accessed online marketplaces where  firearms were advertised for sale. In both Dark Web and Surface Web  testing, the agents contacted sellers that posted ads online, and  attempted to complete firearm purchases. For our testing, we did not  proactively attempt to purchase firearms from Federal Firearm Licensees  (FFL), focusing our efforts on private sellers. We counted an attempt as  successful if we received a firearm. We counted an attempt as a failure if  we contacted the seller and expressed interest in purchasing the  advertised firearm and the seller refused to complete the purchase, or if  the seller failed to respond after initial contact was made. In some  instances on the Surface Web, after we contacted a seller and described  our prohibited status, we were “banned,” or prohibited from accessing the  gun forum or classified ad website. Additionally, in two instances, our  agents were apparently “scammed” in that we remitted payment for a  firearm we did not receive, or our agents otherwise identified indicators  that the firearm would not be shipped. The results of our testing are for  illustrative purposes only and are not generalizable.
Prior to beginning our testing, to understand how prohibited individuals  may use the Internet to purchase firearms or firearm components, we  reviewed Department of Justice (DOJ) and Bureau of Alcohol, Tobacco,  Firearms and Explosives (ATF) published reports, including adjudicated  criminal cases. We also met with third-party groups with knowledge of the  firearms industry, including state law-enforcement agencies, a purveyor of   commercial website that host online firearm classified advertisements, a  gun-control advocacy group, a firearm-industry organization, and an  academic research center, to learn about online firearm marketplaces,  criminal pathways to illegally purchase or sell firearms, and enforcement  responses.
Additionally, we reviewed reports by a gun-control advocacy group to  understand how prior similar work in this area was performed. We learned  through our review and our subsequent interviews with individuals who  performed this work that no federal laws were broken when this testing  was conducted. Accordingly, to demonstrate how the Internet may  facilitate illegal firearm transactions, we decided our agents would  complete the firearm purchases.

	Methodology for Dark Web Covert Testing

Agents also accessed firearm advertisements on a Dark Web  marketplace and attempted to purchase firearms or firearm components  from nonlicensed private sellers. Agents focused on one Dark Web  marketplace for this stage of testing. Our agents performed a preliminary  test to assess the feasibility of purchasing a firearm on the Dark Web.  This attempt was successful, so our agents proceeded with additional  planned attempts to purchase additional firearms on the Dark Web.  Testing ended once a firearm was successfully purchased and received  by our agents, with a total of seven attempts completed. For these covert  tests, we did not disclose any information about our presumed prohibited  status. We also focused our efforts on purchasing a firearm that appeared  to be restricted by the National Firearms Act of 1934 (NFA).

	Methodology for Surface Web Covert Testing

To perform Surface Web testing, our agents accessed public gun forums  and other classified ads where private nonlicensed sellers listed firearms  for sale. These forums and classified ads were identified from our  meetings with ATF and third-party entities, and a review of available  documentation. We considered the following factors when selecting  online classified websites: hosted nationwide or regional ads, quantity of ads,  variety of firearms available, and accessibility of website.
Recently posted ads on these sites were selected if they fell within a  designated price range, and were for transactions between private  nonlicensed individuals.
The purpose of our Surface Web purchase attempts was to determine  whether private sellers would knowingly sell a firearm to an individual  prohibited from possessing one, as outlined by the Gun Control Act of  1968 (GCA). Our agents used one of five scenarios based on a provision  of the GCA when attempting to purchase a firearm. The scenarios  involved overtly explaining why our agent was prohibited from possessing  a firearm. The scenarios based on the GCA covered the following: a felon avoiding a background check, an individual with a domestic-violence background or a restraining  order against him or her, an individual who unlawfully uses controlled substances (or is an an individual who was dishonorably discharged from the military, and an individual who has renounced his or her citizenship or is otherwise  an unlawful alien.
Before we began testing, we determined that we would run each scenario  iteratively until we successfully completed a purchase, we exhausted the  number of applicable ads, or we capped out our predetermined cap of 15  purchase attempts, with a total of 75 attempts to be made in total.  However, due to investigative decisions, we only employed 72 attempts.
We conducted this performance audit from July 2015 to November 2017  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. We conducted our related  investigative work in accordance with the standards prescribed by the  Council of the Inspectors General on Integrity and Efficiency.

Appendix II: Examples of Illegal Firearms Sales Facilitated by the Internet

As noted above, the Bureau of Alcohol, Tobacco, Firearms and  Explosives (ATF) does not track statistics on firearm enforcement actions  that involve illegal transactions facilitated by the Internet. However, ATF  officials provided several examples of closed, adjudicated cases where  the agency took enforcement action against individuals who were using  the Internet to facilitate illegal transactions. The following summaries  provide examples of the type of investigative and enforcement work ATF  agents perform:
One individual was indicted in February 2015 for being a felon in  possession of firearms and for possessing a machine gun. In  November 2014, ATF’s Internet Investigation Center (the Center)  received a tip from the ATF Tip Line; a legitimate seller was  suspicious of a buyer who was attempting to obtain a firearm without  involving a Federal Firearm Licensee (FFL) and suggested the seller  could obliterate the serial numbers. The Center identified the  prospective buyer as a convicted felon. The individual agreed to  provide the undercover agent with a Glock auto sear—which, when  attached to a firearm makes it a fully automatic weapon—and firearm  components that could be used to transform an M-16 style rifle into a  machine gun. In exchange, the undercover agent would provide the  individual with a Glock pistol and $300 cash. The individual and an  undercover agent completed the transaction and the individual was  immediately arrested. The individual’s criminal history included a  recent prior felony gun-possession conviction. The individual pleaded  guilty to being a felon in possession of a firearm and to the illegal  transfer or possession of a machine gun, and was sentenced to 33  months imprisonment and 36 months of supervised release.
In 2009, one individual was indicted on six counts of federal criminal  violations, including one count for engaging in the business of  firearms without a license. According to the indictment, from  approximately January 1, 2005, to May 8, 2008, while serving as an  FBI agent, the individual purchased multiple firearms from various  sources including private sellers, local stores, and sellers he dealt with  over the Internet. He posted at least 280 firearms for sale on a  legitimate firearm website, some of which were multiple listings of the  same item in the event that interested bidders did not meet his target  price. During this period, he purchased at least 54 firearms and sold  at least 51 firearms. He profited from all the sales, collecting more  than $118,000 in gross receipts. The individual was also indicted on  four counts of causing a firearms dealer to maintain false records,  which related to his purchasing firearms for third parties (straw  purchases). In addition, the individual was indicted on one count of  providing ATF with a false document listing the firearms he bought  and sold; agents recovered a more-extensive and more-descriptive  list. The individual was found guilty on all counts in April 2010, and  was sentenced in August 2010 to 2 years in federal prison.
According to an affidavit from an ATF Special Agent, an individual  offered silencers, pistols, and rifles for sale on the Dark Web, as well  as nationwide shipping. The ATF Center “proactively targeted” the  individual’s vendor name “through various methods of analysis,”  identified numerous Internet forum and social-media profiles  associated with the individual, and ultimately discovered his true  identity. The Center referred “an investigative lead” and the  corresponding evidence and analysis to the respective ATF Field  Division. According to the affidavit, the Special Agent conducted a  controlled purchase through one of the Dark Web marketplaces,  reviewed U.S. Postal Service security video and observed the  individual mail the firearm, and executed arrest and search warrants.  The individual pled guilty to one count of causing a firearm silencer to  be delivered by the U.S. Postal Service without proper notification,  and was sentenced to 6 months in federal prison and 3 years of  supervised release.
In October 2013, an individual was indicted for illegal exportation,  shipment, and delivery of firearms and firearm components that were  sold on a Dark Web site. The man shipped a handgun concealed in a  video game system to a buyer in Sydney, Australia. Australian  Federal Police intercepted the package and alerted ATF, which began  an investigation. During the investigation, the individual shipped a  9 mm pistol with an obliterated serial number to the United Kingdom,  various assault-rifle parts to Australia, and a .22-caliber pistol with an  obliterated serial number and a weapon magazine to Sweden. Each  firearm was disassembled and concealed in a broken electronic  device. The individual pleaded guilty and was sentenced to 2 years  imprisonment and 2 years of supervised release.
In February 2015, an individual was indicted for dealing in firearms  without a license and selling firearms to residents of other states. The  individual sold firearms via two Dark Web sites and shipped them to  buyers in the United States and internationally. In an attempt to hide  his identity, the man placed false return-address labels on the  packages, used aliases to send the packages, and packed the  firearms so that they appeared to be computer hard drives. The  individuals agreed to sell handguns to undercover ATF agents posing  as gun buyers and then shipped the guns from Alabama to Nebraska  and New Jersey. The individual was found guilty and sentenced in  November 2015 to 51 months in prison and 36 months supervised  release.

Appendix III: GAO Contacts and Staff Acknowledgments

	GAO Contacts

	Staff Acknowledgments

In addition to the contact named above, Dave Bruno (Assistant Director),  Dean Campbell, Julia DiPonio, Robert Graves, and Kristen Timko made  key contributions to this report. Other contributors include Marcus Corbin,  Colin Fallon, Maria McMullen, James Murphy, Anna Maria Ortiz, Julie  Spetz, and Helina Wong.

Output:
Why GAO Did This Study

The current federal legal framework governing buying and selling of firearms does not specifically address the use of the Internet to facilitate these transactions. Additionally, private transactions involving the most-common types of firearms between individuals who are not licensed to commercially sell weapons and who are residents of the same state, including transactions facilitated by the Internet, are generally not subject to federal background-check requirements.
Congressional requesters asked that GAO assess the extent to which ATF is enforcing existing laws and investigate whether online private sellers sell firearms to people who are not allowed or eligible to possess a firearm. This report describes (1) techniques ATF uses to investigate and enforce generally applicable firearm laws in instances where the firearm or firearm-component transaction is facilitated by the Internet and (2) results of GAO's undercover attempts to buy firearms on the Dark Web and Surface Web.
GAO analyzed documents and interviewed officials to identify actions ATF has taken to prohibit illegal firearm transactions. GAO also attempted to purchase firearms from Dark Web and Surface Web marketplaces. The results of the testing are illustrative and nongeneralizable.

What GAO Found

The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) is responsible for investigating criminal and regulatory violations of firearms statutes and regulations that govern firearms transactions, including sales that are facilitated by the Internet. Two components of the Internet may be used to facilitate Internet firearm sales: the Surface Web and the Dark Web. The Surface Web is searchable with standard web search engines. The Dark Web contains content that has been intentionally concealed and requires specific computer software to gain access. ATF created the Internet Investigations Center (Center) to investigate buyers and sellers who use the Internet to facilitate illegal firearms transactions. The Center uses several tools to provide investigative support to ATF, which has resulted in the arrests of individuals using the Internet to facilitate illegal firearm purchases. ATF officials with the Center also noted that investigations might involve both the Surface Web and the Dark Web. For example, to identify an anonymous user on the Dark Web, the Center works to establish a user's “digital footprint” on the Surface Web.
In 2016, the Center also issued a report about Internet firearm transactions. This and other ATF reports highlighted the following about Internet-facilitated firearm transactions:
The relative anonymity of the Internet makes it an ideal means for prohibited individuals to obtain illegal firearms.
The more anonymity employed by a firearms purchaser, the greater the likelihood that the transaction violates federal law.
Firearm transactions that occur on the Dark Web are more likely to be completed in person or via the mail or common carrier, versus through a Federal Firearm Licensee.
GAO agents attempted to purchase firearms from Dark Web and Surface Web marketplaces. Agents made seven attempts to purchase firearms on the Dark Web. In these attempts, agents did not disclose any information about whether they were prohibited from possessing a firearm. Of these seven attempts, two on a Dark Web marketplace were successful. Specifically, GAO agents purchased and received an AR-15 rifle and an Uzi that the seller said was modified so that it would fire automatically. GAO provided referral letters to applicable law-enforcement agencies for these purchases to inform any ongoing investigations.
Tests performed on the Surface Web demonstrated that private sellers GAO contacted on gun forums and other classified ads were unwilling to sell a firearm to an individual who appeared to be prohibited from possessing a firearm. Of the 72 attempts agents made to purchase firearms on the Surface Web, 56 sellers refused to complete a transaction: 29 sellers stated they would not ship a firearm and 27 refused after the disclosure of the undercover identities' stated prohibited status. Furthermore, in 5 of these 72 attempts, the accounts GAO set up were frozen by the websites, which prevented the agents from using the forums and attempting to make a purchase.

What GAO Recommends

GAO is not making recommendations in this report. ATF provided technical comments, which GAO incorporated as appropriate.