ATF’s New Shenanigans with Electronic Acquisition and Disposition Records – Who’s Ready to Challenge Them?

Recently, the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) announced ATF Ruling 2013-5, regarding requirements for implementing and maintaining electronic Acquisition and Disposition records that Federal Firearms Licensees must keep, without any opportunity for Notice and Comment, in direct violation of the Administrative Procedures Act (APA), and invalidated a number of previously approved variances, again in violation of the APA and in violation of the variance holder’s due process protections.

On December 17, 2013, the new 6 page ruling was issued. Pursuant to the 1968 Gun Control Act, 18 U.S.C. 923(g)(1)(A), and the implementing regulations, 27 C.F.R. 478.121, et seq., an FFL is required to keep and maintain acquisition and disposition records, commonly referred to as one’s A&D book(s). Depending on the type of FFL (importer, manufacturer, dealer or curios and relics), the regulations set forth the types of information that must be maintained and the duration of time for which the records must be maintained. Clearly, ATF previously understood that it is necessary to go through rulemaking to regulate the Industry, pursuant to the APA.

This ruling sets forth the conditions upon which an FFL may maintain electronic Acquisition and Disposition records. While some may appreciate this ruling, even though ATF previously approved electronic record keeping without need for a variance in ATF Rul. 2008-2, the lack of Notice and Comment have deprived the Industry of an opportunity to respond to issues that ATF may not have considered, especially in light of our technological society.

Some of the issues with Ruling 2013-5, which may result in an FFL’s non-compliance, are: 1. requiring at least semiannually the downloading or printing of all records from the system; 2. “Electronic firearms acquisition and disposition records may be stored on a computer server owned and operated solely by the person (as defined by 18 U.S.C. section 921(a)(1)) holding the license”; and 3. “Upon discontinuance of a license, the licensee must provide an American Standard Code for Information Interchange (ASCII) text file (in conformity with industry standards) containing all acquisition and disposition records, and a file description, to ATF Out-of-Business Records Center, in accordance with 27 CFR 478.127. The complete printout and ASCII text file (and file description) must contain all information prescribed by regulation.”

With regards to the semiannual download or printing, how many FFLs will remember, semiannually, to either print out a copy or download a backup to “a Compact Disc (CD), Digital Versatile Disc (DVD), or Universal Serial Bus (USB) Flash Drive.”? This is in addition to the mandatory daily backup. What is the purpose of requiring this redundancy, if such is deemed unnecessary for paper Acquisition and Disposition records? An FFL utilizing paper Acquisition and Disposition records is only required to have one copy and that copy could easily be destroyed by flood, fire or other natural disaster.

In relation to the keeping of the electronic records, ATF is requiring that the FFL own and have sole access to the server that retains the information. As many of the electronic Acquisition and Disposition record keeping software development companies use cloud storage, I was immediately concerned by this requirement. My concerns were founded when ATF just released it’s Ruling 2013-5 Questions and Answers. Question 7 inquiries “Can my electronic recordkeeping system and/or the backup of the system be stored on a ‘cloud’ server?” The answer provided is

As stated in the Ruling, off-site storage of the data is permitted. A backup of the system may be stored on a “cloud” server; however, the system itself must be stored on a server that is owned and operated solely by the licensee, and must be located in the United States or its associate territories. The system must also be readily accessible through a computer device located at the licensed premises during regular business hours.

So now, without any opportunity to comment, the Industry is being restricted to non-cloud based software programs and the server MUST be located in the US or its associates territories. Thus, it would appear that an FFL can no longer rent a cloud-based server, such as the services offered by Amazon and numerous other companies, because 1. the FFL does not “own” the server and 2. the server may be located outside of the US.

Lastly, turning to the discontinuance of a license, the FFL now must not only provide paper copies but ALSO a digital ASCII file. Gee, do you think this might be to facilitate the illegal database that ATF is keeping in violation of 18 U.S.C. 926? Sure does make it nice and easy for them to upload that data right into their servers.

The ruling, in addition to superseding all previous rulings “regarding alternate methods or procedures for electronically maintaining firearms acquisition and disposition records, including ATF Rul. 2008-2, Records Required for Firearms Licensees, approved August 25, 2008,” invalidates and replaces the reference to ATF Rul. 2008-2 in ATF Rul. 2010-8 Consolidation of Required Records for Manufacturers, approved December 6, 2010, and ATF Rul. 2011-1, Consolidation of Required Records for Importers, approved January 26, 2011.

So you’re probably saying, yeah, so what? Well, guess what…if you previously applied for a variance to not only maintain electronic records but additionally to consolidate your records, your variance, in total, has been rescinded, without any opportunity for comment and in direct violation of your due process rights. The question proposed in the 2013-5 Q&A inquiries, “The variance previously issued to my FFL not only addressed computerized recordkeeping, but also the consolidation of records that support several licenses I hold. Is the entire variance rescinded or just the reference to computerized records?” The ATF response is

All variances authorizing the use of computerized records are rescinded in their entirety, including those that addressed consolidation of records. Should you wish to continue to maintain consolidated records, you must apply for a new variance within 180 days of the date of Ruling 2013-5. If the electronic record-keeping system is compliant with Ruling 2013-5, and you do not wish to continue using consolidated records, you do not need to apply for a new variance.

So now, an FFL, who has read Ruling 2013-5, but not the Q&A, could find him/herself in a situation, where he/she is continuing to rely on the previously approved variance, in relation to consolidation of records, but where that approved variance is no longer valid. Does someone think that maybe these are interested people in the Industry that should not only be notified in the Ruling but also be provided an opportunity to comment, before their variance is rescinded?

Again, not found in the Ruling, but only found in the Q&A, ATF is graciously providing all licensees with previously approved variances a 180 day grace period to apply for a new variance.

And don’t worry, if you aren’t in compliance with this new Ruling, you might only be prohibited from continuing to use electronic records…or, you could lose your license(s), depending on what ATF decides, when you had no opportunity to comment on this new ruling.

If you are an FFL or a software development company that has been adversely affected by Ruling 2013-5 and you would like to know what options you have to challenge the Ruling, Firearms Industry Consulting Group is prepared to advise you, and, if necessary, represent you in litigation against the ATF.