The U.S. Department of Justice (DOJ) Office of the Inspector General (OIG) performed a series of audits in 2002 that examined controls over weapons and laptop computers in four DOJ components – the Federal Bureau of Prisons, Drug Enforcement Administration (DEA), Federal Bureau of Investigation (FBI), and United States Marshals Service.¹ The Attorney General requested these audits in response to concerns raised in an OIG audit report about the potentially serious consequences of losing such sensitive property.² The 2002 audits found substantial losses and weak controls over management of this property throughout the DOJ.

At the time the 2002 weapon and laptop computer audits were performed, the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) was part of the Department of the Treasury (Treasury) and not a component of DOJ. The Homeland Security Act subsequently transferred the law enforcement functions of ATF into DOJ on January 24, 2003.

In 2002, Treasury’s Office of Inspector General (OIG) issued an audit of ATF’s controls over sensitive property, which included firearms, computers, ammunition, and explosives.³ The audit found that ATF had adequate controls over firearms and laptop computers and generally took appropriate actions in response to lost, stolen, or missing property, but that controls over ammunition and explosives needed improvement. The Treasury audit specifically cited the lack of periodic inventories of ammunition and inadequate inventory records of explosives. The audit also found that explosives inventories were not conducted with adequate independence because persons outside the chain-of-custody for explosives did not witness periodic physical inventories. ATF concurred with the findings and recommendations and reported that it had implemented new controls to address the weaknesses.

In response to the 2002 Treasury audit, ATF required all divisions to conduct a baseline ammunition inventory and report the results to ATF headquarters. ATF also implemented policies requiring that all divisions perform an annual 100-percent inventory of all ATF-owned ammunition, persons outside the chain-of-custody for explosives participate in all future inventories of ATF explosives magazines, and divisions maintain perpetual records for each type of ATF-owned explosive.⁴

Background

ATF is responsible for enforcing federal criminal laws and also for regulating the firearms and explosives industries. ATF has headquarters divisions located in the Washington, D.C., and Martinsburg, West Virginia area; training facilities located in Glynco, Georgia, Front Royal, Virginia, and Fort A.P. Hill, Virginia; and approximately 250 field and satellite offices within 25 field divisions that are divided into the Eastern, Central, and Western regions across the country.⁵ ATF also has personnel located in several foreign countries. The following graphic displays the geographic distribution of ATF field divisions. ATF personnel located in other countries are not reflected in the graphic.

ATF DIVISIONS MAP

[Image Not Available Electronically]

Source: ATF website

ATF is led by a Director and Deputy Director, and each region has a Deputy Assistant Director. Each headquarters division is led by a Chief and each field division has a Special Agent in Charge (SAC). An organizational chart listing ATF’s divisions is located in Appendix XI.

Among ATF’s major headquarters directorates are the Office of Management (OM) and the Office of Professional Responsibility and Security Operations (OPRSO). The Office of Management includes the Materiel Management Branch that oversees property management.⁶ OPRSO includes the Internal Affairs Division (Internal Affairs), which investigates property losses as those relate to employee misconduct.

As of August 2007, ATF employed 2,461 Special Agents, 1,095 Explosives Industry Operations Investigators, and 1,289 other support personnel. Special Agents investigate criminal cases, Industry Operations Investigators conduct onsite investigations and inspections of the firearms and explosives industries, and support personnel help administer ATF programs and operations. As of August 17, 2007, ATF reported that it had 22,476 weapons and 7,505 laptop computers assigned to staff in its domestic and foreign offices.⁷

Weapons

ATF’s inventory of weapons included handguns, rifles, shotguns, tasers, and specialty weapons. ATF requires Special Agents to carry an ATF-owned primary handgun while on duty and authorizes them to carry the weapon while off duty. ATF also allows agents to carry an ATF-owned secondary handgun, but does not allow them to carry personally-owned weapons on duty. In addition to the weapons that are assigned to Special Agents, ATF maintains a pool of additional weapons for assignment and use as needed. The pool consists of rifles, shotguns, tasers, and prop weapons that are used for training, operations, and undercover operations.⁸

Approximately one-third of ATF’s 22,476 weapons are maintained in a reference collection at the ATF Firearms Technology Branch (FTB) in Martinsburg, West Virginia. The FTB uses the reference collection to test, evaluate, and provide expert testimony on firearms and ammunition. It also uses the collection to provide technical services to the firearms industry and other members of the public. According to a former chief of the FTB, the reference collection was established in the late 1960’s. At the time of our audit, the reference collection included seized weapons, weapons of historical significance, homemade weapons, and weapons modified from household items such as umbrellas, belt buckles, and writing pens.

Laptop Computers

ATF assigns laptop computers to Special Agents, Industry Operations Investigators, other ATF employees, contractors, and Task Force Officers who work for other law enforcement agencies. ATF personnel use laptop computers to prepare investigative reports, access various law enforcement databases, support electronic surveillance activities, and complete administrative tasks.

ATF leases laptop computers rather than purchasing them outright. ATF replaces laptop computers every 3 years, at which time most of the laptop computers are disposed of and replaced by new leased computers.⁹ However, ATF retains ownership of the replaced laptop computers and maintains a few of the computers after the lease has expired to use for special purposes, such as Global Positioning System (GPS) tracking and video surveillance.

During our audit, ATF reported that 18 of its 7,505 laptop computers were authorized to process classified information. Five of the 18 laptop computers were located at ATF headquarters in Washington, D.C., and the remaining 13 were assigned to offices of the ATF Explosives Technology Branch (ETB) located in various cities.

Ammunition

Each ATF field division and headquarters law enforcement division maintains a supply of ammunition. The ammunition consists of various types, including .40 caliber, 9 millimeter (mm), .223 Remington, and 12 gauge. Most ammunition is used for weapons qualification and training.

Explosives

ATF houses explosives in secured storage containers called magazines throughout the United States. ATF personnel in the field, headquarters, and training divisions maintain the magazines and account for the explosives. Each magazine contains multiple types of explosives, including Composition-4 (C-4), detonation cord, and blasting caps.¹⁰ ATF uses explosives for training and field operations.

Property Management

Office of Management and Budget (OMB) Circular A‑123 requires federal agencies to: (1) establish a management control system that provides reasonable assurance that assets are safeguarded against waste, loss, unauthorized use, and misappropriation; and (2) ensure that transactions are promptly recorded, properly classified, and accounted for in order to prepare timely accounts and reliable financial and other reports.¹¹ The Justice Property Management Regulations require that DOJ components issue detailed operating procedures to protect federal property against fraud, waste, and abuse.¹²

ATF Order 1850.2C, Property Management Program, dated November 8, 2001, contains ATF guidelines for the general management of property.¹³ According to these guidelines, all ATF employees are responsible for the proper care and protection of government property they use and control and may be held financially responsible for its loss.

ATF staff told us that all weapons and laptop computers are recorded in the property management system. Ammunition and explosives are considered to be expendable supply items and are not subject to recording as ATF property in the property management system.

Property Management Organization

According to ATF’s property management policy, responsibility for property management is shared by a property management officer and a property accountable officer at ATF headquarters, and property management representatives and property custodians assigned to each headquarters and field division office. Their responsibilities are outlined below.

• The property management officer is responsible for the general managerial oversight of ATF’s property management program. The Chief of the Materiel Management Branch serves as property management officer.
  
  
• The property accountable officer is responsible for ATF’s property management system and the authority to delegate responsibility for the physical control of property. The property accountable officer is responsible for the receipt, utilization, and disposal of ATF property. The Chief of the Property and Fleet Management Section, within the Materiel Management Branch, serves as the property accountable officer.
  
  
• Property management representatives are responsible for the accuracy and certification of the property inventories pertinent to their accounts and for ensuring that Property Issue Receipts are maintained for all property assigned to individuals. The representatives are also responsible for initiating investigative action pursuant to the damage or loss of ATF property. Within each field division or headquarters unit, the Division Director, SAC, Resident Agent in Charge, Area Supervisor, or Group Supervisor serves as the property management representative.
  
  
• Property custodians are responsible for the receipt, physical distribution, and control of all property located in their assigned areas. The custodians maintain Property Issue Receipts for all property issued to individuals within their areas. The property management representative designates a property custodian for each division.

In addition to support from the field personnel identified above, other parts of ATF coordinate with the Materiel Management Branch to ensure control over ATF property and information on laptop computers. These organizations include the Internal Affairs Division, which investigates property losses as those relate to employee misconduct; and the Office of Science and Technology, which manages laptop computers.

Automated Property Management System

ATF uses a commercial-off-the-shelf automated property management system that provides a variety of functions to record information and assign property. The system is designed to:

• record detailed asset information;
  
  
• organize and track ownership;
  
  
• provide information about costs, installed components, service history, and current value of property;
  
  
• generate reports that reflect the status of property; and
  
  
• maintain consistency and accuracy in property reporting.

ATF limits access to the property management system to ATF Materiel Management staff at headquarters and property custodians in the field. Only Materiel Management staff is able to add and remove items from the system. Property custodians can only accept or transfer items within their Divisions. The Chief of the Property and Fleet Management Section told us that the system included about 92,000 items as of March 2008. In addition to weapons and laptop computers, the system also accounts for items such as printers, scanners, and vehicles.

Procedures for Lost, Stolen, or Missing Property

The procedures for reporting lost, stolen, or missing property are outlined in DOJ property management regulations and information technology security standards, ATF property management policies, and in Office of Management and Budget memoranda.

Section 128-51.102 of DOJ Order 2400.3, Justice Property Management Regulations, requires that any incidents of loss, theft, damage, destruction, or other conditions adversely affecting personal property be reported to the property management officer. Further, the property management officer is to refer incidents to a board of survey or other internal review organization for investigations. Incidents not referred are subject to a less formal administrative review. However, inconclusive reviews and recurring irregularities in a single location or property account are to be referred for formal investigation to a board of survey.

ATF property management policy requires lost, stolen, or missing weapons be entered into the National Crime Information Center (NCIC). NCIC is a database of criminal justice information, such as criminal record history, fugitives, stolen property, and an index of individuals incarcerated in the federal prison system. Criminal justice agencies enter records into NCIC, and those records are then accessible to law enforcement agencies nationwide. The NCIC system is generally regarded by law enforcement agencies as the primary method for tracking stolen or recovered weapons. Failure to timely enter items into NCIC could reduce the chance of recovering the weapon or laptop computer or identifying whether the weapon was used in the commission of a crime. In April 2008, ATF revised its property management policy to require that laptop computers containing classified information also be reported to NCIC.

ATF’s property management policy also requires employees who lose their assigned property to immediately report the loss or theft to the property custodian, property management representative, and Special Agent in Charge, division director, or chief. The property management representative is required to obtain the circumstances and all known facts surrounding the incident and prepare a memorandum to report the lost, stolen, or missing property to the property accountable officer within
10 working days from the date of the incident. The property management representative is then required to report the loss or theft to the property accountable officer.

Once the property accountable officer receives the report of the loss or theft, he or she should prepare an ATF Form 1851.3, Report of Survey, and forward it, along with any memorandum and any other necessary attachments, such as a police report, to a designated deciding official.¹⁴ The deciding official’s designation is based on the chain of command of the individual responsible for the property at the time of the incident.

The property accountable officer removes lost property from the property management system and maintains a file of the Reports of Survey.¹⁵ The property accountable officer also provides a copy of the Report of Survey to Internal Affairs for review and action, as deemed necessary.¹⁶

In March 2005, DOJ issued Information Technology Security Standard 2.9 requiring that all DOJ components report computer incidents involving classified and unclassified systems to the Department of Justice Computer Emergency Response Team (DOJCERT). In December 2006, the Department revised this policy and outlined additional reporting requirements, including requirements for reporting the loss of personally identifiable information PII).¹⁷ ATF’s policies did not include the DOJCERT reporting requirements because ATF last updated its policy in 2001, prior to the issuance of the DOJCERT standard in 2005. However, in April 2008 ATF revised its policies but still did not include the DOJCERT reporting standard. Nonetheless, some lost, stolen, or missing laptop computers were, in fact, reported to DOJCERT.

ATF’s property management policy does not require an assessment of whether or not a lost, stolen, or missing laptop computer contained sensitive or classified information. ATF officials told us that ATF had an unwritten policy requiring that a user be interviewed about the contents of a lost, stolen, or missing laptop computer when it was reported missing.

OIG Audit Approach

We conducted this audit to assess ATF’s controls over weapons, laptop computers, ammunition, and explosives. We interviewed ATF officials, reviewed documents, and tested controls at:

• headquarters division offices in metropolitan Washington, D.C. and Martinsburg, West Virginia;
  
  
• field divisions in Atlanta, Georgia; Kansas City, Missouri; Los Angeles, California; New Orleans, Louisiana; Philadelphia, Pennsylvania; San Francisco, California; and Washington, D.C.; and
  
  
• training facilities at Glynco, Georgia; Fort A.P. Hill, Virginia; and Front Royal, Virginia.

Our audit examined actions taken in response to the identification of lost, stolen, or missing weapons and laptop computers and assessed whether ATF staff followed current procedures. We also queried NCIC to determine whether lost, stolen, or missing weapons were entered into the database and to identify weapons that were recovered or used in the commission of a crime. We address these issues in Finding I.

We reviewed the ATF’s internal controls over accountable property, exit procedures for departing employees, and disposal of property. Our assessment included physically verifying a sample of weapons and laptop computers. We also tested the accuracy and completeness of the property records. Our results of these analyses are found in Finding II.

We also reviewed controls over ammunition and explosives to determine whether ATF stored and accounted for these items properly. Our results of these analyses are found in Finding III.