Audit of the Destruction of Electronic Records Pertaining to the Transitional Provisions in the Ending the Long-gun Registry Act

Final Report: January 2013

This report has been reviewed in consideration of the Access to Information Act and the Privacy Act. The published information is UNCLASSIFIED.

Table of Contents

Acronyms and Abbreviations

  • AGC - Attorney General of Canada
  • CFIS - Canadian Firearms Information System
  • CFO - Chief Firearms Officer
  • CFP - Canadian Firearms Program
  • CIO - Chief Information Officer
  • RCMP - Royal Canadian Mounted Police
  • SPS - Specialized Policing Services

1. Background

On October 25, 2011, An Act to Amend the Criminal Code and the Firearms Act (Bill C-19) with the intent to remove the requirement for individuals and businesses to register non-restricted firearms Footnote 1 was introduced in the House of Commons. Bill C-19 (short title - Ending the Long-gun Registry Act) received Royal Assent on April 5, 2012, removing the requirement for non-restricted firearms to be registered. The Province of Quebec filed an injunction to appeal the Ending the Long-gun Registry Act and on April 5, 2012, the Quebec Superior Court issued a court order that requires residents and businesses in Quebec to continue to register non-restricted firearms.

The RCMP's Canadian Firearms Program (CFP) is the service line within the RCMP's Specialized Policing Services (SPS) responsible for the administration of the Firearms Act and its associated regulations that govern possession, licensing, transportation, use, registration and storage of firearms in Canada as well as providing operational support to law enforcement agencies in all firearm-related inquiries and investigations. On September 10, 2012, the Quebec Superior Court ruled in favour of the Province of Quebec and instructed the Attorney General of Canada (AGC) Footnote 2 to provide the Province of Quebec with a copy of the non-restricted firearms records relating to Quebec. Once the data has been provided, the CFP will stop registering non-restricted firearms for Quebec and destroy the related records. The AGC filed an appeal, and in the interim, the CFP has been advised not to apply the Ending the Long-gun Registry Act changes to individuals and businesses residing in Quebec. Footnote 3

Ending the Long-gun Registry Act includes the requirement that all records related to the registration of non-restricted firearms under the control of the Commissioner of Firearms Footnote 4 and the Chief Firearms Officers (CFOs) be destroyed. Specifically, the Act's Transitional Provisions require that:

  • " 29.(1) The Commissioner of Firearms shall ensure the destruction as soon as feasible of all records in the Canadian Firearms Registry related to the registration of firearms that are neither prohibited firearms nor restricted firearms and all copies of those records under the Commissioner's control.
  • (2) Each chief firearms officer shall ensure the destruction as soon as feasible of all records under their control related to the registration of firearms that are neither prohibited firearms nor restricted firearms and all copies of those records under their control."

The organization of the CFP includes a CFO appointed for each province and territory. CFOs are responsible for decision-making and administrative work related to licences, authorizations to transport, authorizations to carry, and confirming the purpose of the transfer of restricted and prohibited firearms by individuals and businesses. The connection between licensing and registration may result in the CFO retaining a hard copy of a record related to the registration of a non-restricted firearm, hence the requirement that the Transitional Provisions also apply to CFOs. The CFOs in all but five provinces are federally appointed and report to the CFP's Director of CFO Operations. In the remaining provinces of Ontario, Quebec, New Brunswick, Prince Edward Island, and Nova Scotia, the CFOs are provincially appointed and are accountable to the federal Minister of Public Safety through contribution agreements.

Records related to the registration of non-restricted firearms exist in both electronic and hard copy (paper or other media) form. Electronic records (live data) are held in the Canadian Firearms Information System (CFIS), and hard copy records are held within the CFP and CFO offices. CFIS is the information system that contains all electronic records related to licences, registrations, transfers of firearms, and authorizations to transport and carry restricted firearms.

The Firearms Act and its regulations establish the basic framework for CFIS. The CFP is the business owner of the CFIS application and the RCMP's Chief Information Officer (CIO) Sector is responsible for the database architecture, and the administration and maintenance of the system. CFIS provides administrative and enforcement support to all partners involved in licensing of firearms owners/users, registration of firearms and the issuance of authorizations related to restricted firearms. The CFP's Central Processing Site processes licence and registration applications. The issuance and revocation of firearms registration certificates is the responsibility of the Registrar. As of April 2012, there were approximately 7.5 million non-restricted firearms registration records as well as non-restricted registration and transfer applications associated to those registration records in CFIS.

On April 5, 2012, the CFP stopped issuing registration certificates for non-restricted firearms except for individuals and businesses residing in Quebec. On May 20, 2012, the CFP disabled its online systems to prevent individuals and business from registering non-restricted firearms unless they reside in the province of Quebec. These actions were part of the CFP's steps, developed in collaboration with the CIO Sector, to address the Ending the Long-gun Registry Act and to enact the Transitional Provisions. The steps detail the work involved in destroying all records, both electronic and hard copy, from the RCMP/CFP information stores, except those records related to public agencies Footnote 5 and individuals and businesses residing in Quebec, which will be retained.

The CIO Sector commenced the destruction of all electronic records identified as being related to the registration of non-restricted firearms in CFIS (with the exception of Quebec and public agencies) in October 2012.

2. Objective, Scope and Methodology

2.1 Objective

The objective of this audit was to provide reasonable assurance that the electronic records in CFIS identified as being related to the registration of firearms that are neither prohibited firearms nor restricted firearms were destroyed as required by the Transitional Provisions in the Ending the Long-gun Registry Act.

2.2 Scope

The scope of this audit included all electronic records Footnote 6 identified as being related to the registration of non-restricted firearms (except Quebec and public agencies) in CFIS.

The audit did not include testing for electronic records that should have been retained by the CFP in CFIS to remain compliant with the Firearms Act as this was outside the scope of the Ending the Long-gun Registry Act.

2.3 Methodology

The planning portion of the audit was completed in November 2012 and included documentation review, process walkthrough, and interviews with CFP and CIO Sector staff. Sources used to develop audit criteria include COBIT 5: A Business Framework for the Governance and Management of IT. The audit objective and criteria are available in Appendix A.

The examination portion of the audit was completed in December 2012 and included the following techniques:

  • observed on-site the destruction of electronic records in CFIS;
  • created and ran queries to determine if electronic records identified as being related to the registration of non-restricted firearms still existed in CFIS;
  • analysed, with computer-assisted audit tools, CIO Sector and CFP reports and counts of key information in CFIS, which were used to determine if any electronic records were erroneously omitted from destruction;
  • obtained confirmation from the Director General, Canadian Firearms Program and the RCMP's Chief Information Officer that the electronic records identified as being related to the registration of non-restricted firearms in CFIS were destroyed.

An oversight committee, including third party members, provided ongoing advice and guidance throughout the audit engagement. Oversight committee meetings were held at each significant stage of the audit. Third party auditors provided technical expertise before, during and after the testing of the destruction of electronic records related to the registration of non-restricted firearms in CFIS.

2.4 Statement of Conformance

The audit engagement was planned, conducted and reported in accordance with the Internal Auditing Standards for the Government of Canada.

3. Audit Finding

3.1 Destruction of Electronic Records in CFIS

Electronic records identified as being related to the registration of non-restricted firearms were destroyed in CFIS as required by the Transitional Provisions of the Ending the Long-gun Registry Act.

It was expected that all electronic records Footnote 7 identified as being related to the registration of non-restricted firearms (except Quebec and public agencies) in CFIS would be destroyed.

The CIO Sector destroyed electronic records identified as being related to the registration of non-restricted firearms from CFIS, based on CFP specifications, by overwriting existing information in CFIS. All records identified as being related to the registration of non-restricted firearms that could be processed by the initial batch process were destroyed in this manner. The audit team was on-site to observe key parts of the destruction process. Anomalies were identified during the initial destruction that would require further actions.

Following the initial destruction of the electronic records, the resulting CFIS database was further queried to determine if information identified as being related to the registration of non-restricted firearms was erroneously omitted from destruction. The results of the analysis, conducted with computer-assisted audit tools, confirmed the anomalies that required further validation from the CFP and CIO Sector against the requirement for destruction.

The CFP and the CIO Sector addressed the anomalies that had not been captured in the initial overwrite. These anomalies related to a minority of electronic records whose characteristics differed from the electronic records that were initially targeted for destruction in CFIS.

Additional queries and confirmation tests using computer-assisted audit tools were performed to ascertain that the electronic records and anomalies had been destroyed in CFIS. Analysing the results of the confirmation tests confirmed the destruction of these records.

The results of the initial queries and confirmation tests validate that all electronic records identified as being related to the registration of non-restricted firearms were destroyed in CFIS.

4. Conclusion

In compliance with the Transitional Provisions in the Ending the Long-gun Registry Act, all electronic records identified as being related to the registration of non-restricted firearms (except Quebec and public agencies) were destroyed in CFIS.

Management Response to the Audit

An Implementation Plan was developed to proactively position the Canadian Firearms Program (CFP) to support the changes to the Firearms Act and associated Regulations introduced by Bill C-19. The Implementation Plan included the destruction of all data associated to non-restricted firearm registration records held within the Canadian Firearms Information System (CFIS) with the exception of firearms registered to businesses or individuals residing in the province of Quebec or firearms recorded to a Public Agency.

The destruction of the target data within the CFIS application, as per the Transitional Provisions in the Ending the Long-gun Registry Act, was successful. The staff at the Canadian Firearms Program and Chief Information Officer implemented a very challenging task effectively, leading to a successful result as identified in the report.

Peter Henschel, Deputy Commissioner

Specialized Policing Services

Royal Canadian Mounted Police

Appendix A-Audit Objective and Criteria

Objective:

To provide reasonable assurance that the electronic records in the Canadian Firearms Information System (CFIS) identified as being related to the registration of firearms that are neither prohibited firearms nor restricted firearms are destroyed as required by the Transitional Provisions in the Ending the Long-gun Registry Act.

Criterion 1: A plan was established for the destruction of electronic records identified as being related to the registration of non-restricted firearms (except Quebec and public agencies) in CFIS.

Criterion 2: Electronic records identified as being related to the registration of non-restricted firearms (except Quebec and public agencies) were appropriately destroyed in CFIS.

Date modified: