DROS/DES user requirement.

[wastemore]

In short, is each person delivering firearms through the DES system required to have an individual account, or can multiple users login and deliver under the CFD/FFL holder?

Just got off the phone with DOJ who was VERY persistent that everyone MUST have separate logins. When pressed could only cite the DROS entry guide but was unable to cite statute.

I understand why they prefer separate logins and why it may be a good idea from the CFD/FFL holders position, but where is the law?

Thanks in advance!

W-

[ugimports]

In short, is each person delivering firearms through the DES system required to have an individual account, or can multiple users login and deliver under the CFD/FFL holder?

Just got off the phone with DOJ who was VERY persistent that everyone MUST have separate logins. When pressed could only cite the DROS entry guide but was unable to cite statute.

I understand why they prefer separate logins and why it may be a good idea from the CFD/FFL holders position, but where is the law?

Thanks in advance!

W-

I would have separate logins even IF it wasn't law..why?

I don't want Joe Schmoe to logout a gun under my name, sign, and then find out he didn't do stuff right and MY name is on the line.. simple accountability...

[acespawnshop]

Whats the difference between the way it is done now where your name is typed on the DROS as before where you simply wrote it down.

[halifax]

Whats the difference between the way it is done now where your name is typed on the DROS as before where you simply wrote it down.

The "Approved" DROS has the name and COE for the person who delivered it on it.

[ugimports]

The "Approved" DROS has the name and COE for the person who delivered it on it.

Here's some ways I think things can go wrong and I would elect to avoid them:

The DOJ database has Account Holders info as the person delivering, but the person signing is not them. Does that mean account holder is now committing perjury? The form still says "By signing this document, I hereby certify under penalty of perjury that the information provided is true and correct."

What if a 'bad' employee forgets to sign the form? I would assume the person blamed in an audit (internal or DOJ) would be the person whose account was used and shown on the "DELIVERED BY" line. If said person says "oh we share accounts" then how does DOJ know if ANY delivery by said account holder was ever really done by them. Perhaps none of them were and they signed all the paperwork after the fact?

I know I wouldn't remember a year old DROS if I was in a larger store. In my shop where it's just me and my wife it's a little easier and we both have accounts.

I'd just prefer to avoid the situation altogether since it's not like the accounts cost me any extra.

[wastemore]

The way I see it is that California is adding a level a liability that may trickle down to the employee/deliverer. If something goes sour they throw a broad lasso and hang everyone they can. It's a way for them to heap liability upon someone other than the FFL holder.

DOJ got back to me yesterday afternoon:
They did/said everything they could to convince me separate accounts are required until I insisted they cite statute. In the end, there is no law requiring individual accounts.

[ugimports]

The way I see it is that California is adding a level a liability that may trickle down to the employee/deliverer. If something goes sour they throw a broad lasso and hang everyone they can. It's a way for them to heap liability upon someone other than the FFL holder.

DOJ got back to me yesterday afternoon:
They did/said everything they could to convince me separate accounts are required until I insisted they cite statute. In the end, there is no law requiring individual accounts.

I would make sure you have good controls in place so a year from now when the paperwork is effed up you can identify who made the mistake and you know who you potentially need to fire.

I am curious how you would prove that you did not deliver a firearm and that one of your employees did though. I guess it doesn't matter because you're still liable for what they do right or wrong.
--
On a side note, in general the concept of shared accounts in infosec security is bad. No accountability and no audit trail. It never appears bad when things are all going well. You only realize how bad an idea it was when SHTF. if you have the opportunity to use separate accounts you should take advantage of that whether in email, your computer, or the DES system.

[kemasa]

The real question is why wouldn't you want to have separate accounts? It allows each person to have their own password, tracks who does what, etc. And in the end, it does not seem like there is any reason not to make use of separate accounts to me.

[wastemore]

I would make sure you have good controls in place so a year from now when the paperwork is effed up you can identify who made the mistake and you know who you potentially need to fire.

I am curious how you would prove that you did not deliver a firearm and that one of your employees did though.

We can look on the 4473 to determine who delivered the firearm.

I guess it doesn't matter because you're still liable for what they do right or wrong.

Right! It makes zero sense to subject another person to liability.

The real question is why wouldn't you want to have separate accounts?

Like I said before: The way I see it is that California is adding a level a liability that may trickle down to the employee/deliverer. If something goes sour they throw a broad lasso and hang everyone they can. It's a way for them to heap liability upon someone other than the FFL holder.

There are 3 people that deliver firearms in the store and each one works a different shift. It's pretty easy based on the 4473 and the time the gun was delivered determining who released the firearm.

[kemasa]

So then if you can tell who released the firearm, then what difference does it make if they have their own account? Not having to share the password is reason enough to have separate accounts as well.

BTW, what is wrong with being able to track what the person did if they did something wrong? What about if an DROS gets cancelled? Don't you want to be able to track who did that?

[wastemore]

Like I said before: The way I see it is that California is adding a level a liability that may trickle down to the employee/deliverer. If something goes sour they throw a broad lasso and hang everyone they can. It's a way for them to heap liability upon someone other than the FFL holder.



I'm not certain how else to say it.

Edit- What is their motive for singling out and identifying who released the firearm by getting users to digitally sign DROS Entry System Terms of Use Agreement? If you believe for a second that DOJ pushes separate accounts because it benefits us, I have some ocean front property to sell you in Utah.

[kemasa]

You said that the person could be tracked down due to other documents, so please explain how adding an account would add a level of liability that does not already exist.

Or just admit that it really doesn't do what you claim it does.

[ugimports]

Like I said before: The way I see it is that California is adding a level a liability that may trickle down to the employee/deliverer. If something goes sour they throw a broad lasso and hang everyone they can. It's a way for them to heap liability upon someone other than the FFL holder.



I'm not certain how else to say it.

Gotta say that you are awfully nice. If I had employees and they could be liable for effing up I'd prefer they got nailed and not me. If it's a trend they may be the one that gets prosecuted and there's at least a chance some leniency could come my way if I could show it was an isolated incident.

I don't know many employers that are willing to shield all their employees from as much liability as possible. If they were my family that' MIGHT be different, but not random employees I hire to do a job. Maybe those employees really like you, but I don't think at the front of their mind is what can they do to keep you out of jail. Maybe it is though and you're one lucky employer.

In my day job I have folks that work for me (about 20) and while I do "protect" them from an organizational standpoint you bet that I would want to ensure I have full auditing capabilities the day a server goes down and we need to know who did it. Not having that and me not knowing what happened will get me fired. I've had an employee explicitly deny they did something even when presented with the auditing evidence. He was given an opportunity to fess up. He didn't. He was fired.

Remember, the auditing opportunity here doesn't just have to be with DOJ or ATF. You personally may want to know who has done stuff and while you know their shifts it's possible one day someone will say I didn't do it. That's what I was describing earlier in the thread where it's all good and no issues...until the day that it is.

You refer to the signed 4473... that's what I'm talking about with controls...say employee A during shift 1 clicks the button to deliver but forgets to sign 4473 and DROS.. then everything gets filed... then you find the docs a year later during a self audit.. maybe employee A is gone... what do you do then? Will you remember that employee A was the one that did it that day? What if employee B came in early and helped out?

In the end it's up to how you decide to run your business. Just want to make anyone else thinking of the same approach thinks about all the ways things can go bad because they are not always apparent right now.

[wastemore]

You said that the person could be tracked down due to other documents, so please explain how adding an account would add a level of liability that does not already exist.

Being able to identify that person does not equate to liability. Contracting with the state individually may. The FFL holder is already liable for all, there is ZERO need to open the door for employees to be.

Or just admit that it really doesn't do what you claim it does.

I didn't CLAIM it does anything. I shared my concern, which may be completely invalid.
DOJ does NOTHING to assist FFL holders, they only hurt/hinder. What would lead you to believe this would be different?

[ugimports]

...
Edit- What is their motive for singling out and identifying who released the firearm by getting users to digitally sign DROS Entry System Terms of Use Agreement? If you believe for a second that DOJ pushes separate accounts because it benefits us, I have some ocean front property to sell you in Utah.

In theory they are attempting to follow best practices. Here's some reading if you care:

https://isc.sans.edu/forums/diary/Critical+Control+11+Account+Monitoring+and+Control/11824

From that page:
Shared accounts are EVIL (really). Too many times we see clerical accounts that are shared between dozens of people in a group. These folks generally have direct access to customer information and to data input that affects prices. I've seen one example where a temp wasn't sure what a field was, so they put "1" in to close out orders. Unfortunately, it was the "dollars per square foot" value for the material selected - it took accounting weeks to untangle that mess! Without named accounts, it would have been impossible to figure out who was making this error ! Shared email accounts can create similar problems with accountability.

This is what you're setting yourself up for.