Illegal Data Release Massachusetts

[Robert Peel]

GOAL Teams with Comm2A in Response to State’s Unlawful Data Release​

Gun Owners’ Action League (GOAL) and the Commonwealth Second Amendment (Comm2A) have teamed up in response to an unlawful data release that includes very specific information on firearm transfers in Massachusetts.
We were recently made aware that the Firearms Record Bureau (FRB) posted links to extensive data covering every recorded gun transaction in Massachusetts going back nearly twenty years. The data files do not use buyers’ names, but it does assign everyone, including retailers, a unique numerical identification number. The data, now made public and downloadable, provides your ID number, the specific gun you bought, your town and zip code. It also provides the same information about the person or retailer you bought it from. Given all that information the data is very easy to decode.
GOAL and Comm2A are joining together to legally notify the State of the clear violation. According to law, we must provide them 30 day’s notice to correct the issue before taking any court action. We will keep our members informed as things proceed.

Data about firearms licensing and transactions:​

Data about firearms licensing and transactions

https://malegislature.gov/Laws/GeneralLaws/PartI/TitleX/Chapter66/Section10B
Chapter 66, Section 10B: Records divulging name, home or email address and phone number; persons who own, possess or have license to carry firearms; government personnel
Section 10B. The commissioner of the department of criminal justice information services, the department of criminal justice information services and its agents, servants, and attorneys including the keeper of the records of the firearms records bureau of said department, or any licensing authority, as defined in section 121 of chapter 140, shall not disclose any records divulging or tending to divulge the names and addresses of persons who own or possess firearms, rifles, shotguns, machine guns and ammunition therefor, as defined in said section 121 of said chapter 140, and names and addresses of persons licensed to carry or possess the same to any person, firm, corporation, entity or agency except criminal justice agencies as defined in section 167 of chapter 6 and except to the extent such information relates solely to the person making the request and is necessary to the official interests of the entity making the request.

I can't find the link that provides the person's name and address. All I see is the sex, the gun info and what town it covers? Can someone post the link on here that gives the private into out please?

 

[Machines]

How do you know what town he is from?

Maybe he talks in his sleep.

 

[Broc]

Maybe he talks in his sleep.

He sleeps at the range?

 

[Mattyweb]

How do you know what town he is from?

Just saying if you do know what town. Also not difficult to find out either through conversation, business logo on his truck, transfer station sticker, etc. Generally not secret info and sometimes easy to figure out. My point was it doesnt need to be as complicated as snapping pics of serial numbers. With the data provided, a few peices of info are enough.

 

[Drix]

You LTC pin isn't your pin on this list. Search a serial # on the post 2016 list and you'll find your PIN.

Wait, I haven't investigated this- is our pin really on the list?

If so, this information just invalidated the whole MIRCS system and anyone can digitally steal firearms.

How?

Well, lets say I buy a firearm, we do the legal shit. You give me a copy of the EFA10.

EFA10 has the buyer's (or seller's) Licence # and Birthday, if the export has my pin I can do the following:

1. Use the export to figure out what guns are owned by anyone I've ever done business with. The important list is the FFL 2016+ which has serial numbers.
2. Search the other person's inventory for guns by querying the ffl sales data
3. Log into mircs using the other person's LTC number, I can't remember exactly what's required but if necessary you already have DOB (also on efa10), address, and I guess you're saying Pin is in the database?
4. Transfer the guns out of the owner into my name.
5. Call the police to collect or just list them as stolen.
6. Wait for firearms to be recovered.

This can't be true, can it?

 

[JoseyWales]

I can't find the link that provides the person's name and address. All I see is the sex, the gun info and what town it covers? Can someone post the link on here that gives the private into out please?

You have to work backwards. First, if you know a person's (1) birthday and (2) address, then, if you think/know that they have an LTC, then you can find out which firearms they have.

#1 and #2 above are easily obtainable thru casual conversation, or loose lips, or public record.

 

[Waher]

Wait, I haven't investigated this- is our pin really on the list?

The PIN on the list is a number assigned to your LTC to theoretically hide your identity. It isn't the same as the transaction validation PIN you use to process a FA10 transfer.

If someone gets a serial # or knows your birthday, town, and what store you likely went to then they can work backward to find you. This list should have never included serial #s or birthdates to protect privacy if it really was the subject of a legit FOIA request.

Having made FOIA requests to agencies before. They are so loathe to release broad information that I have a hard time believing this wasn't a coordinated political hit and intimidation job.

 

[Drix]

The PIN on the list is a number assigned to your LTC to theoretically hide your identity. It isn't the same as the transaction validation PIN you use to process a FA10 transfer.

If someone gets a serial # or knows your birthday, town, and what store you likely went to then they can work backward to find you. This list should have never included serial #s or birthdates to protect privacy if it really was the subject of a legit FOIA request.

Having made FOIA requests to agencies before. They are so loathe to release broad information that I have a hard time believing this wasn't a coordinated political hit and intimidation job.

So that's really more of a ID, less a pin.

Yes, technically personal identification number, but in context the pin to a ma license is a password.

 

[chris_1001]

So that's really more of a ID, less a pin.

Yes, technically personal identification number, but in context the pin to a ma license is a password.

I am not a number I am a free man

I will not be pushed, filed, stamped, indexed, briefed, debriefed or numbered. My life is my own.

Add the above to my .gov ID number (SS)

 

[namedpipes]

I am not a number I am a free man

I will not be pushed, filed, stamped, indexed, briefed, debriefed or numbered. My life is my own.

Add the above to my .gov ID number (SS)

Boy were YOU born in the wrong era, NES Member #11,913!

 

[Drix]

I am not a number I am a free man

I will not be pushed, filed, stamped, indexed, briefed, debriefed or numbered. My life is my own.

Add the above to my .gov ID number (SS)

Like you have a choice in that.

You're not "a" number, you're a shitload of numbers.

You are filed, stamped, indexed, and numbered for sure. Your NES name has a number attached, your internet account has a customer ID, so does your electric, not to mention medical record number.

This is like saying "I'm not a bag of meat, I'm a human".

You're both buddy.

 

[chris_1001]

Like you have a choice in that.

You're not "a" number, you're a shitload of numbers.

You are filed, stamped, indexed, and numbered for sure. Your NES name has a number attached, your internet account has a customer ID, so does your electric, not to mention medical record number.

This is like saying "I'm not a bag of meat, I'm a human".

You're both buddy.

I would add "taxed" but since both lines were a quote.

Its truly ridiculous the coding, numbering etc...

 

[67ray]

I noticed a gun I bought several years ago said it was a female. Thought I was sure so pulled up the EFA-10 and sure enough I was right! Seller transitioned genders
.

 

[wcorey]

My anti malware has issues with some of the FRB files, the personal transfers in particular won't even open unless I disable the anti malware.
What's up with that anyway, can undesirable things be tucked into an exel file...?

 

[wcorey]

I can't find the link that provides the person's name and address. All I see is the sex, the gun info and what town it covers? Can someone post the link on here that gives the private into out please?

Not sure where you got that from but there is no name/address, just the town. Post #49 and others early in the thread will give you some insight on how the data provided can be deciphered.

 

[DW357]

You have to work backwards. First, if you know a person's (1) birthday and (2) address, then, if you think/know that they have an LTC, then you can find out which firearms they have.

#1 and #2 above are easily obtainable thru casual conversation, or loose lips, or public record.

Well you'd need to know some of their recent gun purchases too. I mentioned earlier, I tried to look up a friend of a friend whom I have their name, address, and birthday. I cannot pinpoint which gun sales/registrations are theirs because there's more than one person with the same birthday in that town.
If I knew they purchased X gun recently, it would make it easier to pinpoint

 

[Drix]

My anti malware has issues with some of the FRB files, the personal transfers in particular won't even open unless I disable the anti malware.
What's up with that anyway, can undesirable things be tucked into an exel file...?

Macros

 

[Drix]

Well you'd need to know some of their recent gun purchases too. I mentioned earlier, I tried to look up a friend of a friend whom I have their name, address, and birthday. I cannot pinpoint which gun sales/registrations are theirs because there's more than one person with the same birthday in that town.
If I knew they purchased X gun recently, it would make it easier to pinpoint

Yup.

Purchase day is a big one.

All those people flocking to social media to post their new gun purchases? *coughreddit's/r/magunscoughhak* You could find a user based on the post.

Luckly for those people reddit doesn't store a timestamp with these posts, so you get "1 year ago" or "2 years ago", otherwise you could tie a user to a firearm and then their collection- I've already done this with a person and their Barett, it took me about an hour to set up the databases and about 5 minutes to run the queries.

If you know the Town and birthday of your friend, you can base off ltc expiration or issue, surely they bitch about timelines when submissions/renewals happened.

 

[JoseyWales]

Our illustrious comm2a/goal organizations are playing softball, giving the State 30 days to do something (from post #1). They need to start playing rough with these people. No updates?

 

[Mattyweb]

I noticed a gun I bought several years ago said it was a female. Thought I was sure so pulled up the EFA-10 and sure enough I was right! Seller transitioned genders
.

Well there's a breach of privacy from this data I did not expect. That person has now been outed as transitioned (assuming they didn't want anyone to know).

 

[HARRYM]

Our illustrious comm2a/goal organizations are playing softball, giving the State 30 days to do something (from post #1). They need to start playing rough with these people. No updates?

Standard procedure I would guess.

 

[EJFudd]

Our illustrious comm2a/goal organizations are playing softball, giving the State 30 days to do something (from post #1). They need to start playing rough with these people. No updates?

Well, the post said they have to wait 30 days before filing suit. I assume they have already made their concerns known to the FRB and whomever else had anything to do with posting those data dumps. Let us hope that some aggressive lawyers are already involved, because just a simple letter is probably not going to remedy this outrage.

 

[Darksideblues42]

Our illustrious comm2a/goal organizations are playing softball, giving the State 30 days to do something (from post #1). They need to start playing rough with these people. No updates?

I am going to give you the benefit of the doubt here.

There is a legal requirement to file a notice of intent to sue 30 days prior to filing a lawsuit. This is just how it works. There are specific processes and procedures to follow. If you don't do the steps correctly, you will get your lawsuit tossed.

 

[bigbravehog]

Standard procedure I would guess.

yes, we play by the rules - they don't

 

[426wedge]

Our illustrious comm2a/goal organizations are playing softball, giving the State 30 days to do something (from post #1). They need to start playing rough with these people. No updates?

I just donated to these folks. Do the same. Can't hurt...

 

[pdm]

Our illustrious comm2a/goal organizations are playing softball, giving the State 30 days to do something (from post #1). They need to start playing rough with these people. No updates?

You think they have the juice in MA to play hardball?

 

[Drix]

You think they have the juice in MA to play hardball?

They'd run out of hardball funds in a week.

 

[June4th]

What’s the aftermath for the similar data disclosure in Cali? Calguns is a very well funded group, and what happened in CA can provide a preview of what may happen here.

 

[richc]

I found some records from my home town with a buyer ID and guns I own.

Does the buyer ID change? A fe items seem to be missing that I know went through an FFL for purchase or transfer.

 

[Reptile]

What’s the aftermath for the similar data disclosure in Cali? Calguns is a very well funded group, and what happened in CA can provide a preview of what may happen here.

So, what happened?