How did Dylann Roof pass a criminal background check to buy a gun? Initial reports suggested that Roof’s purchase of the gun he used to murder nine people at Emanuel A.M.E. Church in Charleston, South Carolina, was legal. But now FBI Director James Comey says that’s wrong: Roof should have been prevented from buying the .45 caliber pistol, but something went awry during the background-check process.

Federal laws prevent certain people from purchasing guns, including those facing charges that might result in a prison term of at least a year. Roof was charged earlier this year for the possession of a drug called Suboxone, a misdemeanor offense that did not meet that threshold, and so would not have barred him from making the purchase. But the rules also bar anyone “who is an unlawful user of or addicted to any controlled substance” from buying a gun. When he was arrested on March 1 for possession, Roof told investigators that he had used the drug, which should automatically have disqualified him. Somehow, that crucial fact never made it into the background-check database.

Comey disclosed the error to reporters on Friday at FBI headquarters. “Comey indicated that the data was not properly entered in federal criminal justice computer systems, or had been mishandled by an analyst with the National Instant Criminal Background Check System,” The Washington Post reported. He said, “this rips all of our hearts out” and “we are all sick this happened,” according to CNN.

In the immediate aftermath of the shooting, one line of speculation had been that a relative purchased the gun for Roof, then transferred it to him—a private transaction that would have been exempt from checks. Instead, it seems the problem is just a failure in the system. The Wall Street Journal reported that the FBI official charged with conducting the background check had faxed requests to the police in West Columbia and to the county’s law-enforcement office, but had not received details of the arrest swiftly enough to prevent the sale.

Under federal law, if there’s a delay in obtaining information from the National Instant Criminal Background Check System, or NICS, a gun can be legally transferred to a buyer after three days, which is what reportedly happened in Roof’s case. Sometimes, NICS turns up information after those three days that should have prevented a gun sale, and a retrieval referral is issued. There were more than 2,500 such referrals in 2014. It’s unclear how long it takes for an arrest to make its way into NICS. Roof was arrested in February and bought his gun in early April.

This isn’t the first time that a failure to match up local and federal data had tragic consequences. Seung-Hui Cho, who killed 32 people at Virginia Tech in 2007, should have been barred from getting a gun because he had been declared a danger to himself. A 2008 law passed with support from both the NRA and the Brady Campaign to Prevent Gun Violence sought to ensure that information on people barred from buying guns due to mental health would be added to NICS. NICS also faces funding issues. In response to issues of timeliness and accuracy in data entry to NICS, the Department of Justice has made grants to states to improve data quality.

Since the shootings in Charleston, President Obama and others have called for stricter gun laws. Polls show that a huge majority of Americans support stronger standards for background checks, among other measures, but legislation has stalled on Capitol Hill. Some gun-rights advocates pointed to Comey’s revelation on Friday as evidence that the problem isn’t lack of laws—it’s the failure to effectively enforce the ones already on the books.