Most mass shooters in the U.S. acquired the weapons they used legally because there was nothing in their backgrounds to disqualify them, according to James Alan Fox, a criminologist with Northeastern University who has studied mass shootings for decades.

But in several attacks in recent years gunmen acquired weapons as a result of mistakes, lack of follow-through or gaps in federal and state law.

Not all gun purchases are subject to a federal background check system. Even for those that are, federal law stipulates a limited number of reasons why a person would be prohibited from purchasing or possessing a firearm. Those include someone who has been convicted of a crime punishable by more than a year in prison, has a substance abuse addiction, has been involuntarily committed for a mental health issue, was dishonorably discharged from the military or convicted of domestic violence/subject of a restraining order.

In 2018, there were more than 26 million background checks conducted and fewer than 100,000 people failed. Of those, the vast majority were for a criminal conviction. Just over 6,000 were rejected for a mental health issue.

Here are some of the ways mass shooters acquired their weapons:

MISTAKE IN DATA: CHARLESTON, SOUTH CAROLINA, CHURCH

The gunman who killed nine worshippers in 2015 at Mother Emanuel AME Church acquired a handgun because of a combination of a mistake in the background database and lack of follow-through.

Dylann Roof had been arrested on drug charges just weeks earlier. Although that arrest should have prevented him from purchasing the pistol he used in the attack, the FBI examiner reviewing the sale never saw the arrest report because the wrong agency was listed in state criminal history records. After being told she had the wrong agency to review the arrest record and being directed to a different police department, she didn’t follow through.

After a three-day waiting period, Roof went back to a West Columbia store and picked up the handgun.

FBI examiners process about 22,000 inquiries per day, a Justice Department attorney said during a court case brought by relatives of the church victims.

DATA NOT UPDATED: SUTHERLAND SPRINGS, TEXAS, CHURCH

The man who killed more than two dozen churchgoers in 2017 in Sutherland Springs, Texas, was able to purchase guns because his past criminal record was not submitted to the FBI database.

Devin Patrick Kelley purchased four guns from federally licensed dealers in Texas and Colorado. The military veteran passed the required background checks because the Air Force never informed the FBI about an assault on his wife and her child that led to a court-martial, a year of confinement and a bad conduct discharge.

The Air Force acknowledged that in addition to failing to submit the information in the FBI database for Kelley, it found several dozen other such reporting omissions. The Air Force has blamed gaps in “training and compliance measures” for the lapses and said it made changes to prevent failures in the future.

LACK OF ENFORCEMENT: AURORA, ILLINOIS, WORKPLACE

When Aurora, Illinois, shooter Gary Martin failed a background check and was told to turn over his weapon, he never did and police didn’t confiscate it. Martin later killed five co-workers and wounded six other people at a suburban Chicago manufacturing plant.

An initial background check failed to detect Martin’s criminal record. Months later, a second background check found his 1995 aggravated assault conviction in Mississippi involving the stabbing of an ex-girlfriend.

He was sent a letter stating his gun permit had been revoked and ordering him to turn over his firearm to police, however he never gave up the .40-caliber Smith & Wesson handgun.

There’s no mechanism under federal law to seize firearms from people who are prohibited from possession or purchase. Most states allow police to seize a firearm when they encounter a prohibited person. Few states have a procedure to actively retrieve and remove firearms from prohibited people.

A 2018 report by the California attorney general, for example, said that more than 20,000 people in that state have failed to surrender their firearms as required. California is one of a handful of states that seizes firearms from prohibited people. California, Connecticut, and Nevada require prohibited people to provide proof they’ve complied and relinquished their firearms.

PRIVATE PURCHASE: WEST TEXAS RAMPAGE

The gunman who went on a rampage last weekend along a 10-mile stretch around Midland and Odessa, Texas, killing seven people and injuring about two dozen, had failed a background check in 2014. Authorities believe Seth Aaron Ator evaded the background check system by purchasing the weapon he used through a private transaction. They searched a home in Lubbock that they believe is associated with the person who supplied the gun.

Under federal law, private sales of firearms — such as between friends, relatives or even strangers — are not required to undergo a federal background check. Some 21 states plus Washington, D.C., have laws that require background checks on some private sales, but Texas isn’t one of them. Two other states — Maryland and Pennsylvania — require a background check for handguns but not long guns.

A study by Harvard University researchers published in 2017 found that 22 percent of current gun owners who acquired a firearm in the previous two years reported doing so without a background check.

While Americans are allowed to make their own firearms, they cannot do so commercially. It is illegal to make and sell guns as a business without being a licensed dealer or manufacturer. Some sales at gun shows also are not subject to a background check.

TOOK FROM RELATIVES: NEWTOWN, CONNECTICUT; MARYSVILLE, WASHINGTON AND SANTA FE, TEXAS

The 20-year-old who killed 20 students and six adults at an elementary school in Newtown, Connecticut, took the firearms he used from his mother’s collection. Adam Lanza killed her first in the home they shared before going to the Sandy Hook Elementary School, where he carried out his attack in 2012.

In 2014, 15-year-old Jaylen Fryberg killed four classmates and wounded one other in Marysville, Washington, before killing himself. He was armed with a .40-caliber Beretta Px4 Storm handgun that he stole from his father. Fryberg’s father was later convicted of illegally obtaining the gun for failing to acknowledge on federal firearm forms that he was the subject of a tribal domestic-violence protective order. That order was never sent into the state or federal criminal databases.

Dimitrios Pagourtzis, a 17-year-old high school student in Santa Fe, Texas, is accused of killing eight students and two substitute teachers in 2018 with a shotgun and pistol he took from his father’s closet.

LEGALLY ACQUIRED: LAS VEGAS; AURORA, COLORADO; ROSEBURG, OREGON, AND ORLANDO AND PARKLAND, FLORIDA

The man who carried out the deadliest mass shooting in modern U.S. history — the Las Vegas attack that left 58 people killed and more than 500 wounded in 2017 — legally acquired 33 of the 49 weapons between October 2016 and Sept. 28, 2017, according to the Bureau of Alcohol, Tobacco, Firearms and Explosives.

The gunmen who carried out attacks at a high school in Parkland, Florida; the Pulse nightclub in Orlando, Florida; Umpqua Community College in Roseburg, Oregon and a movie theater in Aurora, Colorado, all passed background checks and purchased their firearms legally.