wide variety of governmental services. When there has been a misuse of gaming revenues, tribal
governments and tribal members who rely on such services are the ones who suffer. Subjecting
the tribal gaming operation to a closure order under such circumstances spreads this pain even
further: employees are laid off; obligations to vendors aren’t fulfilled; business relationships are
disrupted; and the sudden cessation of funds creates hardships that ripple through the tribal and
local economies. We understand this potential even more acutely in the wake of the Covid related-
suspensions of operations in our region. A shut down of the gaming operation is truly a drain of
the “lifeblood for tribal programs.” The issuance of a TCO should be reserved only for the most
egregious statutory violations against only the most recalcitrant violators.

Instead of punishing a tribal government which has been the victim of a criminal act(s), the NIGC
should encourage the Justice Department to prosecute the criminals. As Chair Simermeyer stated
during his confirmation hearing before the Senate Committee on Indian Affairs, IGRA “requires
the National Indian Gaming Commission to refer any actionable information on criminal matters
to law enforcement agencies.” Accordingly, we believe that criminal matters, such as theft,
embezzlement, or the misallocation of funds is best handled by law enforcement agencies and
prosecutors in the appropriate court of jurisdiction.

Further, we fail to see how the misuse of gaming revenues could not be handled in the Letter of
Concern and Notice of Violation processes in 25 C.F.R. Part 573. These processes better respect
tribal sovereignty as tribal governments because tribal governments are given a reasonable
opportunity to respond to and address any concerns before the Chair would be authorized issue a
TCO. Failing to correct or remedy violations contained in an NOV within a reasonable amount of
time is already included in the list of substantial violations that can cause a Chair to issue a TCO.
In sum, no regulatory changes are needed to provide the NIGC the means to enforce against
statutory violations.

IV. Providing More Transparency, Accountability, and Efficiency in Contract
Reviews and Background Investigations (25 C.F.R. Part 537)

The QNGA appreciates the NIGC’s desire to take action to increase transparency, accountability,
and efficiency in the NIGC Chair’s contract review and background investigation process. With
respect to any potential regulatory revision, we believe that the NIGC could make the great strides
toward this goal by building in mechanisms for greater accountability within existing regulations.
For example, 25 C.F.R. § 537.4 currently provides that the Chair will “promptly” notify a tribal
government if the Chair cannot or will not approve a management contract based on background
findings. The QNGA is of the opinion that setting definitive deadlines for such determinations and
communications would increase efficiency, as tribal governments would then have a set timeline
on which they could rely for moving forward with an agreement or pursuing other opportunities.
We encourage the NIGC to explore other such provisions within Parts 537 and 533 in which
mechanisms for increased agency accountability could be incorporated, as well.

The QNGA also welcomes the NIGC’s proposition that technology could be utilized to promote
efficiency and costs savings in the areas of management contract review and background
investigations. It is our opinion that the NIGC is particularly well-suited to employ technology to
facilitate communication among regulated tribal governments, especially about best practices in



The QNGA has difficulty with the concept of incorporating cybersecurity issues into the
environment, public health, and safety framework of IGRA. While a cybersecurity attack could
potentially affect public health and safety tangentially, most such incidents are aimed at capturing
an entity’s data or gaining access to one or more of its systems. It’s difficult to translate a data
breach as an EPHS and even if so, the next question is whether and to what extent has the NIGC a
regulatory role to play. The reference to EPHS in § 2710 of IGRA merely provides that to be
approved a tribal gaming ordinance must have a provision ensuring that tribal gaming operations
are constructed, operated, and maintains in a manner that protects the Environment, Public health
& Safety. Accordingly, the NIGC’s EPHS role appears to be limited to verifying that EPHS
standards exist and are enforced at each tribal gaming operation. In its 2002 EPHS interpretative
tule, the NIGC itself espoused a narrow interpretation of what constitutes an EPHS concern under
IGRA. Specifically, the NIGC found that EPHS matters were limited to those that come within the
categories of water, hazardous and other materials, sanitation, and construction and maintenance.
The QNGA does not believe that one could reasonably categorize either the aftereffects of data
breaches specifically or matters of cybersecurity generally within any of those categories.

However, the QNGA appreciates NIGC’s concerns about cybersecurity and its emphasis on the
importance of protecting tribal and patron data. Indeed, in our view, safeguarding such
information, as well as the corresponding systems through which such data is collected, processed,
or stored, is a core tribal governmental interest. Effectuating that responsibility requires constant
vigilance and perpetual learning—both about new threats and vulnerabilities and about effective
approaches to combat them.

We firmly believe that tribal governments are the appropriate bodies to address cybersecurity
concerns because TGRAs are empowered under law to promulgate and enforce policies,
procedures, and regulations best suited to the needs of that tribal government’s gaming
operation(s). The value the NIGC could bring is to serve as a center for information, training, and
advisory service provider. It is our hope that the NIGC will explore methods by which it could
disseminate information on, as well as recommended safeguards against, trending and emerging
threats.

Finally, the QNGA encourages the NIGC to produce and make available trainings on personal
computer security, methods of monitoring electronic systems for and responding to evidence of
breach or attempted breach, tactics for protecting patron data, strategies for promoting public
confidence in data security, and conducting IT audits.

Ill. Misuse of Gaming Revenue (25 C.F.R. § 573.4 (a))

The QNGA does not support including “misuse of gaming revenue” to the list of violations in 25
C.E.R. § 573.4 (a) for which the Chair may issue a tribal gaming operation a temporary closure
order (TCO) because the term is simply too broad to be amenable to a workable enforcement
standard. Consequently, it is vulnerable to misapplication or application in an unfair manner. A
closure order in this context is akin to punishing the victim of the crime in lieu of the perpetrator.
It is the perpetrators of crimes against tribal governments who should be punished — not the tribe.

As the NIGC’s 2022-2026 Strategic Plan makes clear, Indian gaming is the “lifeblood for tribal
programs.” This not only includes the employment opportunities it provides in largely rural areas,
such as in our case, but also specifically the revenue generated from gaming that goes to fund a



negotiating management contracts and facilitating background checks of those individuals and
entities for which a background check is required under 25 C.F.R. Part 537.

We envision, for example, that the NIGC could host Round Table Sessions both by video-
conferencing technology and in person, which could also be cast and joined by video-conferencing
technology, that could serve as a forum between tribal officials on these issues. Such Round Table
Sessions could be structured to allow tribal leaders and regulators to share successful strategies
and seel advice on stumbling blocks, and the NIGC could provide insight on questions regarding
its view on draft contract provisions and investigation techniques. We also believe that technology
would be best utilized, as described elsewhere herein, to create and provide a platform for on-
demand trainings on contracting best-practices and backgrounding strategies. Publishing these
trainings, along with downloadable corresponding content, so that they are simple and accessible
to participate in would not only better ensure that TGRAs and employees are aware of their duties
but also potentially preempt instances of noncompliance.

Th QNGA believes that utilizing technology in this way—addressing compliance issues before
they are encountered by means of training and education—will serve to increase tribal regulatory
efficiency. Moreover, and perhaps equally importantly, it is our opinion that this approach would
be in line with, and indeed further, the NIGC’s core statutory mission under IGRA: to effect
compliance.

Vv. Conclusion

The QNGA appreciates the opportunity to provide comments to the NIGC, and we are confident
that, through cooperative discourse, the NIGC will achieve the balance that promotes the integrity
of gaming without imposing undue burdens and unnecessary risks on tribal governments, TGRAs,
and tribal gaming operations. We look forward to continuing to engage in discussion and
meaningful consultation with the NIGC on these matters in the future.



Quapaw Nation Gaming Agency
P.O. Box 405 © 69300 E. Nee Rd.
Quapaw, OK 74363
Phone: (918) 919-6020 Fax: (918) 919-6029

February 11, 2022

Mr. E. Sequoyah Simermeyer, Chair
National Indian Gaming Commission
1849 C. Street NW

Mail Stop #1621

Washington, D.C. 20240

Re: Quapaw Nation Gaming Agency Comments on Series C Topics
Dear Chairman Simermeyer & Vice-Chair Hovland:

Included in with this letter are the Quapaw Nation Gaming Agency’s comments on the National
Indian Gaming Commission's potential amendments to its regulations, which were discussed and
presented via video conference on January 11-12, 18, and 25, 2022. We sincerely appreciate the
NIGC’s efforts to solicit and consider tribal input on these matters. We are pleased to provide input
regarding: 1) matters related to technological enhancements and technology threats; 2) issues
related to cybersecurity; 3) whether misuse of gaming revenues should warrant a temporary closure
order; and 4) how the NIGC may modify its regulations to provide more transparency,
accountability, and efficiency in its contract reviews and background investigations.

We sincerely appreciate the NIGC’s efforts to solicit and consider tribal input on these matters,
which will have a tangible impact on Tribal Gaming Regulatory Agencies’ ability to adequately
protect the integrity of gaming.

Erin Eckhart, Director
Quapaw Nation Gaming Agency

Enclosure


PW Nay an ace Wiis Aunt .
Yan eS ®, Quapaw Nation Gaming Agency

P.O. Box 405 + 69300 E. Nee Rd.
Quapaw, OK 74363
Phone: (918) 919-6020 Fax: (918) 919-6029

February 9, 2022

E. Sequoyah Simermeyer, Chair
National Indian Gaming Commission
United States Department of the Interior
1849 C St., NW

Mail Stop #1621

Washington, D.C. 20040

Re: NIGC Series C Discussion Sessions
Dear Chairman Simermeyer and Vice-Chair Hovland:

Thank you for this opportunity to provide the Quapaw Nation Gaming Agency feedback on the
National Indian Gaming Commission’s (NIGC) potential amendments to its regulations and other
topics of discussion which were discussed and presented via video conference on January 11-12,
18, and 25, 2022. We sincerely appreciate the NIGC’s efforts to solicit and consider tribal input
on these matters. We are pleased to provide input regarding: 1) matters related to technological
enhancements and technology threats; 2) issues related to cybersecurity; 3) whether misuse of
gaming revenues should warrant a temporary closure order; and 4) how the NIGC may modify its
regulations to provide more transparency, accountability, and efficiency in its contract reviews and
background investigations.

The Quapaw Nation Gaming Agency (“QNGA”) therefore submits the following comments,
which are included under headings of the discussion topics below.

IL Matters Related to Technological Enhancements and Technology Threats (25
C.FE-.R. Parts 543 and 547)

We share the NIGC’s concerns about strengthening cybersecurity awareness and practices at tribal
gaming operations. Last summer’s cybersecurity attacks on several Oklahoma tribal gaming
operations sent reverberations through the Oklahoma tribal gaming world and prompted our
agency to focus on both the cybersecurity of the Nation’s gaming operations as well as our own.
At the same time, we do not perceive the need for additional federal regulations concerning
cybersecurity. What we think would be beneficial is increasing educational opportunities and
specialized technical assistance. This, we believe will enable the NIGC to better ensure that tribal
governments and TGRAs are able to keep abreast of relevant developments in cybersecurity and
have the tools to develop controls specific tailored each gaming operation.

As the primary regulators of tribal gaming, TGRAs and their employees should be prepared to
respond quickly to attempted or actual cyberattacks. Education and awareness are key to


furthering the NIGC’s regulatory objectives in this arena, We believe that it would be particularly
beneficial if the NIGC provided an on-demand library of trainings and instructional videos on its
website. Currently, the existing NIGC cybersecurity trainings are not readily accessible on an on-
demand basis. Our agency works in shift, so it’s much easier for the day shift to utilize the NIGC’s
training modules than it is for our swing and night shift compliance officers to gain access. It
would also be beneficial if these trainings were captioned and accompanied by guides so that
individuals with low threat awareness can better understand how their actions can cause
cybersecurity vulnerabilities or in the case of our compliance officers, how to better spot such
vulnerabilities.

Moreover, while most cybersecurity issues are caused by human error or ignorance,! we believe
that the NIGC could benefit by providing more specialized and advanced trainings designed
specifically for TGRAs and their associated information technology departments. If the NIGC
does not employ personnel that could put on these trainings, perhaps working in conjunction with
other federal agencies whose primary mission is to deal with cybersecurity issues would be a
worthwhile endeavor. For example, the Cybersecurity & Infrastructure Security Agency (“CISA”)
just launched its Tribal Affairs webpage on January 27, 2022, which signals its interest in assisting
tribal governments in this area.

As a final point related to cybersecurity, the QNGA believes the NIGC should encourage
communication between tribal governments and the NIGC regarding these threats, but in a manner
that does not necessarily entail the threat of punitive enforcement measures. We urge the NIGC
to adopt an approach consistent with IGRA’s purposes, namely those aimed at strengthening the
capacity of tribal governments to protect their assets, to foster an open dialogue between tribal
governments and the NIGC regarding attempted or actual cyberattacks. As discussed in the next
section, we do not believe that IGRA provides the NIGC with clear authority to promulgate
regulations concerning cybersecurity, and we strongly oppose any such regulations that would
permit the Chair to issue a civil fine or a temporary closure order in response to such issues.
Instead, by finding ways to increase communications with tribal governments, the NIGC can better
support its efforts to disseminate pertinent information on pressing matters as soon as the need
arises,

This discussion topic also included a question regarding cloud-based storage solutions and external
vendor services. While the QNGA does not support the promulgation of any prescriptive
regulations, we do believe that the NIGC could play a positive role by providing guidance
pertaining to the risks and rewards of cloud-based data storage. To date, our gaming operations
have not used cloud-based storage for gaming data due to security concerns, but NIGC guidance
on this subject matter would be welcomed by both the QNGA and operations. Cloud storage offers
some attractive benefits, but it also presents certain drawbacks. NIGC feedback on these issues
and how to mitigate the drawbacks would be well-received.

IL. Whether Protecting the Environment, Public Health, and Safety Extends to Issues
Related to Cybersecurity (25 C.F.R. §§ 522.4 (b)(7) and 573.4 (a)(12))

+ See https://www.nvbar.org/wp-content/uploads/cyber-crime-ignorance-nv.pdf.