within any of those categories. Neither does the plain language of the phrase “environment, public
health, and safety” call to mind the subject of data privacy. As a result, the CNOGC is concerned that
any update to the interpretive rule in this regard would exceed the NIGC’s regulatory authority under
IGRA.

Instead, we encourage the NIGC to utilize the resources it would have dedicated to developing such
updates to instead provide trainings to assist tribal governments in remaining vigilant as to rapidly

. evolving threats to data privacy, which trainings could include suggestions and recommendations as
to best practices for preventing and responding to data privacy breaches.

2. “What should the Agency’s role be in promulgating standards and requirements for
cybersecurity, and does that intersect with the Agency’s existing role of ensuring public
health and safety?”

The CNOGC does not see any regulatory role within the authority granted the NIGC pursuant to
IGRA pertaining to cybersecurity, and especially not under the umbrella of environment, public
health, and safety. To stretch the term public health and safety to encompass cybersecurity would take
statutory construction to a whole new level. While NIGC concerns about cybersecurity are
understandable, perhaps even laudable, an agency must remain dedicated to its core regulatory
mission. The NIGC must resist paternalistic impulses and refrain from efforts to expand its authority
into areas not contemplated by IGRA, such as cybersecurity.

3. “What existing cybersecurity considerations are informing tribal lawmakers’ decisions
in this area?”

Like many other industries, tribal gaming is increasingly interconnected with electronic and internet-
based technologies, and as a result, the basis for regulatory decisions changes as rapidly as the area
develops. Among the responsibilities of tribal gaming regulators, as well as tribal information
technology personnel working thereunder, is to monitor and respond to the latest cyber security threats,
including viruses and other forms of malware that could lead to a security breach. However, in our
experience, tribal governments’ considerations are not limited to outside threats, though those may
constitute the subjects for which the solutions vary the most greatly. Indeed, it is of central importance
for tribal gaming regulators to be aware of and protect against mundane vulnerabilities on internal
systems, such as weak passwords and accessible shared files.

As outlined above, tribal governments are the appropriate bodies to address these concerns, as they are
empowered under law to promulgate policies, procedures, and regulations best suited to the needs of
that tribal government’s regulatory needs and to enforce all such controls. Accordingly, we envision
the NIGC’s role in this space to be advisory in nature. As an entity with which most, if not all, tribal
governments engaged in gaming interact, we recommend that the NIGC explore methods by which it
could disseminate information on, as well as recommended safeguards against, trending and emerging
threats on which it has received intelligence.

Moreover, we recommend that the NIGC inctease the availability of educational resources that could
be utilized by TGRAs as teaching tools for staff. Topics that the CNOGC believes would be especially


documents could be quickly updated in light of new information and adjusted to suit the needs of
tribal governments.

Should the NIGC determine that it is appropriate to promulgate additional regulations with relation
to the NIGC Chair’s contract review and background investigation process, though, we would
encourage the NIGC to focus its attention to promulgating standards of Agency accountability in this
area. For example, 25 C.F.R. §537.4 currently provides that the Chair will “promptly” notify a tribal
government if the Chair cannot or will not approve a management contract based on background
findings. We believe that setting definitive deadlines for such determinations and communications
would increase efficiency, as tribal governments would then have a set timeline on which they could
rely for moving forward with an agreement or pursuing other opportunities. by avoiding the potential
indefinite waiting period a tribal government must undertake

2. “How might technology provide mote efficiency and lower cost in this process?”

With regard to these subjects, the CNOGC believes that technology would be best utilized as a tool
to facilitate communication, especially with regard to best practices in negotiating management
contracts and facilitating background checks of those individuals and entities for which a background
check is required under 25 C.F.R. Part 537. For example, the CNOGC believes that the NIGC is
ideally suited to host open Round Table Sessions both by video-conferencing technology and in
petson, which could also be cast and joined by video-conferencing technology, that could serve as a
forum between tribal officials on these issues. We envision that such Round Table Sessions could be
structured to allow tribal leaders and regulators to share successful strategies and seek advice on
stumbling blocks, while the NIGC could provide insight on questions regarding its view on draft
contract provisions and investigation techniques. Thereafter, we encourage the NIGC to provide a
summaty of the findings and conclusions of such Round Tables that would be made available to Tribal
leaders and regulators at large.

In a similar vein, the CNOGC believes that it would be effective for the NIGC to make available on-
demand training on contracting best-practices and negotiation and backgrounding strategies. We urge
the NIGC, though, to ensure that any and all such trainings are 1) easy to locate, 2) viewable on mobile
and desktop devices, 3) fully captioned, and 4) accompanied by downloadable content for viewers to
follow along. Additionally, we recommend that the NIGC distill the information provided in trainings
into non-binding checklists to be used by Tribal leaders as part of a regulatory toolkit.

With regard to how utilizing technology in this way may bring about cost savings, it is our view, as
expressed generally herein, that preempting a potential problem is among the most effective ways of
increasing Tribal regulatory efficiency, both functionally and monetarily. When the Chair declines to
approve a management contract for cause, for example, vital Tribal funds that could have otherwise
been dedicated to other purposes must then be expended toward reworking a contract or seeking out
a new vendor with which to contract for management responsibilities. Moreover, under such
circumstances, the NIGC would then be required to dedicate additional funds from its limited budget
to follow-up and respond to the issue at hand.

Currently, the CNOGC perceives that the NIGC has mainly used its authority in a reactive manner—
only acting in response to already existing-circumstances. We believe that there is great value in shifting
the NIGC’s role to instead be proactive, focusing on preempting negative circumstances (ie.,
impermissible management contracts or insufficient backgrounding) by setting clear goal lines. We are


identification that includes dynamic knowledge-based authentication technology. The CNOGC asks
that the Agency consider amending 543.14(b)() to provide for tribal gaming utilization of remote
authentication technology consistent with industry standards. Proven technologies that maintain
integrity, necessary controls, and that would immeasurably broaden participation for tribal gaming
should be considered and encouraged by the NIGC. While the CNOGC appreciates NIGC
consideration of the impact of current requirements on tribal implementation of new technologies,
we strongly urge the Commission to consider additional processes or procedures that provide Agency
flexibility to amend regulations to accommodate technological advances such as the remote
identification procedures.

3. “What should the NIGC know about the approaches tribal Jaw makers are making
with regard to cloud-based storage investments and external vendor services?”

The CNOGC is not of the view that regulatory change concerning cloud-based storage solutions and
external vendor(s), is necessary. Certain issues arise when tribal gaming operations are considering
these as possibilities for data storage that should be monitored closely by tribal governments and
TGRA’s. Most importantly, ownership of the data stored on these cloud-based storage platforms
could become a contentious issue between gaming operations and vendors where contract terms are
unfavorable. Further, a vendor’s use of and access to such information, both before and after the:
expiration of a contract, will be a major concern in crafting acceptable service contract.

It might be useful if the NIGC were to publish some form of guidance document similar to what was
published regarding sports book agreements, loan documents and financing agreements, and other
contracts between gaming operations and vendors.

4. “What changes should the NIGC consider to strengthen cybersecurity for Indian
gaming operations?”

As stated in the first framing question to this consultation topic, the CNOGC believes that increased
training and education will enhance the capacity of TGRAs to understand both common and novel
threats to a gaming operation’s cybersecurity. Further, the NIGC should find ways to increase
communication between the Commission and tribal governments regarding actual or attempted
cyberattacks without the implied threat of sanctions against an already victimized tribal government.

B. Cybersecurity (25 CFR §§ 522.4(b)(7); 573.4(a)(12))

1. “Should the Agency look to update the EPHS interpretive rule to include the
potentially harmful and life altering results of a data privacy breach?”

The CNOGC is generally opposed to the Commission taking regulatory action concerning data
breaches, as we ate of opinion that the phrase “environment and the public health and safety” as used
in the statutory text of IGRA does not extend to issues related to cybersecurity. Per the NIGC’s 2002
EPHS interpretative rule, the Commission itself has espoused a narrow reading of the phrase, finding
that the Commission only has the authority thereunder to review plans prepared by tribal governments
in relation emergency preparedness, food and water, and construction and maintenance. The CNOGC
does not believe that one could reasonably categorize data breaches and the potential results thereof


helpful include: 1) tips and tactics for personal computer security; 2) methods of monitoring electronic
systems for evidence of breach or attempted breach; 3) strategies for protecting patron data and
ptomoting public confidence in data security; 4) effective responses to suspected or confirmed data
security breaches; and 5) conducting IT audits.

C. Misuse of Net Gaming Funds (25 CFR § 573.4(a))

1, “Given IGRA’s intent and requirement that the Tribe be the primary beneficiary of its
gaming operation, do you view misuses of net gaming revenue as warranting a TCO?
Are there circumstances or a level of misuse that you think would warrant a closure
order for misuse of net gaming revenue?”

The CNOGC strongly opposes the inclusion of “misuse of gaming revenue” to the list of actions in
25 C.F.R. § 573 (a) that would authorize the Chair, in his or her sole discretion, to issue a temporary
closure order to a tribal gaming operation. The term is simply too broad to provide any meaningful
standatd for establishing appropriate parameters for the exercise of the NIGC’s enforcement
authority.

As gaming has unfolded in Oklahoma and throughout the United States since the enactment of IGRA,
most reported misuses of gaming revenues were effectuated by identifiable wrongdoers, whose victims
include the tribal government and its members. Persons who profit from the conversion, theft, fraud,
or misappropriation of tribal gaming funds or assets should be prosecuted under IGRA’s criminal
provisions. To file a temporary Closure Order (TCO) against a tribal government and issue a civil fine
assessment for the unlawful acts of individuals re-victimizes the victims and could effect irreparable
harm.

As Chairman Simermeyer stated during his confirmation hearing before the Senate Committee on
Indian Affairs on July 24, 2019, “[fjor many tribal communities and their neighbors, the [gaming]
industry represents the lifeblood necessary for community operations, robust engagement with Tribal
members and neighboring jurisdictions, and job opportunities for tribal and non-tribal members
alike.” This proposal creates the potential for an NIGC Chair to further deprive tribal governments
and their citizens of “the lifeblood necessary for community operations.” Further, during a TCO,
gaming facilities may have to cease operations entirely for an indeterminate amount of time which will
not only deprive tribal governments with funds necessary to pay ongoing debt obligations, but also
hinder its ability to fund necessary on-going governmental functions including, to name but a few, law
enforcement, housing, healthcare, early childhood and K-12 education, utilities, and services for elders.
Considering the NIGC is only currently comprised of the Chair and Vice-Chair, any appeals of aTCO
brought under Parts 584 and 585 would largely be performative as it takes a majority vote of the
Commission to overturn the Chait’s initial decision.

Additionally, the Letter of Concern and Notice of Violation processes contained in Part 573 are far
superior to resolve any issues related to the misuse of gaming revenues. These processes more properly
respect the sovereignty of tribal governments as it allows for T'GRAs or other Tribal entities with the
opportunity to remedy problems through their own internal processes before the NIGC Chair could
choose to temporarily close a gaming facility at his or her discretion. Moreover, the list of substantial
violations included in 573.4 (a) already authorizes the Chair to issue a I'CO should a respondent tribal


of the opinion that this can best be achieved by utilizing technology for communication and training
purposes, as outlined above, which would transform the NIGC into not only a regulatory resource
but also a hub for information gathering and distribution. This approach would increase the
accessibility of proven techniques and knowledge, allowing tribal lawmakers and regulators to achieve
their stated purposes more efficiently—furthering the tenets of self-governance as outlined in IGRA
without substantially increasing costs or resulting in unnecessary expansion in areas outside the
NIGC’s core mission.

III. Conclusion

The CNOGC appreciates the opportunity to provide feedback to the NIGC through the comments
herein. We look forwatd to continuing to engage with the NIGC on these matters, especially as the
NIGC develops more conctete rulemaking proposals. We are confident that continued dialogue will
help to ensure policies that will benefit the tribal gaming industry and foster economic development
in Indian Country.


Bill Anoatubby
the Governor
hickasaw Chris Analy
Lt. Governor

ation OFFICE OF THE GAMING COMMISSIONER

1500 N. Country Cius Roap | PMB 228,902 ARLINGTON CentER | Apa, OK 74820

February 10, 2022

Mr. Sequoyah Simermeyer, Chairperson
National Indian Gaming Commission
1849 C. Street NW

Mail Stop #1621

Washington, D.C. 20240

Re: CNOGC Comments on NIGC Series C Consultation Topics
Dear Chairperson Simermeyer & Commission members

Included in with this letter are the Chickasaw Nation Office of the Gaming Commissioner’s
comments regarding the topics presented for consultation at virtual sessions held on January 11-12,
18, and 25, 2022, particularly regarding the NIGC’s consultation topics concerning technological
enhancements and technology threats, cyber security, misuse of gaming funds, and the NIGC’s
contract review process.

Thank you for your consideration of our comments. If you have any questions, please contact

me anytime at (580) 310-0570 or Scott.Colbert@C!

Sincerely,

Kssioner

Enclosure.


government fail to correct violations within the time permitted in an NOV. Thus, the CNOGC
opposes this potential regulatory revision.

2. “There are currently 13 substantial violations for which the Chair may issue a TCO.
What would be the impact of adding misuse of net gaming revenue to the list of
substantial violations?”

As alluded to above, the CNOGC does not believe that “misuse of gaming revenue” should be
included in the list of violations that could warrant a TCO as handling these issues in the current
Notice of Violation process is mote aligned with the NIGC’s mission to ensure compliance with
IGRA. The effect of including “misuse of gaming revenue” to 25 C.F.R. § 573.4 (a) would grant the
NIGC Chair nearly unbounded authority to enforce an overly-broad standard that will likely be subject
to allegations of arbitrary and capricious decision-making, further punish the actual victims of the
misuse of gaming revenue, and weaken Tribal sovereignty as it deprives a tribal government the ability
to handle its own internal matters within a reasonable amount of time.

Furthermore, the unlawful conversion of net gaming revenue or other criminal acts that would fall
under the umbrella of “misuse of net gaming revenue” are best handled by those entities with criminal
jurisdiction over such mattets. The NIGC’s powers under IGRA are civil in nature, rather than
criminal. Accordingly, the NIGC’s regulatory goal is not to punish, but to effect compliance.

D. Providing More Transparency, Accountability, and Efficiency in the NIGC’s
Review of Contracts

1. “What regulatory updates would provide additional transparency, accountability, and
efficiency in the NIGC Chair’s contract review and background investigation
process?”

Rather than promulgating new regulations, the CNOGC would encourage the NIGC to dedicate its
resources to increasing transparency and accountability with regard to existing regulatory structures.
Particularly, we believe that tribal governments would more directly benefit from trainings and non-
binding, clarifying communications on issues of importance in these areas.

‘The CNOGC is of the opinion that this approach would be particularly effective in response to
contracts concerning emerging areas of gaming. For instance, what are some of the best practices that
tribal governments carry out to achieve compliance with existing sole proprietary interest requirements
when negotiating revenue sharing agreements for new purposes, such as sports wagering? Or, what
factors has the NIGC identified as particularly problematic when backgrounding individuals or entities
providing services or equipment related to mobile gaming? Moreover, since the particulars of novel
forms and manners of gaming have yet to be fully developed, we believe that promulgating extensive
regulation would be premature. Indeed, the NIGC would risk artificially limiting industry growth and
innovation by installing standards that, even if reasonable on their face now, may not serve the best
interests of tribal governments for the long term. The more prudent approach, in our view, would be
to issue regular guidance documents outlining best practices in the context of the current gaming
environment. Unlike regulations, which are subject to lengthy development and review processes, such


Comments of the Chickasaw Nation Office of the Gaming Commissioner
Consultation Series C
January 11-12, 18, and 25, 2022

I. Introduction

The Chickasaw Nation Office of the Gaming Commissioner (“CNOGC”) is pleased to submit these
comments in response to the NIGC’s request for comments in relation to potential changes to its
regulations, primarily concerning audit technological enhancements and technology threats,
cybersecurity, misuse of gaming funds, and the NIGC’s contract review process. We appreciate the
NIGC’s early outreach efforts and the opportunity to provide feedback in advance of the drafting
process.

Our comments are organized by topic area and/or question presented below. We look forward to
your favorable consideration.

IL. Comments

A. Technological Enhancements and Technology Threats (25 CFR Parts 543 and
547)

1, “In addition to or instead of regulatory requirements, should the NIGC consider other
tools such as additional guidance or additional training efforts in order to promote
awareness and strengthen cyber security practices?”

While the CNOGC shares NIGC’s concerns about cybersecurity threats at tribal gaming operations,
we do not believe that regulations aimed at addressing cybersecurity issues comes within the authority
delegated the agency by the Indian Gaming Regulatory Act (GRA). 25 U.S.C. § 2701 et seg. Although
we do agree that the NIGC could play a positive role in addressing cybersecurity issues through
outreach, training, and education. In our view, the phrase “environment and the public health and
safety” (EPHS) as used in the statutory text of IGRA cannot reasonably be read to encompass
cybersecurity and related issues. In fact, such concerns were not addressed in IGRA or its legislative
history.

When questions arose as to the meaning of the EPHS phrase in 2002, the NIGC published an
interpretative rule, giving the Commission a narrow role and recognizing the supetior governmental
interest of tribal governments in the EPHS arena. We believe that the preamble of the 2002 EPHS
tule represents a correct construction of both law and federal Indian policy. On the other hand,
continuing to educate and provide training to tribal governments and TGRAs on cybersecurity issues
enables the NIGC to disseminate pertinent information on pressing issues as they emerge without the
delay associated with a rulemaking to correct stale or obsolete regulations.

The CNOGC recognizes and supports the efforts of the NIGC to provide education and training
through the publication of its Tribal Cybersecurity Readiness document and issuing NIGC Tech
Alerts. There is more, however, that can be done in this area and we are pleased to offer some
suggestions. First, the CNOGC believes that training or instructional videos covering everything from
the basics of cybersecurity to more advanced and narrow topics should be easily accessible to all
interested individuals on the NIGC’s website. Because the NIGC’s Tribal Cybersecurity Readiness


document outlines common types of cyberattacks, it does a good job of raising awareness for those
without a high degree of threat awareness, but it would be a much more effective and useful tool if
the agency were to provide more sophisticated on-demand training modules. Currently, the NIGC
hosts a limited number of trainings over Zoom on this subject, but there are limits on the efficacy of
these efforts. If an interested party wishes to see a particular session, it must send in a request. An on-
demand library would allow interested patties to watch these recordings at convenient times. Finally,
the NIGC’s expertise in cybersecurity is naturally limited because the subject matter does not come
within its statutory mission. Accordingly, it will not be able to employ enough subject matter experts
on cybersecurity to provide assistance or training to tribal governments at the high levels that may be
needed in the wake of a major breach. We recently ‘becatne ‘aware that the’ Cybersecurity &
Infrastructure Security Agency (“CISA”) launched its Tribal ‘Affaits webpage on January 27, 2022.
Perhaps a collaboration between the NIGC and CISA on an education and training program would
be a valuable endeavor.

Lastly, the CNOGC believes that the NIGC should encourage communication between tribal
governments and the NIGC regarding cyber threats rather than remove incentives to candid
communications. A prescriptive regulatory approach necessarily entails the threat of punitive
enforcement measures. We urge an approach consistent with IGRA’s purposes, particularly those
aimed at strengthening the capacity of tribal governments to protect their assets. We do not believe
that tribal governments must be forced to address cybersecurity concerns. We certainly object to the
idea that a data breach would warrant a closure order or civil fine assessment. ‘As the federal
government learned in 2020 with the SolarWinds attack, even with the.most strifigent cybetsecurity ~
controls in place, data breaches can happen to even the most sophisticated companies and government
agencies."

With regard to the NIGC’s IT Vulnerability Assessments, this may be’ a useful‘tool for gaming
operations that want such service, but we are not clear what such assessments would entail or what
goal is served. Moreover, deployment of such programmatic.approach would require considerably
more staffing than is currently in place. We do not support an increase in the size of the NIGC’s staff
nor an expansion of its mission in areas beyond the agency’s expertise and core statutory mission.

2. “Do existing NIGC requirements create any unintended limits on tribes’ ability to
implement, regulate, or review new technologies?”

Yes, existing NIGC requirements create limitations to tribal gaming, including adoption of new
technologies associated with the emergence of sports betting, digital wallets and mobile gaming.
Opportunities to increase remote participation of patrons are somewhat limited for tribal gaming by
the curtent restrictions imposed by the Minimum internal control standards for patron deposit
accounts & cashless systems contained within 543.14(b)(). The current regulation requires the patron
to appear in person and present government issued identification to facility personnel to create a valid
account with the gaming facility prior to engaging in remote wagering. That requirement limits
opportunity for tribal gaming operations to fully utilize new technologies that provide remote identity
verification that is quickly becoming standard elsewhere in the industry. An example of the emerging
standard of remote identification authentication is demonstrated by rule 5.225, adopted by the Nevada
Gaming Control Board (“NGCB”). The NGCB rule implements procedures for remote patron

1 See, e.g., https://www.gao.gov/blog/solarwinds-cyberattack-demands-significant-federal-and-private-sector-
response-infographic.