Confederated Tribes of the 

Umatilla Indian Reservation 

Board of Trustees & General Council 

46411 Timfne Way • Pendleton, OR 97801 

(541) 429-7030 • fax (541) 276-3095 

info@ctuir.org • https://ctuir.org/ 

February 11, 2022 

Via electronic transmittal 

Mr. Dustin Thomas, Chief of Staff 

National Indian Gaming Commission 

RE: Confederated Tribes of the Umatilla Indian Reservation Comments on Consultation Series C - 

Regulations with implications for technology and NIGC processes to protect tribal assets 

Dear Mr. Thomas, 

On behalf of the Confederated Tribes of the Umatilla Indian Reservation (CTUIR), thank you for the 

opportunity to provide input on the National Indian Gaming Commission regulations relating to 

technological standards and processes to protect tribal assets. Our comments are attached to this letter. 

If any questions arise as you review our comments or if there is additional information that we might be 

able to provide, please do not hesitate to contact Matt Johnson, Interim Deputy Executive Director, at 

541-429-7393 or matthewjohnson@ctuir.org. 

Sincerely, 

CJy\, ~~~ t ~ 

N. Kathryn Brigham, 

Board of Trustees 

Treaty June 9, 1855 - Cayuse, Umatilla and Walla Walla Tribes 
Confederated Tribes of the Umatilla Indian Reservation (CTUIR) 

Comments on National Indian Gaming Commission Technology and Tribal Asset-Related 

Regulations 

A. 25 C.F.R. § 522.2(d): "Provides that a tribe must submit with its gaming class II or class Ill ordinance or resolution 

"governing document(s), or an accurate and true description of the Tribe's governmental entity and authority to enact 

the submitted ordinance or resolution." - The CTUIR does not support the NIGC's proposed requirement that tribes 

submit such information with their class II and class Ill gaming ordinances. What we submit should already suffice as 

the CTUIR government structure is described in our Constitution enacted in 1949 and there has been little to no 

change in the requirements that we have to follow internally to adopt or enact a CTUIR ordinance or resolution since 

having entered into the Indian gaming industry. The CTUIR Constitution is available on our website at: 

https :// ctu i r .org/ departments/ office-of-lega 1-cou nse I/ codes-statutes-laws/ ctu i r-constitutio n/ 

B. 25 C.F.R. § 522.2(h): "Requires tribes to identify "the entity that will take fingerprints" and provide "a copy of the 

procedures for conducting a criminal history check." The CTUIR requests that NIGC clarify this point. 

C. 25 C.F.R. § 522.8 (now§ 522.9): Requires the NIGC to publish its notice of approval of a tribal gaming ordinance or 

resolution and the Chair's accompanying approval in the Federal Register. The current regulations provide that the Chair 

publish a tribe's gaming ordinance in the Federal Register along with the Chair's approval. The NIGC's proposed 

amendment would 'remove this particular requirement. - The CTUIR supports the NIGC's decision to keep the text of 

tribal gaming ordinances a matter between tribes and the NIGC. This is a matter of tribal sovereignty as it should be 

up to individual tribes to determine whether to make their gaming ordinances publicly available. 

A. 25 C.F.R. Parts 543 and 547 - Minimum internal control standards and minimum technical standards Gaming 

technology and risks have changed significantly since the NIGC implemented its current minimum internal control 

standards and technical standards. The NIGC seeks input on matters related to technological enhancements and 

technology threats. 1. In addition to or instead of regulatory requirements, should the NIGC consider other tools such as 

additional guidance or additional training efforts to promote strong cyber security practices? - The CTUIR supports the 

NIGC's proposal to provide training and guidance on cyber security with the recommendation that such guidance and 

trainings cover a wide range of technology and security practices to ensure that the NIGC's efforts are inclusive and 

reflect the diversity of technological sophistication present throughout the Indian gaming industry. The CTUIR also 

recommends that the NIGC provide guidance and training on customer and media engagement post-cyberattack to 

help tribes mitigate potential reputational harm. We believe such assistance is particularly critical for smaller and 

midsize gaming operations and will help to uphold the integrity of, and public trust in, the Indian gaming industry. 

2. At the outset of 2020, the NIGC reviewed its regulations to make sure that the regulations did not discourage the use 

of technology throughout the industry. For example, the NIGC considered the specific question of whether its 

regulations hindered a Tribal Gaming Regulatory Authority's ability to review an operation's adoption of cashless wallet 

systems. Do existing NIGC requirements create any unintended limits on tribes' ability to implement, regulate, or review 

new technologies? -The CTUIR encourages the NIGC to provide maximum flexibility to tribes in all its cyber securityrelated regulations and to continue consulting with tribes and tribal gaming regulators on these issues. 

3. Data storage approaches are an important part of mitigating risk in the area of cybersecurity. These approaches 

include the use of cloud-based technology and approaches that allow for tribes to rely on external cyber security 

expertise to maintain strong data protection practices. What should the NIGC know about the approaches tribal law 

makers are making with regard to cloud-based storage investments and external vendor services? - No comment 

Treaty June 9, 1855 ~ Cayuse, Umatilla and Walla Walla Tribes 
4. What changes should the NIGC consider to strengthen cybersecurity for Indian gaming operations? -The CTUIR 

proposes that the NIGC engage in additional consultation and incorporate tribes' recommendations for maximum 

flexibility into any new agency actions. 

8. 25 C.F.R. § 522.4(b)(7) -Approval requirements for class II ordinances. The NIGC seeks input on whether the 

requirement that a tribe construct and operate its gaming operation in a manner that adequately protects the 

environment, public health, and safety (EPHS) extends to issues related to cybersecurity. 

1. Should the agency look to update the EPHS interpretive rule (found at 25 C.F.R. § 522.4(b)(7)) to include the 

potentially harmful and life altering results of a data privacy breach? -The CTUIR requests that further 

information regarding whether the NIGC is considering limiting its potential update to the EPHS interpretive 

rule to data privacy breaches for gaming customers. Cyberattacks also have the potential to disrupt tribes' 

emergency medical response systems, bank accounts, confidentiality, and intellectual property, among other 

things. The CTUIR has concerns that including cyber security issues under the EPHS umbrella may increase the 

risk that gaming operations are issued a temporary closure order. The CTUIR recommends that the NIGC 

revise its substantial violations list to make clear that cyber security issues do not trigger a temporary closure 

order. 

2. What should the Agency's role be in promulgating standards and requirements for cybersecurity, and does 

that intersect with the Agency's existing role of ensuring public health and safety? - The CTUIR acknowledges 

the importance of cybersecurity measures to keep tribes, gaming operations, and the wider community safe. 

The CTUIR encourages the NIGC provide more information on its regulatory authority, as it is set forth under 

the Indian Gaming Regulatory Act, to promulgate specific standards and requirements for cyber security. 

However, even if the NIGC possesses such regulatory authority, an overly prescriptive approach to 

cybersecurity in the Indian gaming industry could undermine tribes' inherent sovereignty to govern 

protections and responses to cyberattacks that occur on their lands. Cyber security regulations could hamper 

tribes' ability to prevent and respond to cyberattacks in ways that are innovative and fit the needs of their 

communities and gaming patrons. 

3. What existing cybersecurity considerations are informing tribal lawmakers' decisions in this area? -As 

mentioned in response to question 8.1. cyber security breaches have the potential to disrupt emergency 

response systems, information systems related to banking, confidentiality, and intellectual property, so these 

considerations inform the CTUIR approach to the environmental, public health, and safety of its gaming 

operations. 

4. How are existing record maintenance requirements potentially impacted by a data breach and could this 

impact the integrity of data? -The CTUIR presume that a data breach could impact the integrity of any 

electronically stored data, regardless of the record maintenance requirements. 

C. 25 C.F.R § 573.4(a)-When may the Chair issue an order of temporary closure. The NIGC seeks input on adding 

misuse of net gaming revenues to the list of substantial violations for which the NIGC Chair may issue a temporary 

closure order. 

1. Given IGRA's intent and requirement that the Tribe be the primary beneficiary of its gaming operation, do you 

view misuses of net gaming revenue as warranting a TCO? Are there circumstances or a level of misuse that you 

think would warrant a closure order for misuse of net gaming revenue? - The CTUIR encourages the NIGC to 

Treaty June 9, 1855 ~ Cayuse, Umatilla and Walla Walla Tribes 
abstain from including "misuse of net gaming revenue" in its list of substantial violations regardless of the 

circumstances or level of misuse. 

2. There are currently 13 substantial violations for which the Chair may issue a TCO. What would be the impact 

of adding misuse of net gaming revenue to the list of substantial violations? - The CTUIR encourage the NIGC to 

abstain from including "misuse of net gaming revenue" in its list of substantial violations. We do however 

agree with the NIGC that bringing gaming operations back into compliance for misuse of revenue is critical to 

maintaining integrity in the gaming industry. However, expanding the Chair's authority to issue a temporary 

closure order for the misuse of gaming revenue will have collateral consequences that harm tribes and their 

employees as opposed to targeting the individual or group of individuals responsible for such misuse. 

D. 25 C.F.R. Part 537 - Background investigations for person or entities with a financial interest in, or having 

management responsibility for, a management contract. Since the NIGC first issued regulations related to contract 

review, the practices and procedures the agency uses in conducting those reviews has continued to evolve. The NIGC 

seeks to engage in a discussion as to how the NIGC may modify its regulations to provide more transparency, 

accountability, and efficiency in its contract reviews. 

1. What regulatory updates would provide additional transparency, accountability, and efficiency in the NIGC 

Chair's contract review and background investigation process? - The CTUIR propose that the NIGC further 

amend 25 C.F.R. Part 537 to clarify whether the "financial interest" of entities, referenced at 25 C.F.R. § 

537.l(a)(4), must be either direct or indirect and what constitutes a "financial interest." 

2. How might technology provide more efficiency and lower cost in this process? - No comment. 

3. Should the NIGC consider adopting other jurisdictions' best practices in the area of background investigation 

processes? - The CTUIR requests more information on this topic and ask NIGC to identify the jurisdictions and 

best practices that it is considering. 

Treaty June 9, 1855 ~ Cayuse, Umatilla and Walla Walla Tribes