Following a comprehensive review that involved internal and third-party expert investigators, the Horseracing Integrity and Safety Authority has levied charges against owner Marshall Gramm for multiple violations of HISA rules arising from unauthorized access of confidential horse health information.
Gramm, a well-known handicapper, contest player, and horse owner, contends the information he accessed was readily available to him as a horse owner in the HISA system.
In an Aug. 17 release, HISA said that in June past performance data reports for Deterministic and Griffin's Wharf, which included confidential horse health data that should only be accessible to the horses' connections and regulatory veterinarians, were posted on social media by someone unconnected to those horses. Consequently, HISA launched a comprehensive internal investigation into the matter.
HISA's preliminary investigation concluded there had not been any system breach by a person or entity who did not have prior authorization to access the HISA portal. HISA then extended its initial investigation to search for any vulnerabilities in its technology systems that may have allowed someone with some level of authorized access to the HISA portal to view and share confidential horse health information.
At that time, HISA committed to reporting the findings of its extended investigation at its conclusion.
That investigation included robust information sourcing and interviews conducted by HISA employees and contractors, as well as an independent third-party forensic cyber security analysis conducted by Arete, a leading expert in the field. The results unanimously pointed to Gramm being solely responsible for accessing confidential horse health information and creating past performances for horses to which he had no legitimate connection.
HISA said its investigations concluded that Gramm, a founding partner of owner Ten Strike Racing, deliberately and methodically misappropriated confidential horse health information from the HISA portal during a six-week window beginning in early May and concluding in mid-June.
Gramm called it unfortunate that HISA decided to pursue disciplinary proceedings and said he intends to vigorously defend himself. In terms of accessing the information, he painted a much different picture than HISA.
"I am a college professor and data analyst, and gathering and analyzing large datasets is something I have done throughout my career; including extensive work with horse racing data," Gramm said. "The information at issue was available through my authorized HISA account. It was a large dataset, and at the time I accessed it, I had not fully reviewed its contents or understood the scope of the information it contained. I used my own account and credentials and never attempted to conceal my identity or circumvent HISA's security.
"Once logged into my account, I bypassed no security protocols or other safeguards to access the information. Where I exercised poor judgment was in not bringing the vulnerability to HISA's attention sooner after it became a public story. I should have done so, and I regret that I did not. I want to apologize for the difficulties this situation has caused."
In a Monday press conference, HISA CEO Lisa Lazarus explained that Gramm rightfully would have had access to information on horses he currently owned, but not on other horses. She went on to suggest that Gramm, who holds an economics Ph.D. and is an associate professor in economics at Rhodes College, launched a concentrated effort to access information on other horses in the system while concealing his identity.
"Our evidence showed that Mr. Gramm used essentially an automated and invisible browser to download records at scale, while employing methods to avoid detection," Lazarus said, calling social media discussion that the system was easily breached patently false. "This idea that he could have fallen on his keyboard and punched in something else, and suddenly you get a different (horse)—it's just not true.
"There's no question that he would know what he was doing was wrong, that it was unethical, and that he was violating multiple rules. The way we really characterize this—and understand it—is fraud on the market, like insider trading. He had access to information that nobody else did. He was able to use that information to monetize it, and where we find that especially concerning and damaging is respect to the claiming horses within the time frame that he accessed the information he claimed these horses."
Based on information gathered through its investigations, HISA alleges Gramm developed an automated method of obtaining the confidential horse health information at scale in a manner designed to mimic authorized activity to avoid detection by HISA's security systems.
Lazarus said the purse earnings of nine horses claimed by Gramm during that timeframe (about $80,000) will be returned to the previous owners, who all have been contacted. She said HISA will reimburse those owners and then plans to collect that money from Gramm. In terms of possible sanctions, Lazarus took nothing off the table, saying Gramm could face a lifetime ban.
Lazarus said HISA found no evidence that any other individuals had accessed the protected records and that the investigation had been concluded.
As for the breached system, HISA said it has made changes to prevent similar breaches. In its release, HISA said it has made changes to its technology systems to prevent any similar unauthorized access going forward.
"HISA is also devoting additional time and resources to ensuring that its systems are well-prepared to stop any attempts to use new tools and technologies to obtain confidential information," the release said.
HISA said when Gramm was confronted with the findings of its investigations, he admitted being the source of the past performances made public for Deterministic and Griffin's Wharf. HISA said besides the claims Gramm made as an owner during the time period of concern, he also participated in handicapping contests and in wagering on horses.
"The harm that Mr. Gramm has caused to the Thoroughbred racing community is significant. HISA has initiated enforcement actions against Mr. Gramm for HISA rule violations relating to fraud and unauthorized access of horse health records," HISA said in a release. "In addition to these internal actions, HISA will evaluate and pursue, as necessary, all available remedies and claims arising from the harm caused to horse owners, trainers, and veterinarians who rely on the confidentiality of the HISA portal, Mr. Gramm's fellow contest participants, and the wagering public.
"HISA will also be sharing the information it has collected from its investigations with federal and local law enforcement, state racing commissions, and all other relevant authorities so they may consider any appropriate actions that are outside HISA's remit."
In his statement, Gramm, a member of The Jockey Club, suggested HISA is scapegoating him to distract from problems with its systems.
"Horse racing has been an important part of my life for many years, and I care deeply about the integrity of the sport," Gramm said. "I remain willing to work with HISA to address the access-control weaknesses that allowed this information to be available. Making me the focus of this matter is a distraction from the fundamental issues HISA needs to address with its systems."
