Churchill Downs Inc. is asking the Federal Trade Commission to conduct an independent review of the Horseracing Integrity and Safety Authority's governance, transparency, and technological controls related to the handling of sensitive, non-public information.
First reported by Horse Racing Nation, the Aug. 28 letter is signed by CDI CEO Bill Carstanjen and addressed to FTC chair Andrew Ferguson and Mark Meador, an FTC commissioner.
"We have a direct and substantial interest in the integrity of Thoroughbred racing, and in ensuring that the wagering public has confidence in our industry," the letter states.
"We write to respectfully request that the commission require, or itself initiate, a formal independent review of HISA's recent handling of multiple matters implicating racing integrity, wagering integrity, non-public information, and the safeguarding of sensitive industry data. Recent events have highlighted troubling gaps and warning signs in HISA's governance."
Copied on Carstanjen's letter were Lisa Lazarus, CEO of HISA, and members of HISA's board of directors along with 10 United States senators and representatives serving Kentucky, New York, California, New Jersey, Texas, and Washington.
In an email to BloodHorse from HISA, the regulator noted that it is already subject to strict oversight rules by the FTC, including oversight of HISA's rules, budget, enterprise risk management, and performance reporting.
"HISA thanks Churchill Downs Incorporated for sharing their concerns surrounding the industry's integrity. HISA has been in communication with the FTC about the issues raised in the letter and welcomes the FTC's ongoing oversight and review of our actions, policies, protocols, and systems," said a HISA spokesperson.
Carstanjen's request follows incidences involving a betting scandal tied to trainers associated with the Fair Hill Training Center and owner and handicapper Marshall Gramm's unauthorized access to confidential horse health information.
READ: Gramm Immediately Suspended as Owner, Contest Player
The Aug. 9 betting scandal involved unusual betting activity at more than 10 betting shops in Great Britain as well as North American pari-mutuel pools on horses racing at Saratoga Race Course, Monmouth Park, and Colonial Downs (owned by CDI). All the horses involved were with trainers associated with Fair Hill. Three of the horses involved are trained by Angel Quiroz. Four days after details of the betting coup surfaced, the Horseracing Integrity & Welfare Unit—the testing and enforcement arm of HISA—disclosed that Quiroz had allegedly violated anti-doping rules after a horse in his care tested positive in a post-race sample taken July 10 for the banned substance albuterol.
"One of HISA's central promises was more uniform, timely, and transparent handling of integrity related matters. Delayed disclosure of significant violations was precisely the type of problem HISA was created to address," stated Carstanjen's letter. "This situation raises a number of legitimate questions, including whether delays in HISA's testing or reporting procedures allow violators to continue racing for extended periods after failed doping tests; whether racetracks and the betting public are being properly informed of the doping violations that undermine the integrity of the sport; and whether HISA's disclosure practices are meeting the expectations that justified the creation of a national authority."
Regarding the reporting of Quiroz' positive, HISA noted that when it launched its Anti-Doping and Medication Control Program, horsemen with a positive for a banned substance received immediate provisional suspensions that were publicly disclosed. In response to stakeholder feedback, the process was later modified to eliminate the provisional suspension until the case had been fully adjudicated.
The incident involving Gramm led to a provisional suspension by HISA, which is pursuing charges of fraud and unauthorized access and use of confidential information. Gramm allegedly accessed the horse health data through his authorized account on HISA's portal, but it was health information for horses to which Gramm had no legitimate connection. He then allegedly used that information in claiming horses and in handicapping for contests and pari-mutuel wagering. Some of the health information in his customized past performances appeared on social media.
Gramm, a founding member of Ten Strike Racing, accepted his provisional suspension but has denied he committed fraud and said the information was available through an authorized HISA account.
For CDI, the data breach involving Gramm has exposed multiple vulnerabilities. For one, HISA came out early and vehemently denied that the health data came from its portal. Then when it became clear the data did come from the HISA portal, the national organization focused on "fraud" and "misappropriation" rather than addressing the key issues, according to Carstanjen, including: how Gramm was able to access the information, how long this vulnerability existed, what audit tools are in place to detect improper access, and what corrective actions are being taken and who will verify the changes are sufficient.
"When such information is accessible to persons who should not have access to it, the resulting issue is not only individual misconduct. It is a potential failure of governance, technological controls, procurement oversight, auditing, incident response, and disclosure," stated Carstanjen's letter. "The industry is entitled to understand whether this was an isolated event, a broader systems failure, or a symptom of more significant weaknesses in HISA's technology and oversight processes."
CDI's call for an independent review of HISA was strongly supported by the National Horsemen's Benevolent and Protective Association.
"HISA has made centralized technology and centralized data collection fundamental components of its national regulatory system," said Eric Hamelback, CEO of the NHBA in a statement released Aug. 31. "Its own 2023 Annual Metrics Report stated that the HISA Portal contained a broad range of equine treatment and health records and that nearly two million veterinary treatment records had been uploaded to the system, with thousands of treatment reports being received every day.
"That is an extraordinary amount of sensitive information. And it is not information that HISA collected casually. Horsemen and veterinarians have been required to provide it as part of the regulatory system," he continued. "That creates a corresponding responsibility. When an organization spends millions of dollars on technology and builds a national regulatory system around the collection of sensitive information, the industry has every right to expect sophisticated access controls, monitoring, intrusion detection, and auditing."
In his statement, Hamelback raised many of the same questions as those outlined in the CDI letter.
"The National HBPA is not asking for special treatment for anyone. We are asking for the same standard of accountability from the regulator that the regulator demands from the industry it regulates," he said.
The National HBPA is a plaintiff in ongoing litigation that challenges the constitutionality of HISA.
Owner/breeder Mike Repole also had called for an independent review of HISA in a post that appeared Aug. 21 on the social media platform X. Repole additionally offered to pay for such an investigation.
"No non-transparent, internal investigation. A truly independent investigation with the findings shared transparently with the entire industry," Repole wrote. "Horse owners deserve it. Horseplayers deserve it. Trainers and veterinarians deserve it. The integrity of the entire sport demands it. And there should be ZERO excuse about cost. HISA is in its fourth year and the cost to horsemen and tracks has been exorbitant at about $250 million."
