by Andrew Cardno
Tribal sovereignty provides tribal nations with the most empowering abilities to preserve, sustain, protect, and champion the nourishment of their communities. The guaranteed rights to govern a tribal nation, define and enforce laws through tribal law enforcement and a legal system, and regulate property use through tribal sovereignty gives tribal nation’s more power and independence than any non-sovereign jurisdiction within the U.S.
The Indian Gaming Regulatory Act (IGRA) has been a core mechanism for tribal nations in terms of fully exercising these rights that have been in place all along but required the luxury of funding to achieve self-reliance fully. In most instances, tribal governments have been required to function without the power of taxation, but because of IGRA and the gaming infrastructure it allows for, the multi-billion-dollar tribal gaming industry has enabled tribes to use their gaming revenue to fund their courts, police forces, tribal government, schools, and other public services. Furthermore, the influx of tribal gaming revenue has empowered tribal nations to be a greater force in society in terms of having political influence and having the extra money that gaming has brought the tribes to diversify their economies. Untaxed gaming revenue has put tribal nations out in front of so many issues now that they weren’t before and has lifted everybody in their communities by strengthening foundational social services and programs.
Modern technology has provided new options for gaming operators that, although can appear convenient, carry significant risks and potential costs to a tribal casino and its tribal nation. It is becoming more and more common for operators in the industry to move their databases and core systems from on-premise to the cloud; however, in order to protect tribal gaming revenue and sovereignty, there are good reasons to exercise extreme caution when considering the option of moving a database and systems infrastructure to the cloud.
Cloud Jurisdiction is Ambiguous
The first reason to hesitate to move any tribal casino data into the cloud is caused by the ambiguous jurisdictional governance of cloud operations. Due to the often unknown location of cloud computing servers and transborder data flows within the cloud, the ambiguous jurisdiction in which a tribes’ data may be governed in the cloud presents the risk of moving a casino’s operation outside tribal land that is explicitly protected by a nation’s guaranteed sovereignty. The second reason to be skeptical about moving to the cloud is that under the Cyber Intelligence Sharing and Protection Act (CISPA), there are exactly 555 government agencies with the power to access data shared by third parties – compounding this concern into 555 reasons to be hesitant about moving to the cloud. There is good news, though: most core gaming systems are not cloud-enabled. Because these gaming systems in place still are now so old, most tribal casinos have, by happenchance, already implemented the highest standard of security.
The idea of imposing taxes on cloud computing has become increasingly more prevalent during political discussions because the modern world has largely moved from purchasing physical goods to digital experiences dominated by streaming and cloud computing services. Therefore, state and local governments are looking for ways to apply the current tax system to purchases in which the consumer is not getting the physical product or physical rights to. Even in today’s world, there are instances of failed attempts by state governments to collect taxes from tribal nations. Last year, the U.S. Attorney for the Western District of New York sent cease and desist letters to Seneca Nation smoke shops that sold loose cigarettes, known as ‘rollies,’ were not compliant with federal law (nor do they have to be). Therefore, it is best to avoid putting tribal casino data and systems into the cloud environment where the jurisdictional governance is ambiguous, especially since state and local governments will continue grasping at straws to get a slice of tribal revenue.
Choice of System Jurisdiction
Today, the Indian gaming industry is in a position to have a choice whether to move core systems and data into the cloud. The great news is that any government’s highest form of security operates on completely isolated networks. The hard reality is that any external connectivity comes with risk; furthermore, gaming operations and gaming systems can operate in a completely isolated way. Unlike an online business, such as Amazon, a brick-and-mortar casino has the option to implement the highest form of security within its gaming operation. Conveniently, this is also the easiest way of securing tribal casino data and various gaming systems, in addition to being the most secure.
Although technological modernization has given the impression that cloud computing is more efficient and manageable in some instances, the easiest way to secure a tribal casino’s IT infrastructure is to keep it on-premise within a tribes’ firewall on sovereign land. Plus, it is undeniably the best and simplest way to protect tribal data and systems’ security and privacy.
Isolated Networks are the Ultimate Security Protection
A tribe can operate a second network for its business systems, such as finance, accounting, marketing, etc., that can operate with external connectivity. A tribal casino should create an environment where a gaming operation can keep running, even under a cyberattack. Build a cyber response system that can further lock down systems, but maintain a response that enables core systems to continue operating. Zero-day attacks have the fewest available defenses, so a physical network is the best defense against these complex attacks because the cybercriminals are much less able to get into the on-premise system; they would need to be on the property to breach the network physically.
Data Sovereignty is Today’s Choice
Ensuring the continued protection of tribal sovereignty is of utmost importance in the increasingly fast-changing environment of today’s world. When making operational decisions concerning tribal casino data and core system rights, it is crucial to consider options through a lens of tribal sovereignty. Luckily for tribal casinos, the most convenient and low-risk IT infrastructure is right within a tribe’s control inside the casino’s firewall on sovereign land.
Andrew Cardno is Co-Founder and Chief Technology Officer of Quick Custom Intelligence (QCI). He can be reached by calling (858) 299-5715 or email [email protected].