Pending Legislation May Halt FTC Probe into MGM Cyberattack

A bill in the US House of Representatives could stop the Federal Trade Commission (FTC) from investigating last September’s cyberattack on MGM Resorts International. The Republican-sponsored spending bill also calls for a 27% cut in the FTC’s budget.

Congress Introduces Bill to Limit FTC’s Power in MGM Ransomware Probe

The provision targets a civil investigative demand (CID) issued by the FTC on January 25, which sought detailed information on MGM’s data security practices after the ransomware attack. Hackers caused widespread disruption to MGM’s systems for nine days starting September 10, affecting phones, email, credit card transactions, reservation systems, hotel check-ins and slot machines.

During the attack, FTC Chair Lina Khan and a senior aide were staying at an MGM property in Las Vegas for a conference — a fact that has been central to MGM’s argument against the commission’s involvement. The company filed a lawsuit on April 15 in the US District Court for the District of Columbia seeking an injunction to pause the CID unless Khan disqualifies herself from the case.

The bill was introduced by Appropriations Committee Chairman Tom Joyce (R-Ohio), who said it is intended to prevent overreach by regulatory agencies, reported The Las Vegas Review-Journal. It would “preserve the integrity” of US financial and judicial systems by cutting funds for various regulatory actions including those taken up by FTC regarding MGM’s investigation.

Teen Arrested in MGM Cyberattack Investigation Adds New Twist to Case

Despite committee approval in June, it remains unclear when or if the full House will consider this appropriations legislation. Committee Republicans rejected a proposed Democratic amendment to grant greater unilateral action power to the chair of FTC. Though slated for a vote this week, the bill was postponed by Republican leadership. However, the passage of appropriations bills is necessary for the federal budget approval before October 1.

The arrest last week of a 17-year-old boy in connection with authorities’ cyberattack investigation into MGM has thrown yet another twist into what could be its final chapter. 

MGM has consistently fought against the FTC’s CID, claiming in court that Rules of Practice regarding Petitions to Recuse Commissioners are unconstitutional. The company also says it is not subject to “Red Flag Rule” and “Safeguards Rule” imposed on financial institutions. 

FTC considers MGM subject to these rules because it issues “markers” for credit play by high-rollers, while MGM says CID’s extensive requests for information over multiple years and more than 100 categories are irrelevant to cyberattacks.

In the lawsuit, MGM claims CID’s requests closely mirror Chair Khan’s experience during the attack, which led to 15 consumer class-action suits against the company. MGM argues Khan could become a potential witness, thus necessitating her disqualification from the investigation.