With $32 million in casino revenue in 2017, and tribal demographic and financial data increasingly stored in The Cloud, tribes are as susceptible to cyber threats as their non-tribal counterparts. Botnets, DDoS (Distributed Denial-of-Service) attacks, hacking, malware, pharming, phishing, ransomware, spam, spoofing, spyware, Trojan horses, viruses, Wi-Fi eavesdropping, worms, WPA2 handshakes aren’t even their biggest cyber concerns. Electrical outages and computer system failures top the list of cyber vulnerabilities tribes are up against.
Such outages can be extremely costly to tribes. With 511 gaming operations in 29 states, the average loss amounts to about $172K per day in casino gaming earnings if casino operations are affected by an outage of any type. This doesn’t even include losses due to abandoned hotel rooms, empty restaurants, and other amenities. Data breaches to tribal operations may not be as monetarily costly to the tribe, but they can seriously impact tribes for days or weeks as they cope with fallout from exposing tribal financial information and identity theft of tribal member data.
All of the above comprise the reasons Ray Tafoya (Pueblo of Santo Domingo), AMERIND Risk business development representative, names as reasons for tribes to add cyber liability insurance to their coverage portfolios.
“We’ve been pushing a lot of tribal leadership and governments on asset protection like property and facilities, but no looking at information threats or theft, or even financial information that’s out there. There’s been no adequate protection for this kind of asset. So, this was one more tool to offer tribes to protect these assets,” Tafoya stated.
But it hasn’t necessarily been an easy sell. According to Tafoya, “Tribes really didn’t get the value of demographic information and data or other internal tribal information that needed protection, like data used in grants and other programs. Tribes are storing a lot of data! They need protection from ransomware and other cyber threats.”
Besides casino cyber protection, Tafoya is particularly concerned with tribal healthcare and facility data as a lot of AMERIND’s clients move away from the Indian Health Service system.
“We need to make sure client data is not put at risk. Fortunately, cyber thieves haven’t noticed yet and haven’t targeted tribes yet, but we see it as a future threat. Our national tribal associations are encouraging tribes to take on ancillary coverage for that very reason,” Tafoya explained.
To offer this coverage, AMERIND Risk has partnered with NAS Insurance Services who will be doing its underwriting. AMERIND Risk itself can offer $50,000 in coverage in house to its clients that subscribe to its General Liability package. Tribes currently participating in its Indian Housing Block Grant (IHBG) automatically receive that $50,000 in coverage. Clients can purchase up to $1 million in coverage through NAS, with additional coverage available up to $10 million through other programs.
Given the potential cost of a casino hack or electrical outage, that would insure a casino with average earnings for about a week. Cyber insurance covers a range of losses, from restoration of data to financial losses due to computer system down time. Depending on the size of tribal operations, and especially tribes owning casinos, the need for cyber liability coverage seems like a no-brainer.
But that’s not necessarily the case, and for that reason AMERIND has taken a more consultative approach, Tafoya described.
“We no longer go in and just talk about selling insurance any more. The goal is to become more effective business partners with them, much like their lawyers, bankers, and CPAs are to them. It’s much more helpful to go in with a team and profile them, get to know their operations, know their key people, conduct an overall risk assessment, then build insurance coverage around the sum of the whole. We look at the spreadsheets with them to identify main revenue streams to determine their needs. Cyber liability has emerged as a one of those critical needs.”
Tafoya continued, “Our question is always, ‘Are you in a position to be able to handle that risk financially?’ Sometimes it’s helping them to realize that they have other assets that need protection.”
To that end, AMERIND will delve into the critical need for cyber liability coverage at its upcoming 2018 AMERIND Risk Institute, educating tribes about identifying assets that could be put at risk, and to give them a snapshot of what would happen if something should go wrong.
Safety and risk management plans only go so far in Tafoya’s estimation. “Insurance is a backstop beyond the internal plan that they develop. Not only that, but funding and business entities are handing down a lot more requirements to protect their investments in tribes.”
That is a pretty savvy – and highly holistic – approach, and one likely to strike a positive chord in Indian Country as economic development requires deeper internal knowledge, particularly as tribes increase engagement with non-tribal stakeholders.