Churchill Downs Wants HISA Investigated. Fine. Just Don’t Stop There.

Churchill Downs Incorporated wants the Federal Trade Commission to conduct an independent review of HISA.

Fine.

Actually, more than fine. I am all for it.

Open the books. Open the systems. Examine the access controls. Find out exactly how Marshall Gramm was able to obtain confidential horse-health information he was not supposed to have. Determine whether anyone else could do it, whether anyone else did do it, how long the vulnerability existed, what HISA knew, when HISA knew it and what was done about it. Get to the bottom of the Fair Hill Five while you are at it. Examine testing timelines, disclosure timelines, wagering integrity, technology vendors and anything else that deserves examination.

Just don’t stop at HISA.

That is where Churchill Downs’ newfound concern with transparency gets interesting. CDI CEO Bill Carstanjen sent a letter dated August 28 to the FTC asking for an “independent review of HISA governance, information security, disclosure practices, and related integrity concerns.” The letter points specifically to the Fair Hill Five and the Marshall Gramm matter and raises questions about delayed disclosure of a banned-substance positive involving a trainer connected to the Fair Hill situation. Churchill asks whether delays in testing or reporting allow violators to continue racing and whether racetracks and the wagering public are receiving information quickly enough. Those are fair questions. Some of them are questions we have been asking at Past the Wire.

The problem is that when you start throwing stones from a house this large, somebody eventually looks at the windows. Let’s start with Marshall Gramm because I have been all over that story from the beginning, and I have hardly been a HISA apologist. I have criticized HISA when I believed criticism was warranted. I criticized the initial inaccurate characterization of what Gramm had accessed. I questioned the system, the access, The Jockey Club’s role, the technology and how something like this could happen in the first place.

I also sat in the press conference and listened to Lisa Lazarus answer the questions. She did. HISA brought in Arete to conduct an independent forensic cybersecurity investigation. Lazarus laid out what HISA said it found, acknowledged what HISA initially had wrong, discussed Gramm’s claiming activity, answered questions about access and explained what remained under investigation. HISA has alleged that Gramm accessed confidential information on nine horses before claiming them and has said it intends to seek reimbursement connected to approximately $80,000 to $90,000 in post-claim purse earnings. Gramm has acknowledged being the source of the enhanced past performances that became public while disputing significant portions of HISA’s allegations. That case remains pending, and Gramm is entitled to that process.

Then came the $80,000 narrative. Mike Repole publicly questioned what kind of meaningful cybersecurity investigation could possibly be conducted for $80,000. Churchill’s letter now questions the adequacy of the investigation as well. There more than one problem with using that number as the cost of the Arete investigation.

That isn’t what Lazarus said. It doesn’t appear to be the actual cost. It ignores the results.

Lazarus stated the only figure being discussed in connection with the forensic work represented approximately HISA’s deductible under its cyber-insurance coverage, not the total cost of Arete’s investigation. She explained that the carrier covered the investigation beyond the deductible. Under those circumstances any subrogation rights concerning additional recovery would belong to the insurer. That is a rather important distinction.

Asking what kind of sophisticated forensic investigation you can get for $80,000 sounds like a devastating question. It sounds considerably less devastating if $80,000 was approximately the insured’s deductible and not the cost of the investigation.

Criticize HISA. I do. Ask hard questions. I do. But if you ask a question and receive an answer, you don’t get to pretend the answer was never given because you don’t like where it leads. Churchill also questions why a banned-substance positive connected to the Fair Hill story was not immediately disclosed to the public. Again, fair question. But context matters.

Under HISA’s Anti-Doping and Medication Control rules, HIWU does not necessarily announce an Adverse Analytical Finding the moment an A sample produces a laboratory finding. Rule 3610 provides for public disclosure after certain procedural events, including confirmation by the B sample or waiver of B-sample testing, or the imposition of a provisional suspension where applicable. That isn’t something HISA invented last week to cover the Fair Hill situation. It is the published process.

If Churchill believes that process takes too long, I am listening. Maybe it does. If the wagering public should be informed sooner, let’s have that conversation. But there is a substantial difference between “the rule should require earlier disclosure” and suggesting that HISA concealed a positive until the Fair Hill Five brought unwanted attention.

And if Churchill Downs wants to talk about how quickly racing has historically identified, acted upon and disclosed integrity problems, I can think of a few places to start.

How about Jason Servis? Maximum Security walked into Churchill Downs in 2019, crossed the wire first in the Kentucky Derby and was disqualified for interference. We later learned through a federal criminal prosecution that Servis had been administering SGF-1000, a prohibited performance-enhancing substance he believed would evade conventional testing, to virtually his entire barn, including Maximum Security. Servis eventually pleaded guilty and went to federal prison. The United States Department of Justice says Servis continued allowing administration of SGF-1000 until his arrest in March 2020. Did Churchill stop Jason Servis before Maximum Security ran in the Kentucky Derby? No. Did racing’s existing regulatory structure uncover the scheme before he arrived at America’s most famous racetrack? No. Federal law enforcement did. It looks to me like Churchill Downs is asking HISA to solve the Fair Hill Five before Scotland Yard.

That does not mean Churchill knew Servis was doping Maximum Security. There is no evidence I have seen that establishes that, and I am not suggesting it. What it does establish is something much more relevant to the conversation Churchill has now started: the old fragmented regulatory structure failed spectacularly to uncover one of the most significant doping schemes in modern American racing.

Perhaps a little institutional memory is appropriate before lecturing the national regulator about the existence of undetected misconduct. Then there is Medina Spirit. When Medina Spirit tested positive for betamethasone following the 2021 Kentucky Derby, who first told the public? It wasn’t Churchill Downs. It wasn’t the Kentucky regulator. It was Bob Baffert.

Baffert stood outside his barn at Churchill Downs on the morning of May 9 and announced that he had been informed of the positive. Churchill issued its statement afterward and promptly suspended him. Once the information became public, Churchill Downs acted decisively. But the chronology isn’t debatable: contemporary reporting says Churchill’s statement followed Baffert’s press conference. That matters when Churchill is now invoking the wagering public’s right to timely information.

Todd Pletcher and Forte provide another history lesson. Forte tested positive for meloxicam after winning the Hopeful at Saratoga on September 5, 2022. The matter did not become public until May 2023, roughly eight months later. In the meantime, Forte became champion 2-year-old, won the Breeders’ Futurity, Breeders’ Cup Juvenile, Fountain of Youth and Florida Derby and arrived at Churchill Downs as the morning-line favorite for the Kentucky Derby before ultimately being scratched. The New York State Gaming Commission later published a timeline attempting to explain those eight months. Was that Churchill’s positive to disclose? No. And that is precisely the point. That was the system American racing operated under.

Churchill is now asking whether delays under HISA are compatible with the transparency promised by a national regulator. Ask away. But let’s not rewrite history as though delayed disclosure, regulatory limbo and horses continuing to compete while cases remained unresolved suddenly appeared with HISA.

Steve Asmussen had two Kentucky acepromazine-metabolite positives from 2018 that were still being litigated approximately five years later. The Kentucky Horse Racing Commission records show the underlying 2018 findings and subsequent rulings, and BloodHorse reported in late 2023 that the appeal was only then moving toward conclusion. Five years. So yes, let’s talk about timely justice and timely disclosure. Let’s just talk about all of it.

And while we are examining Churchill Downs’ concern for integrity and equine welfare, there is another subject I would like included in the conversation.

Puerto Rico.

The Thoroughbred Aftercare Alliance says more than 2,000 U.S.-bred Thoroughbreds race in Puerto Rico annually, many imported from the mainland. Caribbean Thoroughbred Aftercare is the only accredited Thoroughbred aftercare organization in the Caribbean, operating on ten acres with an 11-stall barn and an average population of approximately 60 horses. Do that math and tell me there isn’t a problem deserving the industry’s attention.

1/ST Racing has publicly addressed it.

Its Gulfstream Park overnights have specifically warned owners and trainers not to ship injured or infirm horses to Puerto Rico, with potential fines and loss of stalls at all 1/ST Racing facilities. More importantly, 1/ST says it monitors the number of horses being shipped to Puerto Rico by owners and trainers stabled at Gulfstream.

That is not me interpreting a policy. That is the policy. So here is my question for Churchill Downs Incorporated: Where is yours?

How many horses leave Churchill Downs, Turfway Park, Ellis Park, Fair Grounds and CDI’s other racing properties for Puerto Rico every year? Does CDI track them? Does it monitor repeat shippers? Does it flag injured or infirm horses destined for Puerto Rico? Are trainers warned? Are stalls at risk? Is there a written policy comparable to 1/ST’s? Does CDI know what ultimately happens to the horses leaving its properties for Camarero? I don’t know the answers. That is why I am asking.

I have long believed CDI tracks are part of the mainland pipeline sending horses to Puerto Rico, but belief isn’t evidence and I am not going to turn it into a fact because it fits an argument. What is established is that the Puerto Rico problem exists, 1/ST has publicly acknowledged it and adopted specific measures, and I have not found a comparable publicly stated CDI policy addressing that flow. If one exists, Churchill is welcome to provide it. I will gladly publish it.

That is transparency. Which brings us to perhaps the most interesting part of Churchill’s letter: its timing. This isn’t being written in a vacuum. Churchill and HISA recently fought a multimillion-dollar battle over HISA assessments. HISA sought approximately $5.27 million plus interest in unpaid 2025 assessments and threatened serious consequences if CDI did not pay. Then, on March 24, the two sides announced that they had reached an agreement. What were the terms? We don’t know. How much did Churchill pay? We don’t know. What did HISA concede? We don’t know. What did Churchill concede? We don’t know. The dispute was public. The threatened consequences were public. The $5.27 million demand was public. The settlement was private.

Past the Wire called that out when it happened. So did others. A one-page order said the parties had reached an agreement. No substantive terms. No dollar amount. No meaningful public explanation.

Then on April 1 Churchill announced that it had prevailed in federal court on a separate but related challenge to HISA’s purse-weighted fee methodology, with the court finding HISA’s methodology arbitrary and capricious and unlawful. Churchill CEO Bill Carstanjen accused HISA of fiscal mismanagement and exceeding its authority.

Now, five months later, Churchill is asking the FTC to conduct an independent examination of HISA’s governance, transparency and accountability. Is Churchill’s FTC letter retaliation for its financial dispute with HISA? I can’t prove that. Neither can anyone else based on what is presently public. But pretending the history doesn’t exist would be equally irresponsible. Context matters. Relationships matter. Timing matters. Churchill had a bitter multimillion-dollar dispute with HISA, resolved that public dispute on private terms, subsequently defeated HISA on an important component of the assessment methodology and now wants HISA’s governance and transparency examined by its federal overseer. Readers can decide for themselves whether those events have anything to do with one another.

Then there is The Jockey Club.

Just days ago, The Jockey Club issued its own extraordinary statement distancing itself operationally from HISA. It emphasized that although it strongly supports the institutional necessity of HISA, it has no influence over HISA’s daily operations or software development. That came amid questions surrounding the Gramm breach and The Jockey Club’s data relationship with HISA. We addressed that statement at Past the Wire because it struck me as less an example of leadership than an organizational explanation of who should not be blamed when the ship is taking on water.

Now Churchill Downs has turned its guns on HISA. Two of the most powerful institutions in American racing suddenly seem very interested in establishing where HISA ends and they begin. Interesting. That doesn’t prove coordination. It doesn’t prove conspiracy. I am not alleging either. But I have been around this game too long not to notice when the horses start changing leads.

The irony is that I agree with much of what Churchill is asking for. Investigate HISA. You may not find what you are looking for, but the industry has the right to know one way or the other. Investigate the Gramm breach thoroughly. Determine exactly what information was accessible, who could access it, whether anybody besides Gramm exploited it and whether HISA’s safeguards were adequate. Finish the Fair Hill Five investigation. Explain the positive-test timeline. Examine whether the disclosure rules adequately protect the wagering public. Audit the vendors. Follow the data. Follow the money. I want all of it.

But once we establish that as the standard, nobody gets an exemption.

Let’s examine how Churchill Downs handles integrity intelligence. Let’s examine suspicious wagering. Let’s examine how horses move through its properties and where they go afterward. Let’s examine its historical medication disclosures. Let’s examine what safeguards existed when Jason Servis brought Maximum Security to the Kentucky Derby. Let’s examine the system that allowed major medication matters involving some of the sport’s biggest trainers and horses to remain unresolved or undisclosed for months and sometimes years. Let’s examine the private settlement between Churchill and HISA while we’re conducting this festival of transparency.

Let’s examine The Jockey Club’s systems and access. Let’s examine HISA. Let’s examine HIWU. Let’s examine everybody. Because Churchill Downs is right about one thing. Racing deserves answers.

Churchill Downs wants the FTC to take a hard look at HISA. I hope it does. I hope it looks at Gramm, Fair Hill, cybersecurity, testing, disclosure, governance and every dollar that deserves scrutiny. Then, when the questioning is finished and everyone thinks they have their answers, I hope somebody stays behind in the room for another minute. That’s where I’ll be.

Look at the bulletin board.

Servis. Maximum Security. Medina Spirit. Forte. Puerto Rico. A multimillion-dollar fee dispute settled privately. The Jockey Club suddenly explaining what it doesn’t control. Churchill Downs suddenly demanding transparency from an institution it was fighting only months ago.

None of it proves conspiracy. None of it proves retaliation. I haven’t said that it does.

They’re simply pieces on the board.

But anyone who remembers the final scene of The Usual Suspects knows sometimes the most important moment comes after everybody thinks the interrogation is over. Someone looks at the board. The pieces begin to connect. The coffee cup drops.

And by then, the bad guy is already walking away.

Just be careful what you ask for.

Because transparency isn’t investigating the institution you’re fighting. Transparency is being willing to stand under the same light yourself. JS