MGM Sues FTC Over Order Denying Petition to Disqualify Khan From Data Breach Query

An April 1 FTC order denying MGM Resorts International's petition to quash a civil investigative demand (CID) “unlawfully deprives MGM of its rights under the Fifth Amendment,” said the hotel chain’s complaint Monday (docket 1:24-cv-01066) in U.S. District Court for the District of Columbia. The CID requested information as part of a nonpublic investigation involving MGM's September cyberattack.

The order also sought to disqualify FTC Chair Lina Khan's participation in the investigation. Khan and an unnamed senior aide were guests at the MGM Grand in Las Vegas during the cyberattack, and a Bloomberg story recounted their front desk experience of having to scribble their credit card information on a piece of paper in order to check in, said the complaint. Khan asked the front desk clerk how the hotel was handling the situation, and the agent reportedly shrugged in an exchange the aide described as “surreal.” The attack was “compounded by the presence of a powerful public figure at its Las Vegas hotel during the attack,” said the complaint.

The cyberattack, which “cost MGM dearly,” was “soon followed up with a wide-reaching FTC investigation,” said the complaint. Agency staff issued a CID on Jan. 25 seeking a response to the unanswered question Khan asked of the front desk clerk “and a great deal of additional information,” it said.

MGM alleges two financial services regulations -- both “facially inapplicable to MGM" -- are the legal justification for the CID, which seeks to compel MGM to produce over 100 categories of information. “The voluminous requests posed by the CID closely track the events involving Chair Khan, with certain requests seemingly derived directly from Chair Khan’s personal experience in transacting business with MGM during the attack,” it said.

Citing the “widespread publicity about the attack -- undoubtedly enhanced by the reporting about Chair Khan and her ‘senior aide’ -- MGM is now the target of private litigation,” said the complaint, noting 15 consumer class actions filed since the data breach. The company didn’t disclose the number of people affected by the September incident, but a 2019 cyberattack affected some 10.6 million guests.

Khan, said the complaint, as the most high-profile person involved in the September incident – “and the only such person widely identified by name in press reports” -- is “both a potential civil plaintiff and a potential witness.”

On Feb. 20, MGM moved under the FTC’s rules of practice to quash or modify the CID, identifying several “substantive issues,” including its reliance on “inapplicable financial services rules,” the complaint said. It followed soon after with a petition to recuse Khan under the Fifth Amendment’s due process clause, “given Chair Khan’s personal involvement in the subject matter under investigation.” On April 1, the commission issued an order denying both MGM petitions.

The FTC asserts its rules of practice don’t allow for recusal of commissioners except from administrative litigation, said the complaint, so in a case like this one, it “refuses to entertain” petitions to recuse them from other aspects of FTC proceedings, such as the petition to quash. The refusal to hear petitions to recuse or disqualify -- "even in extreme cases like this one” -- violates the due process clause, said the complaint. The order said the FTC would “deny MGM’s petition even if it were properly filed” because it believes Khan’s involvement in the situation “is not legally significant,” the complaint said. That “flies in the face of applicable case law” and denies MGM its Fifth Amendment rights, it said.

These “problems” are compounded because against the FTC’s rules and policy, Khan “participated in the Commission’s decision about whether to disqualify her,” the complaint said. They were also compounded by the FTC’s “imposition of a patently impracticable 11-day deadline for MGM to comply with the massive CID following denial of its petitions,” it said. “Such a plainly unreasonable deadline has the effect of punishing MGM and chilling the exercise of the FTC’s administrative procedures to challenge CIDs,” it said.

The FTC’s “investitive authority is not limitless,” and it can only conduct investigations regarding specific statutory grants of authority,” the complaint said. The CID to MGM was premised in large part on “facially inapplicable rules without any attempt to delineate which portions of the CID relate to which purported sources of authority,” it said.

MGM seeks injunctive and declaratory relief, said the complaint. The FTC had no comment, a spokesperson emailed Tuesday.