,i  #aaith ,,congress  #ast ,session    
,h4 ,r4 #bgac  ,,in ,,the ,,house ,,of  
,,representatives  ,april #h1 #bjbe,mrs4
 ,harshbarger 7for herself and ,mr4     
,carter of ,louisiana7 introduced the   
following bill2 which was referred to   
the ,committee on ,energy and ,commerce 
,a ,,bill  ,to improve online ticket    
sales and protect consumers1 and for    
other purposes4  #a4 ,short title ,this 
,act may be cited as the ,mitigating    
,automated ,internet ,networks for      
,event ,ticketing ,act or the ,,main    
,event ,ticketing ,act4  #b4            
,strengthening the ,,bots ,act  7a7 ,in 
general ,section #b of the ,better      
,online ,ticket ,sales ,act of #bjaf    
7#ae ,u4,s4,c4 #de;c7 is amended-- 7#a7 
in subsection 7a77#a7-- 7,a7 in         
subparagraph 7,a71 by striking 2 or and 
inserting a semicolon2  7,b7 in         
subparagraph 7,b71 by striking the      
period at the end and inserting 2 or2   
and  7,c7 by adding at the end the      
following new subparagraph3  7,c7 to use

 or cause to be used an application that
 performs automated tasks to purchase   
event tickets from an internet website  
or online service in circumvention of   
posted online ticket purchasing order   
rules of the internet website or online 
service1 including a software           
application that circumvents an access  
control system1 security measure1 or    
other technological control or measure4 
2  7#b7 by redesignating subsections 7b7
 and 7c7 as subsections 7c7 and 7d71    
respectively2  7#c7 by inserting after  
subsection 7a7 the following new        
subsection3  7b7 ,requiring online      
ticket issuers ,to put in place site    
policies and establish safeguards ,to   
protect site security  7#a7 ,requirement
 to enforce site policies ,each ticket  
issuer that owns or operates an internet
 website or online service that         
facilitates or executes the sale of     
event tickets shall ensure that such    
website or service has in place an      
access control system1 security measure1

 or other technological control or      
measure to enforce posted event ticket  
purchasing limits4  7#b7 ,requirement to
 establish site security safeguards     
7,a7 ,in general ,each ticket issuer    
that owns or operates an internet       
website or online service that          
facilitates or executes the sale of     
event tickets shall establish1          
implement1 and maintain reasonable      
administrative1 technical1 and physical 
safeguards to protect the security1     
confidentiality1 integrity1 or          
availability of the website or service4 
7,b7 ,considerations ,in establishing   
the safeguards described in subparagraph
 7,a71 each ticket issuer described in  
such paragraph shall consider-- 7i7 the 
administrative1 technical1 and physical 
safeguards that are appropriate to the  
size and complexity of the ticket       
issuer2  7ii7 the nature and scope of   
the activities of the ticket issuer2    
7iii7 the sensitivity of any customer   
information at issue2 and  7iv7 the     

range of security risks and             
vulnerabilities that are reasonably     
foreseeable or known to the ticket      
issuer4  7,c7 ,third parties and service
 providers  7i7 ,in general ,where      
applicable1 a ticket issuer that owns or
 operates an internet website or online 
service that facilitates or executes the
 sale of event tickets shall implement  
and maintain procedures to require that 
any third party or service provider that
 performs services with respect to the  
sale of event tickets or has access to  
data regarding event ticket purchasing  
on the website or service maintains     
reasonable administrative1 technical1   
and physical safeguards to protect the  
security and integrity of the website or
 service and that data4  7ii7 ,oversight
 procedure requirements ,the procedures 
implemented and maintained by a ticket  
issuer in accordance with clause 7i7    
shall include the following3 7,i7       
,taking reasonable steps to select and  
retain service providers that are       

capable of maintaining appropriate      
safeguards for the customer information 
at issue4  7,,ii7 ,requiring service    
providers by contract to implement and  
maintain adequate safeguards4  7,,iii7  
,periodically assessing service         
providers based on the risk they present
 and the continued adequacy of their    
safeguards4  7,d7 ,updates ,a ticket    
issuer that owns or operates an internet
 website or online service that         
facilitates or executes the sale of     
event tickets shall regularly evaluate  
and make adjustments to the safeguards  
described in subparagraph 7,a7 in light 
of any material changes in technology1  
internal or external threats to system  
security1 confidentiality1 integrity1   
and availability1 and the changing      
business arrangements or operations of  
the ticket issuer4  7#c7 ,requirement to
 report incidents of circumvention2     
consumer complaints  7,a7 ,in general ,a
 ticket issuer that owns or operates an 
internet website or online service that 

facilitates or executes the sale of     
event tickets shall report to the       
,commission any incidents of            
circumvention of which the ticket issuer
 has actual knowledge4  7,b7 ,consumer  
complaint website ,not later than #ahj  
days after the date of enactment of the 
,mitigating ,automated ,internet        
,networks for ,event ,ticketing ,act1   
the ,commission shall create a publicly 
available website 7or modify an existing
 publicly available website of the      
,commission7 to allow individuals to    
report violations of this subsection to 
the ,commission4  7,c7 ,reporting       
timeline and process  7i7 ,timeline ,a  
ticket issuer shall report known        
incidents of circumvention within a     
reasonable period of time after the     
incident of circumvention is discovered 
by the ticket issuer1 and in no case    
later than #cj days after an incident of
 circumvention is discovered by the     
ticket issuer4  7ii7 ,automated         
submission ,the ,commission may         

establish a reporting mechanism to      
provide for the automatic submission of 
reports required under this subsection4 
7iii7 ,coordination with state attorneys
 general ,the ,commission shall-- 7,i7  
share reports received from ticket      
issuers under subparagraph 7,a7 with    
,state attorneys general as appropriate2
 and  7,,ii7 share consumer complaints  
submitted through the website           
established under subparagraph 7,b7 with
 ,state attorneys general as            
appropriate4  7#d7 ,duty to address     
causes of circumvention ,a ticket issuer
 that owns or operates an internet      
website or online service that          
facilitates or executes the sale of     
event tickets must take reasonable steps
 to improve its access control systems1 
security measures1 and other            
technological controls or measures to   
address any incidents of circumvention  
of which the ticket issuer has actual   
knowledge4  7#e7 ,,ftc guidance ,not    
later than #a year after the date of    

enactment of the ,mitigating ,automated 
,internet ,networks for ,event          
,ticketing ,act1 the ,commission shall  
publish guidance for ticket issuers on  
compliance with the requirements of this
 subsection4  2  7#d7 in subsection 7c71
 as redesignated by paragraph 7#a7 of   
this subsection-- 7,a7 by striking      
subsection 7a7 each place it appears and
 inserting subsection 7a7 or 7b72  7,b7 
in paragraph 7#b7-- 7i7 in subparagraph 
7,a71 by striking ,the ,commission and  
inserting ,except as provided in        
paragraph 7#c71 the ,commission2 and    
7ii7 in subparagraph 7,b71 by striking  
,any person and inserting ,subject to   
paragraph 7#c71 any person2 and  7,c7 by
 adding at the end the following new    
paragraphs3  7#c7 ,civil action  7,a7   
,in general ,if the ,commission has     
reason to believe that any person has   
committed a violation of subsection 7a7 
or 7b71 the ,commission may bring a     
civil action in an appropriate district 
court of the ,united ,states to-- 7i7   

recover a civil penalty under paragraph 
7#d72 and  7ii7 seek other appropriate  
relief1 including injunctive relief and 
other equitable relief4  7,b7           
,litigation authority ,except as        
otherwise provided in section           
#af7;a77#c7 of the ,federal ,trade      
,commission ,act 7#ae ,u4,s4,c4         
#ef7;a77#c771 the ,commission shall have
 exclusive authority to commence or     
defend1 and supervise the litigation of1
 any civil action authorized under this 
paragraph and any appeal of such action 
in its own name by any of its attorneys 
designated by it for such purpose1      
unless the ,commission authorizes the   
,attorney ,general to do so4 ,the       
,commission shall inform the ,attorney  
,general of the exercise of such        
authority and such exercise shall not   
preclude the ,attorney ,general from    
intervening on behalf of the ,united    
,states in such action and any appeal of
 such action as may be otherwise        
provided by law4  7,c7 ,rule of         

construction ,any civil penalty or      
relief sought through a civil action    
under this paragraph shall be in        
addition to other penalties and relief  
as may be prescribed by law4  7#d7      
,civil penalties  7,a7 ,in general ,any 
person who violates subsection 7a7 or   
7b7 shall be liable for-- 7i7 a civil   
penalty of not less than #aj1jjj for    
each day during which the violation     
occurs or continues to occur2 and  7ii7 
an additional civil penalty of not less 
than #a1jjj per violation4  7,b7        
,enhanced civil penalty for intentional 
violations ,in addition to the civil    
penalties under subparagraph 7,a71 a    
person that intentionally violates      
subsection 7a7 or 7b7 shall be liable   
for a civil penalty of not less than    
#aj1jjj per violation4  2  7#e7 in      
subsection 7d71 as redesignated by      
paragraph 7#a7 of this subsection1 by   
striking subsection 7a7 each place it   
appears and inserting subsection 7a7 or 
7b72 and  7#f7 by adding at the end the 

following new subsections3  7e7 ,law    
enforcement coordination  7#a7 ,in      
general ,the ,federal ,bureau of        
,investigation1 the ,department of      
,justice1 and other relevant ,state or  
local law enforcement officials shall   
coordinate as appropriate with the      
,commission to share information about  
known instances of cyberattacks on      
security measures1 access control       
systems1 or other technological controls
 or measures on an internet website or  
online service that are used by ticket  
issuers to enforce posted event ticket  
purchasing limits or to maintain the    
integrity of posted online ticket       
purchasing order rules4 ,such           
coordination may include providing      
information about ongoing investigations
 but may exclude classified information 
or information that could compromise a  
law enforcement or national security    
effort1 as appropriate4  7#b7           
,cyberattack defined ,in this paragraph1
 the term cyberattack means an attack1  

via cyberspace1 targeting an            
enterprise's use of cyberspace for the  
purpose of-- 7,a7 disrupting1 disabling1
 destroying1 or maliciously controlling 
a computing environment or computing    
infrastructure2 or  7,b7 destroying the 
integrity of data or stealing controlled
 information4  7f7 ,congressional report
 ,not later than #a year after the date 
of enactment of this paragraph1 the     
,commission shall report to ,committee  
on ,commerce1 ,science1 and             
,transportation of the ,senate and the  
,committee on ,energy and ,commerce of  
the ,house of ,representatives on the   
status of enforcement actions taken     
pursuant to this ,act1 as well as any   
identified limitations to the           
,commission's ability to pursue         
incidents of circumvention described in 
subsection 7a77#a77;,a74  4  7b7        
,additional definition ,section #c of   
the ,better ,online ,ticket ,sales ,act 
of #bjaf 7#ae ,u4,s4,c4 #de;c note7 is  
amended by adding at the end the        

following new paragraph3  7#d7          
,circumvention ,the term circumvention  
means the act of avoiding1 bypassing1   
removing1 deactivating1 or otherwise    
impairing an access control system1     
security measure1 safeguard1 or other   
technological control or measure        
described in section #b7;b77#a74  4