There are many complicated technical issues that confront online gaming in the United States. Recently, we explored how the complex nature of payment processing for online gaming in the United States was going to make it difficult for American bettors to deposit money on new, regulated online gaming sites.
Another challenge facing U.S. iGaming is making sure that players can be legally allowed to gamble online depending on their geographic location within a legitimate U.S. iGaming jurisdiction.
Depositing money and being able to gamble with it online are not necessarily mutually inclusive. It is totally possible—and legal—for players anywhere in the world to create and fund an account on some U.S. intrastate online gaming sites, such as Ultimate Poker in Nevada.
But being allowed to use that money for actual online play is something that requires the user to be physically located within the boundaries of a U.S. state where online wagering is expressly permitted. You could be physically located in California and you could create and fund an account on Ultimate Poker’s Nevada client. But until you are actually in Nevada, you won’t be allowed to play on that site.
To determine where in the world a player is physically located, online gaming operators will employ a series of technological tools specifically designed to verify the player’s geographic location. This process is known as geolocation, or more accurately, geoverification, and it is certainly not something the online gaming industry invented.
When you utilize the GPS on your phone to find directions, you are being geolocated. But due to the restrictive nature of internet gaming in the United States, geolocation works somewhat differently than in other everyday circumstances.
Better Safe Than Subpoenaed
Before moving ahead to explore what makes iGaming geolocation work, it’s important to understand the crucial role it plays in the developing U.S. online gambling environment. The Department of Justice’s 2011 “Wire Act letter” was hailed by many as a “gift” to the U.S. online gaming industry, but it was a gift with conditions. The DOJ made it clear that, with the exception of sports betting, online gaming was OK in the U.S., provided that it was kept strictly within the boundaries of a state where it was specifically legal.
In other words, if a state cannot keep its online game within its border, it is arguably violating U.S. federal law.
While the consequences of this are better left unimagined, it helps to explain why most of the actors involved in the U.S. iGaming industry have reacted somewhat passively to reports that a sizable percentage (around 40 percent by some reports) of indisputably New Jersey-based players have failed to be correctly geoverified since the state opened its iGaming door on November 26.
No one is happy to turn away perfectly able online gamblers in New Jersey, but for the time being, it is largely better to err on the side of caution and risk disgruntling a few users than relaxing all geolocation barriers and allowing New Yorkers to check-raise the people in Camden.
In addition, any visible interstate transgressions of proper geoverification would be viewed as irresistible fodder for those who oppose online gaming in any form, be it intra or interstate.
Zoning In
The technology exists to perfectly geolocate anyone in the nation who possesses the appropriate technical means, and indeed thousands of New Jersey-based residents have been able to get verified just fine.
In multiple geoverification “fails,” the problem is typically the involuntary fault of the user through something he is not doing correctly on his own end. This becomes more clear once we look at how the geoverification process is actually carried out.
Companies exist that specialize in carrying out the iGaming geoverification process—these include GeoComply and Locaid—and they have to submit themselves to regulatory suitability licensing much like an iGaming operator or supplier does.
GeoComply, which occupies considerable market share in the iGaming space, is the official geoverification partner for most of the online gambling operators who went live in New Jersey.
While downloading the real-money client of any iGaming site partnered with GeoComply, users will be asked to install a GeoComply plug-in. Installation of this plug-in is mandatory for real-money play, as it essentially allows the GeoComply solution to “fetch” the data it needs from the user’s computer to verify its physical location.
The user obviously needs to be online. As soon as a user is connected to the internet—independently of GeoComply or anything having to do with online gaming—he is immediately tagged with an IP (internet protocol) address, a numerical method to define the user’s connection, based, in part, on regionality.
Having established that IP addresses by themselves are not always a surefire way to ascertain the player’s physical location (although they still matter), geoverification software will make use of additional means to snoop into the user’s data. Here we have Wi-Fi connectivity.
A user in New Jersey does not need to be connected to Wi-Fi to play online (they could be using a hard-wired connection), but they do need to be in a position where Wi-Fi networks are available. Fortunately, most modern computing devices come equipped with an ability to detect local Wi-Fi networks. For those that don’t, a user can make use of a portable Wi-Fi USB device. This is obviously an extra step and an additional expense for the user, but it would be mandatory in this instance.
The usefulness of Wi-Fi is in its detection of nearby local access points. If all of your Wi-Fi access points turn up to be based in a state where it is legal to gamble online, then we are all good. Unfortunately, this is where we encounter many of our issues having to do with online gamblers being too close to the state’s border.
A user located physically within New Jersey but hanging out near the border of Pennsylvania or New York could easily be able to pick up on a Wi-Fi signal located across the state line. This is a much more common problem in New Jersey, a state surrounded by bustling communities, than in the largely deserted landscape of Nevada (although border geolocation has been a challenge there as well). The current border geolocation issue is the focus of great attention by operators looking for an easy remedy, but until that’s found, gamblers are advised to kindly take a few steps back in the other direction.
New Jersey is more complicated than Nevada had been for geolocation because of the dense population along the borders. Anna Sainsbury, the president of GeoComply, says that more than 1 million residents of New Jersey live within a mile of the state’s borders.
“But that dense population works in our favor, as well,” she explains. “The amount of Wi-Fi data and Wi-Fi access points we have in these areas has given us the ability to get right over the borderlines. We’re getting accuracy levels of about 50 meters, so we can get very close to the border.”
It would seem that having a sufficiently local IP address would be enough to assess geographic location and quell any concerns. The problem is that IP addresses have become easy to fake and circumvent. Entire systems have been created to basically allow any user from around the planet to connect to a network located in another part of the planet and claim its IP address as its own, a process called spoofing. It’s not a difficult or expensive thing to do.
Some of these systems—they are sometimes referred to as Virtual Private Networks (VPNs)—were created with the pretty transparent purpose of fooling IP trackers. Websites such as HideMyAss.com are cited frequently as an example. Especially after Black Friday, a lot of U.S.-based online poker players took advantage of the VPN method to connect to remote servers around the world and continue to play on offshore poker sites in a country where it was largely made illegal.
The other side of the story is that, as easy as it has become to circumvent IP addresses, it is also relatively easy for guarded operators to spot when this is happening and to take action, which is exactly what companies like PokerStars have been doing. Here again we have an example of how the geoverification process is of paramount legal importance.
“We have algorithms that obtain different data and then we look to make sure that the device isn’t deploying any spoofing software that would allow you to mask your location,” says Sainbury.
Some systems that invariably involve a game of IPs are not meant to be used for any treachery at all. TeamViewer and GoToMyPC.com are examples. But because they involve similar means of making it unclear where the user is physically located, geoverification technology will recognize their presence and shut down the computing device’s ability to be geoverified. Users who call support complaining about geoverification are routinely asked if they’ve got any of these programs running in the background, and will be told to shut them down if the answer is yes.
Alternative Methods
Having done all it can to extract verifiable information from the user’s computing device, and desirous to continue to fulfill that whole let’s-not-violate-federal-law requirement, modern iGaming operators have begun resorting to an alternative geoverification method which would have not been practical, if at all possible, 10 years ago. This involves ascertaining the user’s location through the object that is arguably closer and more important to him than any computing device: his smart phone.
Modern smart phones come into play in iGaming in two ways. The first is to determine where the smart phone is physically located (it is generally assumed that its proprietor will be somewhere nearby, in a position to operate it). Users creating iGaming accounts will invariably be asked to enter their cell phone numbers as a means to fulfill the cell phone triangulation requirement.
Once in possession of the user’s cell phone number, the operator will “ping” the user’s cell phone. The phone is then prompted to send a signal to the nearest three cell-phone towers. An imaginary triangle consisting of these three points is then formed to encompass the user’s general location—or that of his cell phone, anyway.
If the three triangular points are all found to be within the eligible state, this requirement is usually partly fulfilled. Sometimes the user will be texted some kind of PIN code and asked to enter that code into the online gaming system, as additional means of identity verification.
This method has been used in both Nevada and Delaware, but New Jersey has chosen not to permit this form of geolocation.
“It comes down to the federal requirement which calls for reasonably designed geolocation technology,” says Sainbury. “If you look at the European situation, which heavily relied on IP geolocation, it’s pretty fair to say you could easily mask your location with any kind of proxy program. We look to getting a minimum of two different data sources and cross-reference those data sources with anti-spoofing technology. We work with regulators in each state to ensure that meets the requirements of the individual states, as well as the federal requirements.
“Unfortunately, these anti-spoofing programs can increase the false negatives and impact players who are legitimately within the state borders wanting to play.”
But Sainsbury points out that it’s early in the existence of online gaming in the U.S., so she would prefer to err on the side of caution.
“However, our data indicates that we’ve brought down the false negatives to around 10 percent,” she says. “In Nevada, their rate of false negatives is 35 percent. So we’re confident that we’re going to continue to improve.”
