GGB is committed to providing updated news and analysis on our weekly news site, GGBNews.com.

Welcome Home

Why geolocation is one of the most important elements of a successful online gaming industry

Welcome Home

Although the Unlawful Internet Gaming Enforcement Act has been talked to death over the last few years, it is still necessary to mention it when having any conversation about geolocation, as UIGEA is the primary reason for the advancement of geolocation technologies in the i-gaming industry.

It is well-known that UIGEA makes it illegal for internet gaming businesses to knowingly accept payments that are connected with “unlawful internet gambling,” and that the act makes no attempt to define what is “unlawful.” Instead, the act turns to existing federal, state and tribal laws to make this determination, and as a result what is considered “unlawful internet gambling” changes from jurisdiction to jurisdiction.

Thus, we arrive at a situation where it is illegal for a licensed interactive poker operator in Nevada to take play from customers in other states such as California, where internet gaming has no legal standing. It is for this reason that UIGEA demands that for any internet gaming to be lawful in the U.S. at all, the operator must have “reasonably designed” geolocation systems in place to ensure that only players from the right side of the state line are playing.

Nevada’s internet gaming regulations largely echo what is said in UIGEA, but the language used is even more stringent on would-be operators when it comes to their geolocation requirements.

Nevada’s regulations state that within 30 days of a player’s registration, an operator “shall” verify the information supplied by a player and must maintain a record of where that player is physically located when they are logged into their internet gaming account. That Nevada’s regulations opted to drop the term “reasonably designed” and replace it with the more definitive term “shall” implies that there will be very little forgiveness towards those operators that fail to remain compliant, regardless of their best intentions and efforts. Bearing in mind that (according to a CIA report) 80 percent of Americans live on or near state lines, this represents no small risk.

Spoofing

Implementing a geolocation system capable of staying compliant with the above laws and regulations would be difficult enough in a perfect world, let alone one where some players actively try to fake there location to gain access to services they aren’t legally permitted to use. The internet industry has used a form of geolocation through IP address for well over a decade. An IP address is a string of numbers (or letters and numbers in some cases) that is assigned to every internet-connected device, which can be correlated to an indication of where that device is.

IP-based geolocation is incorporated by most web businesses for such purposes as to direct the content of the web page (such as its banner advertising) to appeal to the right geographical demographic and to ensure that the language of the site is in keeping with where the traffic appears to come from. However, this solution is, at best, only accurate in terms of miles rather than feet, and has some drawbacks in terms of accuracy and reliability in some situations.

One of these drawbacks is a vulnerability to “spoofing” techniques, which, simply put, are methods used by players to fake their location results for a variety of reasons (such as to claim a bonus they are not entitled to or to collude in an online poker game). There are many different ways that a player can attempt to spoof their location, including the use of proxy servers, screen-sharing software, and virtual private networks (VPNs). Unfortunately, these methods are easily accessible and do not require advanced computing skills in most cases. In fact, the networking tools included in many major operating systems mean that spoofing via a proxy server or VPN is available to anyone wishing to do so. Screen-sharing software is generally not included with operating systems, but is only a download away thanks to commonly used software such as GoToMeeting.

Proxy Servers

A proxy server is a server that works as an intermediary between internet users and the website they are attempting to access. An out-of-state player can use a proxy server located in a state with a regulated i-gaming industry to mask their real IP address and provide themselves with an IP address that would normally be associated with that jurisdiction. Operators that rely on IP geolocation alone would then assume that the player in question is from their jurisdiction, and could potentially accept an illegal payment.

Some IP geolocation systems are not so easily fooled, and are actually able to detect a player’s real IP address despite the best efforts of the proxy server to mask it, or are able to detect to presence of the proxy server itself and block the player from accessing gaming services.

However, not all IP geolocation systems are capable of this, and as a result proxy servers remain a real concern for operators trying to maintain compliance with gaming laws and regulations. Moreover, proxy servers are easy to connect to using the network connection tools supplied in the four most popular operating systems: Windows, Mac OS, iOS and Android.

This means proxy servers are just as large a threat to mobile operators as they are to traditional online gaming operators. In truth, the hardest part of using a proxy server will likely be finding one that works. However, once a working proxy server is found, knowledge of it is likely to spread through the online gaming community rapidly.

Virtual Private Networks

Much like proxy servers, virtual private networks assign out-of-state players new IP addresses that allow them to access internet gaming services that would otherwise be denied to them. Of course, it is first necessary for an out-of-state player to find a VPN server that provides him with an IP address that a gaming operator within a particular regulated jurisdiction would accept as legitimate.

Unfortunately, with the number of gambling and poker forums on the internet, knowledge about such VPNs is likely to spread quickly. Moreover, there are lists of VPN server locations available on websites like MideMyAss.com.

Once more, VPN clients that allow users to connect to VPN servers are present in the four most common operating systems—meaning that like proxy servers, VPNs are a concern for internet gambling operators regardless of whether their focus is on mobile or the desktop. As with proxy servers, more advanced geolocation solutions are able to detect VPNs and block access to services when a player is found to be connecting through them.

Remote Desktop Software

Remote desktop software differs greatly in its operation from either proxy servers or VPNs, but still potentially allows out-of-state players to access restricted internet gaming services. Remote desktop software is readily available and easy to install and use, at least on PCs. Some common remote desktop programs are GoToMyPC, TeamViewer, and LogMeIn.

Remote desktop software allows a user to control one computer from another. Thus, a user is able to surf the web and run programs on a computer that is in a completely different location. For this to be useful to an out-of-state player, they would have to be able to access a remotely controlled computer in a jurisdiction where internet gaming has legal standing—easier said than done, as it requires that an out-of-state player have a friend that is willing to house a spare computer for him, or let him remotely control his own computer.

Remote desktop software is usually designed for controlling a Windows PC or Mac remotely, but not mobile devices. Although some programs like GoToMyPC do allow a user to control a PC from an Android or iOS-powered device, there are not many programs that allow a user to control a mobile device remotely. Those that do exist are not as simple to set up as their desktop counterparts, as they often require that iOS devices be “jail-broken” or Android ones be “rooted”—or hacked, in other words, thus voiding their warranty.

Despite both of these tasks being easy enough to do, most users will probably not feel comfortable doing them to a device that cost them hundreds of dollars. Furthermore, the player experience offered via a remotely controlled mobile device would be poor, as the frame rate of the screen image is often very low, four to five frames per second.

Despite the limitations inherent to remote desktop programs, and the fact that accessing internet gaming services through them requires significant investment on the part of the player due to having to use two devices, they still offer internet gaming operators a real challenge, particularly those in the traditional PC gaming market. Fortunately, some geolocation systems do have the ability to detect the presence of remote desktop software and block devices that are running it from accessing gaming services.

GPS

In addition to the above forms of spoofing mobile gaming, operators will also have to contend with GPS spoofing attacks, which are a lot easier to commit than many would think. In fact, there are many apps available that will provide a fake location for iOS and Android users, such as LocSpoof and Fake My Location, respectively.

Those with iOS devices will have to take the additional step of jail-breaking their device, which as mentioned previously voids the warranty. Moreover, such apps are not available in Apple’s official app store, but have to be downloaded through third-party app stores.

Despite the possible complications of spoofing GPS locations on mobile devices, it still remains a real concern for mobile gaming operators.

Improving Security And Compliance

Another way of detecting the use of any of these spoofing methods is to take advantage of as many different geolocation technologies as possible, like WiFi, IP, GPS and cell tower triangulation, and looking for any discrepancies between them in the recorded locations of a user.

For example, if IP geolocation records a user as being in Nevada, but WiFi geolocation shows the user is in California, it is likely that this person is attempting to spoof his location. Due to the conflicting location data, an advanced geolocation system (such as GeoComply) could take the action of blocking this user.

Ultimately, the more data that can be gathered about a user’s location the better, and the greater the chance that any type of spoofing will be detected. With their extremely valuable gaming licenses on the line, it makes sense for operators to research carefully the capabilities of their geolocation providers and to use a solution designed for pinpoint accuracy and to overcome the challenge of spoofing.

David Briggs is seen as a pioneer of the internet gaming industry, having joined Ladbrokes in 1999 to head its fledgling online division. Briggs went on to become managing director of Ladbrokes eGaming from 2005 to 2007, running online sportsbook, casino, poker, bngo, financial fixed odds and games businesses worldwide. He now runs his own consultancy company to assist existing and start-up betting and gaming business leverage the opportunities that the internet brings. Briggs is also non-executive chairman for GeoComply, the geo-positioning solutions provider for the internet gaming industry. ?

    Recent Feature Articles

  • The Ruling Class

    Aristocrat’s journey to the top of the slot industry

  • The Giant Awakens

    With citizens who are known to be some of Asia’s most prolific gamblers, Thailand has emerged as Asia’s next gaming opportunity

  • Responsible Gaming: All Together Now

    Voices from the American Gaming Association’s Responsible Gaming Month on the importance of responsible gaming and how the casino industry is handling the issue.

  • Global Games 2022

    The world’s game-makers prepare to wow attendees with the first unrestricted, fully international Global Gaming Expo since 2019

  • Testing, Testing, Testing

    Want to know whether a product, promotion or event will succeed even before it happens? Market research is the answer, but it has to be more nuanced than it has in the past