Legalizing Internet Gaming, Part III: Regulating the Operation

In an earlier article, we referred to the licensing process as the “gatekeeper of the industry” and noted that “[licensing] is based on the concept that it is easier to exclude unfit persons before they obtain a license, as opposed to going through the legal steps to take away a license from an unsuitable party.” While referring to licensing in the context of land-based gaming at the time, this statement is equally true to online gaming.

In order to acquire a license, an individual and/or entity typically must submit background and financial information to the state regulator for review and examination. This information will allow the state regulator to determine whether the applicant is suitable to be involved in online gaming. Possible individuals and entities subject to licensing include operators of the Internet gambling sites, as well those involved in ancillary services, such as gambling software suppliers, those who register customers and those who hold and maintain customer accounts. Determining who will undergo licensing and the extent of the licensing process will depend upon a variety of factors specific to the jurisdiction. These factors include the state’s budget, resources, expertise and the projected size of its online gaming industry.

A state also must determine who is eligible to apply for a license. A state may decide to limit opportunities to persons and entities that have already been vetted and licensed by the state. For instance, in New Jersey, Bill No. 490, which was voted by Gov. Christie, limited the definition of “Internet wagering” to mean “the placing of wagers with a casino licensee at a casino located in Atlantic City…”  By limiting the issuance of online gaming licenses to those who are already licensed to operate brick-and-mortar casinos within Atlantic City, the state of New Jersey will save considerable time and effort that would otherwise have to be exerted to investigate prospective licensees that are unknown to the state regulator. Critics, however, argue that the operation of a brick-and-mortar casino is vastly different to the operation of an online gaming site, and the policy effectively excludes those operators who have previously operated such sites and are thus the most experienced candidates for licensure.

Debate has also arisen regarding whether or not to give priority to certain groups in the licensing process. Specifically, the issue in some states is not the concept of intrastate gaming itself, but rather attempts by certain groups to create exclusive rights to operate the sites. Proponents of giving exclusivity to local operators note that by licensing foreign operators, this allows money to leave the state instead of helping the state’s economy. Whereas, exclusivity assists the state in generating revenue, which is an underlying reason for legalizing such gaming. However, critics again argue that by discouraging or barring foreign gaming operators from seeking licensure, a state will lose out on doing business with some of the best and most qualified operators. Rather than relying on recognizable brands, a state’s fledging online gaming industry will be forced to start from scratch, and whether players will abandon their familiar (albeit unlicensed) gaming operators to unfamiliar new sites is unknown.

Even if a state decides to abstain from the attempts for exclusivity and instead opens up outsiders, new concerns then arise. Most important, is the question of whether companies that have or are accepting players from the United States will be eligible. Three categories exist: (1) those who have never taken U.S. players, (2) those who stopped upon enactment of the Unlawful Internet Gambling Enforcement Act and (3) those still currently taking U.S. players. Clearly, those companies that have never taken U.S. players are viewed favorably, while those that have not complied with state and federal law, especially after the passage of UIGEA, and have demonstrated no interest in voluntary compliance, will be looked upon less favorably. The real question is how to handle those companies that stopped upon enactment of UIGEA.

Ultimately, a state will have to balance the benefits afforded by extensive experience with online gaming and the need to ensure the operations are fair, honest and financially advantageous to the state. Regardless of which of the above strategies is followed, it is certain that lobbyists for all will actively try to influence potential legislation.

After determining who is eligible to undergo licensing, several key components remain. These include, for example, security of site, fairness of games and registering of players to ensure age and location requirements are met.

Ensuring the integrity and fairness of the gaming sites is crucial to the success of a state’s online gaming operation. If these core notions are lost, so too will be the public’s confidence. For example, if a hacker breaks into the operator’s system, considerable damage or loss could result. A hacker could manipulate the operation of the games, access player funds or procure personal information of the players that is stored by the website. Such unauthorized access jeopardizes the prolonged viability of the operations. As a consequence, all hardware, software or operating systems should be secure against unauthorized access.

To ensure the security of the online operation, the state should implement standards that are designed to safeguard critical aspects of the online operation. Such standards should set specific security requirements, which may include the use of firewalls, password security standards, virus software, encryption requirements and the separation of development testing services from the live systems. Such standards also may mandate that the critical systems components of the operation, such as central hosts, network devices and firewalls be self-monitoring. Furthermore, given the rapid development in technology, it is essential that the regulations are drafted to incorporate flexibility, and are reviewed frequently, to ensure that both the regulators and operators stay up to date with the latest, and most secure, technology.

In addition, the computer systems and software should be examined and regulated to ensure all components function properly. A state should compel software manufacturers to submit their programs to testing laboratories for inspection and approval before they are exposed to the public for play. Testing is an important step, because it ensures that manufacturers comply with the government’s regulations. Testing can be conducted in a variety of ways, including by the government or by an independent tester contracted by the manufacturer and supervised by the government. Again, this will depend upon the budget of the state as well as the size of its online gaming industry.

Not only must the integrity of the site be ensured, but the games offered also should be fair. As a consequence, all games offered for play should be approved by the applicable regulatory agency, including game rules and betting rules, before they are offered to players. The site should also display certain core information for each game, including the name of the game, any restrictions on play, the rules of the game, all instructions on how to play and the registered player’s current account balance, which should be updated in real time. Equally important, operators should be required to deploy controls and technology to prevent such fraudulent activity as cheating through collusion and robotic play. If an operator becomes aware that fraud or cheating is taking place or has taken place, it should be required to take steps to stop those activities immediately and inform the regulator of all relevant facts. Moreover, penalties should be set forth if an operator does not comply with these provisions.

Operators also must ensure that users are of age and reside within the state’s boundaries. Otherwise online operators will be subject to serious business and legal risks. At a minimum, in order to register with a site, a user should be required to provide first name and surname, principal residence address, social security number, and identification or certification to prove he/she is at least 21 years of age. Various methods are available to an operator to ascertain the age and location of a user; however, the cost and convenience associated with each vary. In terms of verifying age, some Internet gambling operators verify age by requiring the user to report his age and enter his credit card details. This process is relatively simple for the operator to implement. However, critics argue that such a method of verification is ineffective, because credit and debit cards are merely payment mechanisms that marketers and card companies wish to have widely used by consumers under the age of 21. Thus, critics conclude credit cards are not reasonable tools for verifying age in transactions unless they are face-to-face. Other Internet operators choose to verify age by comparing the personal information provided by a user with a database of consumer transaction data or credit reports. The effectiveness of this method is also questioned. Specifically, critics note that such databases contain records of credit card transactions, magazine subscriptions, self-reported age, and the like, which do not verify that a person is over the age of 21. Still another method for verifying age is the use of governmental issued ID databases. This has become a more widely accepted solution to age verification, because the hallmark of government issued ID is that it contains date of birth provided under an oath of affirmation of veracity, and such IDs are typically issued after the individual’s presentation of other official documents. Yet, perhaps the easiest way for an operator to verify the age of its customers I to use the services of an age-verification service provider. In addition to verifying the age of a user, the operator must not accept bets from players located out-of-state. Otherwise, as discussed in our prior article, the operation runs the risk of being in violation of federal gambling laws. This can be achieved through a combination of safeguards, including bank and address verification and the use of blocking software. In terms of blocking software, technology is now readily available that allows the location of a user can be ascertained. Simply, whenever a person connects to the Internet, their computer or mobile device is assigned what is called an IP address. Using this IP address, it is possible to identify the location from where a person is accessing the Internet. Geo-blocking technology allows operators to determine access to the site by simply choosing to only allow access to a particular range of IP addresses or to block certain ranges. Geo-blocking technology is already in use within the U.S. For instance, many traditional broadcast companies that have moved their television, radio and music content online use geo-blocking technology to ensure these programs can only be accessed by persons logging on within their own country. Moreover, the Nevada Gaming Commission recently approved an application that allows persons to place sports wagers from their cell phones. In this instance, the technology consisted of several layers of security, including patent-pending geographic location processes and encrypted communications.8 In commenting upon these cell phone applications, Nevada Gaming Control Board Chairman Mark Lipparelli said that each application is subject to review and testing to prove the “technology can be disabled at the state border.”

In short, no state or applicable regulatory agency should issue a license until it has issued regulations that set forth the necessary safeguards. Moreover, prospective licensees should be made to demonstrate how they would facilitate compliance with these standards before a license is granted.

To conclude, the regulation of online gaming varies widely throughout the jurisdictions in which it is offered, because each jurisdiction tailors its regulatory requirements to its particular policy goals. Nevertheless, there are certain components that are fundamental to the make up of an effective online gaming regulatory regime. Without an effective regulatory framework, a state will never fully receive the benefits afforded by legalized online gaming.


Karl F. Rutledge
Karl F. Rutledge
Partner, Chair - Commercial Gaming Group

Related Attorneys

Related Services