WiredSafety commissioned study on online gambling and regulatory schemes that will address consumer risks

Can Internet Gambling Be Effectively Regulated?
Managing the Risks



Authored by

Malcolm K. Sparrow
John F. Kennedy School of Government
Harvard University


With Contributions by

Coleman Bazelon, PhD

Charles Jackson, PhD




December 2, 2009
TABLE OF CONTENTS


I. OVERVIEW OF APPROACH AND SUMMARY OF RESULTS 1
A. Our Approach 2
1. Gambling by Minors 3
2. Criminal and Fraudulent Behavior 3
3. Network Access, Data Privacy and Security Issues 3
4. Problem Gambling 4
B. The Status Quo Offers No Effective Protection 4
C. Legalization and Regulation Would Afford Significantly Better Protection than the Status Quo 6
D. Regulatory Methods and Technologies for Controlling Each Type of Risk Already Exist 7
1. Gambling by Minors 9
2. Criminal and Fraudulent Behavior 9
3. Network Access, Data Privacy and Security Issues 11
4. Problem Gambling 12
E. Conclusions 15
II. REGULATORY METHODS AND TECHNOLOGIES AVAILABLE FOR CONTROLLING EACH RISK 16
A. Gambling by Minors 16
1. The Issue of Gambling by Minors 16
2. Existing Controls in Other Jurisdictions 17
3. Relevant Technologies for Risk Mitigation 20
4. Conclusion 23
B. Defrauding of Consumers by Site Operators 24
1. The Issue of Fraud by Site Operators 24
2. Existing Controls in Other Jurisdictions 26
3. Relevant Technologies for Risk Mitigation 28
4. Conclusion 29
C. Cheating or Defrauding of Players by Other Players 29
1. The Issue of Players Being Defrauded by Other Players 29
2. Existing Controls in Other Jurisdictions 31
3. Relevant Technologies for Risk Mitigation 32
4. Conclusion 33
D. Involvement of Organized Crime in Gambling Operations 33
1. The Issue of Involvement of Organized Crime in Online Gambling 33
2. Existing Controls in Other Jurisdictions 34
3. Relevant Technologies for Risk Mitigation 36
4. Conclusion 36
E. Money Laundering by Players 37
1. The Issue of Money Laundering by Players 37
2. Existing Controls in Other Jurisdictions 39
3. Relevant Technologies for Risk Mitigation 40
4. Conclusion 42
F. Money Laundering by Site Operators 43
1. The Issue of Money Laundering by Site Operators 43
2. Existing Controls in Other Jurisdictions 44
3. Relevant Technologies for Risk Mitigation 44
4. Conclusion 45
G. Violation of Jurisdictional Restrictions or Prohibitions 45
1. The Issue of Violation of Jurisdictional Restrictions 45
2. Regulatory Strategy 46
3. Relevant Technologies for Risk Mitigation 47
4. Conclusion 49
H. Breaches of Data Confidentiality 50
1. The Issue of Data Confidentiality 50
2. Existing Controls in Other Jurisdictions 51
3. Relevant Technologies for Risk Mitigation 52
4. Conclusion 53
I. Communications and Computer Security Failures 53
1. The Issue of Communications and Computer Security Failures 53
2. Existing Controls in Other Jurisdictions 55
3. Relevant Technologies for Risk Mitigation 56
4. Conclusion 58
J. Problem Gambling 59
1. Problem Gambling 59
III. SPECIAL ATTENTION TO PROBLEM GAMBLING 60
A. Introduction 60
B. What is Problem Gambling? 60
1. Terminology 60
2. Prevalence Rates and Trends 61
C. Potential Effects of Legalization of Online Gambling on Problem Gambling 62
1. Potential Adverse Effects of Legalization 63
2. Potential Benefits of Legalization 69
D. Concluding Remarks 72

Acknowledgements
The authors would like to thank Dorothy Robyn, PhD, who contributed to this project while at The Brattle Group. The authors would also like to thank Pallavi Seth, PhD, and Michael Sutcliffe of The Brattle Group for their assistance.


EXECUTIVE SUMMARY
This study was commissioned by Wired Safety, an Internet Safety and Educational charity. It examines a range of harms potentially associated with online gambling, and alternative methods for mitigating or minimizing them. Recognizing that the current U.S. prohibitionist regime with respect to online gambling is largely ineffective in achieving its aims, and provides no platform or opportunity for the implementation of most of the relevant harm-reduction strategies, we find that an alternative regime of legalization and regulation of online gambling would likely improve consumer welfare and protections. The body of this report evaluates a range of strategies, both regulatory and technological, that could be used to mitigate potential harms associated with online gambling more effectively.
Notwithstanding the current prohibitionist legal and regulatory approach, millions of U.S. residents gamble online through offshore gambling sites. As a result, the United States finds itself in the unfortunate position of incurring all the social costs of online gambling while having no control over the gaming sites that serve U.S. residents. The United States cannot disqualify industry participants from competing effectively for U.S.-based customers or offer its residents any consumer protections. Nearly all states permit some form of commercial gambling, and the industry is large and well-established. Clearly, policymakers have extensive precedent from which to draw strategies to mitigate the potential social harms of gambling.
Although some controls used in bricks-and-mortar casinos may not translate well to online gambling, several of the risks we examined become more amenable to control online. New technologies can be effective, even for those risks that are more difficult to address online. For example, geolocation and age verification technologies can help turn potentially significant risks into manageable ones.
In this study, we analyze 10 specific risks that others have suggested are potentially associated with online gambling: gambling by minors, fraud by operators, fraud by players, organized crime, money laundering by players, money laundering by operators, violation of jurisdictional prohibitions, breaches of data confidentiality, lack of site security, and problem gambling. It is important that regulators treat each of these potential risks differently. For some risks (such as players cheating other players), the public interest and the interests of the gaming industry align, making a cooperative regulatory relationship natural. For others (such as those involving potentially criminal conduct by operators), a strict enforcement regime would be more appropriate. Still other potential risks (such as underage and problem gambling) call for a more nuanced regulatory approach involving a mixture of strict enforcement, effective nonprofit support, community education, and cooperation, in keeping with the more complex motivations and incentives facing site operators.
For each of the 10 risks, we examined a set of regulatory methods and technologies that would provide a reasonable degree of risk management in a regulated environment. Most of these methods have already been implemented in some form in other jurisdictions. The United Kingdom, Alderney, Gibraltar, and others have successfully implemented regulation, and nearly all of the well-regulated jurisdictions we studied address the 10 risks to some degree.
The establishment of a well-regulated industry under U.S. jurisdiction would offer far better protection against online gambling’s potential social harms than outright prohibition. Combining a thoughtful regulatory scheme with education, technology tools, and support appears to be the most effective means of handling the realities and risks of online gambling in the United States. Therefore, we recommend that plans for regulating online gambling include the design and use of different risk-management strategies tailored to the different classes of risk that are associated with Internet gambling. In the end, consumers in the United States would be better protected than they are now.


I. OVERVIEW OF APPROACH AND SUMMARY OF RESULTS
Congress is debating legislation that would remove the existing prohibition on the use of the Internet for most types of gambling. The proposed legalization of online gambling would be conditioned on the imposition of regulation designed to limit or prevent potential harms such as underage gambling, money laundering, and problem gambling.
A key issue in the debate over legalization of online gambling is whether regulation and technology could effectively control such potential harms. Some of the opposition to legalization reflects a perception that online gambling—in contrast to gambling in bricks-and-mortar casinos—would be difficult, if not impossible, to regulate effectively.
This study reviews the research literature and international approaches to online gambling. WiredSafety (the Internet safety and educational charity) has commissioned this study to help inform the legalization debate and to help educate the public on the risks associated with online gambling and the best ways to address those risks.
We note that our expertise is in regulatory policy and its relationship to risk analysis, rather than in any extensive prior knowledge of the gaming industry and gambling behavior per se. We have critically reviewed the existing literature, evaluated relevant technologies, and interviewed a range of scholars and practitioner experts, both here and abroad. We have not, however, conducted any new epidemiological studies or field research. Our distinctive contribution is the frame for risk management and regulatory analysis, rather than any new scientific inquiry.
Our analysis does not directly address whether online gambling should be legalized. In focusing on managing risks, we did not weigh moral or religious objections to gambling, nor did we examine broadly libertarian arguments in favor of allowing adults to engage in pastimes they may enjoy. We did not conduct any analysis to quantify the benefits of potential tax revenues attributable to regulated online gambling. Further, we have not focused on any issues of federalism or on exactly where regulations and laws should fit into the U.S. multijurisdictional governance structure. Instead, we concentrated more narrowly on the obligations of government to protect citizens in general, and vulnerable groups of citizens in particular, from unnecessary exposure to harm.
We sought (1) to identify the specific risks that are associated with, or perceived to be associated with, Internet gambling; (2) to determine suitable regulatory strategies for controlling or managing those risks; and (3) to assess how effective those strategies are likely to be. We identified 10 distinct risks that fall into four broad categories. Those categories are as follows:
• Gambling by minors
• Criminal and fraudulent behavior
• Network access, data privacy and security
• Problem gambling

On the basis of our review of the existing literature and interviews with academics, regulators, industry participants, and public interest advocates, we came to the following conclusions:
• Online gambling could be regulated effectively if it were legalized.
• A well-structured regulatory regime should provide much better social and consumer protections than the status quo for the risks we identified.
• At a minimum, even an imperfect legalization and regulatory regime for online gambling would give Americans much more protection than they have now. The current prohibitionist policy is extremely weak: large numbers of U.S. residents already gamble online, but they do so using offshore sites, many of which are poorly regulated or unregulated.

For each of the 10 risks we examined, a set of regulatory methods and technologies exist that would provide a reasonable degree of control, and most of them have been implemented effectively in other jurisdictions or in other online settings.
Although some controls used in the bricks-and-mortar environment may not translate to online gambling environments, several of the risks we examined become more amenable to control online. Comprehensive electronic records and the ability to track financial transactions and betting patterns provide more opportunities for analysis and audit, and hence improve the chances of discovering fraud or criminal activity. They also allow gambling websites to provide tools to mitigate problem gambling in a timely manner.
A. Our Approach
Our approach has been to identify the specific risks that are perceived to be associated with Internet gambling and then to determine how best to control or manage them. Those risks are described below.


1. Gambling by Minors
a. Gambling by minors: There is concern that minors might find it easier to access and use online gambling services in a legalized environment.
2. Criminal and Fraudulent Behavior
a. Defrauding of consumers by site operators: There is the possibility that online site operators may be more likely than their bricks-and-mortar counterparts to rig games, refuse to pay out winnings, or simply vanish, taking with them players’ account balances.
b. Cheating or defrauding of players by other players: There is a concern that players could collude to defraud others, particularly in online poker. Online gambling may offer opportunities for collusion that are not available in a physical environment with visual surveillance.
c. Involvement of organized crime in gambling operations: Organized crime has a history of involvement with the bricks-and-mortar casinos and is now involved in some online commerce. There is some concern that involvement in the online gambling industry may be a natural next step.
d. Money laundering by players: There is concern that players or groups of players acting in concert could use legitimate gambling operations for money laundering.
e. Money laundering by site operators: The possibility has been raised that site operators could use online gambling operations, with its significant financial flows, as a cover for money laundering on a large scale.
3. Network Access, Data Privacy and Security Issues
a. Violation of jurisdictional restrictions or prohibitions: Government at the state, local, and tribal levels has traditionally exercised control over gambling within a given jurisdiction. The advent of the Internet has opened the question as to whether controls mandated by any proposed laws can be enforced within particular jurisdictions.
b. Breaches of data confidentiality: To register for play, players surrender personal or financial data to site operators. Consumers might be harmed by deliberate or accidental breaches of the confidentiality of those data.
c. Communications and computer security failures: Some are concerned that site operators might not use appropriate security practices, procedures, and technologies to ensure the integrity of their sites, the gaming on those sites, and player interactions. Absent proper security measures, malicious code could be transmitted to players, game operations could be infiltrated, and intrusions into the systems could compromise the game play and security of users.
4. Problem Gambling
a. Problem gambling behaviors: Some argue that increased opportunity to gamble at any time, from anywhere, and at a faster pace might exacerbate pathological, addictive, or problem gambling behaviors.
With respect to each of these four categories of risks, we sought to answer three broad questions:
(1) In the existing prohibitionist legal and regulatory regime, what level of protection are U.S. consumers afforded?
(2) With legalization, could these risks be addressed more effectively than they are now, and assuming legalization, what regulatory strategy is best suited for addressing these risks?
(3) What are the potentially relevant technologies and methods available for effective risk mitigation, and how might other parties contribute toward effective control?
Our answer to the threshold question of whether online gambling can be effectively regulated came out of our analysis of these more specific questions.
B. The Status Quo Offers No Effective Protection
Many U.S. residents already use online gambling services despite statutory restrictions. Recent estimates indicate that U.S. gamblers constitute roughly one-fourth to one-third of the global market for online gambling services. The size of the U.S. share of that global market was estimated to be $5.9 billion in 2008.
The mainstay of the current prohibitionist regulatory structure is the Unlawful Internet Gambling Enforcement Act (UIGEA). Instead of criminalizing gambling itself, the UIGEA was intended to prevent U.S. residents from gambling by placing restrictions on the role of financial institutions in transmitting payments to and from gaming operators. However, because workarounds such as e-wallets (essentially a payment processor situated between banks and gambling sites), phone-based deposits, and prepaid credit cards have proliferated, very few U.S.-based gamblers are presently much inconvenienced. Most gamblers are either unaware of or confused by the patchwork of federal and state restrictions, and many are readily guided by unregulated online gambling sites toward financial mechanisms that they can use to make deposits and withdrawals.
The net effect is that the U.S. attempt to prohibit online gambling has instead pushed it offshore. Sites are readily available to U.S. residents through the essentially borderless medium of the Internet. Some sites are well-regulated, such as those based in the United Kingdom, Alderney, and Gibraltar, and others are less-well-regulated or unregulated, such as those in Antigua, Grenada, or the Kahnawake Mohawk territory. (Of course, it is the less-well-regulated international sites that provide easier access to U.S. consumers.) As a result of the global gaming industry’s adaptations to the U.S. strategy, the United States finds itself in the unfortunate position of
• incurring all the social costs related to U.S. residents’ online gambling;
• exercising no jurisdiction or control over the gaming sites that serve U.S. residents;
• being unable to offer U.S. residents who choose to gamble on overseas sites any consumer protections or to implement any other harm-reducing strategies; and
• being unable to qualify industry participants or even exclude criminal groups from competing for U.S.-based customers.

In an effort to address this reality and enforce current restrictions more aggressively, federal officials recently instructed four banks to freeze accounts belonging to online payment processors. The frozen accounts apparently contained funds owed to some 27,000 people who used offshore poker websites. Such financially based efforts seem to have had only a temporary chilling effect. Over the long run, it is probably not feasible for the federal government to prevent U.S. residents from accessing foreign sites via the Internet. Unlike China or Iran, for example, the United States has displayed no appetite for centralized control of the Internet to block citizens’ access to undesirable sites.
Nor would criminalization of the gambling itself be an effective strategy. First, it would likely generate a massive pool of lawbreakers, almost none of whom would make attractive targets for criminal prosecution—because it would likely be a waste of law enforcement resources to pursue individual online gamblers. Second, it would exacerbate the dangers of consumer fraud at online gambling sites by making aggrieved consumers more reluctant to report their experiences.
C. Legalization and Regulation Would Afford Significantly Better Protection than the Status Quo
At a minimum, legalization and regulation of online gambling would give Americans much more protection than does the current prohibitionist regulatory framework. Although the kind of regulation that would accompany legalization would not be failsafe, it would be a significant improvement over the current regulatory and enforcement structure. We believe that safeguards could be implemented that would, on balance, substantially improve protections against the identified risks. These safeguards would also provide protection equal to or greater than that provided within the U.S.-based bricks-and-mortar gambling industry. We recognize that no set of technical or regulatory controls could ever eliminate these risks entirely. But even if the new fence had a few holes, it would be an improvement over having no fence at all.
The view that online gambling, in contrast to its bricks-and-mortar casino counterpart, is impossible to regulate reflects an old-fashioned perception of cyber jurisdictional authority. Many offshore commercial entities that operate online are subject to U.S. legal jurisdiction under existing long-arm statutes and authority. When coupled with governmental licensing authority, the ability to police online activities is even more powerful. Legalization with regulation would provide U.S. authorities with the power to grant or deny licenses and to impose significant sanctions on noncompliant licensees. Those licenses would be highly valuable to site operators. Compliance with any regulatory requirements and strict licensing conditions that Congress chooses to impose in return for the privilege of the license would therefore become a cost of doing business.
Just as with bricks-and-mortar casinos, the requirement for site operators to maintain a license gives the government the ability to exclude bad actors as well as impose a broad array of conditions for, and oversight of, licensees. In contrast, the current prohibitionist policy is extremely ineffective: large numbers of U.S. residents already gamble online, but they do so using offshore sites, many of which are poorly regulated. With legalization, we would expect that most online gamblers would prefer licensed U.S.-based sites because of their integrity and security, rather than accept the risks posed by unregulated or poorly regulated sites. A well-structured regulatory regime would provide better protections against all of the risks we identified.
This conclusion is supported by the experience of other jurisdictions in regulating online gambling. Some of these, such as the United Kingdom and Alderney, have adopted regulatory regimes that appear to provide protection against the identified risks. That may be the most compelling evidence that online gambling can be effectively regulated.
D. Regulatory Methods and Technologies for Controlling Each Type of Risk Already Exist
For each of the 10 risks we examined, a set of regulatory methods and technologies already exists that would provide a reasonable degree of risk management. Moreover, most of them have been implemented in other countries. One general insight from regulatory policy, and a review of other country’s experiences, is that no one size fits all: regulators should treat different risks differently. The incentives and motivations of different parties vary across risk categories, as does the locus for detection and control interventions. Understanding the natural incentives of the gaming industry with respect to each class of risk reveals whether a cooperative regulatory strategy would likely be more effective than a traditional enforcement-centric one.
For example, for at least one of the risks we identified (protecting the integrity of poker games by preventing players from colluding or conspiring to cheat other players), the interests of the public and of the gaming industry align reasonably closely. Both groups are interested in ensuring the integrity of the games. That makes a more cooperative and less adversarial regulatory relationship quite natural.
For other risks (such as defrauding of consumers by site operators, involvement of organized crime, and money laundering by site operators), a strict enforcement regime focused on identification and rapid exclusion of bad actors is more obviously appropriate. Oversight in these areas would focus heavily on up-front qualification or “suitability” to exclude those with criminal histories or connections and persons otherwise lacking in “good character, honesty, and integrity” as is the case in the bricks-and-mortar space. Enforcement activity would focus on bad actors, with the goal of exclusion and sanction. The intense and strict monitoring regime for reputable sites would include provisions designed to prevent or reveal any infiltration over time by undesirable groups or influences. Such regulations would mirror those now in place for bricks-and-mortar casinos.
Reputable sites, whose competitive advantage lies substantially with their reputation for integrity, would not be much troubled by the type of oversight designed to keep the “good character, honesty, and integrity” bar for admission high and the bad players out. In fact, they should appreciate such oversight as a positive contribution to the overall public perception of their industry, and the regulatory certainty provided by a licensing model would help with the industry’s overall long-term planning.
Some risks (gambling by minors, money laundering by players, problem gambling, breaches of data confidentiality, and lack of site and technology security) present more complex challenges in terms of regulatory design. If site operators were driven solely by their short-run economic incentives, they would more likely take bets from minors, problem gamblers, and money launderers (because the sites gain financially, at least in the short run, from all such bets), and they might limit their investments in data privacy and security. Site operators might also gain, in the short run, from abusing or selling personal and financial data provided to them by gamblers.
In the longer term, of course, site operators value their brand names and reputations matter, and these five risks all figure as reputational risks from the industry’s perspective just as they do in the bricks-and-mortar gambling industry. By setting the admission bar for licensees suitably high, U.S. regulators would intend to admit only reputable operators, whose behaviors would be guided by the value they place on establishing and maintaining a trusted brand. This is the approach taken by regulators in other jurisdictions—license only reputable firms. Probity investigations are conducted into the companies and their associates before a license is issued. Hence, for these five risks, close supervision would be required if an operator were regarded as a rational but short-sighted actor. At the same time, a more cooperative and symbiotic regulatory relationship ought to emerge when reputable operators take a longer-term, strategic view. To better align site operators’ short- and long-term interests, regulation also would provide for sanctions, from monetary fines up to and including loss of license for those site operators that choose to disregard mandated operational and consumer protections.
One strategy to provide longer-term, reputation-based incentives for good behavior is to create costs to entry—through the regulatory process, licensing fees, or other means—that reduce incentives to make a quick profit and leave the industry. For all risks created by operator shortsightedness, regulators need to establish and retain sufficient audit and monitoring systems so they can see when organizations that are otherwise reputable tilt too heavily toward short-term gain at the expense of public protection. Regulators should not accept the industry’s protestations that they can be entirely trusted to take care of such risks without oversight simply because it is in their interest to do so. It is indeed in the industry’s long-term interests to do so, but short-term considerations sometimes prevail, even in major corporations and multibillion dollar industries.
The following sections of this study describe a variety of control technologies and regulatory tactics relevant to each risk, and identify the most promising approaches in each case. Table 1, in Appendix A, lists the 10 risks and for each outlines
• the level of protection afforded under the current regime (column 2);
• the overall structure and style of regulatory oversight most natural for each risk (column 3), and
• some key points regarding relevant technologies and control strategies (column 4).

Below we summarize key points in relation to each risk.
1. Gambling by Minors
There is a general concern that underage gamblers may access or attempt to access online gambling sites.
• Gambling by minors: A number of technologies routinely used in other industries can be used to exclude minors from online gambling, including a variety of data-matching techniques, electronic or other submission of documentary evidence of age, and possibly application of biometric identification systems. The strongest form of control would require positive matching of a player at the time of registration against existing databases of known adults, thus excluding minors, as well as identity-verification prior to initiating any session of play. U.S.-licensed operators would be expected to use filters and procedures that are as discriminating as reasonably possible. With respect to U.S. residents, we would expect available data needed for age-verification to be of high quality and reliability. Site operators could also be required to provide child-protective software to parents to help prevent minors from accessing gambling sites. Alternatively, a separate governmental or nonprofit entity could provide such software.
2. Criminal and Fraudulent Behavior
Criminal activity can stem from site operators or the players themselves. The following risks are related to criminal activity by site operators:
• Defrauding of consumers by site operators,
• Involvement of organized crime in gambling operations, and
• Money laundering by site operators.

These risks would be effectively limited by a regulatory strategy designed to keep the bar for admission high and to keep criminals out. Such controls have worked well in bricks-and-mortar casinos and would operate similarly with U.S.-licensed online site operators. Relevant tactics include rigorous vetting procedures for new applicants and monitoring of licensed site operator behavior to prevent or detect regulatory noncompliance, criminal conduct, fraudulent and deceptive practices, and disregard for consumers’ rights.
Regulatory strategy with respect to these risks would be enforcement-centric with a focus on excluding operators with criminal histories or connections. Reputable site operators with brands to protect could not afford to risk damage to their reputations, loss of their licenses, or regulatory sanctions. Thus, we would expect the industry at large to support the type of demanding admission standards, regulatory monitoring, and sanctions designed to keep bad actors out of the business. Players, best positioned to detect improper conduct or consumer fraud by site operators, would be enabled and encouraged to report site operators’ improper conduct directly to regulators and others in law enforcement. Players would also have access to U.S. courts for dispute resolution.
Player criminal behavior falls into two major categories—cheating or defrauding of players by other players and money laundering by players.
• Cheating or defrauding of players by other players: Most of the cases of improper player collusion or cheating that have come to light have been detected by other players. With a regulator in place for U.S.-licensed sites, players would have stronger recourse against the sites, or against other players, by lodging complaints with the regulator or relevant law enforcement agencies. More important, licensed operators could be required to maintain comprehensive databases of all betting transactions and these databases could be examined and analyzed by regulators in the event of an inquiry or the triggering of red flags. Site operators, who themselves have a strong interest in maintaining the integrity of their games, could be expected or even required to implement pattern recognition software to scan routinely for anomalous betting patterns.
• Money laundering by players: Online gambling operators, like operators of bricks-and-mortar casinos, would be subject to current anti-money-laundering regulations. These regulations would require site operators to expend some level of effort in detecting money laundering. The online environment provides better opportunities for detecting money laundering by players or player groups than the bricks-and-mortar casino environment. Site operators could be required to retain comprehensive data on all deposits, withdrawals, and betting transactions and to make these data available to regulators for examination and analysis. Given complete data, most patterns related to money laundering (such as light betting or matched bets placed by collaborators) would be easier to detect than they are in a physical environment (where complete transaction histories are available only in the form of video recordings). Software that detects anomalies and suspicious behaviors could be operated easily and routinely on digital databases by the site operators, by regulators, or by both. The site operators’ obligations with respect to their own detection of money laundering would form a part of their ordinary compliance obligations under the licensing regime.
3. Network Access, Data Privacy and Security Issues
Any U.S. legalization and regulatory regime would likely address the risk of access to online gambling sites from jurisdictions that prohibit such activity.
• Violation of jurisdictional restrictions or prohibitions: State, local, and tribal governments may continue to prohibit or restrict (1) the operation of gambling sites from within their jurisdictions and (2) online gambling by individuals resident or physically present within their jurisdiction. Licensed U.S. sites could be required to take all reasonable steps not to permit registration or participation by individuals in such states. A range of geolocation technologies are now available, mostly tied to identification of the user location by reference to their IP addresses. Such technologies, while not entirely foolproof, have the capability of reducing risks as much as is required by regulators. IP geolocation, together with address verification at registration and other controls, can be expected to deter the bulk of casual attempts to gamble from within restricted states. Determined users, of course, already have access to foreign sites and would probably continue to use those rather than go to the trouble of devising sophisticated technological means for defeating U.S.-based geolocation controls. Regulatory oversight methods could include audits of U.S.-based operators’ software controls and routine “mystery shopping” at U.S. sites conducted from locations within states that had chosen to exercise their rights to restrict online gambling.
Data privacy and security risks include: sites not using commercially appropriate security systems and practices; intentional or accidental breach of the gambling site’s and user’s data security; and the introduction of spyware, adware, or malicious code into gambling websites’ software or transmission of such malware to users’ computers.
• Breaches of data confidentiality: Under legalization and regulation, U.S.-licensed operators would be subject to all applicable federal and state requirements regarding data confidentiality and security. Site operators would be subject to regulatory and potentially criminal sanctions and civil liability for any breaches or abuses of personal or financial data. Their data-protection controls would be subject to regulatory audit. There is no reason to believe that licensed online gambling operators would be any less able or willing to fulfill these obligations than other online merchants with similar data custody obligations.
• Communications and computer security failures: Under the current regime, U.S. authorities have no oversight over security for online gambling sites. With legalization and regulation U.S. licensed sites would be subject to existing data protection laws. Furthermore, U.S. regulators would have an opportunity to require state-of-the-art cybersecurity controls to protect against the introduction of malicious code or the unauthorized manipulation of games.
4. Problem Gambling
It is relatively easy to demonstrate for the other risk categories that a well-structured regulatory regime coupled with relevant technologies should provide better protection than the status quo. For problem gambling, however, the potential effect of legalization is less obvious a priori. Many might assume that pathological or addictive gambling behaviors would be exacerbated by the increased opportunity to gamble at any time and from anywhere online. But research on this topic does not support this conclusion. In particular, the link between the availability of online gambling and increases in the prevalence of problem gambling has not been established. Nevertheless, some online gamblers would be problem gamblers.
In a well-regulated online environment, gamblers could have opportunities and technologies made available to them to help curb addictive or problematic gambling behaviors. Such mechanisms would permit them to limit their gambling volume, deposit rates, loss rates, and the size of each wager. Users could also access online clinical and self-help resources from links provided at the gambling site.
The relationship between legalization and potential effects on problem gambling rates must certainly be examined carefully. Opponents of legalization fear an increase in problem gambling rates. However, gambling experts in the United States and the United Kingdom have reported that the prevalence rates for pathological gambling have remained static and low (roughly 0.7% of the adult population, in both countries) for many years. A large-scale study of gambling prevalence in the U.K. found the 0.7% rate remaining stable from 1999 through 2007 despite substantial increases in gambling opportunities during this period.
Because this issue is likely to receive considerable attention as the United States considers legalization, we have attempted to analyze the various arguments given as to why the act of legalization might drive the level of problem gambling up or down. We have identified five popularly discussed mechanisms through which legalization could drive problem gambling up, and describe them here along with some observations that help mitigate the anticipated effects:
• Mechanism: Inhibitions to gamble that are based on would-be gamblers’ knowledge of current legal restrictions would be removed.
 Observation: Gamblers in the United States are generally ignorant of or completely confused about existing legal restrictions, and (until very recently) there has been no enforcement against the gamblers themselves. Hence, the lifting of the prohibition itself is unlikely to have any significant impact on would-be gamblers’ willingness to gamble online.
• Mechanism: Gamblers may be more comfortable gambling online because licensed operators are reputed to be trustworthy.
 Observation: The gamblers most likely to be influenced by the availability of trusted brand-name sites are those who gamble already, perhaps in the casino environment, and hence know the brands. Knowledgeable gamblers may indeed shift their business, but this represents displacement, not overall growth. And the displacement would be from bricks-and-mortar to online gambling, which can offer many more options and protections for problem gamblers than can land-based casinos.
• Mechanism: Gambling opportunities would be ubiquitous and available 24/7.
 Observation: U.S. residents already have online gambling options available to them all day, everyday, and from anywhere. So the addition of U.S.-licensed sites would not alter that particular reality.
• Mechanism: Lifting the UIGEA’s restrictions on financial transactions might make it easier for consumers to place bets online.
 Observation: Lifting the restrictions of the UIGEA would not make it significantly easier for U.S. residents to make deposits to online sites. Enough workarounds have been designed, and are energetically promoted to consumers by the offshore sites, to render the existing restrictions largely ineffective.
• Mechanism: Advertising by licensed online gambling sites might lead to increased problem gambling.
 Observation: Although advertising is one avenue for the expected increase in online gambling that would follow legalization, little evidence exists to show whether and to what extent advertising-induced growth in, or redistribution of, gambling volume might produce increases in problem gambling rates. Furthermore, this mechanism (allowing advertising for online gambling sites) is controllable to the extent deemed necessary or desirable, through regulatory restriction.
We also looked at two mechanisms through which legalization and regulation could drive problem gambling down:
• Mechanism: Tax and license-fee revenue distributions may provide an opportunity to extend and enhance counseling, treatment, and support programs for problem gamblers.
 Observation: Significant tax revenues might be anticipated from U.S. operators, and revenue distributions from taxes and license fees could substantially boost publicly funded prevention, counseling, and treatment programs, as well as research on gambling addiction. Existing budgets for counseling and treatment services for problem gamblers have been limited, and most health insurance programs do not currently cover these services.
• Mechanism: Regulators could require licensed domestic sites to lead the world in offering a full suite of advice and protections for problem gamblers to an even greater extent than is the case in bricks-and-mortar casinos.
 Observation: U.S.-licensed sites could be required to display offers of help prominently on their websites, including (1) registration pages that offer self-diagnostic tests designed to help would-be gamblers understand their own attitudes and vulnerabilities; (2) web pages that display prominent links to support and counseling services; and (3) availability of speed-of-play, compulsory time-outs, or player-loss-rate caps. All players should be offered the opportunity up front and at subsequent intervals to voluntarily exclude themselves or to limit their own deposit rates, loss rates, betting rates, or periods of play.
We believe that the opportunities to mitigate problem gambling provide significant benefits not available under the status quo. These benefits provide a significant counterweight to any potential increases in problem gambling that result from legalization. Furthermore, the potential benefits of mitigation would become available to most existing online problem gamblers.\
E. Conclusions
We have examined 10 distinct risks in four categories that may be associated with the growth and availability of online gambling. In each case, the current legislative framework is failing to provide any effective risk control or consumer protection. The establishment of a well-regulated industry under U.S. jurisdiction would offer the opportunity for much better protection. We recommend that plans for regulating online gambling include the design and use of different risk-control strategies for different risks that may be associated with Internet gambling, as well as education and consumer support.
If the United States decides to legalize and regulate online gambling sites, we would expect most U.S.-resident gamblers to be diverted from overseas sites toward reputable and trusted domestic operators. In the long run, reputable gambling operations under U.S. control should come to dominate online gambling opportunities chosen by U.S. consumers. All four categories of risk would be better controlled in such circumstances than they are at present. In the end, U.S. consumers would be better protected than they are now.