Steven Michener BSc. MSc., Director, Interactive Entertainment Technology Pty Ltd, ceo@ietec.com
Mark A Gregory BEng. (Elec)(Hons) MEng., Senior Lecturer, Department of Communication and Electronic Engineering, RMIT University, m.gregory@rmit.edu.au
Professor Paula Swatman BEc. PGDipBus. Ph.D., Director, Interactive Information Institute, RMIT University, paula.swatman@rmit.edu.au
Internet Gambling, Australian Government Legislation, Transaction Security, Control Procedures
Internet Gambling is the quintessential e-commerce application. The transaction is the product. Each bet, in essence, involves an e-commerce financial transaction. Monetary value is exchanged each time the virtual cards fall or spinning wheel stops. Gambling in Australia accounts for A$10 billion pa revenue. World gambling revenues are estimated at A$300 billion. For a margin of 3% this would equate to gambling, or potential e-commerce, transactions of A$10 trillion pa. As television, telephone and other devices become Internet capable and credible Internet gambling sites appear in more regulated environments the proportion of gambling transacted over the Internet is likely to grow very quickly. This paper addresses the technical and organisational e-commerce issues of government legislation relating to Internet gambling, transaction security and internal control procedures.
Australia is set to become one of the first countries to provide a fully regulated environment for Internet gambling. Several Australian States have now passed Internet gambling laws making it possible for Internet gambling companies to operate from their State.
There are many electronic commerce issues (both technology and policy related) concerning the emerging Internet gambling industry. This paper will look at three of these issues: government legislation which concerns Internet gambling, the security of transactions and internal control procedures – suggesting areas of concern and identifying possible solutions to these problems. This paper does not attempt to provide a complete analysis of these issues, rather offering a basis for future research in this area.
Figure 1 : Casino Internet system configuration
Figure 1 presents a model for an Internet gambling system, which includes functionality to permit the user to: connect with the system; be authenticated; play the Internet games; and carry out administrative tasks such as funds transfer, communicating with the system manager and interaction with other players.
For security or management reasons operators may wish to place some of the system components onto a private network. A network hacker who is able to gain entry to a machine connected to the Internet may also be able to access other machines connected to the breached machine. Moving some of the components onto a private network limits a hacker’s method of attack.
Although this model offers significant protection from many of the technical concerns popularly voiced about Internet gambling, there are three major areas in which e-commerce researchers need to concentrate their analyses:
E-commerce, with its rapid changes and ability to open up new areas of commercial endeavour, taxes to the limit governments’ ability to respond with rapid and effective policy development. In almost every part of the world, governments are undertaking enquiries and feasibility studies in an attempt to understand what is required and what can realistically be provided. Internet gambling is no exception to this rule – some governments (such as the United States) have simply refused to address the issue at all, making Internet gambling illegal, while those (such as Australia) which are trying to come to grips with the complex issues involved, are just now beginning to produce legislation on this rapidly developing area of e-commerce.
Several companies are already conducting Internet-based gambling in Australia, using various legislative and regulatory controls designed for other forms of gambling – for example, the TABs and sports book operators. Clearly, there is a need for legislation which addresses the real issues involved in these activities.
Queensland, the Northern Territory and the Australian Capital Territory passed legislation in 1998 for more generalised Internet Gambling. It appears they may begin to licence Internet gambling operators in the first half of 1999.
It is unclear whether the Federal Government will wish Federal financial institutions or other federal legislation to become involved in the control of Internet gambling – but this is considered unlikely. Restrictive legislation could be to the detriment of the Internet gambling industry, and State revenues, due to rapid changes in electronic commerce and the Internet.
As we point out in the following paragraphs, there are still a number of unresolved issues which existing legislation must address – and which new legislation should cover from its inception.
Clause 23 of the Queensland Interactive Gambling (Player Protection) Act (Queensland 1998) states:
Use of premises for interactive gambling
23. A person must not—
(a) advertise that premises are available for playing interactive games;
or
(b) seek to obtain a commercial advantage from the use of premises for playing interactive games.
The apparent intent of Clause 23 is to prevent, for example, a local arcade game operator from putting computers into their facility and promoting their facility as a gaming house, using Internet gambling, but the clause raises a number of important issues.
Would asking a few friends home to play a new multi-player game offered by an Internet gambling operator constitute a breach of this clause? What if an Internet café promoted or just allowed customers to play a licensed game on their premises?
There is great potential in multi-player-team based games where players attempt to beat the house or other teams for cash or other prizes. A team-based game, such as Microsoft’s Age of Empire™ (Age Of Empires 1998), if played for financial gain, will be far more rewarding and challenging to the younger Internet generation than playing a game based on a typical slot machine or draw poker. Interactive multi-player, role-based or tournament style games offer unlimited potential to Internet gambling operators.
Existing legislation does not appear to take these types of games into account.
Clause 136 (1) of the Queensland Interactive Gambling (Player Protection) Act (Queensland 1998) provides for a registered player to set the maximum bet limit at zero, thus effectively preventing him/herself from engaging in authorised games conducted by the licensed provider until the limit is relaxed or removed. This offers a number of possible solutions, depending on the operator’s attitude: the player could play the game without financial risk (unlikely, except in fairly limited circumstances), or the player could simply be prevented from playing at all.
Clause 160 (1) of the Queensland Interactive Gambling (Player Protection) Act (Queensland 1998):
Aborted games
160.(1) If, after making a wager in an authorised game conducted by a licensed provider, a player’s participation in the game is interrupted by a failure of an operating or telecommunication system that prevents the player from continuing with the game, the licensed provider must refund the amount of the wager to the player as soon as practicable.
In a casino if you are dealt a poor first hand in the game of blackjack you are not allowed to simply walk away from the game and get your bet refunded. This should not be allowed on the Internet either – or players would soon learn that they can recover from a poor first hand simply turning their modem off.
One measure an operator may take in regard to this clause is to ensure a player can continue the game when he logs back on to the system by providing for the state of play to be retrieved and for the player to be offered the opportunity to complete the game.
In other words, there need be no fixed time for the completion of the transaction once it has started.
More complex multi-step, team play or otherwise interactive games would be problematical under the above clause. Reconstructing such games with more than one player is impossible. Repeat offenders who can be seen to deliberately drop out of games for monetary advantage could be banned if regulators allow.
Assuming that government legislation can handle the technical complexity of Internet gambling, the next issue of major concern is the security of transactions, which is a fundamental requirement for a successful Internet gambling industry. "Transactions" in this case refers both to the transfer of funds into and out of a player’s account, and to the individual bets or wagers themselves.
Issues specifically relating to Internet gambling are both technological and organisational in nature and include:
Player accounts are not individual accounts with a financial institution. They are operated in a manner similar to that of a trust account – where the operator, or their trustee, will keep a trust bank account and ledger and maintain the balance attributable to each player. Although the status of these accounts is not clear under financial institutions’ legislation in Australia, it need not be a major cause for concern as there are many existing systems that provide customer accounts. Several existing gambling companies, for example, already hold customer accounts for phone betting clients.
Underage would-be gamblers and problem gamblers need to be identified so that they can be prevented from gambling. Examples of the requirements that are imposed on Internet gambling operators are provided in Section 137 and 179 of the Queensland Interactive Gambling (Player Protection) Act 1998 (Queensland 1998) which in part provide:
Prohibition of interactive gambling
137(1) An application may be made to the chief executive in the approved form for an order—
(a) prohibiting a person who is resident in Queensland from participating in authorised games; or
(b) revoking an order under paragraph (a).
(2) An application may only be made under this section by—
(a) a person who seeks a prohibition (or the revocation of a prohibition) against himself or herself; or
(b) a person who satisfies the chief executive of a close personal interest in the welfare of the person against whom the prohibition is sought.
Participation by minors in conduct of approved games prohibited
179(1) A licensed provider or an agent must not allow a minor to participate in operations related to the conduct of authorised games.
(2) It is a defence to a charge against subsection (1) to prove that the defendant had no reason to believe, and did not believe, that the person to whom the charge relates was a minor.
(3) A minor must not participate in operations related to the conduct of authorised games.
State governments may insist new player accounts are verified using the "100-point check" mandatory for new financial institution accounts in Australia (this involves producing identification having differing points scores – for example, a drivers licence counts for 40 points). This is not a requirement under current legislation, however under Section 17 of the Australian Capital Territory Internet Gambling Bill 1998 (ACT 1998) :
A licensed provider or an agent shall not allow a registered player to participate in an authorised game until the player’s identity has been authenticated under the licensed provider’s approved control system.
If the 100-point check becomes a regulatory requirement, how would a player’s driver licence or passport be verified over the Internet? What of international players? Once issued with a PIN number are further checks required?
If a player uses an electronic funds system similar to BPay™ (BPAY), DigiCash™ HREF1 or CyberCash™ HREF2 and has already satisfied the 100-point for their account in that system it may be argued that it is unnecessary to complete the check once again.
While more people are now using credit cards for purchases over the Internet, some service industry merchants, using telephone and internet credit card facilities, are experiencing high levels of charge backs. Australian banking practice is that where a client denies responsibility for an item on their credit card statement, the amount is automatically reimbursed to the client and the bank withholds that amount from the merchant’s floating balance. The merchant’s recourse is then with the customer. Prospective Internet gambling operators should weigh the risk of considerable losses associated with credit card charge backs versus potential revenues from impulsive gamblers "hitting the plastic".
Players will not deny transactions if they win, but if they have lost a significant amount of money the temptation to forget they made the transaction may be very real.
The timing of electronic transactions, authorisations and funds clearance will be important to Internet gambling operators. In no Australian jurisdiction is an Internet gambling operator allowed to give credit to a customer. Regulators will consider funds authorised by a credit card issuer to have been cleared – even though they may be subject to charge-back for up to six months. Currently none of the electronic finance providers carries out immediate clearance, and notification of cleared funds, without being subject to charge-back to a merchant. Next-day clearance is possible with some providers, with credit card transactions still subject to charge back.
Smart cards may be used to hold funds anonymously for use in gambling machines or be preloaded with funds that can be used in mobile phones and in pay phones. This approach is not suitable for Internet gambling, however. Anonymous clients are not desirable for several reasons: age verification prevention of money laundering, and problem gambler identification.
Money laundering has always been a problem associated with the gambling industry. This involves people betting with money derived from an unsuitable source wanting to "earn" clean money from gambling. The issue exists in the case of Internet gambling – although a requirement for identification may alleviate the problem to a large extent.
Verification of cash transactions will be heavily dependent on the use of off-line checking procedures and PIN numbers issued by the Internet gambling operator at the time of registration, unless a third party service, such as BPay™, is used.
Denials by players that they actually made certain gambling transactions, or lost a certain amount, have nothing to do with the financial institutions that transmitted the cash to establish the account. Players will still complain to their bank, the operator and the government, however, if they want to deny, or dispute, the operator’s records.
It should be apparent the same level of security involved in the cash transactions into and out of players accounts should apply to each gambling transaction.
Transaction security, therefore, must be addressed by a mix of legislative, operational and technical measures, applied as the individual situation requires.
The security of actual gambling algorithm, as distinct from the transmission of the gambling information – the transaction – is not considered in this paper.
There are many forms of possible fraudulent activities in Internet gambling which are analogous to those found in the physical gambling world – and some which are specific to Internet gambling. Comprehensive internal control procedures have been developed over many years for physical casinos, lotteries and other forms of gambling – and a similar approach is required for Internet gambling.
Regulations in Australia require Internet gambling operators to develop and implement control procedures. Procedures must counter the threat of players, the operator’s staff or third parties causing fraudulent gambling transactions or changes to records.
One methodology for such a set of control procedures requires a Government approved Trustee, the Trustee System. All electronic financial transactions would be carried out by the Trustee and recorded on the Trustee database. The Internet gambling operator, or its staff, has no access to this database. Regular data matching between the Internet gambling operator’s customer database and the Trustee master database will keep both databases synchronised.
By ensuring gambling decisions, and the transactions that flow from those decisions, are recorded independently on both the trustee and operator databases it is possible to prevent the operator’s staff benefiting from tampering with the transactions as they occur or player accounts, or creating phantom players. Also, if one of the Trustee’s staff were, for example, to create a phantom player this account would not have any game play appearing on the operational system.
Figure 2: Casino Regulatory Model
As illustrated in Figure 2 the Trustee System requires the interaction of several computer systems to verify the functions of the operator.
Further specific proprietary methodologies involving electronic keys combined with third party compliant systems are used to ensure that random number and gambling algorithms are secure and that the integrity of the entire transaction is rigorously guarded.
The Internet gambling industry is set to become a substantial e-commerce application in Australian. Internet gambling and electronic commerce in combination requires that technical solutions be found and agreed between government regulators and operators. This paper has:
discussed the three major classes of issue for safe and secure Internet gambling; and
briefly described a methodology for the implementation of an Internet gambling system that reduces the possibility of fraud being carried out by staff, players and third parties.
In this paper we have opened the discussion of these issues, and pointed to a number of areas for further research.
Solutions to the particular problems of Internet gambling require both legislative and technical solutions. There is a need for interaction between legislators, engineers and Internet gambling operators to ensure the operation of Internet gambling is both rigorously regulated and commercially viable.
Control procedures described in this paper have been developed as part of a contract being carried out by the author and RMIT University’s Interactive Information Institute and Pacific Casino Management Pty Ltd and are commented on here with permission.
Queensland (1998) Interactive Gambling (Player Protection) Act 1998 Act Number 14 of 1998
Australian Capital Territory (1998) Interactive Gambling Bill 1998 28 May 1998
BPAY™ is registered to BPAY™ Pty Ltd ACN 079 137 518
Northern Territory of Australia (1998) Gambling Control Act 27 May 1998
Age of Empire™ (1998) is a trademark of Microsoft Corporation http://www.microsoft.com
HREF1 http://www.digicash.com/
HREF2 http://www.cybercash.com/
Steven Michener, Mark A Gregory and Paula Swatman, © 1999. The authors assign to Southern Cross University and other educational and non-profit institutions a non-exclusive licence to use this document for personal use and in courses of instruction provided that the article is used in full and this copyright statement is reproduced. The authors also grant a non-exclusive licence to Southern Cross University to publish this document in full on the World Wide Web and on CD-ROM and in printed form with the conference papers and for the document to be published on mirrors on the World Wide Web.
[ Proceedings ]