DraftKings leaves door unlocked for barred fantasy sports players

By James Glanz and Jacqueline Williams, New York Times News Service

Saturday, Nov. 14, 2015 | 2 a.m.

Starting next week, the two leading daily fantasy sports sites will be barred from taking bets from a lucrative market — New York state. But one of them, DraftKings, leaves open a simple digital loophole that may let New Yorkers play anyway.

On Tuesday, the New York state attorney general ordered DraftKings and the other top site, FanDuel, to stop taking bets in the state, saying that daily fantasy sports is no different from online sports gambling, which is illegal in New York. With the hugely popular games coming under intense scrutiny, both companies say they will fight the action, and on Friday, both companies filed formal complaints.

But for DraftKings, the ruling and any courtroom battle may be easily circumvented. The New York Times, working with users in all six states where daily fantasy sports is already considered illegal, was able to make bets on the DraftKings site using the most basic, easily accessible service for disguising a computer’s true location.

Called a proxy server, the service is available for a few dollars a month from numerous companies. It allows users in, say, Iowa — one of the states where daily fantasy is illegal — to appear to be logging on to a website from somewhere else. Although companies can use standard technology to counter the service, The Times used it to make bets on DraftKings from Iowa and the five other states where daily fantasy is considered illegal.

On Thursday, for example, The Times tried to log on to DraftKings from Des Moines without a proxy and was informed that the user was in a restricted state and could not gain access to the site. Moments later, when the proxy was activated and the computer’s “Internet protocol” address appeared to originate from Los Angeles, the connection was allowed.

A user clicked to play the “$15 million fantasy football world champ qualifier” for a deposit of $5, choosing Aaron Rodgers of the Green Bay Packers as the quarterback and Travis Kelce of the Kansas City Chiefs as the tight end, among other players.

Fantasy sports, under a 2006 federal law, is essentially unregulated, and it is unclear whether the companies have any obligation to block such bets placed via proxy.

In contrast, FanDuel would not allow access via a proxy from any of the states where daily fantasy is considered illegal, The Times found. In Iowa, the FanDuel site noted that the user was in a “restricted location” and would not allow any betting.

In a statement, DraftKings said The Times had fraudulently gained access to its site. “The use of proxies by The New York Times is a deliberate technique to circumvent” the company’s tracking methods, the statement said. It added, “If users do so, they would be violating our terms of use, and therefore would not be eligible to play on our site.”

FanDuel declined to comment.

Experts in geolocation — the technique of determining a computer’s location — say that blocking proxies is one of the first, and most straightforward, steps websites take to keep users from restricted areas off the sites. (Both the FanDuel and DraftKings accounts were originally created in New York.)

If DraftKings continues its policy and does not block proxy access in New York, those experts say, then any resident here can continue to play fantasy sports even as the company can claim to be complying with the attorney general’s order.

By stating in the “terms of service” that users in some regions are not allowed, while at the same time doing little to enforce the rule, online gambling companies around the world often try to have it both ways, said Feda Mecan, a senior official at Playing Legal, a site based in Germany that is devoted to legal gambling in the United States. “I think they are playing that card, to be honest,” Mecan said.

According to a poker Web forum, a DraftKings employee appeared to provide public advice on how to circumvent geographic restrictions in the United States.

David Briggs, chairman of GeoComply Ltd., the technical arm of the firm that provides geolocation services to legal gambling companies in New Jersey, Nevada and elsewhere, said that enforcing laws at state boundaries is perfectly feasible — if the companies are serious about enforcing the laws. The services are sometimes called geofencing.

“What we’re doing for our customers is not lip-service geofencing but committed geofencing,” Briggs said. “We know the ways people can spoof their location, and we’re doing everything we can to stop it.”

The accuracy of that kind of geofencing has been amply demonstrated, said Todd Kobrin, a veteran of the online gambling industry who is based in Las Vegas. He said he could recall using a legal, online gambling site on a hand-held device in Nevada while being driven west on Interstate 15.

“If you go, literally, 10 yards into California, you’re not allowed to play — it stops,” Kobrin said.

In order to serve millions of customers in the United States, the fantasy sites now rely on an enormous computing infrastructure extending from coast to coast, including nests of servers that deliver content for the websites to users.

According to Internet routing data collected by Doug Madory, director of Internet analysis at Dyn, an Internet performance company, DraftKings is delivered from servers operated by Akamai, the world’s largest content delivery network. Content for FanDuel is delivered by CloudFlare, another such network, and Amazon’s Web services arm.

“Any customer contractually works with Akamai with the understanding that they are complying with any applicable laws,” an Akamai spokesman said in response to questions on whether the company might bear legal responsibility for delivering fantasy sports content.

“If that changes, then the customer has to address that. If not, we have the right to take action in accordance with our acceptable use policy.”

A spokeswoman for CloudFlare said the company did not comment on customers without their permission. Amazon did not respond to questions from The Times.

The five states where playing fantasy sports for money is considered illegal are Iowa, Louisiana, Washington, Arizona and Montana; regulators in Nevada declared in October that daily fantasy sports would be considered gambling according to state law there.

Marc Edelman, an associate professor of law at Baruch College, who said he was representing a smaller company in a legal dispute with DraftKings, said the proxy loophole left DraftKings open to accusations that it was inviting users to evade the laws in those states.

“It seems absurd that a daily fantasy sports operator with financial means would not implement the best possible technology,” Edelman said.