What's It Going to Take?

A key issue facing the Nevada Gaming Commission as it moves forward in the licensing of online casinos is how safe and secure the facilities can be for consumers.

Industry experts are divided on how safe current systems are and how safe future ones need to be for Nevada gaming authorities to maintain the high industry standards they have in place with land-based operations.

"There is no Internet gaming system that could defend from an attack by a first-world hacker who throws all its resources at the site."

- James Sargeant
BMM North America

Many agree that if the proper steps are taken, then systems can be very safe. As high as a 99 percent protection from hackers and other attacks can be achieved (although it's been argued that even 99 percent isn't enough); the Gaming Commission will have to decide how high it wants its standards.

James Sargeant, a senior consultant for BMM North America, a firm that specializes in the safety and security of online gaming operations, feels that no matter what measures are taken, no site is fully safe from attacks.

A big loophole that many gaming operators fail to recognize is their vulnerability to attacks from inside their own ranks. Sergeant says that 70 percent of e-commerce attacks come from inside sources. As long as hackers with inside information target systems, he says, they would be penetrable.

Sergeant also feels that if enough resources are thrown at a site by a well-financed hacker, most gaming sites could be hit.

"There is no Internet gaming system that could defend from an attack by a first-world hacker who throws all its resources at the site," he said, but he admits it wouldn't be easy. "A properly maintained system would require a hacker to use a lot of time and money. You can get a system that would repel 99 percent of the attacks to it. It would take weeks or months for some systems to be penetrated, and that would require a lot of lost time. If someone could afford that they could probably crack most systems."

But other experts aren't so sure about Sergeant's assessment of the security situation.

Stephen Williams, the former chief technological officer for America Online and currently the chief technical advisor for the Interactive Gaming Institute of Nevada, agrees that no site is 100 percent safe but feels that they are safe enough.

"You can get 99.99 percent safety," he said. "There then starts to be a curve that you are so close to 100 percent that you are as safe as you need to be."

Williams says that there has to be a threshold for when operators know they have maximized their security issues and it is not in their best business interests to achieve higher standards.

He wonders if Internet gaming systems should be held to the same standards as those systems at the Pentagon, for example. Members of the Nevada Gaming Commission feel that sites need to be secure enough to keep minors from gambling online; to protect everyone, measures need to be at a high level.

Williams also says that an ideal solution for preventing outside hackers and unwanted players from accessing sites would create a combination of biometrics and e-border blocking devices like GPS tracking systems. Like Sergeant, he agrees that any system that's created has to be maintained for its effectiveness to be fully utilized.

"There are technology and business methods available today that greatly exceed reasonable assurance when properly deployed and monitored," he said.

The answer for the Nevada Gaming Commission may also lie somewhere in the middle. Williams compares the dilemma the commission faces to different means of travel.

At one end of the spectrum for transportation there's riding a bicycle; at the other there's the space shuttle. In the middle of those two modes of transportation is commercial flight. Plenty of consumers rely on the standards and practices in place for commercial aviation and the technology that drives it. There's little need for consumers to use the high standards and secure systems that help space agencies take man to the moon, but they're available at a certain cost.

The commission, Williams says, will need to find that medium of safe protection at a certain cost, but not "space shuttle" protection, which would come at an exorbitant cost to consumers.

The key point for Sergeant though remains that any rules and regulation that are put into place in Nevada will have to be followed for the utmost amount of security and safety to be assured. He admits that the sites that are the most vulnerable to hacker attacks are those in unregulated jurisdictions.

"I am unaware of any successful external penetration of any gaming system in a jurisdiction with strong regulations," he said. "A system can be tested and then problems arise later. The onus is on the operator to make sure that his system is up-to-date and constantly checked and counter-checked for problems."