On April 30, 2013, the poker world saw the launch of the United States' first legal online poker site, Ultimate Poker. But Ultimate Poker has one significant limit: it is only legal within the boundaries of Nevada. As more sites come online under similar state schemes—New Jersey and Delaware are likely next—online gambling in the United States may be poised for an explosion.

It wasn't always this way. Among online poker players, Black Friday refers to the infamous day in April 2011 when the United States brought federal criminal charges against the founders of three major overseas online poker companies: PokerStars, Full Tilt Poker, and Cereus (under the brand name Absolute Poker). The move targeted companies accused of illegally catering to US players, and it shut down easy access to real-money online poker for American players.

Federal prosecutors alleged that the 11 defendants violated the Unlawful Internet Gambling Enforcement Act (UIGEA) of 2006 and conducted notable bank fraud between financial institutions, poker companies, and players. In parallel, a civil case sought the forfeiture of $3 billion worth of company assets, many of which were overseas.

Eight of the 11 named were out of the country when the indictments came down, but the others either pled guilty, settled with the government, served time, or experienced some combination of it all. The UIGEA (PDF) summary, as written by the United States Treasury Department, specifically "prohibits gambling businesses from knowingly accepting payments in connection with the participation of another person in a bet or wager that involves the use of the Internet and that is unlawful under any federal or state law."

One of those convicted as part of the Black Friday roundup was John Campos. He pleaded guilty to one count of "dealing in bets used as a means for participating in a lottery by a state nonmember insured bank" and served three months in federal prison. Campos remains on probation until November 2013.

The government accused Campos, then-vice chairman of the board of directors at SunFirst Bank in St. George, Utah, of agreeing to process gambling transactions in exchange for a sizable investment in the bank from these poker companies. In a sentencing memorandum (PDF), the prosecuting United States Attorney, Preet Bharara, wrote that SunFirst Bank processed more than $200 million in payments from November 2009 to November 2010.

"My perspective on it is that [the law for online gambling] is still not clear," Campos told Ars by phone. "Until some of the states start to actually pass the laws and the banks start processing, it's still pretty nebulous. I think there are still some questions as to implementations. I'm afraid to do anything in that area, because the federal government is scary."

Major poker sites will no longer do business with American residents for fear of running afoul of federal law.

"Everybody hates [the United States government]. You know why? We're like the sovereign of the world. [Internet poker] has come out and we're seizing people's money in France!" Jeff Ifrah, an attorney who represents PokerStars, told Ars recently over coffee in San Francisco. "Half the money [seized on Black Friday] was in France, Spain, and Italy. Players don't want to deal with US law enforcement [and risk] their accounts being seized or extraditions."

Players who had money on one of the targeted sites have largely had their assets frozen—the US is still trying to repatriate the money.

"I had about $12,000 on [Full] Tilt, so I still haven't seen that money and am hoping to get it back from the Department of Justice in the next year or two, if I'm lucky," Matthew Stout, one of the world's top poker players, told Ars. As a result of Black Friday, Stout decided to employ the services of PokerRefugees.com and relocated to Costa Rica, and later to the Netherlands, where he can play 15 to 20 tables at once online, all day long. (Stout noted that he still files taxes with the Internal Revenue Service.)

Now two years after Black Friday, the outlook for online gambling has changed dramatically. Collectively, the American market for online casinos and poker could be worth as much as $12 billion, according to a 2009 estimate by Goldman Sachs. At present, "traditional" (that is, offline) gambling revenues in the US total $35 billion annually, roughly the size of all foreign online gambling sites. With depressed economies nationwide, state governments increasingly want a piece of that revenue—and they are willing to license online gambling to get it.

There's just one problem: how do website users prove—really prove—that they are physically located in states like Nevada?

Welcome to Nevada

The big question for the new online gaming companies is exactly how are they going to limit online gambling on a geographic basis. The Internet is by nature borderless, though some applications do enforce IP geoblocking to limit the consumption of various forms of intellectual property (Hulu uses this). But to anyone who knows how to use a virtual private network (VPN), such blocks are trivial obstacles.

Under Nevada's new regulations, players using a Nevada-based poker website need to be physically present within the Silver State while playing, but they do not need to reside there nor have financial assets there. They simply need to prove that they are located within the state's geographic boundaries.

Nevada has not said precisely how it will determine a poker player's geographic location, but it does make clear that simply checking the IP address isn't going to cut it. "People do use IP geolocation, but it could not be a sole qualifier," Jim Barbee, the chief of the technology division at Nevada's State Gaming Control Board, told Ars.

If a company came to the board trying to get its poker product certified and was only using IP-based geolocation, Barbee said he would respond this way: "Why are you wasting our time? My nine-year-old can spoof that."

So what does Nevada require? "It would involve multiple data points, incorporating IP address, registration information, street address—we would be marrying all the data points together," Barbee said. "In order to do location information you're going to have to do an algorithm and weigh the variables. Based on the sum of those variables, you'll make a decision: is this person located in this area or not? One of those would be IP geolocation information. Another could potentially be where they were when they created their account. Another would be GPS information, and another would be cell phone or Wi-Fi triangulation. Overall, a solution will be multi-factor—it will include several of those data elements."