First of two parts

In early 2022, a powerful tech company offered to help the Iowa Division of Criminal Investigation’s sports wagering unit.

The division, which launched in 2021 to investigate fraud in the state’s new online betting market, was struggling to track and monitor gamblers as the industry grew rapidly in Iowa. Unlike the monitoring by DCI’s gambling and horseracing investigators, based at casinos and Prairie Meadows racetrack, the agents on the sports betting unit didn’t have tools to see who was placing wagers from anywhere in the state.

Then, in March 2022, the unit received an offer from GeoComply, a Canadian company that contracts with sportsbooks like FanDuel and DraftKings to track the locations of their users. GeoComply said it would share the company’s software with the DCI and train its agents on how to track bets around the state as they happen.

“We can make huge gains in the discovery of illegal activity that we know is taking place,” DCI Special Agent in Charge Troy Nelson told Brian Ohorilko, then director of the Iowa Racing and Gaming Commission (IRGC), in a July 2022 email.

What followed, however, became a statewide controversy. Without a warrant, a DCI agent used the tool to discover that Iowa State University and University of Iowa athletes were using wagering accounts registered to parents and friends to place bets ― and some bet on their own games.

The investigation netted 25 arrests. It also attracted outrage from politicians, coaches, fans and sports commentators who accused the DCI of violating high-profile athletes’ constitutional rights.

A Des Moines Register review of hundreds of DCI and Gaming Commission emails has revealed the origins of the controversial case, showing for the first time that GeoComply played a prominent role in how law enforcement investigated the athletes.

In addition to giving the DCI its software and training agents on how to spot suspicious bets around Iowa, GeoComply officials held monthly meetings with law enforcement investigators around the country to explain where to find “hotspots” of illegal betting, the Register’s review found. A DCI agent’s memo, meanwhile, suggests that GeoComply helped coach Iowa officials on how to write state regulations that would allow the geolocation company to turn over information without a warrant and without informing sportsbooks.

The Register’s review also shows how dependent sports betting investigators have been on the whims of private companies. Without many rights to monitor online wagering in Iowa’s current law, DCI agents depended on GeoComply. In January, when GeoComply cut the DCI’s access to the tool amid the rising controversy, the agency was once again left without any reliable way to monitor sports betting, an industry viewed as ripe for fraud, money laundering and addiction.

“People are going to be very shocked with how involved GeoComply was with this,” said John Holden, an Oklahoma State management professor who studies sports betting. “We, effectively, have created this self-regulatory system if this is how it’s supposed to work. Do we want that? I think that’s a fair question. Can you trust these companies to do this job?

“Given the outcome that we’ve seen in Iowa, I think there’s questions that they have to answer.”

DCI agent asks for tech company’s ‘special sauce’ to investigate potential sports betting fraud ring

Founded in 2011 by online gambling company executives who saw the need for geolocation services for gambling companies, GeoComply has grown into an industry giant since the U.S. Supreme Court allowed states, including Iowa, to legalize sports betting in 2018.

The company now contracts with the country’s biggest mobile betting companies, including FanDuel, DraftKings, BetMGM and Caesars. GeoComply’s clients control 90% of the online gambling market, and investors value the company at more than $1 billion, according to the Wall Street Journal.

When users register with online betting companies, they consent to those businesses sharing their data, including their locations. Those companies, in turn, share the information with GeoComply, which uses Wi-Fi signals, GPS, cell-tower signals and other data to track a user’s location.

Sports betting companies must track users’ locations because they must abide by different regulations and laws depending on where a bettor places a wager.

As it has grown, GeoComply has become a go-to source in the media for information about the prevalence of sports betting around the country. During one presentation, GeoComply showed that 1,200 users opened mobile betting apps inside Nile Kinnick Stadium during Iowa’s 2022 season opener against South Dakota State, records obtained by the Register show.

The company also cultivated close relationships with law enforcement agencies.

In Iowa, DCI Special Agent Brian Sanger led the sports betting unit’s use of GeoComply’s software for investigations. In February 2021, he emailed a GeoComply official for help obtaining data as part of a joint investigation with the Illinois Gaming Board. Sanger explained that he was looking into a fraud ring, and he asked GeoComply for its “special sauce,” the company’s collection of data that could show other sportsbooks that the suspects were using.

In response, GeoComply Senior Vice President of Compliance Lindsay Slade told Sanger her company had found more “data points” for the investigators. She also suggested that GeoComply could better assist Iowa officials in future investigations.

“Perhaps it’s best we discuss on the phone to determine how to move forward and coordinate data shares,” she said.

After the call, Sanger wrote a report titled “Why GeoComply should be licensed in Iowa.” He explained that the state’s current methods for investigating sports betting didn’t work well. He said sports betting investigators did not have a way to examine wagers without first tipping off sports books.

“This is an item of concern when investigating high-level patrons who have close connects with top-level casino/sports book management,” he wrote.

Sanger, however, offered a solution: The gaming commission should write a regulation requiring geolocation companies like GeoComply to get a license from the state. He said other states had created such a regulation.

Without the change, Sanger wrote, GeoComply would not have to abide by Iowa warrants or subpoenas because the company stores its information outside the state in a Virginia data center. But with licensing, Iowa regulators could create a rule that required GeoComply to turn over information upon request.

If the Iowa Racing and Gaming Commission followed through with licensing, Sanger wrote, GeoComply would turn over the information without a warrant. Further, the company would not tell its sportsbook clients.

He did not say where he came up with the ideas. But in part of the report, he referenced a conversation with Slader.

“GeoComply would prefer to be licensed by IRGC so GeoComply could share all their data, analysis, assist, and reports directly with state investigators without violating their sportsbook client contracts,” he wrote, citing what Slader told him.

Sanger’s paper circulated around the DCI in May 2021. In one email that month, DCI Special Agent in Charge Rob Winchell told Sanger that he mentioned the idea during a conference call with the Iowa Racing and Gaming Commission. Winchell said the regulators seemed to “like the idea very much.”

In June 2021, DCI Assistant Director Dave Jobes told agents that the commission was following through on enacting the license requirement. Internally, several DCI agents said the move was an important step to help them investigate sports betting crimes.

Iowa Division of Criminal Investigation readies for cooperative relationship with GeoComply

In February 2022, as GeoComply prepared to apply for a license in Iowa, Slader emailed Sanger to discuss how the company and the investigators could partner. She added that GeoComply had bulked up its own investigative team.

“We now also have dedicated fraud specialists who could do this hands on with you, and who work directly with law enforcement in other states on individual cases,” Slader wrote.

A month later, according to the emails, GeoComply Risk Services Director Danny DiRienzo discussed the potential partnership with Nelson, the special agent in charge of the DCI’s sports wagering unit.

Recapping his conversation to other agents, Nelson wrote that GeoComply would give them three training sessions about how to use the company’s tools. GeoComply gave the agents a demonstration of its tools in March 2022.

About two months later, DiRienzo emailed law enforcement officers around the country to propose monthly meetings, hosted by GeoComply.

“With the rapid spread of online gambling has come the spread of fraud including identity theft, credit/debit card fraud, money laundering, proxy betting and who knows what tomorrow will bring,” DiRienzo wrote.

After attending one of GeoComply’s meetings in July 2022, Sanger recapped what he learned to other DCI agents. He said GeoComply was picking up evidence of credit card and identity theft among sports bettors. Criminals were stealing victims’ information, registering accounts with their credit card numbers and placing bets.

Sometimes, Sanger wrote, GeoComply’s tool would identify “hotspots” ― single locations where an unusual number of accounts were apparently placing bets. According to GeoComply’s notes from the meeting, regulators and investigators from 10 other states attended the meeting.

“It sounds like GeoComply is assisting these agencies locate/find ‘hotspots’ (high activity areas) around their states using their geolocation ping maps,” Sanger wrote.

Racing and Gaming Commission head hesitates about signing off on DCI-GeoComply relationship

While DCI agents were beginning to learn how to use GeoComply’s tools, according to the emails, the company insisted that the Iowa Racing and Gaming Commission needed to sign off on law enforcement’s use of the tools.

Commission leaders weren’t sure whether this was a good idea. They canceled a joint call with the DCI and GeoComply in July 2020, with leaders saying internally they didn’t know if they could give law enforcement access to the tool.

Nelson, the special agent in charge of the DCI’s sports betting unit, emailed then-commission director Ohorilko directly five days later. He said GeoComply’s tools could “help curtail the fraud that we know is taking place all of the time but is not being reported by the sports operators.”

“They are very proactive as it relates to sharing information and logging suspicious activity,” he said.

On July 27, Ohorilko told Nelson he would discuss the proposal with GeoComply.

“I apologize for being apprehensive when it comes to these requests,” he said. “Make no mistake, we want to cooperate and help as much as we can.”

More: Iowa State player’s father recorded calls with gaming commission leader over betting probe

He added that the gaming commission had not wanted to be responsible for those decisions, but lawmakers tasked his group with regulating the sports betting industry. He recalled debates in 2019 over how lawmakers should write the legislation.

“Public safety wanted access to much more citing the improved ability to prevent criminal behavior,” Ohorilko said.

More: Iowa lawmakers halt attempt to tighten sports betting rules after college gambling scandal

On Aug. 4, 2022, Nelson told Ohorilko, “In talking to other state regulators and law enforcement, they rely heavily upon the information provided by GeoComply to make their cases.”

Ohorilko responded that he was still not sure why GeoComply wanted the gaming commission to sign off on sharing its tool with the DCI.

“My sense is that GeoComply believes this technology could be beneficial for other types of investigations and may not have a way to control how our agencies use the information…..which is why they are looking for the commission to say it is okay,” Ohorilko said. “In other words, if either agency uses the information in the wrong way; they will advise the aggrieved party that the IRGC required or gave permission for them to share. I may be looking into this too much though.”

A couple of weeks later, after hosting a conference call with DiRienzo and Iowa Assistant Attorney General Jeffrey Peterzalek, a gaming commission employee told GeoComply that the company could share its tool with DCI agents.

In September 2022, according to the emails, GeoComply gave login credentials to gaming commission and DCI staff, allowing them to practice using the software. DiRienzo also offered the gaming commission a “monitoring package” that included a 65-inch television and an Apple Mac Mini desktop computer.

GeoComply trained employees in an online meeting that same month. DiRienzo then traveled to Iowa for a Nov. 30 in-person training session.

Prior to that meeting, Nelson emailed the DCI sports wagering agents.

“Bring your laptop as you will be working through live cases,” he wrote.

GeoComply showed the DCI how to use the company’s pindrop map, which displays dots where people are placing bets around Iowa. The agents could zoom in to specific areas, seeing whether several users were placing bets in a single location.

In training slides presented to law enforcement officers around the country, GeoComply highlighted that they could use the tool to look for betting activity in areas where people should not be gambling, such as prisons.

In one example, GeoComply explained how the company helped investigators track bets inside a high school. The tool shows only account numbers, not the names of the people placing bets. But, according to the presentation, GeoComply could tell that the account users had connected their phones to Apple Air Pods, leading investigators to believe the bettors were high school students rather than teachers.

In early 2023, according to defense attorney court motions, Sanger used the tool to identify betting activity inside Iowa State and Iowa athletic buildings. The DCI then subpoenaed sports betting companies, which revealed that athletes and student managers were using accounts registered to parents and friends. Prosecutors in Johnson County, home of the University of Iowa, and Story County, home of Iowa State University, filed charges against 25 defendants for underage gambling and identify theft.

As controversy rises, GeoComply backs away from the Iowa Division of Criminal Investigation

The cases, which ensnared Iowa State quarterback Hunter Dekkers and Denver Broncos defensive lineman Eyioma Uwazurike, a recently graduated Iowa State star player, drew national attention. No other state had seen such a slew of cases involving college athletes using betting apps, and soon questions began flying about the prosecutions.

Meanwhile, GeoComply’s stance toward the DCI changed.

During a presentation at the Global Gaming Expo in Las Vegas in October, GeoComply staff presented a slideshow titled “Geolocation Best Practices.” One slide featured a screenshot of a Wall Street Journal story about the Iowa investigation.

“In recent investigations, state investigators were called into question for their use of sensitive data without due process,” one slide read. “Authorized access to sensitive data, including geolocation data, should be clearly outlined in regulations to ensure responsible use and application.”

On Oct. 26, GeoComply Government Relations & Licensing Director Gabrielle Angle attached the slideshow in an email to several Iowa Racing and Gaming Commission employees. She also said the company was going to cut off the DCI’s access to GeoComply software “by a certain date.”

In a Jan. 23 court motion, defense attorneys for Iowa State University players alleged Sanger had testified in a deposition that he did not obtain a warrant before checking for betting activity using GeoComply’s software.

Two days later, Angle again emailed the gaming commission, writing that GeoComply would cut off the DCI’s access to the company’s software by the end of Jan. 26. Defense attorneys later obtained the email from the Iowa Racing and Gaming Commission through a public records request, leading them to accuse the DCI of withholding key information in the cases against their clients.

Defense attorneys also alleged that DCI Special Agent Mark Ludwick, in his own deposition, testified that he had been misled during the investigation, saying that based on representations by his supervisor, he told former Iowa State defensive lineman Isaiah Lee that he was not the target of a criminal investigation. Lee was later charged.

News of Sanger’s warrantless search sparked criticism around the state.

“Will DCI be conducting warrantless searches on other kids?” state Sen. Janet Petersen, D-Des Moines, said at the Capitol. “… Where else are Iowans’ privacy rights being violated?”

“Most of us are more concerned with constitutional rights than $5 parlays,” WHO-TV sportscaster Keith Murphy said on the air.

“Basic liberties were infringed upon,” University of Iowa wrestling coach Tom Brands said during a news conference.

In Story County, prosecutors dismissed charges against five defendants in March. In four of the cases, an assistant state attorney cited GeoComply’s decision to strip the DCI of the company’s tool.

A prosecutor wrote that GeoComply had not responded to his calls seeking more information. GeoComply has also not responded to multiple interview requests from the Register.

When a reporter visited Story County Attorney Tim Meals’ office April 3, his assistant said Meals was in a meeting but that he had told her he was “not real interested” in discussing the cases.

Johnson County Attorney Rachel Zimmermann Smith’s office prosecuted the last pending cases in her jurisdiction, even after learning that the DCI had lost access to GeoComply’s tool.

Asked whether she thought DCI agents needed a warrant to check betting activity on GeoComply’s software, Zimmermann Smith told the Register in an email, “Prior to charging we did a thorough review. We are satisfied that all evidence was obtained by lawful means.”

Legal expert: Warrantless searches in Iowa sports betting cases were constitutional

Orin Kerr, a law professor and Fourth Amendment expert at the University of California, Berkeley, agreed with Zimmermann Smith that the warrantless searches were legal. He told the Register that DCI agents did not need a warrant to track bettors’ locations with GeoComply’s software.

While courts have yet to weigh in on many elements of how law enforcement officers have used geolocation data, Kerr said the police do not need a warrant when all parties freely give up their data.

In the Iowa cases, the defendants agreed to share their data with DraftKings and FanDuel. Those companies, in turn, shared the data with GeoComply, which shared it with the DCI. Those agreements amounted to a chain of consent, Kerr said.

The Fourth Amendment’s requirement of warrants centers on whether the government can forcefully take evidence. In Iowa, the DCI did not use force.

“It’s like your roommate allowing the police to search your apartment,” Kerr said. “You might not want your roommate to do that. But they can. … They have authority over your apartment, in the same way that GeoComply has authority over the data.”

While GeoComply has not explained its shifting relationship with Iowa law enforcement, the company does have a financial incentive to encourage betting. GeoComply’s revenues come from contracts with sportsbooks, which receive more revenue as users bet more.

GeoComply has also at least explored a business model that more directly relies on users’ betting activity. In October 2022, the company told gaming commission officials that GeoComply was contemplating a contract that would pay the business a percentage of a sportsbook’s revenue, as opposed to a flat fee.

At least one gaming commission employee raised concerns.

“It would put GeoComply’s skin in the game from a revenue perspective. So at that juncture, would they look the other way if a whale with a certain (sportsbook) was flagged(?),” wrote Gaming Commission Sports Programming Manager Danny Lawhon, referring to a high roller.

Others at the commission did not share Lawhon’s concerns.

“All gaming in Iowa is a revenue-driven business,” said Ian Hudson, the commission’s director of gaming. “… This argument could easily be applied to any licensee or business, so I’m not sure why we would want to distinguish GeoComply.”

Tyler Jett is an investigative reporter for the Des Moines Register. Reach him at [email protected], 515-284-8215, or on Twitter at @LetsJett. He also accepts encrypted messages at [email protected].

This article originally appeared on Des Moines Register: How a private tech company pushed Iowa sports betting probe, then walked