Q A Addendum RFI FGCC 25.26-12.pdf

STATE OF FLORIDA

FLORIDA GAMING CONTROL COMMISSION

REQUEST FOR INFORMATION

FOR A

ONLINE GAMING INTEGRITY GEOFENCING SYSTEM

RFI NO. FGCC 25/26-12

Questions and Answers Addendum https://flgaming.gov/

Questions and Answers

The Florida Gaming Control Commission (Commission) has received the following questions, and the Commission’s answers are provided in the table listed below:

No.

Question

Answer

Scope and Coverage

1. Which populations are in scope for compulsory blocking (e.g., state agencies only, K-12, higher education, local governments, general public via ISPs/mobile carriers)?

All populations in Florida, including the general public via: ISPs/mobile carriers.

2. Approximately how many users or subscribers fall under that scope today, and what growth should we assume over the next 3–5 years?

Because unauthorized online gaming operates outside regulated reporting systems and lacks transparent market disclosures, precise participation and growth figures are not available; however, there are million visitors and

22.6 million residents with access at any given time.

3. Are there categories of users/networks that must be excluded (e.g., law enforcement investigations, specific research networks, other exemptions)?

Yes, there will be categories of users/networks that must be excluded.

Network Topology and DNS Traffic

4. Which DNS resolvers currently serve the in-scope networks (state run DNS, ISPrun DNS, public resolvers, etc.)?

The State of Florida does not maintain a single statewide DNS infrastructure service for the general public. DNS resolution for Florida residents is currently provided through a decentralized mix of commercial internet service providers, enterprise networks, mobile carriers, and public recursive DNS services. Examples of providers serving Florida include, but are not limited to: Comcast/Xfinity, Spectrum/Charter, AT&T Internet, Frontier Communications and Hotwire Communications. Mobile Carrier DNS Infrastructure examples include but are not limited to: AT&T Mobility, Verizon Wireless, T- Mobile and smaller MVNO providers. Public Recursive DNS Services may be used to override ISP defaults and manually select public DNS providers. Examples include: Google Public DNS, Cloudflare DNS, Quad9, OpenDNS, AdGuard DNS and NextDNS.

Florida state agencies maintain internal DNS services for state-operated enterprise networks.

5. Can you share approximate DNS query volumes (queries per second or per day) for:

- State networks (executive branch, agencies, etc.), and

- Major ISP/mobile networks, if they are expected to participate?

We don’t have a current estimate for DNS volumes.

There is currently no expectation of participation from major ISPs/mobile networks.

6. Is DNS encryption (DoH/DoT) currently in use for any in-scope networks, and if so, by whom?

The assumption is that DNS encryption is in use; however, we are unable to quantify its utilization or identify entities.

Stakeholders and Deployment Model

7. Which telecom/ISP and mobile providers does the Commission envision as stakeholders in a statewide solution, and will their participation be mandated or voluntary?

At this time, the Commission or the State of Florida has no authority to mandate participation by telecommunications carriers, internet service providers, or mobile providers. The Commission’s RFI is intended to explore available options, if any exist, to block illegal casino operators from the state of Florida even if telecom/ISP and mobile providers do not participate in the program.

8. Does the Commission prefer:

- A central, state-operated resolver/service,

- A distributed model where each provider enforces a state policy feed, or

- A hybrid approach?

The purpose of this Request for Information is to obtain industry input regarding the technical, operational, and stakeholder considerations associated with implementing a potential statewide solution. In the RFI, the Commission is requesting information about a central, state-operated resolver/service, but also welcomes information about effective approaches that allow for coordination among telecommunications providers, internet service providers, wireless carriers, technology vendors, cloud service providers, and other entities.

Because the Commission has not predetermined a specific implementation model, this RFI seeks to better understand the roles, capabilities, dependencies, and participation requirements of potential stakeholders, as well as any statutory, regulatory, or practical limitations that may affect the deployment of such a solution.

9. Are there state workloads in public cloud providers (e.g., AWS, Azure, GCP) that must also be covered by the geofencing controls?

Yes, but based on ISP-level detections and blocking queries in this questionnaire, it is uncertain how the public cloud provider workload applies.

Policy and Legal/Compliance Expectations

10. How does the Commission plan to formally define an “illegal online gambling operator” for purposes of inclusion on a state blocklist (e.g., licensing status, specific statutory criteria)?

The Commission would apply existing Florida statutory prohibitions on gambling, using the definitions set forth in chapter 849, Florida Statutes.

11. Should the system block only clearly illegal operators, or also broader gambling content/categories on certain networks (e.g., for state agencies or K12)?

Information provided in response to the RFI should focus on blocking illegal operators.

12. What data retention period and level of detail are expected for DNS logs and enforcement decisions, including any specific Florida or federal legal requirements the Commission wants vendors to assume?

The retention periods must comply with Florida law. Please provide the maximum time period that such records could be stored and the cost associated with such storage, as well as shorter time periods (e.g., 5 years).

13. Are there constraints on where logs and configuration data may reside (e.g., U.S.only, FedRAMPlike expectations, specific cloud regions)?

Yes, CONUS (Continental United States)

Logging, Analytics, and Reporting

14.

Does the Commission require full DNS logging for all queries, or only logging of policy hits (blocked/allowed gambling related domains)?

The Commission does not require full DNS logging for all queries.

15. Which existing tools, if any, must the solution integrate with (SIEM, SOAR, data lake, case management), and what ingest volume or retention assumptions should vendors use?

Undetermined at this time.

16. What reporting cadence and granularity are expected (e.g., real-time dashboards, monthly/quarterly statewide reports, per agency or per provider breakdowns)?

Near-time information should be available to the Division of Gaming Enforcement.

Functional and Investigative Requirements

17. How quickly should new or updated blocklist entries be enforced statewide (e.g., near real-time, within a defined SLA)?

It is anticipated that the blocklist will be updated in near-real time.

18. How important are advanced analytics (such as lookalike domain detection, infrastructure clustering, or campaign analysis) versus a simpler, static domain blocklist approach?

It is important to incorporate advanced analytics into this process.

19. Does the Commission expect a vendor provided portal for Commission staff to investigate events and run reports, or will you primarily rely on log exports/APIs into existing state tools?

It is anticipated that a vendor-provided portal will be provided to the Gaming Enforcement to be used to investigate events and run reports.

Implementation, Operations, and Support

20. Is the Commission envisioning a phased approach (pilot then expansion) or a broad, initial statewide rollout?

Commission is seeking industry input to determine feasibility and the best approach.

21 What internal resources (FTEs or roles) will FGCC and state IT/security allocate for ongoing policy management, system operations, and investigations?

Commission is anticipating a turn-key solution;

however, we are seeking industry input to determine what, if any, additional resources are needed.

22. What level of support and SLAs does the Commission expect from a vendor (e.g., business hours vs. 24×7, response times for critical incidents)?

Commission anticipates business hours support for regular non-critical support and 24x7 for critical incidents, such as outages, with a one-hour response time.

Budgeting and Commercial Assumptions

23. Is the Commission planning for a multi-year subscription term (e.g., 3–5 years), and does it have a preliminary annual budget range or ceiling for planning purposes?

The Commission anticipates planning for a multi-year subscription term. The budget range is currently undetermined.

24 Does the Commission have a preferred commercial construct for planning purposes (e.g., per user/per subscriber, query volume-based, or a statewide enterprise model)?

A statewide enterprise model.

25. Does the Commission anticipate requiring mandatory professional services for initial rollout and onboarding of providers/agencies, and if so, approximately how many distinct environments or stakeholders should vendors assume?

Yes. Our assumption would be one distinct environment; however, if numerous environments are needed, please respond accordingly.