Heads Will Roll

A (Not So) Brief History of the Iowa Gambling Scandal

Before we begin: I was compelled to write this because the Iowa gambling scandal has been slowly rolling out for a year, with new details trickling in from time to time, and I hadn’t seen a full compendium and explainer of the legal side yet. But everything in this — and I mean everything — is the result of the lawyers for the defendants and the dogged reporting of the Iowa press. It’s not plagiarism if you link to it, and I do my best throughout, but I give my deep appreciation to all those involved.

The charges came on August 1.

There had been rumors for months. They started in the winter, as the sort of pseudo-sourced insider fodder that only ends up being true half the time. On May 8, the Iowa Racing and Gaming Commission — the regulatory agency for gambling statewide, including sports gambling — issued a press release stating that it was “aware of an ongoing investigation by the Iowa Division of Criminal Investigation…concerning sports wagering that includes individuals affiliated with the University of Iowa and Iowa State University.” Later that day, the University of Iowa confirmed 26 student athletes were under investigation. Iowa State admitted 15 of their athletes were involved, as well. Still, it took another three months before the charges came.

They hit some programs hard, especially Iowa Wrestling and Iowa State Football. The biggest names:

• Hunter Dekkers: ISU’s starting quarterback from 2022 was accused of placing 366 wagers, including 297 when he was underage, totaling $2800.

• Jirehl Brock: Iowa State’s star halfback was accused of placing 1,327 wagers totaling $12,000.

• Arland Bruce: The Iowa receiver was alleged to have placed 132 bets totaling $4300. He had already transferred by the time he was charged.

• Reggie Bracy: Another Iowa State football player, alleged to have placed 66 bets totaling $715. He had also already entered the portal, and transferred to Troy.

• Ahron Ulis: A former Iowa point guard, Ulis had allegedly made 1,850 bets totaling just under $35,000. About a third of them were before he turned 21. He had also transferred out by the time the charges dropped.

• Paniro Johnson: The reigning Big 12 wrestling champ at 149 pounds was accused of 1,283 wagers totaling up to about $45,000.

In total, the list included 25 former and current student athletes, managers and staff. Importantly, the list included Eyioma Uwazurike, the former Cyclone defensive lineman who had since been drafted by the Denver Broncos, and Isaiah Lee, another ISU football player who allegedly bet 115 times for $885.

Why did it take DCI and IRGC three months to charge two dozen Iowa-based student athletes with crimes related to sports gambling? It was no coincidence that the charges dropped in the middle of preseason media appearances for both schools’ football programs. They hit at a time of maximum media interest in both teams, and the allegations — in Ames, in particular — targeted some of the most prominent members of those programs.

They were also borderline nonsensical. Iowa legalized sports gambling in August 2019, but the legislature had passed Iowa Code 725.19 fifteen years prior. Under that section of the Iowa Code, underage gambling was a “scheduled violation” like possession of alcohol under the legal age, punishable by a ticket and a fine of $645. That may be a lot of money for a college kid, but it’s hardly the sort of thing that generates the appearance of scandal and sells newspapers.

Instead of taking $16,000 from college students, authorities charged the 25 student-athletes accused of underage gambling with “tampering with records.” Iowa Code 715A.5¹ makes it a crime to “falsify, destroy, remove, or conceal a writing or record, with the intent to deceive or injure anyone or to conceal any wrongdoing.” Under this theory, the crime was not underage wagering. The crime was using someone else’s online sportsbook account — whether from a parent, a friend, or an imaginary person — to place those bets, and the victims were the online sportsbooks. Unlike those $645 tickets for underage gambling, tampering with records is an aggravated misdemeanor that brings the threat of two years in state prison. And for a few lucky guys, prosecutors added a charge of identity theft, carrying a maximum sentence of 10 years.

In Iowa, criminal complaints are filed by the county attorney, and so the Johnson County Attorney and Story County Attorney brought the charges. But those charges have to be supported by an affidavit describing the crime, the investigation, and the evidence supporting it.

In the Iowa gambling probe, those affidavits were signed by Brian Sanger.

---

Brian Sanger is an investigator at DCI, the state version of the FBI in Iowa. Since his name hit the news in January, his minimal social media profile has effectively vanished. According to court documents, he’s employed as a DCI special agent in the Sports Wagering Unit. I’ve been told he played football and wrestled at Waldorf University, a small college in Forest City, Iowa. His LinkedIn page has him working in Epworth, outside of Dubuque, and state salary information shows him as a resident of Dubuque County. State records show he was initially hired as a gaming enforcement officer in 2008, and became a special agent in 2011. In 2014, he cracked a ring of fraudulent cash transfers at the Dubuque riverboat casinos that took down a multi-state crime syndicate, and got a bit of notoriety as a result. Soon after, he was promoted to “Special Agent 2.”

Sanger moved into the Sports Wagering Unit, a division of the DCI tasked with enforcing the new regulations on sports gambling, soon after its creation in 2021.² As the Des Moines Register reported last month, the Sports Wagering Unit was struggling to enforce sports gambling rules, largely because it had no mechanism for monitoring activities in what has become a largely phone-based online industry. Casinos could check IDs at the door and watch the action from cameras. How was DCI supposed to do the same when everyone could place sports bets from a phone app anywhere in the state? How do you check the door when there is no door to check?

Sanger thought he had the answer. In 2021, Sanger was investigating a fraud ring in coordination with the Illinois Gaming Board, when he contacted an online gambling monitoring company named GeoComply. If you’ve ever tried to place a bet on an app while located in a state where it’s illegal, you probably learned of GeoComply as the company that locates your phone for the sportsbook and prevents you from breaking the local law. In 2021, as part of that investigation with Illinois, Sanger asked for their “special sauce.” In response, he got a phone call from the company’s Senior Vice President of Compliance to coordinate use of GeoComply’s data in his investigation.

---

That “special sauce” was geofencing. The practice of “geofencing” has been around for a while, and exists due to the massive volume of data obtained and retained by cell service providers and tech entities such as Google and Apple. Cell phone tower data, Wi-Fi signals, and GPS data is cataloged and readily available, if the right software is provided. Such data been used in numerous criminal investigations to pinpoint the location of a suspect at the time of a crime; anyone who watched the Netflix series on the Alex Murdaugh murder investigation saw it in action. That data can also be used in the opposite manner: Identifying a location where a crime is likely being committed, and pulling all cell phone user data in that location at a given time to narrow the pool of possible suspects. This practice — putting up a virtual perimeter and collecting all the data inside — is “geofencing” at its most basic.

In the criminal investigation context, geofencing is also a search and seizure, which means it generally requires a warrant. The standard for those warrants is relatively low, and the use of geofencing to monitor the activity of a large group of mostly innocent people has grown exponentially. According to a 2021 article in the Harvard Law Review³, “between 2017 and 2018, the number of geofence warrants issued to Google increased by more than 1,500%; between 2018 and 2019, another 500%.” By the time of that article, Google was fielding as many as 180 geofence warrant requests per week.

It’s allowed in large part due to those terms and conditions that we all scroll through and accept without a moment’s thought. Most tech data companies bury a notice in their terms and conditions that they will turn over user data upon receipt of a warrant, and the question remains open in many jurisdictions whether cell phone users are voluntarily giving away their constitutional rights when they click their consent without reading those notices.

While the bar for a geofence warrant is low, there is a bar: The Bill of Rights. The Fourth Amendment requires both probable cause and particularity to justify any search, whether it be an old-fashioned search of your home or a virtual taking of your digital fingerprint. In other words, the investigating agency must show that there is some basis — a tip or information indicating that a crime is being committed — and a limitation in the area to be searched. Most importantly, that showing must be made to a judge, who gets to determine whether the warrant is issued.

In the case of a geofence warrant, most are supported with some sort of information on a crime being investigated and a basis for why it’s being investigated in that area. The warrant is issued to a private company holding the data, with a search radius and time period. Frequently, investigators make impromptu changes to these parameters after the warrant is issued to better refine the results. But first, the warrant must be issued.

---

According to the DMR, immediately after that call, and on the recommendation of GeoComply’s vice president, Sanger began advocating for the licensure and use of GeoComply in Iowa. GeoComply held their data outside the range of an Iowa subpoena or search warrant, but if regulators licensed the company, GeoComply would “share all their data, analysis, assist and reports directly with state investigators,” with one important distinction: They would do so without the need for a warrant. GeoComply had taken the position that sports betting app users had consented to the disclosure of their user information to other parties through the terms of service in the app. By GeoComply’s read, that consent included disclosure to law enforcement, without a warrant being needed. Rather, GeoComply interpreted the terms and conditions at FanDuel and DraftKings as permitting disclosure "to satisfy any applicable law, regulation, subpoena, governmental request or legal process if in [GeoComply’s] good faith such is required or permitted by law.”

Within four months, the wheels were in motion. Sanger attended a meeting with GeoComply in July 2022 where he learned how GeoComply was using geofencing to find areas of high gambling activity, and compiling evidence of fraudulent wagering through identity theft. In September 2022, GeoComply turned over access to its software, named Kibana, to DCI staffers to practice using it pending licensure. On November 30, GeoComply held an in-person training session with DCI, showing how geofencing could be used to locate gambling in places where it would likely be illegal, such as high schools. Documents filed by the State of Iowa in one of the subsequent criminal cases state that there was no discussion of restrictions on the use of Kibana during that training.

By early 2023, DCI in general — and Sanger in particular — had access to Kibana, despite no formal licensure being approved. According to motions filed in one of the criminal cases, Sanger initially used Kibana to put a warrantless geofence around “a freshman/sophomore dorm at the University of Iowa to investigate underage gambling without any tips, complaints, or evidence that underage gambling was occurring.” In other words, the geofence was placed without any probable cause necessary for a search warrant. Sanger took the information he obtained to his supervisor, Troy Nelson, and asked permission to proceed with an investigation. Nelson and Assistant DCI Director David Jobes denied that request.

Undaunted, Sanger then geofenced the Iowa football facility.⁴ He performed the same search and obtained the same kind of information. He reviewed it with a team that included agents Chris Adkins and Chris Swigart. He then took it to Nelson and Jobes.

Only this time, Nelson and Jobes said yes.

---

Why Sanger’s supervisors authorized him to proceed with his search of the Iowa football facility — and then broaden it to other facilities at both Iowa and ISU — remained a subject of speculation until this week. In internal emails published first by WHO in Des Moines Wednesday night, DCI says the quiet part out loud: That they targeted student athletes at Iowa and Iowa State because it would generate the most headlines.

On February 2, 2023, Special Agent Chris Adkins (one of the investigators working with Sanger) emailed Sanger and Nelson:

I was thinking about the discussion yesterday surrounding the Iowa football program. I might be in the minority, but I think this is one of those things that would bring attention to our unit, not only in the public’s eyes, but also as far as the commissioner and even possibly the legislatures [sic].

From what I gathered from what Brian said, there is a crime here. Underage individuals using their parent’s names on their sportsbook accounts. So you possibly have underage gambling and also maybe identity theft. As far as the coaches, players and managers are concerned, we don’t necessarily have a crime on the books in Iowa, but I think it would be a good idea to report them to the University, the Big Ten and the NCAA. If they get suspended or get a scholarship taken away, so be it….

I know it seems like a lot of work for something small, but on a case like this, where it will be higher profile, we can show our worth to the powers to be [sic] along with sending out a warning that we will be overseeing things and hopefully work on slowing down these sorts of things in the future. And if we pursue this and it hits the media, which it would, and people start asking why nothing criminal was done — we can use that platform to hopefully push legislators for code changes moving forward.

That’s a state Special Agent admitting that — in fact, advocating for — DCI would use its resources to pursue and prosecute high-profile individuals despite knowing that “nothing criminal was done” by the vast majority of those targeted, just to drive up DCI’s profile among the public, the commissioner, and the legislature. Even if the gambling was legal — by a player over 21 years old, or a coach — they would punish those involved in any way they could through any authority available, whether it be suspension, loss of scholarship, or loss of eligibility.

Nelson, who was supposed to be supervising Adkins, responded with, “I like everything that you have to say here Chris and I am also on board with your perspective.”

If you had any doubt that DCI knew what it was doing was a violation of the Fourth Amendment, Adkins gave that away in September 2022. As reported by WHO, on September 15, a Story County prosecutor emailed Adkins and explained that a warrant would be needed to get geofence information. One week later, Adkins emailed then-Iowa Racing and Gaming Commission Director of Operations Tina Eick⁵ to complain that the Story County Attorney’s office was letting their demand for constitutional protections getting in the way.

Nelson knew, as well. Agent Swigart, who was part of the Sanger team that initially started the investigation, emailed Nelson on March 2, 2023:

Specific to some counties I’m working in, a search warrant will be the requirement for any location data obtained from geofencing on Kibana. It’s going to be a controversial issue for us to be able to articulate what leads an investigator to search specific locations for accounts based on the absence of a complaint or lead. Fourth amendment issues are going to be challenged when we are arbitrarily picking locations we want to randomly locate account information from.

Nelson’s response: “Hmm, very interesting. Yeah I’ll think through that.”

---

And so the investigation continued, and migrated to Ames, and branched out into other sports. “There [was] a crime here” in the eyes of DCI, and there were examples to make, and things like the Bill of Rights didn’t much matter if it was going to get in the way of DCI’s day in the sun.

And that’s when things truly went off the rails.

In early May 2023, DCI agents were dispatched to interview student athletes identified by the geofencing data obtained without a warrant. According to documents filed in the Paniro Johnson case, DCI Special Agent Mark Ludwick testified in deposition that the agents were told the interviews were “purely administrative,” and that the targets of the investigation were online sports books like FanDuel and DraftKings.

Ludwick testified that he told his interviewee — ISU football player Isaiah Lee — that Lee would face no consequences for talking with him. As a result, Lee told him everything. When Ludwick returned with the summary of their interview, Nelson “congratulated [Ludwick] for obtaining a confession.” Lee would be charged with felony identity theft and tampering with records, with a potential 10-year prison sentence in play. His statement to Ludwick would be directly cited in the charging affidavit.

This was the case for almost every player facing a criminal charge. Those affidavits that Sanger signed as part of the indictment? They near-uniformly included an admission by the target defendant, usually with a parent when it was a parent’s account being used. Because if you’re going to start the investigation by shredding the Fourth Amendment, the rest of the Constitution can go with it. Ludwick would request reassignment out of the investigation out of anger. He was not the only DCI agent to do so.

The investigation was so over the top, so blatantly unconstitutional from the very start, that DCI and prosecutors had to follow a very particular playbook to get the effect they wanted without having anyone dig into how they obtained the information. DCI wanted to make a scene. Handing out glorified traffic tickets to a handful of football players wasn’t going to cut it, and would likely only serve to notify potential underage gamblers that the consequences of their actions were no more than getting caught in a downtown Iowa City bar with an illicit pitcher of beer. They needed headlines, so they needed aggravated misdemeanors and a handful of felonies, and the charges had to drop during Media Day, so that the newspapers, the legislators, and the public paid attention and the investigation had its proper effect.

Of course, those charges weren’t going to hold up. Even if they hadn’t come from an improper search, they likely weren’t going to hold up. This was not “tampering with records” as intended, and pleading the crime stretched the statutory language to its breaking point. As the father of DeShawn Hanika wrote to the administrator of IRGC Brian Ohorilko in October 2023, the “identity theft” and “tampering with records” allegations equated to someone using their parents’ Netflix account, a permissive use by the alleged victim. Even worse, these weren’t high rollers. Isaiah Lee was facing a felony charge because he was improperly coerced into confessing that he’d made 115 bets averaging less than $8 apiece. Judges were going to throw out these charges, and if not, juries were going to laugh them out of the courtroom.

Once the headlines died down and the players were kicked out of their respective programs, prosecutors⁶ cleaned everything up by leveraging those over-the-top charges, backed up by those ill-gotten confessions, into quiet plea bargains for the modest statutory fines that weren’t enough for DCI to begin with. It was a perfect scenario for them: The players could remove the Sword of Damocles and avoid the possibility of jail time with one easy payment of $645. The prosecutors could get all those headlines, then quietly discharge the case before anyone dug deep enough to find that it came from the fruit of a poisonous tree. All eight cases brought by the Johnson County Attorney ended in underage gambling pleas and fines.

But in Ames, there were five holdouts: Lee, Paniro Johnson, Jirehl Brock, former ISU basketball player Osun Osunniyi, and Eyioma Uwazurike. The charges against Uwazurike — tampering with records and identity theft based on Uwazurike’s use of his girlfriend’s FanDuel account — became the biggest problem for prosecutors. By the time they were filed, Uwazurike had become a fourth-round draft pick of the Denver Broncos, and the charges against him included mention of 32 bets he allegedly placed on five Broncos games during his rookie season. As a result, he was suspended for the 2023 season by the NFL, missing out on $1.06 million in contracted salary. Uwazurike was also not underage at the time; rather, he was using his girlfriend’s account to place bets in order to avoid detection as a football player. Therefore, the simple remedy of a ticket for underage gambling was unavailable, even if he would accept it. And he would never accept it, because it could theoretically void his NFL contract and end his career.

All of that meant that prosecutors could not simply get rid of Uwazurike’s case with a quick plea deal. Almost immediately, his attorney, Van Plumb, began picking at the knot DCI and prosecutors had tied that held together the details of the initial search and subsequent investigation. It didn’t take much to find the loose thread. In October, Plumb filed a motion to dismiss on a very simple premise: Identity theft requires theft, and a theft cannot occur when the other party voluntarily gives the thing allegedly being taken. Prosecutors fell back on violation of “gambling rules established by the NCAA, Iowa State Football, and FanDuel,” which ignored the fact that none of those things are actual laws⁷. Plumb then sought evidence of the investigation from the IRGC, DCI and GeoComply, and the deposition testimony of the agents involved. By January 2024, Plumb and other defense attorneys were taking the court-ordered depositions of DCI’s agents, including Sanger.

The case melted down from there. Finally under oath, Sanger could not avoid disclosing the details of the search. By March, Story County prosecutors had dismissed the charges against the five remaining defendants, including Uwazurike and Lee. The last Johnson County plea deal was entered in late March — another $645 ticket for an Iowa basketball manager — and the criminal side of the matter came to an end. Earlier this week, 26 people implicated in the probe, including some who placed legal wagers that were then referred to the NCAA for punishment like Iowa defensive lineman Noah Shannon, filed a civil suit in federal court against the State of Iowa, DCI, and the individual agents involved.

---

In his February 2 email to Sanger and Nelson, Special Agent Adkins alludes to Iowa Athletics’ conduct of investigations:

[UI Athletics] will not report it to anyone until someone does something. They will do everything possible to keep it in house and sweep it under the rug. I have direct experience with this dealing with the U of I athletic department. We investigated a sexual assault by 2 football players years ago, and the athletic department was aware of it months before we found out. They tried to deal with it ‘in house.’

It’s a reference to the botched ‘in-house’ investigation of allegations of sexual assault against Cedric Everson and Abe Satterfield in 2007. Iowa Athletics convinced the victim to let them investigate a crime they absolutely should not have been investigating, and then did everything imaginable to avoid anyone else ever finding out about it. That investigation only came to light when a letter sent by the victim’s mother to the University, which detailed the horrific behavior of Iowa’s athletic administration, went ignored. She then sent it to the press. Had it not been for that one leak, from that one person concerned with getting justice, we likely still would not know the extent of Iowa’s impropriety and ineptitude.

Adkins is absolutely correct about that case. It was horrible, and horribly-handled. But what Adkins failed to realize at that moment was that, in advocating for DCI to go full rogue, he was recommending his department do the exact same thing that Iowa Athletics did fifteen years prior. Their goals were polar opposites — Iowa was trying to avoid headlines; DCI was trying to encourage them — but the means were the same. DCI took control of an investigation early, then used every method imaginable to railroad it to the ends it sought, no matter the appropriateness or constitutionality of what that entailed. They conducted repeated warrantless searches, lied to the investigation’s targets to get confessions, concocted unsupportable criminal charges, and then rushed them to plea agreements in order to avoid anyone finding out how they got to that conclusion. Like the Iowa investigation in 2007, that failed only due to the dogged efforts of people who saw that something was wrong about this from the start and would not stop until it was uncovered and brought to light.

This investigation has wrecked lives. It has wrecked careers on all sides. Eyioma Uwazurike is still suspended. Noah Shannon missed his senior season, and the showcase it could have provided to get him drafted into the NFL. When excerpts of his deposition were disclosed in late January, Sanger had been scheduled to speak at the Midwest Gaming Investigators & Regulators Conference in Colorado; his place on the dais was quickly removed. GeoComply quickly washed its hands of the Iowa investigation, yanked DCI’s access to Kibana, and appears to want to act as if it had nothing to do with DCI’s actions. Nobody comes out of this looking good: The players alleged to have gambled have nearly all admitted to breaking the law, or the rules, or some other regulation, and the investigators who pursued them apparently broke more fundamental laws than that in the chase. This investigation began with fruit from the poisonous tree, but it’s left scorched earth everywhere around it.

1. Chapter 715A is reserved for crimes related to “forgery and related fraudulent criminal acts” and generally used for financial crimes. However, it does have some academic components: Section 715A.6A relates to falsifying academic degrees, grades and honors to get a job.

2. Sanger’s annual pay — which went from a biweekly salary to hourly rates after his move to the Sports Wagering Unit — jumped from $89,000 to $119,000 over his first two years in the SWU. He was among the 35 highest-paid agents in the Department of Public Safety in 2023.

3. Geofence Warrants and the Fourth Amendment, 134 Harv. L. Rev. 2508 (May 2021). Let’s get some citations up in this motha.

4. This was made a generic “University of Iowa athletics facility” in documents filed with the court in January. The emails released this week, and discussed below, state that it’s Iowa football that was first targeted.

5. Point of full disclosure here: Tina Eick was a partner at my former firm when I was there, and I worked with her for more than ten years.

6. The last piece of this story that hasn’t been told, and will likely never see the light of day as it’s largely shielded from public disclosure, is why the Johnson County and Story County Attorneys agreed to bring these charges in the first place. If a Story County prosecutor in fact told DCI that it needed a warrant for the information it then used to charge these student athletes, how did they not shut it down?

7. We’re going to address this next, because I’ve had half a post in my drafts since August on this issue.