back to article Six charged for 'hacking' lottery terminals to spew only winning tickets

Six people have been charged with exploiting a bug in lottery terminals to print off winning tickets on demand. Connecticut prosecutors say the group conspired to manipulate automated ticket dispensers to run off "5 Card Cash" tickets that granted on-the-spot payouts in the US state. According to the Hartford Courant, a group …

  1. David Roberts
    Facepalm

    Expect a lot more charges

    Once someone discovers a way to work the odds, the word will spread like wildfire.

    Illegal, but far too tempting when it feels like a victimless crime.

    A variant on the "If you bang the machine just here you get free candy.".

    Immediate temptation and an anonymous victim.

    This does, of course, make you wonder how they test these machines.

    1. petur

      Re: Expect a lot more charges

      also, this is not how lottery (should) work(s)...

    2. DrBobMatthews

      Re: Expect a lot more charges

      Why am I not surprised at either at the scam. or the names of those charged!

      1. Hans 1
        Facepalm

        Re: Expect a lot more charges

        >Why am I not surprised at either at the scam. or the names of those charged!

        I am very surprised, because the US has the highest crime rate on the planet, and there are not that many Patel's in the US ... just sayin ...

      2. Ideala2

        Re: Expect a lot more charges

        Care to explain WHY you're not surprised at the names?

        A curious comment to make without qualification Bob.

    3. John Brown (no body) Silver badge
      Joke

      Re: Expect a lot more charges

      "A variant on the "If you bang the machine just here you get free candy.".

      Except that it's scary computer crime so life sentences if not executions all round!

  2. tfewster Silver badge
    Facepalm

    So, what's the charge?

    If I left a pile of cash in the middle of the street, I could hardly complain if some of it went missing.

    So if I implemented a "lottery" system (that I expected to make money out of) and someone successfully gamed it, I'd have even less to complain about.

    Taking advantage of someones stupidity may be immoral, but it's not necessarily illegal.

    1. John Tserkezis

      Re: So, what's the charge?

      "Taking advantage of someones stupidity may be immoral, but it's not necessarily illegal."

      It's only legal if you don't get caught. Ahem.

      Monies obtained via illegal means usually doesn't hang around for long. I'm surprised they didn't sic the IRS on them. They don't care if proceeds are still around.

    2. Anonymous Coward
      Anonymous Coward

      Re: So, what's the charge?

      The key is that they are shop owners / employees. They are probably in a different legal position than the general public due to their special access to the terminals - this is something only someone who owned or worked for a shop with a lottery terminal could do, since the general public doesn't touch the terminals themselves.

      Sort of like how (at least where I live) the owner or employee of an establishment with a liquor license faces harsher penalties for providing alcohol to a minor than a member of the general public does.

    3. John Savard Silver badge

      Re: So, what's the charge?

      They tampered with the machines. They cancelled tickets after first finding out whether or not they would be winning tickets, which is inherently fraudulent, whatever scheme or mechanism they may have used to do so: since the whole point of this "gambling" thing is that you pay first, and then find out if you've won. And taking advantage of weak security is no excuse; it's neither more nor less illegal to pick the lock on someone's door and steal his furniture whether he has an expensive lock on his door or a cheap one.

      1. Anonymous Coward
        Anonymous Coward

        Re: So, what's the charge?

        Or for that matter, it would not be legal to take his furniture even if he left the front door wide open when we was away for the weekend.

      2. John Brown (no body) Silver badge

        Re: So, what's the charge?

        "They tampered with the machines. "

        The didn't actually "tamper" with the machines. They used them in an unorthodox way but within the parameters of the software as designed and deployed. Tampering implies fiddling with and changing the hardware or software code to change the outcome. These guys used the system as built, if not as expected.

        It's still wrong. It's probably illegal, but all they did was use the user interface in an unexpected way. They didn't "tamper" with it although I have no doubt a prosecutor will try to bend the meaning of "tamper" to mean doing anything the manufacturer thinks you shouldn't do with it.

    4. Anonymous Coward
      Anonymous Coward

      Re: So, what's the charge?

      Not only did you violate the rules, you also failed to understand the principal lesson.

  3. Winkypop Silver badge

    User testing

    Never under estimate the power of in the wild users.

  4. akeane

    Idiots...

    What they should have done is monitored the odds of the winning tickets before they enacted the scheme.

    Then did of couple of the winning tickets, when the stats are just about right don't issue any more winning tickets that day, i.e. give the customers non winning tickets (Oh sorry there is an issue with the printer, let's have another go). Vary the stats a little bit so it doesn't look too suspicious, also not be greedy just a couple of tickets here and there.

    They might have had a "passive income stream" for years...

    1. Anonymous Coward
      Anonymous Coward

      Re: Idiots...

      That'll still tip the lottery off because they'll also know the times of those tickets. Due to federal gaming regulations, the lottery tends to keep paper trails of just about every ticket it prints, especially when it comes to what appears to be "Fast-Play" games like these. Based on what I know about these machines, the scheme has to be pretty specific and perhaps a bit elaborate to know a ticket is a winner during the printout, as your typical Fast-Play printer won't tell you anything about the ticket except the price.

      1. akeane

        Re: Idiots...

        vary the times?

        1. Charles 9 Silver badge

          Re: Idiots...

          Then you lose the predictability.

    2. Alan Brown Silver badge

      Re: Idiots...

      The thing that trips up most criminals is greed.

      They took "too much" and told "too many" people - note that this was picked up after hearing a rumour, not ongoing statistical analysis of the machines.

      It's on par with the guy who hit the repeat button when the computer was printing his paycheck and then tried to bank 20 of them at the same time.

      If you want to con people into gladly handing over money for a nonexistent prize, setup a church.

  5. Destroy All Monsters Silver badge
    Trollface

    "felony rigging charges"

    Nothing was rigged, it was working as expected.

    The next round of SCRUM will fix it...

    1. Anonymous Coward
      Anonymous Coward

      Re: "felony rigging charges" - The next round of SCRUM will fix it

      There's a reason why banks don't use "Agile" methods for real money handling, but is there any evidence that the sort of companies that design voting machines and lottery machines use them? They were incompetent before Agile was even a thing.

  6. J.G.Harston Silver badge

    setup is a noun.

    1. emess

      ... or a phrasal verb

  7. Henry Wertz 1 Gold badge

    "They tampered with the machines."

    I'm not sure that they did. It sounds like a software flaw that involved no tampering to me -- you tell the machine to print a bunch of tickets, it shows the print queue apparently including which are winners, and allows queued tickets to be cancelled. I think "rigging" a machine is more vague though and includes things just like this, finding some software flaw that tilts the odds unfairly in your favor and using it.

    "They cancelled tickets after first finding out whether or not they would be winning tickets, which is inherently fraudulent, whatever scheme or mechanism they may have used to do so"

    Agreed.

  8. John Doe 6

    But what about the machines ? Why is the company responsible for the bug not prosecuted ?

    1. John Brown (no body) Silver badge

      For that matter, calling what is in effect a Tombola a Lottery sounds a bit fraudulent to me too.

  9. Anonymous Coward
    Anonymous Coward

    Rigged

    The entire lottery is rigged. Do the math. How many combinations of numbers are their in Mega Millions or Power Ball? Then assume 100 Million people played with 10 numbers each (those are large numbers), what are the chances that any one of them will have the winning combination? About 3% (guessing). If that is correct, then about 3 out of every hundred lottery draws should produce a big winner, but it doesn't. It's more like 30% of the time, CONSISTENTLY!

    It has to be pre-recorded, then their computer decides when and where there will be a winner and it transmits it to the terminal someplace.

    1. Charles 9 Silver badge

      Re: Rigged

      They CAN'T be rigged, unless you're saying the ENTIRE STAFF, including the independent accounting firm required by federal gaming law is on the take. Look, allegations of lottery rigging have been around since the modern age of lotteries. I recall a big new story of the sort blowing up around 1987. That's why the machines are set up the way they are: they make ball tampering exceedingly difficult.

      PS. You math's rather off. Given 1 billion tickets, the odds are actually quite good for at least one of them to hit since there are now about four times more tickets than combinations, meaning the Law of Averages will favor a hit. That's why the likelihood of a hit goes up with the jackpot as more tickets are put into play. The $1.5B Powerball one was a pretty wild case of the odds beating everyone.

      PPS. Going back to the fraud bit, the system shouldn't even be telling the retailers if a ticket's a winner or not. That's how it works in Virginia. You see a ticket number on the display, that's all, with no knowledge of whether or not it's a winner.

  10. John H Woods Silver badge

    Do the math ...

    OK ...

    I googled Mega Millions, it seems there are 5 numbers between 1 & 75, and 1 number between 1 & 15. The chances of getting all six is therefore one in 15 * 75! / ( (75-5)! * 5!) which is about 1 in 259 million (258,890,850)

    The probability that you won't win is therefore (258,890,849 / 258,890,850 ) per play or about 0.99999999613. The probability that nobody will win in a draw with N plays is this number to the power of N. Where N is a million, that is 99.6%, but where N is a billion it is only 2%, so it doesn't seem that unlikely. Interestingly, that's nearly the exact opposite of your guess --- if 1 billion plays were made then the jackpot would get won 98% of the time!

    If you want to work out what N is to so that the jackpot is won about 30% of the time, you need to work out what power you'd need to raise the non-win probability to to get 0.7 (i.e. a 70% chance no one wins a given draw). This is log (0.7) / log (258,890,849 / 258,890,850) which is about 92.3 million.

    It doesn't seem at all unlikely to me that a 44 state lotto might get this many plays, it's probably only what, one play per average 2 head of population?

    PS: didn't down vote you, because almost nobody can calculate probabilities like this intuitively, hence things like the birthday problem.

    1. Anonymous Coward
      Anonymous Coward

      Re: Do the math ...

      Also remember that the tickets in play do not have a completely random distribution of numbers. If all the tickets were computer-selected random numbers, sure, but in reality some portion of the players (I don't know the stats on how many) will pick their "lucky" numbers. Expect 1-12 to be biased for higher occurrences due to corresponding to the month of a lucky date. Same goes for 1-31 for day of month.

      So here's a way to game the system, 1:259 million odds (ticket combinations) in a $1 play with a > $259MM jackpot should have net expected value (granted, need to adjust for taxes, risk of split jackpots, etc). Just buy out every combination of numbers and collect the jackpot.

      1. Anonymous Coward
        Anonymous Coward

        Re: Do the math ...

        "So here's a way to game the system, 1:259 million odds (ticket combinations) in a $1 play with a > $259MM jackpot should have net expected value (granted, need to adjust for taxes, risk of split jackpots, etc). Just buy out every combination of numbers and collect the jackpot."

        Except lotteries are already wise to this back when Lotto odds were as low as 7+ million to 1 (6 out of 44). One of the first things they banned was computer-blotted playslips. No, they have to be hand-marked: every last one of them. Not to mention with a limit usually of five or six per playslip, and the time it takes to run them through and get them printed out, time is against you, not to mention alerts concerning problem gambling.

        1. Alan Brown Silver badge

          Re: Do the math ...

          "Just buy out every combination of numbers and collect the jackpot."

          Apart from the tactics used to ban computer generated slips, in most countries the prize pool is significantly smaller than what's paid in.

          In the USA, prizewinners pay tax on their winnings and frequently are unable to collect it all at once (mostly they payout at something like $10k/month)

          In most other countries, the tax department takes a cut off what's paid in (usually 30% of the gross(*)) and the prize is "tax free" (and usually paid out all at once). Either way, taxation has to be figured into the "play all combinations" tactic. (I understand that some US states allow gambling losses to be declared against tax liabilities. This isn't the case in most places)

          (*) This is why "running an unlicensed lottery" can be a serious charge. The tax department doesn't like being diddled.

          1. Charles 9 Silver badge

            Re: Do the math ...

            In the United States, gambling winnings are classed as income (definitely federal, state depends on which). Any winnings over $600 MUST be reported to the IRS (that's where Form 1099-G comes in); that's why those tickets have to be taken to regional offices. Amounts $5,000 and up are subject to withholding. And for jackpot games, you ARE allowed to take a "cash option". Think is, jackpot values are always based on annuities. You only get the listed value (minus taxes) if you take the jackpot as an annuity. Most winners, however, don't bother with it and take the immediate payout of about half the stated value (what would've gone into the annuity originally) because that gives them legal control over the money. Not only can they invest it as they see fit (usually in ways that beat the annuity rate), but it also allows for inheritance (jackpot annuities are almost universally listed as non-transferable; if you die before the annuity is up, it's void).

  11. Bob Rocket
    FAIL

    Picking winners and losers

    The game is an instant win (there was also a draw element)

    The terminal prints a poker hand, flush gets x$, straight something else etc.

    The bug is the terminal displays the hands in the queue when there is a printer fault (out of paper/lid open)

    When the fault is rectified the option is to continue or cancel.

    Greed, stupidity and a big mouth got them caught (Darwinism in action)

    1. Charles 9 Silver badge

      Re: Picking winners and losers

      "The bug is the terminal displays the hands in the queue when there is a printer fault (out of paper/lid open)"

      I agree that is a bug. In Virginia, when there's a printer fault, the entire display blanks except for the notice to change the printer paper. All printing is on hold with no knowledge of what's in queue until the problem is solved, and the unit will refuse to do anything else until you fix the problem (sure you can cold boot the unit, but that defeats the purpose as the ticket queue gets erased).

      1. Charles 9 Silver badge

        Re: Picking winners and losers

        Also, a print queue is never shown: only a running total of what's BEEN printed. Plus it NEVER reprints a ticket (at least, not one that's legal for turning in) unless it's a Remainder Ticket (turning in a winning multi-draw ticket with draws still to play; a Remainder Ticket is only good for the draws still to play). Jams, rare as they are, have to be resolved with the Lottery. Also, Fast Play games are never displayed: only printed, and each one is accompanied by a "cha-ching" sound effect so you can HEAR when the ticket is printed (a similar sound is played when a winner is scanned so you don't get scammed out of a winning ticket). As you can see, they go to great lengths to prevent cheating and scamming.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2021