Cheats and thieves have worked it out. No one in the casino is watching electronic games, except maybe the slot technicians.
📷
Hackers and Slot Technicians
Last month the news hit about four slot employees of the Miccosukee casino in Florida who along with four accomplices were charged with stealing over $5 million from the casino between 2011-2015. The news reports were typically vague about the M.O. and casino management are not saying anything. Here’s what we know from the court documents.
To generate and record the false and fraudulent "coin-in" amounts, the defendants and their conspirators would open an EGM, and connect one end of a wire to a location inside the EGM where a device that would recognize coins might be attached. They would then connect the other end of the wire to another metal surface inside the cabinet which would cause the EGM to generate and record false and fraudulent "coin-in" amounts. On occasions when the defendants and their co-conspirators caused an EGM to generate and record false and fraudulent "coin-in" amounts, they would cause the EGM to generate, record, and print false and fraudulent credit vouchers for all or some of the "coin-in" amounts. In an attempt to conceal their fraudulent activity, the defendants and their co-conspirators would typically conduct a "hard reset" or "RAM clear" of the EGM, which would delete the history of the false and fraudulent "coin-in" amounts from the EGM.
This is one of an increasing amount of sophisticated casino cheating scams over recent years that highlights how casinos are not prepared for threats against electronic gaming. How can employees rip off your casino so blatantly for over four years without anyone seeing it?
To make matters worse it seems that every time a casino gets whacked with an electronic games scam, the details are not shared within the industry, at least not for a long time. Casinos don’t want to reveal their management incompetence. Machine manufacturers deny it’s not a flaw in their equipment. The case disappears in to a bureaucratic black hole of regulatory and law enforcement agencies. Casino and vendor executives hit the reputation control button and go into “we can’t comment until the investigation is concluded” mode. Their public relations people know full well that news cycles these days are short and if they can initially deflect questions, people will fagheddaboudit. This lack of sharing information within the industry enables cheating organizations (yes, I said organizations) to continue on their merry way and we as an industry are none the wiser.
In the last two years casinos around the world have been exposed for their complacency, a lack of controls and a surveillance blind spot when it comes to protecting their electronic games from high-tech cheating gangs, internal theft and collusion. The Miccosukee heist is not an isolated case of a high tech slot scam being placed under the cone of silence, pending investigation. Last year a group of Bulgarians pulled off a sophisticated scam by hacking the slot machines to enable them to manipulate the outcome. In Switzerland a slot employee working with five accomplices hacked the machines to payout more then they should. Like the Miccosukee scam the details of these “hacks” have not been made available to the industry. All we know is apparently they were hacked. Whatever that means.
And then there’s the rats in the kitchen. Like the slot employee who teamed up with an ex-slot employee in Alabama last year to steal $193,000 from a TITO kiosk. Another slot employee used a similar M.O. to rip off $57,000 in a Florida casino. Another slot technician from a Massachusetts casino stole over $22,000 by withdrawing money from the cashier to perform tests on slot machines and then kept the cash.
Remember the Russian hackers from 2014? They reverse-engineered slot machines with non-complex random number generators and came up with an algorithm to predict jackpots. Five years later, organized teams are going strong all over the world. Quite frankly, why wouldn't they? Manufacturers didn't fix the problem. Casino operators and regulators didn't call for manufacturers to fix the problem. All parties seem content with counting the millions of dollars generated from slots each year and taking their chances with hackers.
Maybe the most brazen slot scam going on right now involves the bill stacker bandits. No, they’re not a bunch of bandits led by a guy called Bill Stacker. The bill stackers in the machines are being loaded up with cash, tickets are then cashed out for large amounts and then the thieves are literally ripping off the bill validators to recoup there cash. They’re doing that by physically forcing access into the machine or using a master key. No one is quite sure where they’re getting the key from. It’s old school theft in a new school world. The question is how are they getting away with it?
Why is no one watching the machines?
There are a lot of electronic games out there. Dare I say it, too many? The total of machines on a single casino floor can often number in the hundreds or sometimes thousands. Unlike table games no one is supervising them or watching the customers. Nowadays it’s hard to find any employees in the slot areas. Machines are often viewed by management as self-reliant. That’s why casino managers love them. They don’t have to hire staff to operate them. They’re like a wondrous orchard that magically produces shiny fruit every day. The only time staff are required is to pick the fruit (bill stackers) and every now and then to fix them (see what I did there?) FIX them.
In the “machine forest” people keep to themselves. It’s a lonely place. The forest goes from being full of customers to being empty. Regardless of how many customers are playing, each one focuses on what is happening on their machine and pays no mind to what other customers are doing. For cheats and thieves it’s a great environment to get their scam on. No one is watching.
But wait, what about the cameras? Oh yeah, they exist; lots of them. But until camera manufacturers start selling AI cameras that can monitor games and detect foul play by themselves (which I expect to happen in the next five years), we still have to hire surveillance operators to watch them. Right now cameras don’t catch people stealing…people catch people stealing. Until we make the step to AI, it’s important to prioritize what we look at.
Now more than ever it is time to take a look at what’s going on around the world and ask yourself are we looking in the right direction. Are we still playing with our Atari when everyone else is playing X-Box?
No one in surveillance can deny that their role and responsibilities have expanded over the last 20 years. Arguably, the value of surveillance to an organization has grown and that’s good. In saying that, not monitoring an area that generates anything from 60-90% (in the US) of your gaming revenues seems dumb to me. Surveillance now spends a lot of time reviewing and investigating issues of a non-gaming nature but when they do get to proactively watch the games it seems a lot spend most of their time chasing low-lying fruit like card counters and $5 dealer errors.
In defense of my surveillance brothers and sisters, watching gaming machines is boring. I mean “watching paint dry” boring! Watching customers hypnotized by their screens pushing buttons for hours on end is not exactly like watching an Asian high roller using kung fu moves to squeeze and throw his cards on the table or a craps tub full of players jumping up and down high-fiving after the shooter makes the point.
It has become apparent to me that hardly anyone in casinos, except for the slot technicians, know how the machines work. As the scams become more digital in nature, surveillance people don’t know what they’re looking for. From a game protection point of view our “analogness” is not serving our businesses well in an ever-increasing digital casino world.
Manufacturers of electronic games are not educating or training the people who are responsible for game protection. In fact, a lot of them seem to avoid it. Surveillance people have little chance of protecting machines if they don’t know the inside and out of how they work. At this year’s World Game Protection Conference we surveyed delegates and 92% of them revealed they are not prepared to protect electronic games. Maybe this is why surveillance people gravitate towards watching table games so much. Our main table games have been around for generations. Whether the game is old or new or you’re a veteran or a rookie, it is easy to become familiar with them as they all come with instruction manuals. With electronic games we’re kept in the dark.
Another challenge that surveillance has with electronic games is that the cameras can’t see inside the machine. Whenever a slot employee accesses a machine to fix it (see what I did there again?) surveillance operators can’t see what they’re doing. It’s like pulling the wool over our eyes. Couple that fact with standard camera coverage in slot areas usually running at a ratio of one camera to ten machines, often finding a good angle to see what the Tech is doing is difficult.
Some Ideas to Ponder
Electronic games are the future. The machine forests are growing in casinos all over the world. Scams involving hackers and rat b**tard employees are not going away. They’re going to get worse. Casinos are going to have less employees and more machines. Surveillance must adapt to the 2020 (and beyond) casino environment. We need to get ready. Here’s some ideas…
In my estimation, 20% of surveillance departments do a good job of monitoring electronic games, 60% do a mediocre job and 20% don’t care. Protecting electronic games effectively starts with education and training. It’s time to start demanding that manufacturers provide training on how their new products work and how they can be protected. Ask them if the product you’re buying has ever been scammed and if it has, request all the details. It shouldn’t be up to us to work it out for ourselves. Training surveillance people should be included in the supplier terms and conditions.
Slot machine monitoring interfaces should be added to every surveillance monitor room. I am surprised that there are a lot of surveillance operations out there that don’t have access to real-time machine data via their internal slot machine network. For me it’s standard operating equipment for any surveillance operation and probably the most effective way right now to monitor slots. Without it it’s like driving your car in the country at night without lights.
Slot machine monitoring interfaces send real-time alerts to surveillance whenever the notable events take place like jackpots, door openings, malfunctions, etc. The casino can set what alarms they want to get and it’s up to surveillance management to decide what alarms they want to get and what the appropriate response is. No brainer - if you don’t have it, get it! In effect one operator can monitor thousands of slot machines at any given time if they have access to the network and responds appropriately to carefully chosen alerts.
The activities of slot technicians should be monitored more closely. I suggest regular audit-based surveillance where employees are monitored at least on a once a month schedule using a check-box audit list to ensure they are complying with internal controls and procedures. To ensure effective surveillance cameras should be installed in the technicians workshop.
Camera coverage needs to be more innovative. The PTZ cameras above every ten machines is OK for getting overviews but its time to channel your inner ESPN producer. All slot technicians should have to wear a body camera while on duty. For that matter, so should all security officers and floor supervisors. I’m talking video and audio. Got your attention? How about every machine having an infrared motion-activated miniature camera installed inside it? What about a motion-activated miniature camera installed to the front of every machine that looks directly at every customer and searches a database of images for matches on persons of interests and cheats? Providing the alerts going off on self-excluded problem gamblers doesn’t crash your system, you might just catch some Russian hackers.
Surveillance shouldn’t be confined to just using cameras. I think to detect cheating in the future we will need to develop algorithms in-house that will be programmed to scan systems and detect patterns that could indicate cheating and advantage play. An example in slots could be regular jackpots hitting on particular machines where a player card wasn’t used. In the case of the random number generator scam, a program to detect long pauses between pushing the buttons may be a an indicator that the player is using a computer.
These are just a few ideas. With the digitization of gaming we can’t take a knife to a gun fight. The game protection battles in the future will be fought in our information systems. We have to be innovative. We need to recruit and train people who think programs are a set of instructions in a computer not something you watch on TV. We need people who use browsers instead of being one. We need people who don’t think spyware is what surveillance people wear when they go on the casino floor. It’s time to replace the “Art of War” mentality and replace it with the “Art of Star Wars” mentality. willy
Comments