Computer system breached; technicians printed bogus tickets, investigators allege
D.C. officials were told last year that lax enforcement of security procedures made it possible for a handful of contract employees to steal tens of thousands of dollars in lottery tickets and prize money, according to records released this week in response to a Freedom of Information Act request filed with the D.C. Lottery and Charitable Games Control Board.
An investigation conducted by Battelle Memorial Institute in August 2006 determined that the ticket thefts were most likely committed by field service technicians employed by Lottery Technology Enterprises, a District-based joint venture between GTECH Corp., New Game Technologies and Opportunity Systems Inc.
Lottery officials learned of questionable ticket sales in December 2005, when several District retail locations began complaining about unauthorized ticket sales charged to their accounts. In each case, the sales were recorded as occurring after the retailers' business hours. Surveillance footage and audits of ticket stock showed that no one was at the retailers' lottery terminals when the tickets were supposedly sold.
Battelle, a technology consultancy, concluded that LTE technicians probably created the unauthorized tickets by manipulating radio communications technology that is used to transmit ticket purchases from retail terminals to the D.C. Lottery's central system. Battelle determined that many lottery retailers failed to enable encryption security on their machines. LTE technicians were thus able to gain remote access to these machines and, using spare lottery terminals, were able to print lottery tickets without paying for them, Battelle found.
In about 5,600 transactions over a seven-month period, the perpetrators made it appear as if purchases had been made at one of more than three dozen lottery terminals at authorized locations.
All told, the perpetrators created $86,000 in phantom DC Lucky Numbers, DC-4, D.C. Keno and Powerball tickets, with more than $70,000 in prize money.
Lottery Technology officials did not return calls seeking comment. A spokesman for GTECH, a lottery hardware and software vendor based in Providence, R.I., also did not respond to repeated calls.
Jay Young, chief operating officer for the D.C. Lottery, said the board worked with the FBI to identify at least three LTE employees suspected of committing the fraud. The company later fired the workers, but investigators did not have enough evidence of wrongdoing to bring criminal charges.
LTE has since repaid the District government the purchase price of the stolen tickets, but not the resulting prize money. Ben Lorigo, executive director of the District's Office of Integrity and Oversight, said the D.C. government is seeking to recoup the lost winnings as well as monetary damages from Lottery Technologies, though he declined to say how much.
"We're just looking to be made whole here," Lorigo said.
The Battelle report found that the "radio communications being used by the [lottery] system had a previously undiscovered vulnerability. This vulnerability permitted an unauthorized lottery terminal to enter 'rogue' transactions into the system, producing apparently legitimate tickets that could be cashed as winners."
According to Battelle, GTECH has since put in place a technological fix that should prevent unregistered lottery terminals from being used on the network. The terminals used to print the stolen tickets were never found.
The Battelle audit also faulted Lottery Technology's management processes on multiple levels, from a failure to conduct thorough background checks on employees to the lack of strict controls over who had access to lottery terminals.
News of the phantom tickets comes at a sensitive time for GTECH and LTE; the D.C. government is soliciting requests for proposals to rebuild the city's aging gaming system. Installed in 1985 — with minor upgrades a decade later — the technology that powers the District's lottery system is among the oldest in North America. The city is expected to award the contract early next year.
The D.C. Lottery retailers affected by the scam were never told how the thefts were carried out. The D.C. government simply refunded to retailers the money it gained from the ticket sales. The stores were allowed to keep the commissions made on the bogus tickets.
Last year, the D.C. Lottery sold more than $266 million in tickets, generating almost $74 million for the city.