WASHINGTON POST ARTICLE (Update)

5 December 2008

Investigative writer takes an in-depth look at Internet gambling's two biggest cheating scandals

 

The Washington Post has published its full five page article on Internet poker, titled "Players Gamble on Honesty, Security of Internet Betting" and written by Gilbert M. Gaul, who worked with Sixty Minutes television producers in preparing Sunday's program on the same subject (see previous InfoPowa reports)

The full article can be read here: http://www.washingtonpost.com/wp-dyn/content/article/2008/11/29/AR2008112901679.html

In the piece, Gaul describes the detection and resolution of the Absolute Poker scandal as "...a huge victory for the players and the self-policing nature of the Internet. Yet just weeks later, rumors of a new scandal rocked the world of online poker, this time at AbsolutePoker's sister site, UltimateBet.com. The stakes were dramatically higher: more than $20 million cheated from players over four years. The alleged culprits included a former world poker champion and UltimateBet employees who had hacked into the site."

Gaul characterises the two events as the biggest cheating scandals in online gambling" and claims that this has raised fresh questions about the honesty and security of "...a freewheeling industry that operates outside of U.S. law." He goes on to claim that the online gambling world has little regulation and even less enforcement, with many sites scattered over dozens of countries with no reporting requirements.

"The licensing agencies there essentially operate as pay-as-you-go boutiques, generating millions of dollars in fees while showing little interest in policing rogue sites," he comments, estimating that revenue has more than tripled over five years, to $18 billion annually, including about $4 billion from virtual poker.

Yet players have little way of knowing who is watching their bets or where their money is going, Gaul writes Often, owners hide behind multiple layers of limited partnerships, making it difficult to determine who controls the sites or to lodge complaints about cheating.

In the AbsolutePoker and UltimateBet cheating scandals, players decided to investigate the matter themselves after managers and regulators did not respond to their complaints, Gaul reports. "No one would listen to us," Serge Ravitch, a 28-year-old lawyer-turned-poker pro who played a key detective role told the writer.

Gaul describes AB and UB thus: "AbsolutePoker and UltimateBet operate out of a shopping mall in Costa Rica, run their games on computer servers housed on an Indian reservation near Montreal, and are licensed by a Mohawk tribe that has no background in casino gambling and does not answer to federal or provincial regulators."

He goes on to identify Joe Norton's Tokwiro Enterprises as the owner of the two sites, and spends some time recapping the already well known details of the Kahnawake hosting and licensing set-up. But he comments that Norton only admitted buying the sites a year after the deal was closed - and that even some of the most powerful members of his tribe had no idea Norton owned the poker sites.

"I was as surprised as anyone else," Mohawk Grand Chief Michael Delisle told the Washington Post writer. He added that he had not spoken with Norton about the cheating. "I have had no opportunity," he said in an interview, "and honestly I don't think it's any of my business." But it is his tribe's business, Gaul points out.

The Kahnawake collect millions in fees each year by licensing Internet gambling companies and hosting the Web sites on servers inside a high-tech building. Recently, they took a 40 percent stake in another Internet server firm on the Isle of Man, in the Irish Sea called Continent 8 Technologies. They collect more than $1 million a year from that investment, which aims to expand and protect their Internet gambling footprint.

Gaul writes that Norton, a former ironworker, purchased AbsolutePoker and UltimateBet in 2006 and folded them into a newly created holding company, Tokwiro Enterprises ENRG. The company says it is "properly registered as a proprietorship in Canada." However, Norton declined repeated requests to be interviewed for Gaul's article, but has denied he knew about the cheating, the writer claims. Managers at AbsolutePoker and UltimateBet also declined interviews, as did the Kahnawake's licensing and regulatory body, the Kahnawake Gaming Commission.

The Washington Post piece goes on to report the $2 million in fines levied on AB and UB by the Kahnawake Gaming Commission following the cheating scandals, but comments that the apparent victory by the player-detectives quickly soured when the Kahnawake declined to name the cheater in the Absolute Poker debacle or turn his name over to prosecutors.

The piece is critical of the three-member KGC which it claims operates largely in secret, and that it would not disclose the size of its staff. The KGC outsources background checks to a security firm in Horsham, Pa., and uses a small company in Australia to audit its licensee's software, the article reveals.

It called on Frank Catania, former head of the New Jersey Division of Gaming Enforcement, to investigate UltimateBet and reopen the AbsolutePoker probe.

In an interview with the Washington Post, Catania said there was no comparison between New Jersey and the Kahnawake when it came to oversight. "I don't think they have -- they don't have the staff, first of all," he said. "With the New Jersey Gaming Commission, I had about 400 people there. I had CPAs. I had our big budget."

Gaul delves into the origins of Absolute Poker, which he describes as "sketchy". Records and interviews point to a poker aficionado named Scott Tom, who attended the University of Montana in the late 1990s. After graduating, Tom and several partners headed to Costa Rica and started the business, Gaul claims.

Soon, the Internet poker phenomenon gathered momentum, with scores of other sites popping up in Antigua, Costa Rica, Malta, the Isle of Man and other locations. "The Kahnawake alone license 450 sites run by 60 permit holders. By 2007, Internet gambling sites had revenue of $18.4 billion, up from $5.9 billion in 2003, according to Christiansen Capital Advisors, a New York firm that tracks online gambling," the article reports.

Thousands of those players found their way to AbsolutePoker, which has handled more than 300 million hands since it started accepting bets and at its peak accounted for as much as 5 percent of the multibillion-dollar online poker market. Hundreds of customer service employees worked at its office in a mall in San Jose, Costa Rica, and at a smaller office in Panama.

In September 2007 a 21-year-old player named Marco Johnson paid $1 000 to enter a tournament sponsored by AbsolutePoker. Johnson, who uses the screen name "Crazy Marco," reached the final against a player called "Potripper." They played 20 hands and Potripper won them all, collecting $428 520. At first, Johnson shrugged off the loss. But others watching the final games online insisted that they, too, had been cheated. Johnson requested his hand histories for the games.

A few days later, Johnson received a Microsoft Excel spreadsheet containing 65 000 lines of data and a wealth of information on hands played and IP addresses. At first, he set it aside, but it was to become the key for player-detectives to expose the rampant cheating that had been going on.

Around this time the management at AbsolutePoker released the first of several statements denying the cheating allegations, the Washington Post article continues. "While we are continuing with our investigation, we have yet to find any evidence of wrong doing," the first statement said. "A super-user account does not exist in our software," stated the second. "Absolute Poker remains a 100 percent secure place to play."

However, Gaul reports, players continued to attack AbsolutePoker in online forums, complaining that they could not get answers to their questions or tell who owned the site. A few frustrated players decided it was time to start their own investigation. Serge Ravitch was one of them.

Ravitch is a graduate of the University of Michigan Law School who realized he enjoyed playing poker more than filing legal briefs. He offered to help analyse the suspect hand histories. and was joined by Nat Arem, a former auditor in the Philadelphia office of the consulting firm Deloitte & Touche. Like Ravitch, the 26-year-old Arem is good at math and with computers. In 2006, he attended Emory Law School in Atlanta for a semester but dropped out after selling a software program that players use to track the results of poker tournaments. He now lives in Costa Rica, where he develops poker-related businesses.

In the fall of 2007, Arem and Ravitch obtained copies of Marco Johnson's spreadsheet file and started analysing the data. Arem wrote a software program to decode the information. Joined by a handful of other poker detectives, they quickly identified improbable betting patterns for Potripper and several other suspect accounts. The patterns suggested that the players with improbable win rates could somehow see their opponents' face-down, or hole, cards.

"Obviously, if you can see your opponents' hole cards, you have a huge advantage," Ravitch told Gaul. "That helped to explain how the suspect accounts never seemed to lose."

One of the first things the poker detectives noticed was that Potripper was playing exclusively in "nosebleed stakes," games with the biggest pots. "He got caught because it was easy to catch," Ravitch said. "There are only a handful of other players playing those stakes, and everyone knows one another."

Greed was another contributor to Potripper's discovery. Instead of losing a few hands to deflect attention, Potripper continued to win every time. "It would have been so easy if he had just lost a few hands. No one would have ever suspected a thing," Ravitch said.

In addition to hand histories, the poker detectives said, Johnson's spreadsheet contained e-mail and Internet addresses that appeared to connect one of the suspicious accounts to Costa Rica, to a home owned by Scott Tom, the alleged founder of AbsolutePoker who Gaul claims sold the business to Joe Norton in October 2006. When the poker detectives posted their findings on a popular poker forum called Two Plus Two, bloggers pounced on the information as proof that Tom must have known about the cheating, if not have cheated himself.

It was not clear from the information, however, whether Tom used the account or whether someone else may have had access to it. AbsolutePoker officials did not address the bloggers' charges. Instead, they released a statement saying that Tom had not worked at the site for more than a year - a claim that they would later be forced to retract. In fact, Tom continued to manage day-to-day operations at AbsolutePoker until October 2007, when he resigned as the cheating scandal was heating up.

Norton was "aware of the press releases but did not [initially] realize they were false," the company said in response to written questions from The Post. "The fact that they were misleading, if not outright false, contributed to Joe's decision to change the management" in October 2007.

AbsolutePoker officials have said that Tom was not involved in the cheating, but they have declined to say who was. Tom declined Washington Post requests for comment.

Tom's father, Phil, defended his son in interviews and via e-mail, saying Scott was "attacked viciously and unfairly by bloggers" who tried to link him to the cheating.

If Scott Tom wasn't the cheater, who was? the Post asks, reporting that the player-detectives kept probing and by mid-October 2007, were focusing on an employee at AbsolutePoker's Costa Rica office. They posted their findings online, setting off a new wave of charges and increasing pressure on AbsolutePoker's management and the Kahnawake Gaming Commission to address the cheating.

Shortly thereafter, the commission announced that it had hired Gaming Associates, a small Australian computer security firm, to audit the poker site's software. Two days later, AbsolutePoker released an e-mail acknowledging that it had identified "an internal security breach that compromised our systems for a limited period of time." It added: "The cause of the breach has been determined and completely resolved."

The company's statement did not detail how the breach occurred, how many players were cheated or how the cheater was able to spy on cards without being noticed.

But, reports the Post, unbeknown to the players, AbsolutePoker had already cut a secret deal with the cheater, whom it characterised as a "consultant with managerial responsibilities." The company agreed not to release his name in return for a "full and detailed explanation" of how he cheated, according to company officials and other interviews. AbsolutePoker also agreed not to sue the cheater or turn him over to Costa Rican authorities, company officials told The Post.

"Of course we considered going to the police, but we decided that it was in the best interest of our cheated players and of AP to get the perpetrator to tell us how the cheating was done," company officials wrote in response to questions from The Post. "We also recognized that prosecutions for white collar crimes in Costa Rica can be time-consuming and sometimes unsuccessful."

The Post notes that the name of the alleged cheater has circulated widely among poker players on the Internet. The Post is not publishing his name because, even though he purportedly confessed to AbsolutePoker, the company did not release its records and would not discuss the matter. The alleged cheater declined requests to be interviewed.

Most players said they were appalled by AbsolutePoker's decision not to seek prosecution of the cheater. "Yeah, we were paid back," one said. "But they made absolutely no attempt to bring any of the people to justice. If someone stole that amount of money from a [land] casino, they would be thrown in jail."

AbsolutePoker told the Post that it fired the cheater on October 20, 2007, the day before it started sending $1.6 million in refunds to the cheated players. "Our previous business culture was entrepreneurial, decentralized and individualistic," company officials wrote The Post. "In retrospect, this decentralized approach was not conducive to strict oversight and accountability." The company says it "installed a completely new management team" in order to "build a solid security foundation."

In January 2008, the Kahnawake Gaming Commission released a four-page report on the AbsolutePoker scandal. It said a single cheater using several screen names had taken advantage of a flaw in the software to spy on players' cards during a six-week period starting in August 2007.

It fined Norton's [Absolute Poker] firm $500 000. But it also declined to name the cheater, contending that there "would be no material benefit to the affected players."

"I don't know about that," said Frank Catania, the former New Jersey gambling official who helped the Kahnawake write their Internet gambling regulations, and who was hired by the commission last summer to investigate Norton and his poker sites. "Maybe what they should have done is named the person."

A day after the Kahnawake commission released its report about AbsolutePoker, managers at UltimateBet were alerted to new allegations of cheating involving a player using the screen name "NioNio," unleashing another scandal that has been widely reported.

This time the investigation turned up seven other suspicious accounts that had won a total of $1.5 million on UltimateBet. Later, UltimateBet officials determined that the cheaters had used as many as 88 screen names to avoid detection.

It was as though the cheaters were playing against a "bunch of blind men," Catania recalled. "I mean . . . you're the only one that can see. Everyone else is blind."

In news releases, UltimateBet said that former employees had secretly installed a back door in the software allowing them to spy on players' cards. They stressed the gaming commission's finding that the breach took place before Norton bought UltimateBet in 2006 through a limited partnership in Malta called Blast Off Ltd.

The company told The Post that it performed full financial and operational due diligence before the sale but that it did not find the unauthorised software.

However, Catania, the outside investigator, said that UltimateBet officials did "no due diligence on the technical part. None." At the same time, he said he did not think Norton was aware of the cheating.

UltimateBet officials acknowledged to The Post that the "winning-hand statistics were certainly suspicious and should have been flagged for investigation." They said the accounts belonged to professional players who had been designated as VIP players by the prior owners, and as such were not subject to the same level of scrutiny as other accounts. They added that they did not review the VIP accounts until after the cheating allegations surfaced.

Citing what they said were UltimateBet player logs and real estate records, some of the poker detectives this summer linked former World Series of Poker champion Russ Hamilton to the scandal. In online posts, they alleged that several of the suspect accounts were traced back to property Hamilton owns in Las Vegas, where he is based.

Hamilton did not respond to the accusations. In September, the Kahnawake Gaming Commission announced that there was "clear and convincing evidence" that Hamilton "was the main person responsible for and benefiting from the multiple cheating incidents" at UltimateBet.

The commission did not disclose its evidence allegedly linking Hamilton to the cheating. But Catania said the player accounts "point directly to Russ Hamilton." He added that six to eight accounts were involved in the cheating. "And we know Russ Hamilton was . . . part of those accounts."

Hamilton's lawyer, David Chesnoff, scoffed at the accusations when approached by the Washington Post. "Have I heard these allegations? Yes," he said. "We deny them." He added: "Without having an opportunity to review what is alleged to exist, we can't answer the questions and don't think we should dignify it with answers."

In a statement, UltimateBet's owner, Tokwiro Enterprises, cited the commission's finding that Hamilton was responsible for the cheating. The company noted that Hamilton "was never employed by Tokwiro or any of its companies," though he briefly had a "relationship" with the company in which he referred players from his Web site to UltimateBet.

To date, UltimateBet has issued $6.1 million in refunds, The Washington Post claims.

Catania said the poker site has promised to reimburse players an additional $15 million, at which point he expects UltimateBet to lose its license or be sold.

The gaming commission fined UltimateBet $1.5 million "for its failure to implement and enforce measures to prohibit and detect fraudulent activities." It defended its handling of the case but said its actions "were not well communicated to the poker industry or public at large, creating an incorrect perception that the [commission] was doing nothing."

The Kahnawake now say they operate one of the most secure Internet gambling operations in the world, the Post article concludes. Tokwiro says it has "established cutting-edge security systems that make us the safest site in the industry." But Catania said he does not expect cheating to stop: "I'm sure there are people out there right now figuring out, let's say, 'Here's a way we can do it again.'"