The House Doesn’t Always Win
Anyone who has set foot in a casino is familiar with the neon glow and incessant chattering of slot machines. They are the top earner for any casino’s gaming floor. Millions of zombies, faces lit by the glow of five rows of indecipherable symbols, pumping their savings away at a dollar or a nickel a spin, dragging on their cigarettes, sipping free rum and cokes.
Depressing! Well, back in 2011 some enterprising Russians found a way to make money by gaming certain machines:
By early 2011, casinos throughout central and eastern Europe were logging incidents in which slots made by the Austrian company Novomatic paid out improbably large sums. Novomatic’s engineers could find no evidence that the machines in question had been tampered with, leading them to theorize that the cheaters had figured out how to predict the slots’ behavior.
In 2014, US authorities caught on to groups of Eastern European men who were winning unusually large payouts from slots across the country. The men would travel around to different casinos, winning modest amounts and moving on to other machines, spreading their profits out over a couple of days. Then, usually, they’d move on to other states or countries. Some enterprising casino security investigators were able to track down some of the men, however:
On July 14, 2014, agents from the California Department of Justice detained one of those operatives at Pechanga and confiscated four of his cell phones, as well as $6,000.
Those cel phones turned out to be the key to unraveling exactly how the crew was doing it. One interesting and somewhat unexpected element of the story is that, in 2006, Russia banned gambling and casinos. How progressive! It was actually, allegedly, a move made by Putin to reduce the influence of Georgian organized crime. What it also did, as it turned out, was to suddenly flood the market with cheap slot machines:
Some of those cut-rate slots wound up in the hands of counterfeiters eager to learn how to load new games onto old circuit boards. Others apparently went to Murat Bliev’s bosses in St. Petersburg, who were keen to probe the machines’ source code for vulnerabilities.
It wasn’t as simple as reverse engineering the machines’ circuit boards, or running a few lines of code like you see in terrible movies about hackers. First you have to determine what algorithms the machines are using to create their “random” (not actually random) results, but then you have to actually observe the machines at play. The entire set-up was quite elegant. I kind of love it:
They upload that footage to a technical staff in St. Petersburg, who analyze the video and calculate the machine’s pattern based on what they know about the model’s pseudorandom number generator. Finally, the St. Petersburg team transmits a list of timing markers to a custom app on the operative’s phone; those markers cause the handset to vibrate roughly 0.25 seconds before the operative should press the spin button.
“The normal reaction time for a human is about a quarter of a second, which is why they do that,” says Allison, who is also the founder of the annual World Game Protection Conference. The timed spins are not always successful, but they result in far more payouts than a machine normally awards
I think this is the most sophisticated scam I’ve ever written about. Hacking is one thing, but this level of human coordination is impressive. I do feel for the guys in Russia, up in the middle of the night watching grainy cel phone video of slot machine wheels in California.
Unfortunately, for 4 of the players, the Feds caught up to them when they returned to the US:
On December 10, not long after security personnel spotted Bliev inside the Hollywood Casino in St. Louis, the four scammers were arrested. Because Bliev and his cohorts had pulled their scam across state lines, federal authorities charged them with conspiracy to commit fraud.
Some of the men took plea bargains, and one of them cooperated with authorities. While most of the scheme was uncovered, it doesn’t seem to have…really solved the problem? The company who makes the particular line of slot machines the group was targeting hasn’t patched all of their systems five years later. However, there are more developments in this wild story! The mastermind of the group reached out to Brendan Koerner, the article’s author, and told him what he’d been up to:
Alex, who insists that his hacking doesn’t violate Russian law, fancies himself a bit of a Robin Hood—a champion for the common man against an avaricious casino industry. “Gaming manufacturers claim they provide ‘entertainment,’ but we all know the nature of this ‘entertainment’ a little too well,” he says by email. “All they and I are really doing is moving money. Their job is to help casinos take money from the people; my job is to help myself and the people take money from the casinos. Just a little counterweight to the global gambling system, where the house always wins.”
Comrade! Alex said he’d grown tired of having to manage a global network of slot machine Merry Men, and tried to…move some money to himself from the slot machine manufacturer, instead:
In a November 2016 email to Tracey Elkerton, the company’s global head of regulatory and product compliance, he offered to direct his agents to “cancel their work on Aristocrat slots to stop compromising your trademark” as well as “help your developers eliminate all design flaws.” He did not mention the fee he expected to be paid for these services, though he did note that he wished “to extract maximum money from my developments.”
After some back and forth it became clear Aristocrat was not going to play ball. Alex tried calling, and even sent them some code samples that allegedly proved he could crack their newer models of slot machine, though they seemed a little dubious:
I showed it to David Ackley, a computer science professor at the University of New Mexico. Ackley discovered that the algorithm had a peculiar backstory. On a hunch, he took some of the equation’s values that were expressed in hexadecimal format and converted them to decimal format. When he did, he noticed that the resulting numbers were familiar: One was an approximation of pi (31415926), one was an abbreviation of the mathematical constant e (271828), and one was a slightly ribald jest (69069).
Nice. A deal never materialized, and Alex claimed he’d decided to shop his software to interested buyers as an exit strategy. It seems he may have done exactly that, because a New York-based Russian gang was rounded up in 2016 with am Aristocrat slot machine, having done some awfully similar sorts of things:
…four months later, the group began fleecing casinos in Pennsylvania by using “electronic devices and software designed to predict the behavior of particular models of electronic slot machines.”
While it’s been two years and I haven’t heard anything about this, Alex did muse about putting his software on the Internet for free, which would be incredible:
“Sometimes I fantasize about just putting my tech out there for everyone to use,” he says. This would result in what he terms his “zombie apocalypse” scenario: Equipped with Alex’s information and software, both obtained online for free, anyone with a smartphone will be able to turn a vulnerable slot machine into a gaudily decorated ATM.
Me too, Alex. Me too. For those who’d like to learn even more about this story, I was turned on to it by this Planet Money podcast, which includes an interview with one of the investigators at a California casino who tracked the crew in 2014.
Hack the Cabinet
The history of the slot machine is interesting. For many years they were on the edges of casino floors, intended to be a distraction for the wives of the table game players - mostly men. This all changed in the 1970’s, when an enterprising game salesman realized he could turn the classic slot machine into a far more interesting product using computers. The video slot machine was born in the 1980’s, and by 1990 slot machines accounted for two thirds of gaming revenue in Las Vegas. Computerizing the one arm bandit was the key to opening up these new frontiers. Makers of slot machines could now study their customers’ habits and create games specially designed to keep them hooked. It’s so advanced that nowadays a slot machine can tailor your experience based on your casino loyalty card. Any casino on the planet who wants to attract customers must have a good variety of video slots. It’s a huge business.
Ten years ago, a fella named Rodolfo Cabrera figured out how to hack a popular line of slot machines:
Like any good hacker, Cabrera decided to express his admiration for IGT's technology by trying to beat it. Using blueprints meant to assist casino service personnel, he figured out a way to solder a half-dozen jumper wires between the memory cards and the motherboards, completing circuits that circumvented the machine's security. This gave him the ability to load any IGT game he wanted onto the boards.
Remember the guy who invented the video slot? He went on to form a company that eventually became IGT, and dominated the market. IGT was known for having high tech, secure slot machine circuit boards and software. Cabrera had a slot machine repair business, and so he started out finding ways around IGT’s hardware that prevented him from servicing the machines, but soon realized he could build entire slot machines from scratch once he had the source code for the games.
This, suffice it to say, was not at all legal in the US. IGT took notice:
IGT realized something was amiss in mid-2007. Sales of its machines were suddenly plummeting in Peru. The company began to suspect that counterfeit slots were to blame. When its engineers took apart several suspicious machines pulled from casino floors, they found circuit boards that had been modified with jumper wires and off-brand memory cards.
By now, Cabrera’s business had grown so rapidly that he was seeking partners all over the world to help him with manufacture and distribution. It got to a point where his small operation could no longer keep up with demand, so a US-based business partner came up with the idea of selling the pirated software to slot dealers, who could purchase the parts to build their own slot machines.
Like most stories where a plucky upstart takes on multi-billion dollar business interests in the United States, it did not end particularly well for Cabrera:
As Cabrera glumly watched his business get stripped bare, the brown-haired cop's fellow FBI agents in the US were busy raiding Southeast Gaming and three other companies suspected of receiving or selling FE Electronic merchandise.
IGT had provided the FBI with the locations of alleged counterfeit machines, and the bureau had quickly traced them through various middlemen all the way back to Southeast Gaming.
At the time of the writing in 2011, Cabrera was languishing in a US jail because authorities had seized his Cuban passport, and his residency in Latvia had expired so he couldn’t be sent back there. A cursory Google search didn’t turn up any news on what happened to the poor guy, hopefully he ended up somewhere far away from the Long Arm of Big Slot.
Ghost’n
Carlos Ghosn was the CEO of Nissan from 2001 to 2017. He is Brazilian-born, and of French and Lebanese ancestry (keep this in mind). He lived in Japan for a long time as head of Nissan. In November of 2018 he was arrested by Japanese authorities for financial crimes. They said he broke the law by telling Japanese authorities he was being paid a modest amount, and deferring his “other” pay until after he retired, so he wouldn’t have to disclose it publicly. This was designed to get around Japan’s laws requiring companies to publicly state how much they pay their executives. It seems he probably broke the law to avoid disclosing $140 million in pay, which, yeah okay. You should get in trouble for that. However, that’s not what I want to write about. The other elements of the case have been bonkers!
First there was the heavy handed treatment of Ghosn - he was arrested and detained in a solitary cel for weeks, which is apparently a common tactic used by Japanese police. They are allowed to interrogate suspects without charging them which is definitely not the way the law works in a lot of other democracies. The cops added more charges to his case after the first three weeks were up, so they could hold him for even longer. They kept rearresting him, which seems a bit unfair when he was already in jail. They let him out on bail in March and then arrested him again in April when he was going to hold a press conference. Yikes!
There was also a palace intrigue element to the case - some people speculated he had been ratted out by other executives at Nissan who resented working for Ghosn, and wanted to get rid of him as chairman of the board after he had retired as CEO. Apparently he had a reputation:
…while his success in turning Nissan around from near bankruptcy earned him the moniker “Mr. Fix It.” His efforts made him popular in Japan, with blanket media coverage and even a manga comic produced about his life. However, his lavish lifestyle and relatively high pay remained sources of controversy.
His conspirators did get one of their wishes - Ghosn never got his $140 mil after he got caught. Ironically, this meant that his financial statements were correct. I think we can agree that intent does matter, even if you don’t get away with your fraud. Anyhow.
Ghosn’s bail had some pretty wild requirements:
When Carlos Ghosn, the flamboyant auto executive, posted a record $14 million bail in the spring, he agreed to have surveillance cameras installed outside his Tokyo home, he was denied access to the Internet, and, for months, he was even banned from talking to his wife.
Sounds like a dream! Ha ha. He’d also given up all his passports, allegedly. I say allegedly because he escaped Japan on New Years Eve, and is now in Lebanon. There are many wild theories about how he was able to get out of the country, and they are all worth reading:
It has emerged that Lebanon’s efforts to secure his return began in October and involved a team of hired professionals, according to people with knowledge of the details. Mr Ghosn, whose passports had been seized, flew out of Osaka airport on a private jet after evading round-the-clock surveillance.
Some real Ocean’s Eleven vibes going here:
Lebanese news channel MTV reports that a group of paramilitaries entered the home posing as musicians hired to perform at a dinner party and left with Ghosn hiding inside a box designed to hold a musical instrument.
The box is thought to have been a double bass case, typically around 6ft 2in long.
I love it. Did they have to perform at his dinner party? Were a bunch of Japanese cops watching camera feeds wondering why the band was playing The Alphabet Song over and over?
French newspaper Le Monde reported Tuesday that the escape was planned by Ghosn’s wife, Carole, who was on his plane when it arrived in Beirut.
No wonder he wasn’t allowed to talk to her, she was a criminal mastermind! I am uncertain how to feel about this story, because on the one hand I am extremely not sympathetic to rich executives breaking laws to pay themselves more, but on the other hand I am not into cops coercing confessions out of prisoners by denying them basic rights. I am very into daring international escapes inside guitar cases.
Lebanon claims he’ll be tried there, and I’m…not sure how that works? For what? Ghosn claims he’s not fleeing the charges, which strains credulity. I don’t know what the ideal resolution to this is whole mess, but so far everyone seems to be losing, and that’s fine with me.
Short Cons
NY Times - “The balloon boy incident was our first taste of the 2010s — a decade of scams and ruses, of Donald Trump and Pizzagate, an era in which Americans learned that they shouldn’t believe anyone or anything.”
Engadget - “This included a staggering array of personal information including email addresses, a list of cameras in the house, WiFi SSIDs and even health information including height, weight, gender, bone density and more.”
WSJ - “Just about anyone can open a store on Amazon.com and sell just about anything. Just ask the dumpster divers.”
Happy New Year! Tips and gambling advice to scammerdarkly@gmail.com