An investigator for the Connecticut Lottery determined that terminal operators could slow down their lottery machines by requesting a number of database reports or by entering several requests for lottery game tickets. While those reports were being processed, the operator could enter sales for 5 Card Cash tickets. Before the tickets would print, however, the operator could see on a screen if the tickets were instant winners. If tickets were not winners, the operator could cancel the sale before the tickets printed.
Lack of atomicity of the operation is the key here.
The point of the law is not to physically preclude violations. The law is to declare what is a violation and enforce it through, ultimately, violence. The "good kind" of violence, tautologically.
Sure, I guess. But this is like playing craps at a table where you can take back your bet after you see where the ball lands... What else are you supposed to do?
“We the government, who represent the people, are in the business of exploiting the people’s unfamiliarity with probability. You the retailer, who represent us, are not supposed to be in the business of exploiting our unfamiliarity with security.”
Yes, laws are unphysical and totally notional. When people talk about the law as if it were a physical real thing, that is just abuse of language. Law is convention. Defrauding the government is what the government says is defrauding the government. Try to convince a Judge and Jury that this wasn't fraud.
> exploiting the people’s unfamiliarity with probability
You have to give "the people" a little more credit than that, I'm sure most people know that they aren't actually going to win the lottery, but are doing it for the thrill.
Edit: Do the downvoters believe that a significant portition of lottery players expect to win?
I was just making a joke. In reality, it’s a lot more complicated then innumeracy, there are a number of “profiles” of lottery ticket buyers. Here are three common ones:
Alice buys a ticket every once in a while for “the thrill,” usually she buys tickets for the big jackpot games, and usually she buys just one on her own, plus she puts a small amount into a go in a pool with friends for social reasons. She doesn’t spend a lot every month, but she’s steady.
Bob has a sense of desperation in his life. He's older, and with chronic economic problems. For him it’s a hail-mary play: He doesn't believe he has any other way to get rich, or even be comfortably provided for in his old age. Bob spends a lot on tickets, more than is advisable, but he tries to pick the ones with the biggest rollover jackpots to maximize his outcome.
Carol is addicted to the rush of the gaming itself. She goes for the instant payoff games, and mixes lottery purchasing with video slots. There is a compulsive aspect to her play, and she spends what to us is a horrifying proportion of her disposable income on lotteries and video slots. She also has substance abuse problems.
Alice, Bob, and Carol all know the odds are against them. Alice thinks that what she loses is made up for in entertainment and the social interaction with her friends. Bob know he’s losing, so he thinks he’s being perversely rational in buying tickets. Carol has problems, and the instant-win games and video slots are engineered to exploit them.
These were people placed into a position of trust that they abused. It wasn't Joe Sixpack figuring out that 1 was more likely to be drawn than 2 and making his Lotto pics accordingly. It was machine operators who took advantage of a timing problem to rollback unfavorable transactions.
Unlikely. Many kinds of cheating are basically using systems as they're built. Social systems, accounting systems, computer systems. Those systems are just a (fallible) embodiment of the relationships we choose to create between one another.
If somebody abuses a system to shift a relationship to one that's parasitic or harmful, they shouldn't expect the rest of society to blame the system rather than the system's abuser.
Are you saying that the original 'relationship' of the lottery isn't parasitic or harmful?
I take your point that it's useful to have a definition of cheating that goes beyond 'what the system seems to permit'. On the other hand, there's a point at which you release software that's so vulnerable that the liability is as much on the coder as the criminal.
> Are you saying that the original 'relationship' of the lottery isn't parasitic or harmful?
I agree that it is, but that doesn't matter for the moral analysis of the people who got arrested. If they had been screwing the lottery and donating the money to gambling addiction programs, I'd applaud them. But this was just thievery.
> On the other hand, there's a point at which you release software that's so vulnerable that the liability is as much on the coder as the criminal.
I don't think there's a fixed quantity of moral responsibility that you have to allocate between criminal and victim. If you don't install a very good lock on your door, that does not lessen the criminal's liability, moral or legal, for breaking in.
Sorry if I was unclear, I was suggesting that the quality of a lock doesn't matter. I agree that the existence of a lock matters. Which I think should have been obvious from the phrase "criminal breaking in", in that as you point out, mere trespassing is a different crime from breaking in.
I doubt they, the prosecutors, the judge, or a jury will agree with you on this. I certainly don't. It wasn't very good security, easily jimmied. But that was true with early vending machine security as well, and with a surprising number of home door locks. The defendants here went beyond normal operation of the machine, which is all that it will take to qualify it for "rigging a game" and the computer crimes.
Most state lottos describe their product as a 'game' and by the common definition, games can be won if you know how to play them. Also, it's illegal in many states to operate a gambling establishment -- therefore we can assume that gambling is harmful to society.
Given those definitions, these guys can defend themselves by saying (a) I was playing the game, (b) the mere fact that I turned a gamble into a sure win isn't evidence of ill intent -- as we all know, gambling is immoral, and (c) this use was not proscribed by the instructions.
I wouldn't be surprised if there are rules against playing the lotto at your own store; that would be a contractual breach requiring the merchants to return their winnings. You can stretch that contractual breach to claim 'unauthorized use' for a CFAA charge, though if you lose it sets a tough precedent that hurts other CFAA prosecutions. But the mere act of using the machine in an alternative (but not prohibited) way isn't a crime.
the operator could see on a screen if the tickets were instant winners. If tickets were not winners, the operator could cancel the sale before the tickets printed.
Wow, looks like someone screwed up big time. Why the hell would you ever allow someone to see whether or not it was a winning ticket before printing it? That's asking for abuse.
27 comments
[ 12.4 ms ] story [ 867 ms ] threadAn investigator for the Connecticut Lottery determined that terminal operators could slow down their lottery machines by requesting a number of database reports or by entering several requests for lottery game tickets. While those reports were being processed, the operator could enter sales for 5 Card Cash tickets. Before the tickets would print, however, the operator could see on a screen if the tickets were instant winners. If tickets were not winners, the operator could cancel the sale before the tickets printed.
Lack of atomicity of the operation is the key here.
“We the government, who represent the people, are in the business of exploiting the people’s unfamiliarity with probability. You the retailer, who represent us, are not supposed to be in the business of exploiting our unfamiliarity with security.”
You have to give "the people" a little more credit than that, I'm sure most people know that they aren't actually going to win the lottery, but are doing it for the thrill.
Edit: Do the downvoters believe that a significant portition of lottery players expect to win?
Alice buys a ticket every once in a while for “the thrill,” usually she buys tickets for the big jackpot games, and usually she buys just one on her own, plus she puts a small amount into a go in a pool with friends for social reasons. She doesn’t spend a lot every month, but she’s steady.
Bob has a sense of desperation in his life. He's older, and with chronic economic problems. For him it’s a hail-mary play: He doesn't believe he has any other way to get rich, or even be comfortably provided for in his old age. Bob spends a lot on tickets, more than is advisable, but he tries to pick the ones with the biggest rollover jackpots to maximize his outcome.
Carol is addicted to the rush of the gaming itself. She goes for the instant payoff games, and mixes lottery purchasing with video slots. There is a compulsive aspect to her play, and she spends what to us is a horrifying proportion of her disposable income on lotteries and video slots. She also has substance abuse problems.
Alice, Bob, and Carol all know the odds are against them. Alice thinks that what she loses is made up for in entertainment and the social interaction with her friends. Bob know he’s losing, so he thinks he’s being perversely rational in buying tickets. Carol has problems, and the instant-win games and video slots are engineered to exploit them.
computer law will get so much clearer if we stop blaming people for using systems as they're built.
If somebody abuses a system to shift a relationship to one that's parasitic or harmful, they shouldn't expect the rest of society to blame the system rather than the system's abuser.
I take your point that it's useful to have a definition of cheating that goes beyond 'what the system seems to permit'. On the other hand, there's a point at which you release software that's so vulnerable that the liability is as much on the coder as the criminal.
I agree that it is, but that doesn't matter for the moral analysis of the people who got arrested. If they had been screwing the lottery and donating the money to gambling addiction programs, I'd applaud them. But this was just thievery.
> On the other hand, there's a point at which you release software that's so vulnerable that the liability is as much on the coder as the criminal.
I don't think there's a fixed quantity of moral responsibility that you have to allocate between criminal and victim. If you don't install a very good lock on your door, that does not lessen the criminal's liability, moral or legal, for breaking in.
Given those definitions, these guys can defend themselves by saying (a) I was playing the game, (b) the mere fact that I turned a gamble into a sure win isn't evidence of ill intent -- as we all know, gambling is immoral, and (c) this use was not proscribed by the instructions.
I wouldn't be surprised if there are rules against playing the lotto at your own store; that would be a contractual breach requiring the merchants to return their winnings. You can stretch that contractual breach to claim 'unauthorized use' for a CFAA charge, though if you lose it sets a tough precedent that hurts other CFAA prosecutions. But the mere act of using the machine in an alternative (but not prohibited) way isn't a crime.
Wow, looks like someone screwed up big time. Why the hell would you ever allow someone to see whether or not it was a winning ticket before printing it? That's asking for abuse.