Absolute Poker Scandal: An Inside Job

[dankhank]

for the most part that press release is completely weak and does nothing to help "resolve" this scandal

[ QUOTE ]

With respect to the claims that Scott Tom, a former Member of Team Absolute Poker, is in anyway involved in wrong-doing, Absolute Poker has requested a formal investigation into that matter as well. Mr. Tom has not been involved with Absolute Poker for over a year and to the best of our knowledge, information and belief has not had access to any of Absolute Poker’s systems, databases or information.

[/ QUOTE ]

but naming scott tom and making it clear he is not an employee of AP (although it'd be interesting to try and confirm their timeline of "for over a year.") is imo a major step, and in a weird way helps confirm what was mostly circumstantial evidence that scotty is closely tied to the superuser account. i mean weren't people asking just yesterday if the residential cable modem connected to him could be in an AP office somewhere?

i wonder how AP will push the scott tom angle of this. when you think about it, if you were to eventually find out that tom is the main culprit, and he pulled this off from some random costa rican condo after he'd severed ties with the company, wouldn't you be a little less motivated to see AP the poker site reduced to rubble?

[Alobar]

[ QUOTE ]
I'd say like 2% #1, 98% #2. Not that I'm trying to set the line here, but I agree with you.

Hopefully #1.

[/ QUOTE ]

Im a little more optimistic, I'm guessing its like 35% #1 65% #2

[aaronbeen]

Dankhank this occurred to me as well but I think they might have another scapegoat lined up relating to potripper. Personally I get the feeling that the truth might be that several people were involved in this and that AP might be better off getting reduced to rubble.

[Dima2000123]

I think it's a good sign that Absolute acknowledges that we're onto them. If there is somebody in charge who is not a crook, maybe just maybe he'll realize the full gravity of the situation for him and his company, and do the right thing. However, it doesn't look like that's what's being planned, GA is not reputable given their apparent past incompetence/permissiveness. So far it sounds like Enron is hiring Arthur Andersen to look into that whole scam thing.

[comfortably_numb]

Regarding the nickname "watchdog". Did anyone sometime think about why "watchdog" was chosen ? Maybe that's a hint, too ?!?
"Watching" in this context meaning: I watch every table I like, because I can see everyone's hole cards.
Just a thought...

[StreetRiver]

[ QUOTE ]
[ QUOTE ]
[ QUOTE ]
Oh.. and don't get too excited about the independent auditor. I'm already calling shenanigans with it.

By the time the auditor examines their system, they can easily cover up or remove any damning evidence.

For example, they could disable Account 363's superuser access. They could fix it so there is absolutely zero evidence that the account ever had such access.

Obviously AP would not readily invite a third-party investigator into their computers and files if they weren't 100% sure they'd come out smelling like roses.

The only way I would accept the validity of this "audit" is if the auditor works in conjunction with a player representative who helps direct what is actually examined. I will volunteer for this job, but as long as any trusted 2+2er is selected for it, I'll be just as happy.

What I don't want to see is this auditor being led around on a leash by AP, and subsequently coming out giving them a favorable report.

[/ QUOTE ]

I really, really, really think the Abso security dept is too stupid to be able to do this.

[/ QUOTE ]

I know they've shown unbelievable ineptitude so far, but now someone up there MUST know they are in big trouble now, you don't think at this point they'd make it a point to get someone who knows what they're doing to clean things up before the auditors looked at things?

EDIT: Assume theoretically Abso completely cleans up any trace of 363 etc, what are the changes of GA working with the evidence found here?

[/ QUOTE ]

It depends solely on the integrity of AP' backup tapes, files, dvd's or whatever they are using for backup media. Any investigation into this matter must be done on basis of the backups, if they can be trusted (ie. integrity is ok). Backups must be restored to a different system, and data has to be analysed thoroughly. Othervise there are no guarantees that an investigation or audit will give the correct result.

Brgds,

Lars
CISA, CISM

[flight2q]

[ QUOTE ]
Also, Gaming Associates (GA) also audits for people other then the KGC. Check out this page:

GA Jurisdictions

/edit I'm not saying I think they are good at what they do, just that I think they actually are independent. Theoretically, if they were actually doing their job, they would have uncovered all this [censored] long before we (the community) did.

[/ QUOTE ]

It's not reasonable to think that Gaming Associates should have already been on top of this. They don't pore over all the data; they don't basically do all the work that the AP security people are supposed to do. I'm sure what they examine are the processes that AP has adopted, the quality assessment and continuous improvement methodology, possibly some validation of specific aspects of the software, and periodically some simple data analysis of game logs ex post. They may or may not do a thorough job of this.

Now it has been called into question whether the AP processes are adequate for detecting chip dumping, and for detecting the specific form of cheating that involves seeing hole cards. It's possible that at least with respect to hole cards that AP doesn't have a check for that, but relies on validation of the software. These questions justify more examination than what is done in their routine audits. Whether Gaming Associates is the right company depends on whether there is another more suitable.

This forum was clamoring for AP to be audited not so long ago, saying it was the only way for them to regain the trust of the player community. Now some people are posting that they're not satisfied that it is happening.

[basementproject]

[ QUOTE ]
This forum was clamoring for AP to be audited not so long ago, saying it was the only way for them to regain the trust of the player community. Now some people are posting that they're not satisfied that it is happening.

[/ QUOTE ]

Do you not see how this particular party auditing this particular site could potentially be unfair?

[Josem]

Reading the "Gaming Associates" contribution to the Australian Senate Inquiry into the topic, they've made it there under the name of "Global Gaming Services Pty Ltd." Their representative was Stephen Toneguzzo, their Managing Director and Principal Consultant. Apparently, he was (still could be) the boss in October 1999.

(Just a note on this - appearing as a witness to such an inquiry is not evidence in itself that you're a particularly reliable/worthy person. I've provided evidence at an inquiry personally, and it was quite an interesting process.)

Some notes from his contribution
-he is a strong advocate of online gaming regulation (as opposed to banning or doing nothing about it)
-they've been employed to audit Lasseters in the past, a reputable Australian gaming operator
-their audit covered issues such as:[list] [*] the RNG is truly random [*] the games are fair[*]there are no misleading or deceptive comments on the site[*] there are no techniques of psychological manipulation[*] player privacy[*]databases be securely stored[*] the operating environment be behind various levels of firewalls and security and that the defence is in depth[*] applying Australian Dept. of Defence IT security policies to Lasseters[*] stop loss limits[*] self-exclusion[*] money laundering


He had this to say on security:
[ QUOTE ]
Senator STOTT DESPOJA—In relation to online gambling, what are some of the
security threats or issues for online gambling with which the committee should be familiar, and specifically in relation to e-commerce transactions being adequately protected?

[/ QUOTE ]

[ QUOTE ]
Mr Toneguzzo—I have mentioned gambling, stock market, wagering, et cetera. You may hear representations that, ‘It does not need to apply to us because we have never had a problem.’ Quite often that is because they do not know they have ever had a problem. With large organisations, either (a) they do not know they have been hacked or (b) they know they have been hacked but it would affect their share value if they were to announce it to the market so they do not necessarily do that, one could suggest.

Essentially, what we are looking at in terms of security is wanting to protect the privacy
of the players—we are wanting to protect who those players are, how much they are
gambling. That player database is a substantial asset of any operator. It is also a potential source of blackmail. And, as this industry gets more competitive, I would expect that offshore operators or offshore groups may very well attempt to steal that player database to identify who the players are and then try to market to them. So there is that issue, and with that comes not only a loss of consumer confidence but also significant political embarrassment because the regulator has let that happen. The other issue is one of denial of service, and that is that every second you are off line is a second that you are losing money.

So there is that aspect, and a loss of income equals a loss of tax, fundamentally. There is also hacking a site, changing a web page, as has happened to governments here and to
different corporations.

With regard to security, I would suggest that fundamentally it is about maintaining
consumer confidence and continuity of business. If you lose consumer confidence that has a
significant political backlash on the regulators and the politicians. It also has the potential, I would suggest, to damage trade relations, especially if, hypothetically, a database with many Americans in it was suddenly bandied around the Internet. And, make no mistake, we will be a significant target—I know we are, from the sites that are up and running now—of people of other governments, of other corporations and of just the kid at school wanting to hack in and try to prove a point. Again, this is where the federal government comes in. If another government tries to take my site out, what do I do? Do I counterattack—knock out their banking system?


[/ QUOTE ]

He also made the point several times that in an online gaming operator, every transaction is recored.

[pokeuineye]

wow. i cant believe ive read every last word in this and the first post on the issue. tired i am now. i dont care how repetitive i sound, great work to all involved! i wish i was good at the internets. now back to lurking silently