The Iowa mastermind who scammed $24M in jackpots in 5 states says the lottery system remains fatally flawed
Eddie Tipton warned them.
As the head of IT at the Multi-State Lottery Association, Tipton pulled aside his boss and told him the computer software that randomly selected the winning numbers for million-dollar games in as many as 17 states had a terrible flaw.
It wasn't really random.
Though his boss listened, Tipton told state investigators that other officials with the nation’s chief lottery system did not. They told him to fix it, then moved on.
A disgruntled Tipton made some updates but also stuck in a computer code that let him rig at least five jackpots in as many states worth a combined $24 million in prizes.
Even after he was caught, Tipton insisted the lottery system remained fatally flawed.
Lottery officials have assured the public that the games’ problems have been resolved. But Tipton's lawyers and others aren't convinced.
And some have accused the association of trying to placate the public so people will keep playing. They cite an unreleased internal investigation as one example.
"The Multi-State Lottery Association suggests they only conducted the internal investigation because we sued them," said Gary Dickey, a Des Moines attorney. "And that should be very concerning to anybody who plays the lottery."
One of Dickey's clients, Burlington, Iowa, resident Dale Culler, is seeking a class-action lawsuit on behalf of all players cheated out of lottery wins by Tipton's manipulated drawings.
The association, commonly referenced as MUSL, is owned and operated by 36 member lotteries, mostly state organizations such as the Iowa Lottery. It operates some of the nation's most popular games, including Powerball and Hot Lotto.
Tipton was convicted of fraud and sentenced last year to as much as 25 years in prison related to rigged jackpots in Colorado, Wisconsin, Iowa, Kansas and Oklahoma.
In his confession to state authorities, Tipton said his former employer ignored multiple warnings before his scam was uncovered, including security deficiencies that he pointed out himself.
"It's definitely myself trying to say: 'Look, you guys are skating on thin ice, and you don't even know it and you're not paying attention,'" Tipton told state officials.
The lottery association's mistakes
Citing ongoing litigation, Multi-State Lottery Association officials declined to answer almost all questions related to Tipton's secret coding, which went undiscovered for years.
They also declined to outline what changes the organization has made following the discovery that its own employee had hacked the system.
Association officials did, however, respond to Tipton's statement in which he asserted some state lotteries "actually encouraged me to play their games because they wanted the revenue."
"All MUSL employees are, and have always been, prohibited from claiming prizes in games facilitated by MUSL," said Bret Toyne, the association's CEO. "In 2015, this prohibition was extended to all lottery games offered by United States lotteries, regardless of whether MUSL has any involvement in those games."
The "most obvious and basic" mistake the association made was its failure to have a separation of duties among its employees, said Gus Fritschie, an executive of SeNet International, a Virginia-based company that helped investigators reverse-engineer Tipton's code.
As director of security, Tipton was the lead programmer and had access to the Multi-State Lottery Association's systems, he noted.
Tipton's random-number software was certified by a New Jersey-based company, Gaming Laboratories International. Tipton designed his rigged coding so that it wasn't detected in the company's random tests, according to a report Fritschie helped present last year.
Gaming Labs did not return a request for comment. Its website said early this month it conducts all testing and certification for the Multi-State Lottery Association, but that statement was removed after the Des Moines Register on March 5 requested copies of its contract with the association.
Toyne said the association does not have any ongoing contractual relations with Gaming Labs.
"To give MUSL credit now, they have completely revamped their entire process," Fritschie said, "and their operational, management and technical controls are 100 times better than they were when this fraud was committed."
In 2016, the association's board president, Gary Grief, responded to questions about the Tipton scam posed by the U.S. Senate Committee on Commerce, Science and Transportation.
He assured lawmakers that all of Tipton's illegal software has been taken out of service, and his organization "continuously conducts meticulous analyses, audits and reviews" of all its games.
Des Moines attorney Nick Mauro questions how it is possible that the association was conducting rigorous monitoring during Tipton's tenure and never discovered his coding, yet now professes to have "100 times better" security processes in place.
"It doesn't add up," said Mauro, who is part of the team seeking a class-action lawsuit against the association.
Some consequences apparent
The Multi-State Lottery Association faced consequences even before Tipton was sentenced for spearheading the largest lottery scam in U.S. history.
The Iowa Lottery, for example, no longer uses the association's programs that randomly select game numbers. The Tipton scandal played a part in that decision, Iowa Lottery CEO Terry Rich said.
In addition to the possible class-action lawsuit, the association faces a lawsuit brought by Larry Dawson of Webster City, Iowa, who contends that his jackpot was smaller than it should have been as a result of Tipton's fraudulent win.
It’s unknown whether any Multi-State Lottery Association employee other than Tipton has been held accountable for the scandal. Charles Strutt, the director since the association’s 1987 founding, retired in 2015, just days after state investigators announced they had expanded their probe nationwide.
An organization statement said Strutt believed new leadership was necessary for it "to move forward to regain its status in the lottery industry."
Strutt did not return calls seeking comment for this story.
Internal investigation's findings
The Multi-State Lottery Association's board hired the Des Moines law firm of Dorsey & Whitney to conduct an investigation into fraud in the wake of Tipton's scheme.
An April 26, 2016, summary obtained by the Register indicates the firm was unable "to do a law-enforcement-style investigation" because it did not have subpoena or compulsory powers.
Nonetheless, Dorsey & Whitney concluded no other association employees were involved.
The summary provided to board members said the association had improved practices or procedures related to the Hot Lotto Draw in 2010 that ultimately revealed Tipton's scam, but "a public description would undermine their purpose and effect."
Jason Maher, a former computer technician for the association, said he was unexpectedly fired about four months after the Dorsey & Whitney report. He said he was given no reason, but he told prosecutors during a Nov. 30, 2016, court deposition that the Powerball drawing was moved to Florida, a blow to the Iowa staff.
"They no longer had a need for me because of the whole thing," Maher said in the deposition, which was related to Tipton's criminal charges. "We lost a lot of clients."
'Huge consequences'
The Register reached out to several state lotteries for reaction to Tipton's confessions. For example, he specifically mentioned deficiencies in California's Lottery that he said made it vulnerable.
Russell Lopez, deputy director of the California Lottery, disputed Tipton's claims, saying its procedures are sound.
Maryland Lottery dropped its membership with the Multi-State Lottery in 2016, largely a strategic decision, said its director Gordon Medenica. Maryland is part of the Mega Millions network and much of the services offered through the association weren't needed, Medenica said.
Even so, lotteries across the nation have taken note of the Tipton scandal, said Gordon Medenica, director of the Maryland Lottery, a one-time member of the Multi-State Lottery Association.
"I think it's had huge consequences," Medenica said. "… Everybody in the technical side of the business is hugely aware of where the vulnerabilities are and what we need to do to prevent any future incidences."