Cracking the Scratch Lottery Code
wired.com
wired.com
"The package was sent at 10 am. Two hours later, he received a call from Zufelt. Srivastava had correctly predicted 19 out of the 20 tickets. The next day, the tic-tac-toe game was pulled from stores."
I know that we're supposed to be fascinated by the statistical work done cracking the code, but my real sympathy is for the head of security that received that package. How do you react in such a situation?
As an aside, the statistician seems really cool too - it's a very forthright interview and the article's much better than I expected. Both the statistician and the author seem to be very surprised by the lack of concern shown for the apparent evidence of security breaches. This, of course, has a direct analogue with the way large multi-nationals treat computer security. I was only surprised to get to the end of the article and not find that the statistician had been threatened with prosecution or similar.
may be because he is in Canada. Do they have DMCA alike?
;)
This would be evil, of course, but if you're running a lottery your entire business is stealing money from poor people.
the hunch is that it will pay out, but not how much. what if this woman in texas had 5 marked "winners" from a dirty merchant "placed" on her when she bought it to avoid a misplaced accusation?
The lottery commission in BC is on it's Nth major criminal investigation - but the trick here seems to be the simpler method of the shop stealing winning tickets from customers.
"I found it hard to believe that only this tic-tac-toe game was flawed. What were the odds that I just happened to stumble upon the only breakable game the very first time I played the lottery? Of course, I knew it was possible that every other scratch game was totally secure. I just didn’t think it was very likely."
Spoken like a true statistician.
Am I the only one who finds this ironic?
Edit: Except, of course, for those who learn to predict 19 of 20 tickets correctly.
While not strictly true (a better educated populous would probably earn more, and give more taxes to the state, among other reasons), I find the idea on this small scale amusing.
So, for example: if the school budget for the year is $5 million, and lottery brings in $1 million for the school, the school doesn't get $6 million the way a lot of people seem to think. The school gets $1 million from the lottery and the state only has to pay $4 million out of the general budget.
"Of course, it would be really nice if the computer could just spit out random digits. But that’s not possible, since the lottery corporation needs to control the number of winning tickets"
Surely the lottery could quantify uncertainties and set up a system where the probability of them losing money would be arbitrarily small. Interesting interview, btw.
Try convincing your boss that the chance of all tickets be winners (which would bring the business down) is "small enough".
Sure it is. How do you think casinos work?
Simply randomly assigning numbers wouldn't work, and it seems the method they've developed for building "fun to play" cards contains weaknesses against statistical analysis.
Hmm... now I'll be stuck mulling over a good algorithm for this all day...
Let's say you design a game that has outcomes Lose, Near-Miss, Win, and Invalid (tickets that must be suppressed, e.g. multiple wins). Then, imagine a rare, salient pattern, like 3 singletons in a baited-hook row. That might be an extremely rare occurrence in the overall lot of random boards, but it might still occur disproportionately in, or in the vast majority of, Win boards and Invalid boards.
If you then choose the Lose, Near-Miss, and Win cards randomly, in the desired proportion, from your truly randomly generated set, then the pattern will be statistically correlated -- potentially strongly -- with the Win cards. That's what the article describes.
A single confusing sentence in the article seems to have gotten a lot of people (including me, at first) thinking this had something to do with PRNG; rather, apalmblad's claim that this is a game design issue seems right.
Only if the "game design" purposely used a limited pool of numbers for the visible and hidden boards. If there was no guarantee that a number would appear 1.9 times, then seeing singleton numbers wouldn't be a predictor.
My guess is that the restricted number pool was used as a means of easily mapping a number (the number on the back of the card) onto a playing board. Anyone interested in the why and how of this should look at The Wizard of Odds[1]. If the number on the card was used to seed a PRNG which then produced a lot more data, there could be a more sophisticated board generator that doesn't need to take such compromising shortcuts.
So in a sense, the culprit is game design in that rules were created to allow for certain percentages of Loses, Near Wins, and Wins. But there is no reason to mix output control into game design. My suggestion is to make the game rules with no regard to controlling output. Instead, evaluate the generated boards and keep/drop them to control the output.
Let's say there's no such demand, and the boards are generated truly randomly and neutrally. If visible-quality X is disproportionately correlated with invisible-quality "Win" then the game is already flawed; this may emerge naturally from the Win conditions and from the game design decision of what is shown in the baited-hook. If the output is controlled post-generation to increase the proportion of Win cards and Near-Win cards vs. Lose and Invalid cards, then the statistical correlation may be greatly increased.
Simplified example: Scratcher with two numbers 0-4: one bait, one hidden, pays if sum is 5 or 6. If everything is fair and truly random, the odds of winning are, 0 showing: 0%, 1 showing: 20%, 2-4 showing: 40%. Already a bad game, but now the game designers want to eliminate cards with sums of 7 or 8 because this confuses people, (not minding that they're changing overall odds of winning), so they block those Invalid cards from shipping without blocking anything else. That gives:
0 1 2 3 4
0 - - - - -
1 - - - - W
2 - - - W W
3 - - W W I
4 - W W I I
OK, database geek hat on here. It's not too hard to pregenerate a set of every possible ticket combination, just lots of cross joining of numbers tables and a bit of coding of the play rules. Add in the payout rules and you can produce a total set of all possible cards along with the payout for each given card.
From this set, we can select exactly the number and balance of paying and non-paying cards we want, chosen pseudorandomly from the set of possible cards. Output that set and sort that pseudorandomly, then send to the printers. You've got a (pseudo) random selection of cards with an absolutely controlled payout pattern.
The downside, and what seems to be the critical problem for the suppliers, is that I suspect you'd have less 'near miss' cards this way to entice players. But it's absolutely possible to ensure that you have a defined payout pattern while also giving random ticket distribution.
Anyhow, the real solution is easier: checking a bingo card or lottery ticket for any feature you want is, essentially, O(1). Generating a lottery ticket is O(1). Generate billions, sort into piles, choose millions from piles in proper proportions, randomize order, done.
This still won't help you if you print sufficient information on the ticket to reverse engineer whether it won or not without actually purchasing it, of course.
All this I agree won't help if your card design is as poor as the original article was, but to address the complaint of the poster before me it's perfectly possible to randomly generate tickets while controlling the number of winning tickets - you just have to have a screening function which prevents more than your controlled number of winners making it through.
Or you could make an app for your smartphone that uses OCR to instantly tell you whether you are looking at a winning ticket.
news.ycombinator.com/item?id=1764895
A highly recommended read.
So what you are suggesting isn't that far fetched.
This may not be the most efficient system but it guarantees it isn't crackable with a couple of caveats:
1. They weren't always releasing a winner at a fixed time - i.e. they had to have x win per week, and they released a winner at regular intervals to guarantee separation. You don't want all the winners for a month produced in the first hour. Although this would be random and should be a possibility.
2. The random number generator was actually random.
Even if you were able to crack the code you'd have to wait for others to buy the losers before a winning ticket would show up. The flaw in this would be if the store selling the tickets was be in on the scam. They'd be able to sell a bunch of losers and pull any winners as soon as it was their turn to dispense. But as with most crimes, the more people involved in it, the harder it is to keep quiet about it and pull it off.
Of course, later in the article it appeared that people were abusing cracks in the system and reaping the benefits, so it doesn't apply to this case. I just wanted to note that sometimes business concerns trump all actually interesting parts of a problem :/
He said he could make $600/day doing this. Even if you only do this 5 days a week and give yourself 2 weeks of vacation, you still end up making $150,000/yr ($600/day * 50 weeks/yr * 5 days/week). That's well above the national average for both the US and Canada.
With progressive taxation, if you get 12 students to redeem 1/12th of your winnings (for say 5%), you're paying taxes at the lowest level (likely even 0%) rather than the 35+% you would be if you had to claim 150k on a single tax return.
"James “Whitey” Bulger, a notorious South Boston mob boss currently on the FBI’s 10 Most Wanted Fugitives list—he’s thought to be the inspiration for the Frank Costello character in The Departed"
The inspiration for that character is the original movie, Infernal Affairs, which The Departed is a remake of. They may have bleneded some features of Bulger into that character, but that doesn't make him the inspiration.
There's no law which says that "if you can figure out how the lottery works, it is illegal". Their recourse is to only pull the lottery and discontinue it; they can't accuse you of fraud if you somehow figured out how to pick the right tickets.
More generally, other than saying "statistics," what specific fields of math are applicable to a problem like this? I'd guess there's some relation here with cryptographic attacks and attacks against pseudo random generators, but what specifically would one study to understand these types of problems?
All you need is some basic knowledge of statistics, uniform distribution, etc. I don't see a need for high-falutin' cryptographic analysis and higher order math.
If you're dealing with online stuff, then some knowledge of PRNGs can help. I remember (a long time ago) hearing about some online poker algorithm which was just calling rand(), and had been seeded with unix time. That leaves a really small number of possibilities to try, and you can reconstruct the stream of random numbers it would generate.
Also, that seems to indicate the issue is due to the overall structure of the problem of choosing numbers for a game like this, while I got the sense from the article that the problem was more due to the algorithm the company used to control winners and losers (maybe I'm wrong on that). If it is due to how the company controls wins in some way, I could see how observing 3 in a row of singles more often than expected by a random distribution (whatever the distribution is for choice of number and choice of spot on the board) is a giveaway to some nonrandomness introduced by their algorithm. But if you were to approach it by finding divergences from this distribution, wouldn't you need a lot of tickets before you could infer this?
In any case - any guess on the expected number of tickets you'd have to have to discover a flaw like this?
But manufacturers appear to have dealt with this by getting rid of "baited hooks"--every number on a card is under a surface that has to be scratched off.
I guess they lose the allure of letting people say "I want to buy a card with lots of 7s because that's my lucky number" but it's a simple and effective fix. Oh well, guess I'll have to get rich through hard work :)
The most obvious vulnerability here is clerks and convenience store owners who unroll the tickets and hand out the loser tickets to customers. That risk is mitigated by the craziness of lotto addicts, who won't accept a ticket that doesn't come off of the roll.
This to me seemed to be the core of the problem; not that the cards were crackable, but that it was possible for a user to select what card to purchase rather than just what game to play. Remove that and the problem largely goes away through simple education about valid play procedures as I suggested.
(* I say educated, but there's the infamous 'Winter temperatures' scratchcard which rather undermines that concept - http://menmedia.co.uk/manchestereveningnews/news/s/1022757_c...)
I grew up in Maine and tickets are dispensed this way. Not sure about returning tickets, but knowing Mainers, I'd be surprised if they would take them back. It doesn't pass the straight-face test.
There is a crackdown on relatives of store owners winning the lottery - but is normally them defrauding winners who come in to check the ticket.
“Lots of people buy lottery tickets in bulk to give away as prizes for contests,” he says. He asked several Toronto retailers if they would object to him buying tickets and then exchanging the unused, unscratched tickets. “Everybody said that would be totally fine. Nobody was even a tiny bit suspicious,” he says. “Why not? Because they all assumed the games are unbreakable. So what I would try to do is buy up lots of tickets, run them through my scanning machine, and then try to return the unscratched losers. Of course, you could also just find a retailer willing to cooperate or take a bribe. That might be easier.”
In theory, the tickets are not actually visibly different. In practice, apparently they are, just not in entirely obvious ways.
If you are worried about people doing this without you, just make an app to calculate the values. Make the calculations server side, and only after checking if the phone is registered.
Just don't hire too many people, or the clerks may start to get suspicious.
However, if they're knowingly selling losers, could that be construed as fraud? Then again, the lottery does that already...
Yes, it's also clearly immoral.
http://www.northumberlandtoday.com/ArticleDisplay.aspx?archi...
They slide out the little display holding the type you're interested in and you sit and mull over the aura of winnitude of each of them. There would be little tolerance for someone looking at each individual card for a minute, though.
The Ontario lottery corporation has come down hard on retailers because, of course, they're the ones who generally ply these scams.
The whole story just feels like a good Samaritan helping a schoolyard bully steal change out of the back pockets of unwitting classmates.
A happy ending would be the lottery system managers getting thrown out after suffering unexpected sustained losses.
This is like helping the nerds carry on taking money from the bullies once they grow up and get dead end jobs