Players Gamble on Honesty, Security of Internet Betting

Video

From Wall Street to Online Poker

David Paredes, 29, a Harvard graduate and lawyer turned hedge fund employee began playing online poker around 2004. "Live poker is much slower," Paredes says, comparing live poker with online play. "I can probably play 30 hands an hour live, whereas if I'm six-tabling online I can probably get somewhere in the neighborhood of 500 to 600 hands an hour."

» LAUNCH VIDEO PLAYER

According to his father, Scott Tom is still living in Costa Rica but is hard to contact. "Even I have trouble reaching him," Phil Tom said. "I don't call him. He calls me."

Finding the Cheater

If Scott Tom wasn't the cheater, who was?

The poker detectives kept pushing. By mid-October 2007, they were focusing on an employee at AbsolutePoker's Costa Rica office. They posted their findings online, setting off a new wave of charges and increasing pressure on AbsolutePoker's management and the Kahnawake Gaming Commission to address the cheating.

Shortly thereafter, the commission announced that it had hired Gaming Associates, a small Australian computer security firm, to audit the poker site's software. Two days later, AbsolutePoker released an e-mail acknowledging that it had identified "an internal security breach that compromised our systems for a limited period of time." It added: "The cause of the breach has been determined and completely resolved."

The company's statement did not detail how the breach occurred, how many players were cheated or how the cheater was able to spy on cards without being noticed.

Unbeknown to the players, AbsolutePoker had already cut a secret deal with the cheater, whom it characterized as a "consultant with managerial responsibilities." The company agreed not to release his name in return for a "full and detailed explanation" of how he cheated, according to company officials and other interviews. AbsolutePoker also agreed not to sue the cheater or turn him over to Costa Rican authorities, company officials told The Post.

"Of course we considered going to the police, but we decided that it was in the best interest of our cheated players and of AP to get the perpetrator to tell us how the cheating was done," company officials wrote in response to questions from The Post. "We also recognized that prosecutions for white collar crimes in Costa Rica can be time-consuming and sometimes unsuccessful."

(The name of the alleged cheater has circulated widely among poker players on the Internet. The Post is not publishing his name because, even though he purportedly confessed to AbsolutePoker, the company did not release its records and would not discuss the matter. The alleged cheater declined requests to be interviewed.)

Witteles and other players said they were appalled by AbsolutePoker's decision not to seek prosecution of the cheater. "Yeah, we were paid back," he said. "But they made absolutely no attempt to bring any of the people to justice. If someone stole that amount of money from a casino, they would be thrown in jail."

AbsolutePoker said it fired the cheater on Oct. 20, 2007, the day before it started sending $1.6 million in refunds to the cheated players. "Our previous business culture was entrepreneurial, decentralized and individualistic," company officials wrote The Post. "In retrospect, this decentralized approach was not conducive to strict oversight and accountability." The company says it "installed a completely new management team" in order to "build a solid security foundation."

In January 2008, the Kahnawake Gaming Commission released a four-page report on the AbsolutePoker scandal. It said a single cheater using several screen names had taken advantage of a flaw in the software to spy on players' cards during a six-week period starting in August 2007.

It fined Norton's firm $500,000. But it also declined to name the cheater, contending that there "would be no material benefit to the affected players."

"I don't know about that," said Frank Catania, the former New Jersey gambling official who helped the Kahnawake write their Internet gambling regulations, and who was hired by the commission last summer to investigate Norton and his poker sites. "Maybe what they should have done is named the person."

'A Bunch of Blind Men'

A day after the Kahnawake commission released its report about AbsolutePoker, managers at UltimateBet were alerted to new allegations of cheating involving a player using the screen name "NioNio."

One of those who had played against NioNio was David Paredes, 29, a Harvard graduate and lawyer-turned-hedge fund employee. As a childhood math whiz, Paredes had been good enough at chess to travel to national tournaments. In high school, he and his friends played poker for as much as $100 a game. During breaks from law school at New York University, he played at the Foxwoods Resort Casino in Connecticut and in the city's network of underground clubs.

Paredes started playing online around 2005. "I made money almost from the start," he said. Over time, he said, he used his winnings to pay off his law school bill, rent a Manhattan apartment and pay private tuition for a high school student he mentors.

In July 2007, Paredes lost $70,000 to NioNio in a series of games. NioNio had played recklessly, Paredes recalled, making one improbable bet after another, yet winning most hands.

Paredes said he did not suspect cheating until he discussed his hands with another player who also had lost to NioNio. They did a statistical analysis of hand histories, and what they found shocked them: During one brief stretch, NioNio had managed to win $300,000 while rarely losing. Another poker detective calculated that his win rate was about equal to winning the Powerball jackpot three days in a row.

Moreover, it appeared that NioNio was not the only unusually lucky player. Their investigation turned up seven other suspicious accounts that had won a total of $1.5 million on UltimateBet. Later, UltimateBet officials determined that the cheaters had used as many as 88 screen names to avoid detection.

It was as though the cheaters were playing against a "bunch of blind men," Catania recalled. "I mean . . . you're the only one that can see. Everyone else is blind."

In news releases, UltimateBet said that former employees had secretly installed a back door in the software allowing them to spy on players' cards. They stressed the gaming commission's finding that the breach took place before Norton bought UltimateBet in 2006 through a limited partnership in Malta called Blast Off Ltd.

The company told The Post that it performed full financial and operational due diligence before the sale but that it did not find the unauthorized software. Catania, the outside investigator, said that UltimateBet officials did "no due diligence on the technical part. None." At the same time, he said he did not think Norton was aware of the cheating.

UltimateBet officials acknowledged to The Post that the "winning-hand statistics were certainly suspicious and should have been flagged for investigation." They said the accounts belonged to professional players who had been designated as VIP players by the prior owners, and as such were not subject to the same level of scrutiny as other accounts. They added that they did not review the VIP accounts until after the cheating allegations surfaced.

Citing what they said were UltimateBet player logs and real estate records, some of the poker detectives this summer linked former World Series of Poker champion Russ Hamilton to the scandal. In online posts, they alleged that several of the suspect accounts were traced back to property Hamilton owns in Las Vegas, where he is based.

Hamilton did not respond to the accusations. In September, the Kahnawake Gaming Commission announced that there was "clear and convincing evidence" that Hamilton "was the main person responsible for and benefiting from the multiple cheating incidents" at UltimateBet.

The commission did not disclose its evidence allegedly linking Hamilton to the cheating. But Catania said the player accounts "point directly to Russ Hamilton." He added that six to eight accounts were involved in the cheating. "And we know Russ Hamilton was . . . part of those accounts."

Hamilton's lawyer, David Chesnoff, scoffed at the accusations. "Have I heard these allegations? Yes," he said. "We deny them." He added: "Without having an opportunity to review what is alleged to exist, we can't answer the questions and don't think we should dignify it with answers."

In a statement, UltimateBet's owner, Tokwiro Enterprises, cited the commission's finding that Hamilton was responsible for the cheating. The company noted that Hamilton "was never employed by Tokwiro or any of its companies," though he briefly had a "relationship" with the company in which he referred players from his Web site to UltimateBet.

To date, UltimateBet has issued $6.1 million in refunds. Catania said the poker site has promised to reimburse players an additional $15 million, at which point he expects UltimateBet to lose its license or be sold.

The gaming commission fined UltimateBet $1.5 million "for its failure to implement and enforce measures to prohibit and detect fraudulent activities." It defended its handling of the case but said its actions "were not well communicated to the poker industry or public at large, creating an incorrect perception that the [commission] was doing nothing."

The Kahnawake now say they operate one of the most secure Internet gambling operations in the world. Tokwiro says it has "established cutting-edge security systems that make us the safest site in the industry." But Catania said he does not expect cheating to stop: "I'm sure there are people out there right now figuring out, let's say, 'Here's a way we can do it again.' "

Steve Kroft, Ira Rosen and Sumi Aggarwal of "60 Minutes" and special correspondent Gary Wise contributed to this report.