Man Accused of Hacking Lottery Computers to Win $14.3 Million Ticket

They say you have a better chance at getting struck by lighting than winning the lottery, but prosecutors say not for this man, a former head of computer security for a state lottery association may have tampered with the lottery system prior to him buying the winning ticket of a $14.3 million jackpot.

51-Year-Old Eddie Raymond Tipton, is begin accused of allegedly tampering with lottery systems prior to his winning of the million dollar ticket, well, fourteen million dollar ticket. In the official complaint lodged against Tipton, the Iowa-man is alleged to have inserted a USB thumbdrive into the highly-secured computer system that generates random numbers used to determine official lottery winners.

Prior to Tipton’s accusations, he was the information security director of the Multi-State Lottery Association. He was later videotaped purchasing a Hot Lotto ticket that just ironically enough contained the winning numbers for a $14.3 million payout.

In the court documents filed last week, prosecutors say there is evidence supporting the theory that Tipton abused his position inside the lottery association. Alleged evidence shows the 51-year-old enter a highly-secured room, fully enclosed in glass, where Tipton is seen inserting his infected USB drive into the server, which allowed Tipton to control the winning numbers. The enclosed room can only be occupied by two people simultaneously, and the rule is strictly enforced to prevent possibly tampering.

To protect against remote attacks, the Random Number Generator (RNG) systems are not connected to any internal or external networks. Presumably, the systems are air-gapped, meaning the machine is entirely isolated from any external connections into the computer. The machine is gaped from external connections on the other side of the air.

Alleged video surveillance evidence shows Tipton entering the room on November 20, 2010, appearing to change the time on the computers. Though something out of a James Bond movie occured, the surveillance cameras that day just happen to be set to record only one second every minute, instead of running a continuous feed as the association normally does.

“Four of the five individuals who have access to control the camera’s settings will testify they did not change the cameras’ recording instructions,” prosecutors said, speaking on the nearly 4-year-old lottery hacking case. “The fifth person is defendant. It is a reasonable deduction to infer that defendant tampered with the camera equipment to have an opportunity to insert a thumbdrive into the RNG tower without detection.”

Tipton has pleaded not guilty on all charges, while his attorney claims the theory regarding tampering with the RNG system isn’t “factually visible”. The defense attorney even went on to claim Tipton was is another state during the time the lottery ticket was purchased.

Prosecutors said despite the defenses claims that Tipton was out of state during the time the winning $14.3 million ticket was purchased, records indicate otherwise. Citing phone records that exhibit Tipton used his mobile device in Iowa shortly after the ticket had been purchased.

On December 23, a little over a month after Tipton allegedly tampered with the lottery systems, a man at a convenience store was video taped buying a lottery ticket that later won the $14.3 million jackpot. Law enforcement identified the man as Tipton, but a lottery association staffer told authorities all lottery association employees’ are federally ban by law from buying lottery tickets or claiming any lottery-associated prize.

After the winning numbers were announced… nothing happened. The ticket went unclaimed for nearly a year, yet just hours before the ticket was scheduled to expire, a company based out of Belize tried to claim the $14.3 million winning ticket through a New York attorney. Lottery officials refused to cash the winning ticket, due to the individuals behind the Belize company refusing to disclose their names. One month later, Tipton was charged with two counts of fraud.

Allegations regarding Tipton’s tampering of the lottery’s RNG system only came to light in recent court documents filed last week.

Prosecutors offered up additional evidence supporting the case against Tipton, stating the former security director “was ‘obsessed’ with root kits, a type of computer program that can be installed quickly, set to do just about anything, and then self-destruct without a trace.” Prosecutors went on to say a witness will testify against Tipton, stating the Iowa-man told the anonymous witness that he had a self-destructing rootkit, back before December 2010, prior to the lottery hacking and winning ticket.

The trial against Tipton had been scheduled to be reviewed Monday, but defense attorneys postponed the court before jury selection had started. The trial has been rescheduled and Tipton is set to appear before a judge July 13 of this year. If convicted, Tipton could face up to five years in jail and a maximum fine of $7,500.

Sources:
Des Monies Register
Photo via Mark Ou/Flickr [CC BY 2.0]