Eddie Tipton: the lottery random number generator that knew three dates a year

Two hot dogs, a soda, and a $14.3 million ticket

The surveillance tape from the QuikTrip on Des Moines’ east side shows a large man in a hooded sweatshirt at about 3:30 in the afternoon, two days before Christmas 2010, paying for $3.17 of hot dogs, a fountain drink and two Hot Lotto tickets. Six days later, on 29 December 2010, one of those tickets matched all five numbers and the Hot Ball. The jackpot was $14.3 million in cash, $16.5 million as an annuity. Nobody came forward.

The claim arrived with hours to spare. Iowa tickets expire after a year; on 29 December 2011, an hour and fifty minutes before the deadline, lawyers at a Des Moines firm presented the ticket on behalf of a trust called Hexham Investments, registered in Belize, whose trustee, a New York lawyer named Crawford Shaw, had spelled it “Hexam” on the paperwork. The claim was turned away. In January 2012 Shaw met lottery officials in person; Iowa does not pay anonymous winners, Shaw would not say who had bought the ticket, and on 26 January 2012 he signed an affidavit and withdrew. The $14.3 million went back to the players’ pool. The lottery released the QuikTrip tape and asked the public who the man in the hoodie was.

Dates from the Iowa case record as reported by the Des Moines Register, the Associated Press, The Daily Beast (7 July 2015) and CNN (22 August 2017). The Wikipedia summary of the case gives the cash value as $14.3 million and the advertised prize as $16.5 million; both figures appear in contemporary reporting.

The man in the hoodie was Eddie Tipton, who could not legally buy a lottery ticket at all. As MUSL’s information security director he was one of five people with access to the draw room, and he had helped write the software inside it. A colleague recognised his voice on the tape. The prosecution’s theory at the 2015 trial was that on 20 November 2010 he had used the clock adjustment as cover to plug in a USB stick carrying a self-deleting program, and that the camera, set to record one second in sixty, had been arranged not to see it. The defence said the cameras had a history of faults and no malware was ever found. The jury convicted; the Iowa Supreme Court threw the convictions out two years later on the statute of limitations; and then Tipton, facing charges in five states, stood up in court and explained what he had actually done.

Three dates a year, after eight o’clock

The code was found not in Iowa, where the drives had been wiped, but in Wisconsin. In 2016 investigators examining the generator used for that state’s Megabucks draw found segments of code added after the software had been reviewed and certified. On three dates in the year, 27 May, 23 November and 29 December, if the date fell on a Wednesday or Saturday (the draw days) and the draw ran after 8 p.m., the generator did not draw at random. It ran what the investigators called a multi-variable algorithm whose output the author could reproduce. On every other day of the year it was exactly the random number generator the auditors had signed off.

Look at the list of jackpots then. Colorado, 23 November 2005: $568,990, Tipton’s brother Tommy’s share of a $4.5 million prize, on a generator Eddie had helped build. Wisconsin, 29 December 2007: $783,257, paid to a company controlled by Robert Rhodes, a friend from Texas who later moved money to Tipton. Kansas, 2010. Iowa, 29 December 2010: the $14.3 million that was never paid. Oklahoma, 23 November 2011: $1.2 million. Every one of them on 23 November or 29 December. The dates were the signature; the reason nobody read it for six years is that nobody was looking at a list of dates. They were looking at a certified random number generator.

C(39,5) × 19 = 575,757 × 19 = 10,939,383 for the matrix Hot Lotto used until May 2013. A player who can reproduce the generator’s state does not have better odds; he has the answer. The other 362 days were, as far as anyone has shown, honest, which is why the generator passed every audit it was given.

There is a detail here that matters more than the rootkit. A random number generator is a function: seed in, numbers out. Certification checks the function; it cannot check who chose the seed, or whether the function quietly uses a different one on three nights a year. The Wisconsin code did not break randomness. It replaced it, briefly, with something that looked identical from outside and was fully determined from inside, and then went back to being random before anyone checked. Every test of the output, before or after, would pass.

The question an audit cannot answer: who chose the seed?

The case was broken by a claims clerk, a misspelt trust and a convenience-store camera, not by anything in the draw. That is the uncomfortable part. MUSL ran a sealed room, a certified generator, a five-person access list and a surveillance camera, and the person responsible for all four was the attacker. After the arrest the Iowa Lottery announced new draw equipment and software, new cameras, new draw-room protocols and “separation of duties”, which is the honest phrase for the problem: the same person had written the function, held the keys and set the camera. Hot Lotto itself was retired in October 2017.

The structural fix is not a better camera. It is to take the choice of the seed away from anyone who can see the outcome. In a provably fair game the operator publishes a hash of its seed before the bet; the player supplies a seed of their own; and every round’s number is a keyed hash of the two together with a counter. An insider who wrote the function and holds the server seed still cannot pick the result, because the player’s seed arrives after the commitment and the operator cannot change its own seed without breaking the published hash. Tipton’s three dates a year would have been impossible under that rule, not because the code could not be written, but because the seed he needed to know was not his to choose.

None of this is a claim that a provably fair casino is more trustworthy than a state lottery; it is the smaller claim that the seed is not the house’s alone to choose, which in the lottery it was. Tipton’s jackpots were only ever as random as the one man allowed in the room, and the room was built so that nobody could tell. A public commitment and a seed the house does not choose would have left him with the same odds as everyone else: one in 10,939,383, on every date in the year.