The auditor was the attack: Ronald Harris and the slot machine he was paid to check

The job

A slot machine is a claim about probability that you cannot inspect. The reels are pictures; the outcome is decided by code on a chip, and no player has ever been able to read that chip. So the industry built a chain of trust in place of a proof: the manufacturer writes the software, a state regulator’s technical staff examine it, and the certified program is burned onto a chip and sealed into the cabinet. Everything after that rests on the examination.

Ronald Dale Harris worked at that examination. He was a computer engineer at the Nevada Gaming Control Board in the early 1990s, responsible for finding flaws and cheating devices in the software running computerized casino games. New Jersey’s later exclusion filing describes him plainly as an engineer specializing in the detection of software and devices designed to cheat at slot machine play. He had the source code, the tools and the standing that came with being the person who signed off.

Co-conspirator Ronald D. Harris is an engineer specializing in the detection of software and devices designed to cheat at slot machine play.New Jersey Division of Gaming Enforcement, exclusion order for Reid E. McNeal, docket 95-0240-EL

Two schemes, and only one of them was tampering

What Harris ran was not one scam but two, and the second is far more interesting than the first.

The first was a backdoor. Using his access to source code, he modified certain machines so that inserting coins in a specific sequence and number would trigger a large payout. From 1993 to 1995 he and an accomplice took thousands of dollars from Las Vegas casinos with it. It is a clean insider attack: the man checking for hostile code was adding it.

The second scheme touched nothing. Toward the end, Harris turned to keno and wrote a program that determined in advance which numbers the game’s pseudorandom number generator would select. No chip was altered. No seal was broken. The machine ran exactly the code it had been certified with, and produced exactly the numbers that code was always going to produce — which was the entire problem.

A pseudorandom generator is a deterministic function. Feed it the same starting state and it produces the same sequence every time, and its unpredictability to a player is a matter of that state and that algorithm being unknown. Harris knew both. From the outside the game was untouched and honest; from where he stood it was a printed list.

Atlantic City, January 1995

The scheme ended at the cage. On 15 January 1995 Harris and Reid E. McNeal were charged with attempted theft by deception, conspiracy and computer theft, over an attempt to obtain a $100,000 keno jackpot from Bally’s Park Place Casino/Hotel in Atlantic City using proprietary computer software information. The charge is worth reading closely: attempted. The ticket was never paid.

What stopped it was not a technical control. When McNeal presented the winning ticket, casino executives found his manner suspicious and called New Jersey gaming investigators. The mathematics had been beaten; the man collecting the money had not rehearsed being delighted.

Harris was sentenced to seven years and released after serving two. He is listed in the Nevada Gaming Control Board’s black book and barred from entering casinos in the state.

What the case actually proves

The usual moral drawn from Harris is that regulators need better vetting. That is true and it is small. The larger lesson is structural, and it applies to every gaming system built the same way since.

• A trusted reader is a single point of failure. If the guarantee is “an expert examined it”, then the guarantee is exactly as strong as that expert, and it fails completely and silently when they turn.
• Secrecy is not a security property. The keno predictor needed no tampering at all. A system whose fairness depends on nobody learning how it works has already lost to anyone who does — which, in a regulated industry, includes a rotating cast of employees, examiners and contractors.
• The player is outside the proof. In the 1990s model no player could verify anything. The best available response to “how do I know this is fair?” was a name on a certificate, which is the answer that failed here.

Cryptography had already answered the middle point in the nineteenth century. Kerckhoffs’s principle holds that a system should stay secure even when everything about its design is public, and that the only thing allowed to be secret is a key. A keno generator whose safety rests on its algorithm being unknown fails that test on the day it is written. It just does not fail publicly until someone like Harris turns up.

The model that replaced it

Commit-reveal fairness exists to remove exactly the assumption Harris broke. The house generates a server seed and publishes its hash before you bet — a commitment it cannot alter afterward. Your own client seed is mixed into the outcome, so the result depends on a value the house did not choose. A counter makes each round distinct. Rotate the seed pair and the old server seed is revealed, at which point every past round can be recomputed on your machine and checked against what you were paid.

Read that against the two schemes above. The backdoor fails because the outcome is pinned by a commitment made before the bet, so no code path can decide to pay differently once it knows what you did. The predictor fails because knowing the algorithm buys nothing: the server seed is committed and hidden, your client seed is yours, and the entire method can be published without weakening it. That is the point — the algorithm is meant to be public. The whole walkthrough of verifying a round takes about a minute, and it is a proof rather than a promise.

It is worth being precise about what this does and does not buy, because overclaiming here is its own kind of dishonesty. A verified draw proves the numbers were not steered. It says nothing at all about whether the paytable is generous — a game paying half of fair value verifies perfectly. Those are two separate questions, and only a published paytable answers the second one.

Harris is remembered as a cheat, which he was. He is more useful as a proof of a negative: he demonstrated, twice, that a trust model resting on the integrity and discretion of insiders will eventually meet an insider. The industry’s answer was to keep hiring careful people. The better answer was to stop needing them.