B.C. gambling website, privacy commissioner probe glitch that exposed user info

VANCOUVER - Dozens of gamblers on B.C.'s new casino-style website were able to place bets with other users' money, forcing the site to shut down almost as soon as it was up and running, the province's lottery corporation revealed Tuesday.

The B.C. Lottery Corp. added casino games such as blackjack, roulette and craps to its PlayNow.com site last week, but the service was quickly shut down in the midst of an immediate flood of virtual gamblers.

It has remained offline as the Crown corporation investigated a glitch that led some users to be suddenly and inadvertently logged in as others. The corporation was still working on a fix Tuesday.

B.C. Lotteries said the increased load caused the switch in some accounts as users played, leading them to place bets with others' money. In some cases, the users were able to see the other person's account balance and personal information.

About 130 people were affected, and the corporation has identified 12 cases in which a user viewed "sensitive" personal information belonging to someone else.

B.C. Lotteries president Michael Graydon said the overwhelming response on the first day overloaded the servers and caused the glitch..

"We're the first in North America to undertake this business (casino-style online gambling), and our assumptions in regards to servers and volume capacity were wrong," Graydon said in an interview.

"We've been testing this for three months and following the examples of others that are in this industry and we expected (the volume) would not ramp up for a number of days. But it just hit so much that we couldn't do it, so we stopped; we shut it down."

He said the gamblers involved have been told of the mistake and staff have since reviewed winnings and losses from the time of the breach and applied them to the correct accounts.

Last Friday, Graydon said PlayNow.com wasn't working simply because too many users caused crashed the server but the corporation now admits it shut the site down over the privacy breach.

Graydon said the site could be back up by the end of the week if technical staff can fix the problem, and he doesn't think the breach will affect players' confidence in site security.

"We reacted incredibly quickly, and our first concern was our players — we shut the site down," he said. "We are going to work very hard to ensure that the solution put in place is one that this situation doesn't reoccur."

The lottery corporation said it's working with the province's privacy commissioner to respond, and a third-party investigation uncovered no evidence of hacking. The privacy commissioner couldn't be reached for comment.

PlayNow.com became the first website in North America to offer legal casino-style games when it added them to its existing roster of lottery purchases and sports betting last Thursday.

The province's social development minister, Rich Coleman, declined comment Tuesday.

He said last week that British Columbians gamble an estimated $100 million a year with offshore gambling websites. He said the province wants those gamblers to spend that money in B.C., where the government can redirect it to services like health care and education.

Coleman also said the government-operated website would insure the "highest levels of integrity and security of any system in the world."

Shane Simpson, the housing and social development critic for the Opposition New Democrats, said the breach suggests the lottery corporation didn't do its homework to ensure the website would be secure.

"That raises real questions about whether the lottery corporation and the minister rushed into getting this thing out there," Simpson said in an interview.

"It's another of these issues that raise questions of confidence."

Meanwhile, the lottery corporation was also facing criticism Tuesday over hefty fines it received from the federal agency that monitors money laundering and terrorism financing.

The lottery corporation confirmed the Financial Transactions and Reports Analysis Centre of Canada — also known as FINTRAC — fined about $670,000 for more than a thousand infractions related to reporting requirements.FINTRAC requires casinos and provincial gambling regulators to file regular reports to help track suspicious activity.

Graydon suggested the fines were merely administrative rather than an indication anything nefarious was happening.

Most of those, too, were blamed on a computer glitch that sent filed reports back to B.C. Lotteries. By the time they were resent, they were late, he said.

But they weren't all the computer's fault.

In about 230 cases, casino staff failed to obtain enough information from people spending more than $10,000. For such large transactions, the casino is required to check ID and ask a number of questions, including what the person's occupation is, but the reports submitted didn't include detailed enough information.