How does a man hack the lottery for years,
pocketing untold amounts of cash all under the noses of the authorities?
Rob Sand sat at his desk in the Iowa Attorney General's Office reviewing case files. Suddenly,
his boss dropped a heavy folder on his desk. “See if you can figure this one out,” he said.
It was a case about a $16.5 million lottery ticket that was purchased and claimed
under suspicious circumstances. Little did Sand know, in the coming months he
would be tangled in a web of lies and deception.
All Sand had to go on for the case was a grainy surveillance recording of the
person who had bought the $16.5 million lottery ticket. The date of the video was December 23,
2010, and was almost four years prior to when Sand received the case file.
In the video, a man wearing a hoodie pulled up over his head and a baseball cap enters a
QuikTrip convenience store in Des Moines, Iowa. He purchases two hot dogs, a fountain drink,
and a lottery ticket. The suspect and the cashier talked briefly before the suspicious man receives
his change, walks back to his SUV, and leaves the gas station holding a Hot Lotto ticket with
the numbers 3, 12, 16, 26, 33, 11 on it. Six days later, that ticket would be worth $16.5 million.
Three months after the numbers were announced no one had claimed the prize.
Six more months passed and still no winning ticket was cashed in. Hundreds of people
claimed they were the winners, saying either they lost their ticket or it was stolen,
but based on the security footage, no one matched the description of the man
who purchased the winning Hot Lotto ticket the night of December 23rd.
The ticket could be turned in up to a year after the numbers were drawn, after that,
the money would be forfeited. Each time the lotto issued a public reminder of this more people tried
to claim the prize. Then, on November 9, 2011, just over a month before the ticket was to expire,
a lawyer from Quebec phoned the Iowa Lottery claiming he had the winning ticket.
This man was able to give the correct 15-digit serial number on the ticket.
His name was Philip Johnston, but he was not the man on the security camera.
When pressed for answers about how he ended up with the ticket Johnston hung up the phone.
He called back a few days later and admitted he was helping a client claim the money
who did not wish to be identified. This alone made the entire situation suspicious,
but what happened next raised all sorts of red flags,
and was the main reason the case ended up on the Attorney General’s desk.
According to Iowa Lottery rules the identities of all winners must be made public. The lawyer
refused to divulge the name of his client and the two parties were at an impasse. Weeks went
by and less than two hours before the ticket needed to be claimed lawyers from a large legal
firm in Des Moines showed up at the Iowa Lottery’s headquarters holding the winning Hot Lotto ticket.
These big-shot lawyers were claiming the ticket on behalf of a trust. The trust’s beneficiary was
a corporation located in Belize that was run by none other than Philip Johnston, the attorney from
Quebec who had tried to claim the prize money a month prior. It was at this point the chief
executive of the Iowa Lottery opened an official investigation that was now Rob Sand’s problem.
In order to get more information on the mysterious hooded man from 2010
Sand released the surveillance footage from the gas station.
With it was a number to call if anyone had information regarding the person in the video.
Days went by with no tips, then a call came in from the Maine Lottery office who identified the
voice in the surveillance video as belonging to a man who audited their office a few years back.
Sand had a break in the case. But it was the next call that came in which led him down the path to
who the mysterious man really was. Members of the Iowa Lottery office informed Sand that they too
recognized the voice on the video. It belonged to the information-security director and programmer
for the Multi-State Lottery Association. This man’s name was Eddie Tipton.
The Multi-State Lottery Association was in charge of lotteries in 33 states,
based in a Des Moines suburb, and ran the Hot Lotto that paid $16.5 million to the unknown
winner in Sand’s case. Now he had a name, all he had to do was find the person it belonged to.
Eddie Tipton was described as a friendly man who was slightly paranoid and always wanted people to
like him. As a programmer he worked long grueling hours for the Multi-State Lottery Association,
often putting in 60 plus hours a week. His main responsibilities were to write software,
update the network security and firewalls for the association,
and to review security threats for the games under the Multi-State Lottery Association umbrella.
When Tipton was accused of being the man in the security video
many of his fellow employees couldn’t believe it. It was illegal for someone
who worked for the association to play the lottery for obvious reasons. To them,
Tipton was an easy-going man who was fun at office parties and nice to everyone.
Luckily for Sand, Tipton was not difficult to track down. He was arrested in January of
2015 at his office and charged with two felony counts of fraud. The suspicious lottery ticket
had been bought by Tipton, which made the case a classic inside job. But how did he do it?
How had Eddie Tipton been able to buy a ticket with the exact winning numbers when the lottery
was supposed to be randomized in a way that no one could know the outcome ahead of time?
The working theory for the prosecution was that Tipton had installed a rootkit malware program
into the lottery computer system via flash drive. However, they couldn’t find any evidence
of the malicious program in the system. It would seem that either they were wrong,
and Tipton had found a different way to manipulate the lottery, or something else was going on.
On July 20, 2015, the jury found Eddie Tipton guilty. He was sentenced to 10 years in prison.
However, when Sand returned to his desk, he couldn’t help but feel like he missed something.
From working in the DA’s office for several years now, and having major success early in his career,
he knew that intelligent criminals like Tipton were rarely caught on their first crime.
Also, something strange had happened during the trial. Once the prosecution brought up
the malware theory the defense changed tactics. They tried to confuse the jury
with technical jargon and claimed the prosecution was using the malware as a
red herring since they didn’t have any hard evidence to support their claims.
The defense also demanded a 90-day speedy trial. This tactic is often done so the prosecution
has less time to investigate before a trial concludes. Something just didn’t feel right
to Sand. He couldn’t help but think that maybe there were other winning lottery tickets that
had been manipulated by Tipton. Sand decided to dig deeper and see just how far the fraud went.
As Sand contemplated the ramifications of Tipton’s years of working in the lotto system
the phone rang. On the other end was a man with a southern drawl. He asked:
“Did y’all know that Eddie’s brother Tommy Tipton won the lottery, maybe about 10 years back?”
Sand’s stomach dropped. His mouth hung open as he thought about how much money Tipton
may have funneled to family and friends if he had been manipulating the lottery
for over ten years. Sand thanked the man for the tip and immediately went to work.
He and his team of investigators sifted through lottery records going back a decade. Once they
had compiled a list of around 45,000 names they began to cross-reference them with Tipton’s known
friends and family. The first big coincidence that the team came across was a winner of
$783,257.72 in the Megabucks Game in Wisconsin. But the large sum of money
wasn’t what caught investigators’ eyes. It was the date that the lotto ticket had won.
It was the same exact date as Tipton’s ticket, but three years earlier on December 29, 2007.
When the investigators looked at the name they were shocked. The person who had won
was Rober Rhodes and he was Eddie Tipton’s best friend. The next breakthrough came when
Sand was working during the holiday season at his parent’s house. He was searching over
some more of the lottery winner names in the spreadsheet that the team had created.
Sand noticed a familiar last name. Kyle Conn from Texas had won $644,478 in the Oklahoma Lottery,
and when the name was cross-referenced with Tipton’s friends on Facebook, they found a match.
Tipton’s phone records were looked into further and Kyle Conn’s number came up multiple times.
On the very same day that Tipton had bought his lottery ticket, two other people bought winning
lottery tickets in Kansas. These two people were friends of Eddie Tipton. When interviewed
by authorities, it was found that Tipton had actually bought the winning tickets himself.
But since he couldn’t claim them, he asked his friends to turn them in for a cut of the money.
Sand and his team had done it. They found several instances of lottery winners who
were all connected to Eddie Tipton. It was clear he had been carrying out his lottery
scheme for several years, and had in effect, stolen millions of dollars from the system.
But the question still remained: how did he do it?
This was driving Sand crazy. He needed to find the exact mechanism to ensure that something
like this would never happen again. The problem was that Tipton wasn’t going to spill his secret,
and all of the machines that Tipton had hacked were either wiped clean before the
investigation had started, or were retired and dismantled. It seemed like a dead end.
But then Sand got another break. Someone had found a number of random-number-generator
computers used for the 2007 lottery in a storage facility. A programming expert was
brought in named Sean McLinden, and he had a plan to reverse engineer the software on
the machines to find the malware that allowed Tipton to predict the outcome of the lottery.
Several days later, Sand received an email from McLinden with 21 lines of code. He had found the
malware that Tipton snuck into the system. It wasn’t very long, which meant it did not alter
the file size of the program in any meaningful way. Also, the code was sitting in plain sight.
However, unless someone was looking for it like McLinden was, it would never have been found.
The program that Tipton inserted into the lottery system’s code was called
QVRNG.dll or Quantum Vision Random Number Generator. The way it worked was genius. The
Multi-State Lottery Association’s random-number generators operated by using a Geiger counter
to measure radioactive isotope Americium-241 in the air at a random time. This measurement would
consist of a long string of numbers that would be fed into the computer system. The program
would then choose a line of numbers based on the radiation measurement. Once this was all done, the
computer would display the digits and they would be the winning lottery numbers for the drawing.
Theoretically, this made it impossible for anyone to cheat because there was no
way to know what the Geiger counter reading would be, how it was going to be randomized,
and which series of numbers would be displayed. What Tipton’s code did was
narrow a series of parameters to make the numbers that could be selected much smaller.
Eddie Tipton never knew what the order of the numbers would be, but his malware was able to
restrict the options, limiting the randomized choices from 10,939,383 sets down to only
a few hundred. That meant if Tipton and his friends purchased all of the possible outcomes
they would end up spending a few hundred dollars on tickets but would almost be guaranteed to win.
Therefore, they would make their money back plus thousands or even millions more.
Tipton’s code worked and he was able to make huge sums of money off the lottery just by
buying a few hundred tickets. Sometimes he would purchase these himself, other times he would give
family or friends the series of possible winning numbers and they would buy their own tickets.
Sand brought everything he had discovered to Tipton and his lawyer to make a deal. Although it
would be hard to bring legal action against some of Tipton’s friends, they could still be dragged
to court and may even be sentenced. Therefore, Sand offered Eddie Tipton a plea agreement where
he would confess to how he had pulled off the largest lottery scam in history, and in return,
his brother would only spend 75 days in jail while the rest of his friends wouldn’t be prosecuted.
As part of the plea deal, Tipton was sentenced to 25 years in prison. He also had to pay
$2.2 million in restitution to all of the state lotteries he scammed, even though his
attorney claimed Tipton only pocketed around $350,000 in total. The rest of the money is
held by the friends and family who turned in the tickets for him. This means there may be millions
of dollars never recovered from the manipulation of the lottery system by Eddie Tipton.
Now watch “What Happened to Lottery Winners Who Won?” Or check out
“How This Couple Won $26 Million in Lottery Using Math.”