No doubt that this is cheating, but IGT should be embarrassed....
HOW THEY BEAT THE HOUSE
The “Double Up bug” lurking in the software of Game King video poker machines survived undetect*ed for nearly seven years, in part because the steps to repro*duce it were so complex. John Kane and Andre Nestor experimented until they could trig*ger it at will.
1. Locate a Game King video poker machine con*figured for multi-denomination play. If you're in Las Vegas, you're probably already standing next to one.
2. Flag down a slot attendant and ask them to enable the Double Up option. Say thank you and smile until they walk away.
3. Insert money or a voucher and select the lowest denomination level offered by the machine—for example, $1 per credit on a $1, $2, $5, $10 machine.
4. Choose your favorite game variant—Triple Double Bonus Poker is fun—and start playing.
5. Keep playing at the $1 level until you win a big hand. An $800 royal flush is perfect.
6. With your royal flush showing but not yet cashed out, hit the More Games button on the touchscreen and select a different game variation. Play it until you score a win.
7. Insert more money or a voucher into the machine.
8. Touch the More Games button again, and change to the maximum denomination—in this case, $10 per credit. Then return to your original $800 royal flush.
9. Press the Cash Out button. “Jackpot! $8,000” will appear on the screen and the light on the top of the machine will illuminate. Congratulations!
10. Wait for the slot attendant to show up with an IRS form W-2G (“certain gam*bling winnings”). Once you've signed it, they'll get the machine to spit out a jackpot ticket.
MICHAEL FRIBERG
John Kane was on a hell of a winning streak. On July 3, 2009, he walked alone into the high-limit room at the Silverton Casino in Las Vegas and sat down at a video poker machine called the Game King. Six minutes later the purple light on the top of the machine flashed, signaling a $4,300 jackpot. Kane waited while the slot attendant verified the win and presented the IRS paperwork—a procedure required for any win of $1,200 or greater—then, 11 minutes later, ding ding ding!, a $2,800 win. A $4,150 jackpot rolled in a few minutes after that.
All the while, the casino's director of surveillance, Charles Williams, was peering down at Kane through a camera hidden in a ceiling dome. Tall, with a high brow and an aquiline nose, the 50-year-old Kane had the patrician bearing of a man better suited to playing a Mozart piano concerto than listening to the chirping of a slot machine. Even his play was refined: the way he rested his long fingers on the buttons and swept them in a graceful legato, smoothly selecting good cards, discarding bad ones, accepting jackpot after jackpot with the vaguely put-upon air of a creditor finally collecting an overdue debt.
Williams could see that Kane was wielding none of the array of cheating devices that casinos had confiscated from grifters over the years. He wasn't jamming a light wand in the machine's hopper or zapping the Game King with an electro*magnetic pulse. He was simply pressing the buttons. But he was winning far too much, too fast, to be relying on luck alone.
At 12:34 pm, the Game King lit up with its seventh jackpot in an hour and a half, a $10,400 payout. Now Williams knew something was wrong: The cards dealt on the screen were the exact same four deuces and four of clubs that yielded Kane's previous jackpot. The odds against that were astronomical. Williams called over the executive in charge of the Silverton's slots, and they reviewed the surveillance tape together.
The evidence was mounting that Kane had found something unthinkable: the kind of thing gamblers dream of, casinos dread, and Nevada regulators have an entire auditing regime to prevent. He'd found a bug in the most popular video slot in Las Vegas.
As they watched the replay for clues, Kane chalked up an eighth jackpot worth $8,200, and Williams decided not to wait any longer. He contacted the Silverton's head of security, a formidable character with slicked-back silver hair and a black suit, and positioned him outside the slot area. His orders: Make sure John Kane doesn't leave the casino.
Virtuoso pianist John Kane discovered an exploitable software bug in Game King poker machines. MICHAEL FRIBERG
Kane had discovered the glitch in the Game King three months earlier on the other end of town, at the unpretentious Fremont Hotel and Casino in downtown's Glitter Gulch. He was overdue for a lucky break. Since the Game King had gotten its hooks in him years earlier he'd lost between tens of thousands and hundreds of thousands annually. At his previous haunt, the locals-friendly Boulder Station, he blew half a million dollars in 2006 alone—a pace that earned him enough Player's Club points to pay for his own Game King to play at his home on the outskirts of Vegas, along with technicians to service it. (The machine was just for fun—it didn't pay jackpots.) “He's played more than anyone else in the United States,” says his lawyer, Andrew Leavitt. “I'm not exaggerating or embellishing. It's an addiction.”
To understand video poker addiction, you have to start with the deceptively simple appeal of the game. You put some money in the machine, place a bet of one to five credits, and the computer deals you a poker hand. Select the cards you want to keep, slap the Draw button, and the machine replaces the discards. Your final hand determines the payout.
When the first video poker machine hit casinos in the 1970s, it was a phenomenal success—gamblers loved that they could make decisions that affected the outcome instead of just pulling a handle and watching the reels spin. The patent holder started a company called International Game Technology that debuted on the Nasdaq in 1981.
IGT's key insight was to tap into the vast flexibility offered by computerized gambling. In 1996, the company perfected its formula with the Game King Multi-Game, which allowed players to choose from several variations on video poker. Casinos snatched up the Game King, and IGT sold them regular firmware upgrades that added still more games to the menu. On September 25, 2002, the company released its fifth major revision—Game King 5.0. Its marketing material was triumphal: “Full of new enhancements, including state-of-the-art video graphics and enhanced stereo sound, the Game King 5.0 Multi-Game suite is sure to rule over your entire casino floor with unprecedented magnificence!” But the new Game King code had one feature that wasn't in the brochure—a series of subtle errors in program number G0001640 that evaded laboratory testing and source code review.
The bug survived like a cockroach for the next seven years. It passed into new revisions, one after another, ultimately infecting 99 different programs installed in thousands of IGT machines around the world. As far as anyone knows, it went completely undetected until late April 2009, when John Kane was playing at a row of four low-limit Game Kings outside the entrance to a Chinese fast food joint at the Fremont, smoke swirling around him and '90s pop music raining down from the casino sound system.
He'd been switching between game variations and racking up a modest payout. But when he hit the Cash Out button to take his money to another machine, the candle lit at the top of the Game King and the screen locked up with a jackpot worth more than $1,000. Kane hadn't even played a new hand, so he knew there was a mistake. He told a casino attendant about the error, but the worker thought he was joking and gave him the money anyway.
At that point, Kane could have forgotten the whole thing. Instead, he called a friend and embarked on the biggest gamble of his life.
Even before the phone rang in his suburban Pittsburgh home, Andre Nestor had a gut feeling that everything was about to change for him. Superstitious and prone to hunches, he'd felt it coming for days: April 30, 2009, would be exactly 15 years since Nestor ignored an urge to play a set of numbers that came up in the Pennsylvania lottery Big 4.
That was the story of his life—always playing the right numbers at the wrong time. Games of chance had been courting and betraying Nestor since he was old enough to gamble. In 2001 he'd moved to Las Vegas to be closer to the action, answering phones for a bank during the day and wagering his meager paycheck at night. That's when he met John Kane in an AOL chatroom for Vegas locals. Though Nestor was 13 years younger than Kane and perpetually flirting with poverty, they developed an intense addicts' friendship.
Nestor's records show he lost about $20,000 a year for six years before he gave up, said good-bye to Kane, and moved back to the sleepy Pittsburgh suburb of Swissvale, Pennsylvania, in 2007. For about two years he had a stable life, living off public assistance, gambling infrequently, and playing the occasional lottery ticket. Then Kane called to tell him about a bug he'd found in video poker. Nestor drove to the airport that night and camped there until the next available flight to Las Vegas.
Kane picked him up at the curb at McCarran airport. After a quick breakfast, they drove to the Fremont, took adjacent seats at two Game Kings, and went to work. Kane had some idea of how the glitch operated but hadn't been able to reliably reproduce it. Working together, the two men began trying different combinations of play, game types, and bet levels, sounding out the bug like bats in the dark.
It turned out the Game King's endless versatility was also its fatal flaw. In addition to different game variants, the machine lets you choose the base level of your wagers: At the low-limit Fremont machines, you could select six different denomination levels, from 1 cent to 50 cents a credit.
“You had complete control,” Andre Nestor says. “You could win $500,000 in one day.” MICHAEL FRIBERG
The key to the glitch was that under just the right circumstances, you could switch denomination levels retroactively. That meant you could play at 1 cent per credit for hours, losing pocket change, until you finally got a good hand—like four aces or a royal flush. Then you could change to 50 cents a credit and fool the machine into re-awarding your payout at the new, higher denomination.
Performing that trick consistently wasn't easy—it involved a complicated misdirection that left the Game King's internal variables in a state of confusion. But after seven hours rooted to their seats, Kane and Nestor boiled it down to a step-by-step recipe that would work every time.
Nestor and Kane each rang up a few jackpots, then broke for a celebratory dinner, at which they planned their next move. They would have to expand beyond the Fremont before the casino noticed how much they were winning. Fortunately, Game Kings are ubiquitous in Vegas, installed everywhere from the corner 7-Eleven to the toniest luxury casino. They mapped out their campaign and then headed back to Kane's home for the night.
Kane lived in a spacious house at the far northeast edge of town. His Game King was in the foyer. A spare bedroom down the hall was devoted entirely to a model train set, an elaborate, detailed miniature with tracks snaking and climbing through model towns, up hills, across bridges, and through tunnels, every detail perfect. The home's centerpiece was the living room with its three Steinway grand pianos. Kane is a virtuoso pianist; in the early 1980s he was a leading dance accompanist in the Chicago area, and even today he sells recordings under the vanity label Keynote Records. He left the professional music world only after failing to advance in the prestigious Van Cliburn International Piano Competition. Now he ran a manage*ment consulting practice that claimed one-third of the Fortune 100 as clients.
Kane's business was lucrative, so he was accustomed to handling money. But now that they were on the verge of a windfall, he was worried about Nestor; he could see his younger friend returning every cent to the casinos at the roulette tables or blowing it all on frivolities. “If you had a million dollars, what 10 things would you do?” Kane asked him. He wanted Nestor to make a list and really think through his priorities.
Nestor started a list, but it would prove unnecessary. After another day at the Fremont, they branched out. To their surprise, the button sequence didn't work. Over the following days, they explored the Hilton, the Cannery, then the Stratosphere, Terrible's, the Hard Rock, the Tropicana, the Luxor, and five other casinos, drawing the same dismal results everywhere. For some reason, the Game King glitch was only present at the Fremont.
NESTOR TAPPED THE MAGIC SEQUENCE OF BUTTONS, HIT “CASH OUT,” AND WATCHED AS HIS $500 PAYOUT BECAME A $10,000 JACKPOT.
At the end of a frustrating week, Nestor headed to the airport for his return flight with just $8,000 in winnings. As a final insult, he lost $700 in a video poker machine while waiting for his plane.
Kane decided to wring what he could from the four Fremont machines. He learned to speed up the process by using the Game King's Double Up feature, which gave players a chance to double their winnings or lose everything. Respectable payouts that might once have satisfied Kane were garbage now. After five weeks using the new strategy, Kane had pocketed more than $100,000 from the Fremont.
Unsurprisingly, the Fremont noticed. In modern casinos, every slot machine in the house is wired to a central server, where statistical deviations stick out like a fifth ace. The four machines under the Chinese food sign shot to the top of the Fremont's “loser list” of underperforming games: They'd gone from providing the casino a reliable $14,500 a month to costing it $75,000 in May alone.
On May 25, a slot manager approached Kane after one of his wins and announced that he was disabling the Double Up feature on all of the Game Kings—he was aware that Kane used the option copiously, and he figured it must have something to do with his run of luck.
Kane took the development in stride: The bug, not the Double Up, was the real secret of his success. But he was in for a shock. The next time he played the Game King, the magic button sequence no longer worked. In an instant, the Fremont was no better than all the other casinos that had been immune to the glitch.
He phoned Nestor, who processed the news. With the Double Up option turned on, the bug worked; turned off, it didn't. Whatever internal stew of code made the Game King exploitable, Nestor concluded, the Double Up option had been a key ingredient the whole time. They just hadn't known it.
This wasn't bad news at all. It was the missing link. It explained why the bug had failed them everywhere but at the Fremont. Most casinos don't enable Double Up because it's unpopular with players. But that could easily be changed. High rollers and slot aficionados often have favorite game variants or features that aren't available by default but can be enabled by any passing slot attendant.
Nestor purchased two dress shirts and caught another flight to Las Vegas, where he joined Kane at Harrah's. Row after row of Game Kings were waiting, and, true to the plan, the staff didn't hesitate when Kane and Nestor asked for Double Up to be enabled.
Nestor got the first significant winning hand of the trip: four fours and a kicker for $500. He tapped the magic sequence, hit Cash Out, and watched with delight as his $500 became a $10,000 jackpot. He tipped the slot attendant $20.
There were no limits now. They could play anywhere and beat the house wherever they went. Nestor, who’d been scraping by on a $1,000-a-month welfare check, saw a whole new future unfolding: home ownership, an investment account, security, better clothes, and gifts for his friends back home. For his part, Kane was already well on his way to erasing the massive losses he’d suffered since moving to Sin City.
Working as a team had its advantages. While experimenting with the bug, they discovered that they could trigger a jackpot on the same hand more than once: All they had to do was lower the denomination again and repeat the steps to activate the glitch. They could effectively replay their win over and over, as much as they wanted. It was a risky play—even the busiest casino might notice the same player repeatedly winning with the same hand. But now that they were playing together, Kane and Nestor could ride on each other's jackpots. Nestor won $4,000 with four aces; then, after waiting a bit, Kane slid over to the same machine and replayed the hand for another $4,000.
They could even piggyback on other players' wins. No longer confined to four low-limit slots at a single casino, they prowled the floor at Harrah's looking for empty machines still showing a player's jackpot. Once they got an attendant to turn on Double Up, it took only seconds to replay the hand at up to 10 times the original value. Video poker wasn't even gambling anymore. “You had complete control over how much you could win,” Nestor says. “If you wanted to go to a casino and win $500,000 in one day, you could win $500,000 in one day.”
At the end of the evening, Nestor says they went to his cheap hotel room at Bill's Gamblin' Hall and Saloon to settle up. As the benefactor of Kane's discovery, Nestor had agreed to give his old friend half his winnings. But now that the cash was rolling in, he was having second thoughts about the arrangement.
Every jackpot, he realized, was being reported to the IRS, and he'd already won enough from the bug to propel him into a higher tax bracket. If he paid half to Kane off the top, he might wind up without the reserves to pay his tax debt come April of the following year. He broached the subject with Kane: He'd be more comfortable holding on to the money until his taxes were paid. It was just a year. He'd happily give Kane half of his post-tax winnings then.
Kane was indignant but not surprised; leave it to Nestor to turn even free money into a problem to obsess over. He insisted Nestor honor his agreement, and Nestor grew more agitated, his voice rising in pitch. “What am I doing? Why am I even doing this?” he complained. “I'm not winning any money doing this if I'm giving you all this up front.”
Kane finally agreed to accept a third of Nestor's $20,000 take for the day. Nestor says he counted out $6,000 in hundreds onto an end table, and Kane said good night.
The tension between the men lingered the next day at the Wynn, a towering upscale supercasino with more than 1,300 slots. They played side by side, raking in money and continuing to argue over the split. Nestor was now of the opinion that he shouldn't have to pay Kane anything. It was Nestor, after all, who'd figured out that the Double Up feature was part of the bug. That should make them square.
AFTER A NIGHT IN JAIL, AN UPSET KANE CALLED NESTOR. “STAY OUT OF THE CASINOS”, HE SAID. “DO NOT GO BACK TO THE CASINOS.”
“This was my gift to you,” Kane shot back testily. “If you'd found this bug instead of me, you would never have told me about it.”
The accusation stung. Nestor gaped at his friend, then he stood and walked away from the machine.
The next day Nestor nursed his hurt feelings with a solo trip to the Rio. He found a Game King displaying four aces and a kicker and hit it for $5,600. Then he wandered into the high-limit room and found another four aces. He punched this one twice: $20,000 at a $5 denomination, then, after a decent interval, $8,000 at the $2 level. Nestor's records show that he eventually left the casino with about $34,000 in his pockets. He didn't need Kane at all. “There was so much money to be made, what did it even matter?” he says.
On his last day in Vegas, Nestor continued his solo run, hitting a Game King at the Wynn for a combined $61,000. Back in his room at Bill's, he added up his winnings: He was going home with $152,250 in cash in his luggage. And he wasn't done yet. There were casinos in Pennsylvania, too, where he could operate without the slightest risk of Kane knowing what he was up to—or demanding a cut up front.
After Nestor left, Kane tore into Vegas with a vengeance. Official numbers have never been released, and Kane declined to speak for this article, but the FBI would later tally Kane's winnings at more than $500,000 from eight different casinos. The Wynn, where Kane kept four nines on one Game King for days, was the biggest loser at $225,240.
Back in Pennsylvania, Nestor targeted the newly opened casino at the Meadows Racetrack in Washington County. In contrast to Kane, who played the bug with joyless, businesslike intensity, Nestor was voluble and chatty at the Meadows. He dressed smartly and, according to court documents, brought along a small entourage for company: his roommate, a retired cop named Kerry Laverde; and Patrick Loushil, a server at Red Lobster who agreed to collect some of Nestor's jackpots for him, so they wouldn't all show up on Nestor's tax bill. Nestor hammed it up every time he won, gushing excitedly to the slot workers—“I'm so excited! Here, feel my heart!”—and tipping generously.
But it all began to unravel the night Kane found himself waiting for a payout at the Silverton. The casino's head of security stood just outside the slot area. Kane paced and huffed, spun the swivel chair back and forth like a metronome, and complained to passing slot attendants. Finally, three men strode up to him. The head of security directed Kane to an alcove, handcuffed him, and escorted him away from the video poker machines.
An armed agent from the Gaming Control Board arrived soon after. He sealed the machines Kane had been playing on with orange evidence tape and collected Kane from the back room, where he'd been handcuffed to a chair. Kane's wallet and the $27,000 in his pocket were confiscated, and he was booked into the Clark County Detention Center on suspicion of theft.
After a night in jail, Kane was released. On Monday he called Nestor to warn him that the bug had been discovered. He sounded more upset than nestor had ever heard him. “Stay out of the casinos,” Kane said. “Do not go back to the casinos.”
Nestor's heart sank for his old friend. It was painful to imagine Kane suffering the indignity of a night in jail, mug shots, fingerprints, being treated like a common criminal. But after the call, Nestor talked himself into an alternate theory. What if there'd been no arrest? What if Kane suspected—as he must have—that Nestor was using the bug and had made up the story about the Silverton to scare Nestor into stopping, so Kane could have the exploit all to himself? By this time Nestor had been back in Pennsylvania three weeks and had already won nearly $50,000 from the Meadow's Game King.
He decided to ignore Kane's story and started planning his next trip to the Meadows.
Three days later, in Las Vegas, engineers from the Nevada Gaming Control Board's Technology Division descended on the Silverton. The forensics investigation of the Game King scam had fallen to John Lastusky, a 25-year-old clean-cut USC computer engineering graduate.
Lastusky pulled up the game history on the two machines Kane had played and reviewed the wins, then slid out the logic trays, the metal shelves housing the Game King's electronic guts, and checked the six EPROMs containing the machines' core logic, graphics, and sound routines. There was no sign of tampering. He confiscated the logic trays and packed them up for the trip back to headquarters.
Housed in an anonymous office park near the airport, the GCB's Technology Division was formed in the mid-1980s to police video gambling as it began its Nevada ascent. The division helps set the rigorous standards that gamemakers like IGT must meet to deploy machines in the Silver State. A 3,000-square-foot laboratory at the back of the office is packed end to end with slot machines in various states of undress—some powered down, some in maintenance mode, others stripped to their bare electronics, though most are configured as they would be on a gaming floor.
“GET ON THE FLOOR!” YELLED THE TROOPER, LEVELING HIS AR-15 AT NESTOR'S FACE.
A smaller, locked-down room adjacent to the lab is more important: It houses a permanent repository of the source and executable code for every version of game software ever approved in Nevada—more than 30,000 programs in all. The code vault is at the center of the gaming board's massive software integrity operation. Every new addition is carefully examined: Is the random number generator random enough? Does the game pay out at the advertised rate? Is there logic where there shouldn't be? “We're not necessarily looking for something nefarious, but the goal is to ensure the integrity of the product,” says division chief Jim Barbee.
There's a real, if mostly unrealized, danger of gaming software being backdoored. The concept was proven in 1995, when one of the GCB's own staffers, Ron Harris, went bad. Harris modified his testing unit to covertly reprogram the EPROMs on the machines he was auditing. His new software commanded the machine to trigger a jackpot upon a particular sequence of button presses—like a Konami Code for cash. He was eventually caught, and he served two years in prison.
BRATISLAV MILENKOVIC
That stain on the board's integrity haunts the division to this day. But by all evidence, the division's paranoia, coupled with the game industry's self-interest, have kept video gambling code clean and mostly free of exploitable bugs. That made the Game King case an intriguing puzzle for Lastusky. Armed with the surveillance footage of Kane in action, Lastusky sat at one of the Game Kings in the lab and began experimenting. Within a few days he was able to reliably reproduce the exploit himself. He gave his findings to IGT, which rushed out a warning to its customers advising them to immediately disable the Double Up option. “Replacement programs are being expedited,” the company explained.
Every Game King on the planet running a vulnerable version would need a patch. The upgrade process would be grueling. When an operating system like Windows or OS X has a security bug, customers can download the patch in a few minutes over the Internet. Slot machines aren't online. New programs are burned onto EPROMs by the manufacturer and shipped in the mail in plastic tubes.
Blind to the firestorm erupting in Vegas, Nestor spent the rest of July and most of August playing at the Meadows, until August 31, when the casino finally got suspicious and refused to pay Nestor on a four of a kind. Nestor protested but walked away, breaking into a run as he reached the parking garage.
Nestor was up more than $480,000. The Game King ride was over, but he had enough money to last him forever.
At 1:30 pm on October 6, 2009, a dozen state and local police converged on Andre Nestor's split-level condo on a quiet, tree-lined street in Swissvale. He was dozing on his living room couch when the banging started. “State police! Open up!” The battering ram hit the door seconds later, splintering the frame and admitting a flood of cops into the house.
Nestor says he started toward the stairs, his hands over his head, when he came face-to-face with a trooper in full riot gear. “Get on the floor!” yelled the trooper, leveling his AR-15 at Nestor's face. Nestor complied. The cop ratcheted the handcuffs on Nestor's wrists, yanked him to his feet, and marched him into the kitchen.
For the next two hours, Nestor watched helplessly, handcuffed to a kitchen chair, while the police ransacked his neat home. They flipped over his mattress, ripped insulation from his ceiling, rifled his PC. At about 4 pm, Nestor's roommate, Laverde, arrived home and was arrested on the spot as an accomplice to Nestor's crimes.
It was the first major gambling scandal in Pennsylvania since the state had legalized slots in 2004. The media portrayed Nestor as a real-life Danny Ocean, and prosecutors hit him with 698 felony counts, ranging from theft to criminal conspiracy. The district attorney seized every penny of Nestor's winnings and gave it back to the Meadows. Nestor and Laverde spent about 10 days in the county jail before making bail.
A defiant Nestor vowed to fight the case—no jury would convict a gambler, he was certain, for beating a slot machine at its own game. But on January 3, 2011, when it was time for jury selection, Nestor was hit with another surprise. Two FBI agents showed up and pulled him from the Washington County courthouse. The Justice Department had taken over the case. Nestor and Kane had both been charged federally in Las Vegas.
As the agents walked him to their car, Nestor stopped in front of a television camera and let loose. “I'm being arrested federally now—for winning at a slot machine!” he shouted in disbelief. “This is what they do to people! They put a machine on the floor, and if it has programming that doesn't take your money and you win on their machine, they will throw you in jail!”
The Las Vegas prosecutors charged Nestor and Kane with conspiracy and violations of the Computer Fraud and Abuse Act. Passed in 1986, the CFAA was enacted to punish hackers who remotely crack computers related to national defense or banking. But in the Internet age the government had been steadily testing the limits of the law in cases that didn't involve computer intrusion in the usual sense. Kane and Nestor, the government argued, exceeded their otherwise lawful access to the Game King when they knowingly exploited a bug. The casinos only authorized gamers to play by the rules of video poker. “To allow customers to access previously played hands of cards at will, would remove the element of chance and obviate the whole purpose of gambling,” assistant US attorney for the District of Nevada Michael Chu argued in a court filing. “It would certainly be contrary to the rules of poker.”
The defense attorneys pushed for dismissal of the computer hacking charge, on the grounds that anything the Game King allowed players to do through its interface was “authorized access” by definition: The whole point of playing slots is to beat the machine, and it's up to the computer to set and enforce limits. “All these guys did is simply push a sequence of buttons that they were legally entitled to push,” says Leavitt, Kane's attorney.
The pretrial motions dragged on for more than 18 months, while in the larger legal landscape, the CFAA was going under a microscope for the first time since its passage. In January 2013, coder and activist Aaron Swartz committed suicide after being charged under the same law for bulk-downloading academic articles without permission, spurring calls for reform. Three months later, the US Ninth Circuit Court of Appeals threw out computer hacking charges in a closely watched case against David Nosal, a former executive at a corporate recruiting firm who persuaded three employees to leak him information from the firm's lead database. The Ninth Circuit found that pilfering contacts doesn't become computer hacking just because the data came from a computer instead of a copy machine.
Seeing parallels to the Game King prosecution, the judge overseeing Kane and Nestor's case ordered the government to justify the hacking charge. The prosecutors didn't even try, opting instead to drop the charge—leaving only an ill-fitting “conspiracy to commit wire fraud” count remaining.
Prosecutors had a weak hand, and they knew it. As a December 3, 2013, trial date approached, the Feds made Kane and Nestor separate but identical offers: The first one to agree to testify against the other would walk away with five years of probation and no jail time.
The old gambling buddies had one more game to play together. It was the Prisoner's Dilemma. Without speaking, they both arrived at the optimal strategy: They refused the offer. A few months later, the Justice Department dropped the last of the charges, and they were free.
Kane and Nestor haven't spoken since 2009. After his Silverton arrest, Kane began recording classical music in his house and uploading the videos to a YouTube channel. Last March, after the federal case was dropped, he sent a CD of some of his performances to his high school piano teacher. “I'm essentially now retired from a career in business, have remained single, leading a quiet suburban life,” he wrote.
Nestor's greatest regret is that he let the Game King bug come between him and Kane. “I didn't want it to go that far,” he says. “I thought he and I were friends long enough that these kinds of issues didn't need to happen.” He claims he always intended to pay Kane his cut from the secret jackpots. Now he can't. His roommate, Laverde, signed over Nestor's money in exchange for avoiding a trial of his own. (There are no court filings to suggest that Kane's winnings were seized.) Nestor says the Meadows still has his winnings, and the IRS is chasing him for $239,861.04 in back taxes, interest, and penalties—money he doesn't have.
If there's one silver lining, it's that Nestor has been banned from Pennsylvania casinos. He still gambles occasionally in neighboring states, but his more pressing addiction right now is Candy Crush, which he plays on a cheap Android tablet. He cleared 515 levels in two months, using a trick he found on the Internet to get extra lives without paying.
HOW THEY BEAT THE HOUSE
The “Double Up bug” lurking in the software of Game King video poker machines survived undetect*ed for nearly seven years, in part because the steps to repro*duce it were so complex. John Kane and Andre Nestor experimented until they could trig*ger it at will.
1. Locate a Game King video poker machine con*figured for multi-denomination play. If you're in Las Vegas, you're probably already standing next to one.
2. Flag down a slot attendant and ask them to enable the Double Up option. Say thank you and smile until they walk away.
3. Insert money or a voucher and select the lowest denomination level offered by the machine—for example, $1 per credit on a $1, $2, $5, $10 machine.
4. Choose your favorite game variant—Triple Double Bonus Poker is fun—and start playing.
5. Keep playing at the $1 level until you win a big hand. An $800 royal flush is perfect.
6. With your royal flush showing but not yet cashed out, hit the More Games button on the touchscreen and select a different game variation. Play it until you score a win.
7. Insert more money or a voucher into the machine.
8. Touch the More Games button again, and change to the maximum denomination—in this case, $10 per credit. Then return to your original $800 royal flush.
9. Press the Cash Out button. “Jackpot! $8,000” will appear on the screen and the light on the top of the machine will illuminate. Congratulations!
10. Wait for the slot attendant to show up with an IRS form W-2G (“certain gam*bling winnings”). Once you've signed it, they'll get the machine to spit out a jackpot ticket.
MICHAEL FRIBERG
John Kane was on a hell of a winning streak. On July 3, 2009, he walked alone into the high-limit room at the Silverton Casino in Las Vegas and sat down at a video poker machine called the Game King. Six minutes later the purple light on the top of the machine flashed, signaling a $4,300 jackpot. Kane waited while the slot attendant verified the win and presented the IRS paperwork—a procedure required for any win of $1,200 or greater—then, 11 minutes later, ding ding ding!, a $2,800 win. A $4,150 jackpot rolled in a few minutes after that.
All the while, the casino's director of surveillance, Charles Williams, was peering down at Kane through a camera hidden in a ceiling dome. Tall, with a high brow and an aquiline nose, the 50-year-old Kane had the patrician bearing of a man better suited to playing a Mozart piano concerto than listening to the chirping of a slot machine. Even his play was refined: the way he rested his long fingers on the buttons and swept them in a graceful legato, smoothly selecting good cards, discarding bad ones, accepting jackpot after jackpot with the vaguely put-upon air of a creditor finally collecting an overdue debt.
Williams could see that Kane was wielding none of the array of cheating devices that casinos had confiscated from grifters over the years. He wasn't jamming a light wand in the machine's hopper or zapping the Game King with an electro*magnetic pulse. He was simply pressing the buttons. But he was winning far too much, too fast, to be relying on luck alone.
At 12:34 pm, the Game King lit up with its seventh jackpot in an hour and a half, a $10,400 payout. Now Williams knew something was wrong: The cards dealt on the screen were the exact same four deuces and four of clubs that yielded Kane's previous jackpot. The odds against that were astronomical. Williams called over the executive in charge of the Silverton's slots, and they reviewed the surveillance tape together.
The evidence was mounting that Kane had found something unthinkable: the kind of thing gamblers dream of, casinos dread, and Nevada regulators have an entire auditing regime to prevent. He'd found a bug in the most popular video slot in Las Vegas.
As they watched the replay for clues, Kane chalked up an eighth jackpot worth $8,200, and Williams decided not to wait any longer. He contacted the Silverton's head of security, a formidable character with slicked-back silver hair and a black suit, and positioned him outside the slot area. His orders: Make sure John Kane doesn't leave the casino.
Virtuoso pianist John Kane discovered an exploitable software bug in Game King poker machines. MICHAEL FRIBERG
Kane had discovered the glitch in the Game King three months earlier on the other end of town, at the unpretentious Fremont Hotel and Casino in downtown's Glitter Gulch. He was overdue for a lucky break. Since the Game King had gotten its hooks in him years earlier he'd lost between tens of thousands and hundreds of thousands annually. At his previous haunt, the locals-friendly Boulder Station, he blew half a million dollars in 2006 alone—a pace that earned him enough Player's Club points to pay for his own Game King to play at his home on the outskirts of Vegas, along with technicians to service it. (The machine was just for fun—it didn't pay jackpots.) “He's played more than anyone else in the United States,” says his lawyer, Andrew Leavitt. “I'm not exaggerating or embellishing. It's an addiction.”
To understand video poker addiction, you have to start with the deceptively simple appeal of the game. You put some money in the machine, place a bet of one to five credits, and the computer deals you a poker hand. Select the cards you want to keep, slap the Draw button, and the machine replaces the discards. Your final hand determines the payout.
When the first video poker machine hit casinos in the 1970s, it was a phenomenal success—gamblers loved that they could make decisions that affected the outcome instead of just pulling a handle and watching the reels spin. The patent holder started a company called International Game Technology that debuted on the Nasdaq in 1981.
IGT's key insight was to tap into the vast flexibility offered by computerized gambling. In 1996, the company perfected its formula with the Game King Multi-Game, which allowed players to choose from several variations on video poker. Casinos snatched up the Game King, and IGT sold them regular firmware upgrades that added still more games to the menu. On September 25, 2002, the company released its fifth major revision—Game King 5.0. Its marketing material was triumphal: “Full of new enhancements, including state-of-the-art video graphics and enhanced stereo sound, the Game King 5.0 Multi-Game suite is sure to rule over your entire casino floor with unprecedented magnificence!” But the new Game King code had one feature that wasn't in the brochure—a series of subtle errors in program number G0001640 that evaded laboratory testing and source code review.
The bug survived like a cockroach for the next seven years. It passed into new revisions, one after another, ultimately infecting 99 different programs installed in thousands of IGT machines around the world. As far as anyone knows, it went completely undetected until late April 2009, when John Kane was playing at a row of four low-limit Game Kings outside the entrance to a Chinese fast food joint at the Fremont, smoke swirling around him and '90s pop music raining down from the casino sound system.
He'd been switching between game variations and racking up a modest payout. But when he hit the Cash Out button to take his money to another machine, the candle lit at the top of the Game King and the screen locked up with a jackpot worth more than $1,000. Kane hadn't even played a new hand, so he knew there was a mistake. He told a casino attendant about the error, but the worker thought he was joking and gave him the money anyway.
At that point, Kane could have forgotten the whole thing. Instead, he called a friend and embarked on the biggest gamble of his life.
Even before the phone rang in his suburban Pittsburgh home, Andre Nestor had a gut feeling that everything was about to change for him. Superstitious and prone to hunches, he'd felt it coming for days: April 30, 2009, would be exactly 15 years since Nestor ignored an urge to play a set of numbers that came up in the Pennsylvania lottery Big 4.
That was the story of his life—always playing the right numbers at the wrong time. Games of chance had been courting and betraying Nestor since he was old enough to gamble. In 2001 he'd moved to Las Vegas to be closer to the action, answering phones for a bank during the day and wagering his meager paycheck at night. That's when he met John Kane in an AOL chatroom for Vegas locals. Though Nestor was 13 years younger than Kane and perpetually flirting with poverty, they developed an intense addicts' friendship.
Nestor's records show he lost about $20,000 a year for six years before he gave up, said good-bye to Kane, and moved back to the sleepy Pittsburgh suburb of Swissvale, Pennsylvania, in 2007. For about two years he had a stable life, living off public assistance, gambling infrequently, and playing the occasional lottery ticket. Then Kane called to tell him about a bug he'd found in video poker. Nestor drove to the airport that night and camped there until the next available flight to Las Vegas.
Kane picked him up at the curb at McCarran airport. After a quick breakfast, they drove to the Fremont, took adjacent seats at two Game Kings, and went to work. Kane had some idea of how the glitch operated but hadn't been able to reliably reproduce it. Working together, the two men began trying different combinations of play, game types, and bet levels, sounding out the bug like bats in the dark.
It turned out the Game King's endless versatility was also its fatal flaw. In addition to different game variants, the machine lets you choose the base level of your wagers: At the low-limit Fremont machines, you could select six different denomination levels, from 1 cent to 50 cents a credit.
“You had complete control,” Andre Nestor says. “You could win $500,000 in one day.” MICHAEL FRIBERG
The key to the glitch was that under just the right circumstances, you could switch denomination levels retroactively. That meant you could play at 1 cent per credit for hours, losing pocket change, until you finally got a good hand—like four aces or a royal flush. Then you could change to 50 cents a credit and fool the machine into re-awarding your payout at the new, higher denomination.
Performing that trick consistently wasn't easy—it involved a complicated misdirection that left the Game King's internal variables in a state of confusion. But after seven hours rooted to their seats, Kane and Nestor boiled it down to a step-by-step recipe that would work every time.
Nestor and Kane each rang up a few jackpots, then broke for a celebratory dinner, at which they planned their next move. They would have to expand beyond the Fremont before the casino noticed how much they were winning. Fortunately, Game Kings are ubiquitous in Vegas, installed everywhere from the corner 7-Eleven to the toniest luxury casino. They mapped out their campaign and then headed back to Kane's home for the night.
Kane lived in a spacious house at the far northeast edge of town. His Game King was in the foyer. A spare bedroom down the hall was devoted entirely to a model train set, an elaborate, detailed miniature with tracks snaking and climbing through model towns, up hills, across bridges, and through tunnels, every detail perfect. The home's centerpiece was the living room with its three Steinway grand pianos. Kane is a virtuoso pianist; in the early 1980s he was a leading dance accompanist in the Chicago area, and even today he sells recordings under the vanity label Keynote Records. He left the professional music world only after failing to advance in the prestigious Van Cliburn International Piano Competition. Now he ran a manage*ment consulting practice that claimed one-third of the Fortune 100 as clients.
Kane's business was lucrative, so he was accustomed to handling money. But now that they were on the verge of a windfall, he was worried about Nestor; he could see his younger friend returning every cent to the casinos at the roulette tables or blowing it all on frivolities. “If you had a million dollars, what 10 things would you do?” Kane asked him. He wanted Nestor to make a list and really think through his priorities.
Nestor started a list, but it would prove unnecessary. After another day at the Fremont, they branched out. To their surprise, the button sequence didn't work. Over the following days, they explored the Hilton, the Cannery, then the Stratosphere, Terrible's, the Hard Rock, the Tropicana, the Luxor, and five other casinos, drawing the same dismal results everywhere. For some reason, the Game King glitch was only present at the Fremont.
NESTOR TAPPED THE MAGIC SEQUENCE OF BUTTONS, HIT “CASH OUT,” AND WATCHED AS HIS $500 PAYOUT BECAME A $10,000 JACKPOT.
At the end of a frustrating week, Nestor headed to the airport for his return flight with just $8,000 in winnings. As a final insult, he lost $700 in a video poker machine while waiting for his plane.
Kane decided to wring what he could from the four Fremont machines. He learned to speed up the process by using the Game King's Double Up feature, which gave players a chance to double their winnings or lose everything. Respectable payouts that might once have satisfied Kane were garbage now. After five weeks using the new strategy, Kane had pocketed more than $100,000 from the Fremont.
Unsurprisingly, the Fremont noticed. In modern casinos, every slot machine in the house is wired to a central server, where statistical deviations stick out like a fifth ace. The four machines under the Chinese food sign shot to the top of the Fremont's “loser list” of underperforming games: They'd gone from providing the casino a reliable $14,500 a month to costing it $75,000 in May alone.
On May 25, a slot manager approached Kane after one of his wins and announced that he was disabling the Double Up feature on all of the Game Kings—he was aware that Kane used the option copiously, and he figured it must have something to do with his run of luck.
Kane took the development in stride: The bug, not the Double Up, was the real secret of his success. But he was in for a shock. The next time he played the Game King, the magic button sequence no longer worked. In an instant, the Fremont was no better than all the other casinos that had been immune to the glitch.
He phoned Nestor, who processed the news. With the Double Up option turned on, the bug worked; turned off, it didn't. Whatever internal stew of code made the Game King exploitable, Nestor concluded, the Double Up option had been a key ingredient the whole time. They just hadn't known it.
This wasn't bad news at all. It was the missing link. It explained why the bug had failed them everywhere but at the Fremont. Most casinos don't enable Double Up because it's unpopular with players. But that could easily be changed. High rollers and slot aficionados often have favorite game variants or features that aren't available by default but can be enabled by any passing slot attendant.
Nestor purchased two dress shirts and caught another flight to Las Vegas, where he joined Kane at Harrah's. Row after row of Game Kings were waiting, and, true to the plan, the staff didn't hesitate when Kane and Nestor asked for Double Up to be enabled.
Nestor got the first significant winning hand of the trip: four fours and a kicker for $500. He tapped the magic sequence, hit Cash Out, and watched with delight as his $500 became a $10,000 jackpot. He tipped the slot attendant $20.
There were no limits now. They could play anywhere and beat the house wherever they went. Nestor, who’d been scraping by on a $1,000-a-month welfare check, saw a whole new future unfolding: home ownership, an investment account, security, better clothes, and gifts for his friends back home. For his part, Kane was already well on his way to erasing the massive losses he’d suffered since moving to Sin City.
Working as a team had its advantages. While experimenting with the bug, they discovered that they could trigger a jackpot on the same hand more than once: All they had to do was lower the denomination again and repeat the steps to activate the glitch. They could effectively replay their win over and over, as much as they wanted. It was a risky play—even the busiest casino might notice the same player repeatedly winning with the same hand. But now that they were playing together, Kane and Nestor could ride on each other's jackpots. Nestor won $4,000 with four aces; then, after waiting a bit, Kane slid over to the same machine and replayed the hand for another $4,000.
They could even piggyback on other players' wins. No longer confined to four low-limit slots at a single casino, they prowled the floor at Harrah's looking for empty machines still showing a player's jackpot. Once they got an attendant to turn on Double Up, it took only seconds to replay the hand at up to 10 times the original value. Video poker wasn't even gambling anymore. “You had complete control over how much you could win,” Nestor says. “If you wanted to go to a casino and win $500,000 in one day, you could win $500,000 in one day.”
At the end of the evening, Nestor says they went to his cheap hotel room at Bill's Gamblin' Hall and Saloon to settle up. As the benefactor of Kane's discovery, Nestor had agreed to give his old friend half his winnings. But now that the cash was rolling in, he was having second thoughts about the arrangement.
Every jackpot, he realized, was being reported to the IRS, and he'd already won enough from the bug to propel him into a higher tax bracket. If he paid half to Kane off the top, he might wind up without the reserves to pay his tax debt come April of the following year. He broached the subject with Kane: He'd be more comfortable holding on to the money until his taxes were paid. It was just a year. He'd happily give Kane half of his post-tax winnings then.
Kane was indignant but not surprised; leave it to Nestor to turn even free money into a problem to obsess over. He insisted Nestor honor his agreement, and Nestor grew more agitated, his voice rising in pitch. “What am I doing? Why am I even doing this?” he complained. “I'm not winning any money doing this if I'm giving you all this up front.”
Kane finally agreed to accept a third of Nestor's $20,000 take for the day. Nestor says he counted out $6,000 in hundreds onto an end table, and Kane said good night.
The tension between the men lingered the next day at the Wynn, a towering upscale supercasino with more than 1,300 slots. They played side by side, raking in money and continuing to argue over the split. Nestor was now of the opinion that he shouldn't have to pay Kane anything. It was Nestor, after all, who'd figured out that the Double Up feature was part of the bug. That should make them square.
AFTER A NIGHT IN JAIL, AN UPSET KANE CALLED NESTOR. “STAY OUT OF THE CASINOS”, HE SAID. “DO NOT GO BACK TO THE CASINOS.”
“This was my gift to you,” Kane shot back testily. “If you'd found this bug instead of me, you would never have told me about it.”
The accusation stung. Nestor gaped at his friend, then he stood and walked away from the machine.
The next day Nestor nursed his hurt feelings with a solo trip to the Rio. He found a Game King displaying four aces and a kicker and hit it for $5,600. Then he wandered into the high-limit room and found another four aces. He punched this one twice: $20,000 at a $5 denomination, then, after a decent interval, $8,000 at the $2 level. Nestor's records show that he eventually left the casino with about $34,000 in his pockets. He didn't need Kane at all. “There was so much money to be made, what did it even matter?” he says.
On his last day in Vegas, Nestor continued his solo run, hitting a Game King at the Wynn for a combined $61,000. Back in his room at Bill's, he added up his winnings: He was going home with $152,250 in cash in his luggage. And he wasn't done yet. There were casinos in Pennsylvania, too, where he could operate without the slightest risk of Kane knowing what he was up to—or demanding a cut up front.
After Nestor left, Kane tore into Vegas with a vengeance. Official numbers have never been released, and Kane declined to speak for this article, but the FBI would later tally Kane's winnings at more than $500,000 from eight different casinos. The Wynn, where Kane kept four nines on one Game King for days, was the biggest loser at $225,240.
Back in Pennsylvania, Nestor targeted the newly opened casino at the Meadows Racetrack in Washington County. In contrast to Kane, who played the bug with joyless, businesslike intensity, Nestor was voluble and chatty at the Meadows. He dressed smartly and, according to court documents, brought along a small entourage for company: his roommate, a retired cop named Kerry Laverde; and Patrick Loushil, a server at Red Lobster who agreed to collect some of Nestor's jackpots for him, so they wouldn't all show up on Nestor's tax bill. Nestor hammed it up every time he won, gushing excitedly to the slot workers—“I'm so excited! Here, feel my heart!”—and tipping generously.
But it all began to unravel the night Kane found himself waiting for a payout at the Silverton. The casino's head of security stood just outside the slot area. Kane paced and huffed, spun the swivel chair back and forth like a metronome, and complained to passing slot attendants. Finally, three men strode up to him. The head of security directed Kane to an alcove, handcuffed him, and escorted him away from the video poker machines.
An armed agent from the Gaming Control Board arrived soon after. He sealed the machines Kane had been playing on with orange evidence tape and collected Kane from the back room, where he'd been handcuffed to a chair. Kane's wallet and the $27,000 in his pocket were confiscated, and he was booked into the Clark County Detention Center on suspicion of theft.
After a night in jail, Kane was released. On Monday he called Nestor to warn him that the bug had been discovered. He sounded more upset than nestor had ever heard him. “Stay out of the casinos,” Kane said. “Do not go back to the casinos.”
Nestor's heart sank for his old friend. It was painful to imagine Kane suffering the indignity of a night in jail, mug shots, fingerprints, being treated like a common criminal. But after the call, Nestor talked himself into an alternate theory. What if there'd been no arrest? What if Kane suspected—as he must have—that Nestor was using the bug and had made up the story about the Silverton to scare Nestor into stopping, so Kane could have the exploit all to himself? By this time Nestor had been back in Pennsylvania three weeks and had already won nearly $50,000 from the Meadow's Game King.
He decided to ignore Kane's story and started planning his next trip to the Meadows.
Three days later, in Las Vegas, engineers from the Nevada Gaming Control Board's Technology Division descended on the Silverton. The forensics investigation of the Game King scam had fallen to John Lastusky, a 25-year-old clean-cut USC computer engineering graduate.
Lastusky pulled up the game history on the two machines Kane had played and reviewed the wins, then slid out the logic trays, the metal shelves housing the Game King's electronic guts, and checked the six EPROMs containing the machines' core logic, graphics, and sound routines. There was no sign of tampering. He confiscated the logic trays and packed them up for the trip back to headquarters.
Housed in an anonymous office park near the airport, the GCB's Technology Division was formed in the mid-1980s to police video gambling as it began its Nevada ascent. The division helps set the rigorous standards that gamemakers like IGT must meet to deploy machines in the Silver State. A 3,000-square-foot laboratory at the back of the office is packed end to end with slot machines in various states of undress—some powered down, some in maintenance mode, others stripped to their bare electronics, though most are configured as they would be on a gaming floor.
“GET ON THE FLOOR!” YELLED THE TROOPER, LEVELING HIS AR-15 AT NESTOR'S FACE.
A smaller, locked-down room adjacent to the lab is more important: It houses a permanent repository of the source and executable code for every version of game software ever approved in Nevada—more than 30,000 programs in all. The code vault is at the center of the gaming board's massive software integrity operation. Every new addition is carefully examined: Is the random number generator random enough? Does the game pay out at the advertised rate? Is there logic where there shouldn't be? “We're not necessarily looking for something nefarious, but the goal is to ensure the integrity of the product,” says division chief Jim Barbee.
There's a real, if mostly unrealized, danger of gaming software being backdoored. The concept was proven in 1995, when one of the GCB's own staffers, Ron Harris, went bad. Harris modified his testing unit to covertly reprogram the EPROMs on the machines he was auditing. His new software commanded the machine to trigger a jackpot upon a particular sequence of button presses—like a Konami Code for cash. He was eventually caught, and he served two years in prison.
BRATISLAV MILENKOVIC
That stain on the board's integrity haunts the division to this day. But by all evidence, the division's paranoia, coupled with the game industry's self-interest, have kept video gambling code clean and mostly free of exploitable bugs. That made the Game King case an intriguing puzzle for Lastusky. Armed with the surveillance footage of Kane in action, Lastusky sat at one of the Game Kings in the lab and began experimenting. Within a few days he was able to reliably reproduce the exploit himself. He gave his findings to IGT, which rushed out a warning to its customers advising them to immediately disable the Double Up option. “Replacement programs are being expedited,” the company explained.
Every Game King on the planet running a vulnerable version would need a patch. The upgrade process would be grueling. When an operating system like Windows or OS X has a security bug, customers can download the patch in a few minutes over the Internet. Slot machines aren't online. New programs are burned onto EPROMs by the manufacturer and shipped in the mail in plastic tubes.
Blind to the firestorm erupting in Vegas, Nestor spent the rest of July and most of August playing at the Meadows, until August 31, when the casino finally got suspicious and refused to pay Nestor on a four of a kind. Nestor protested but walked away, breaking into a run as he reached the parking garage.
Nestor was up more than $480,000. The Game King ride was over, but he had enough money to last him forever.
At 1:30 pm on October 6, 2009, a dozen state and local police converged on Andre Nestor's split-level condo on a quiet, tree-lined street in Swissvale. He was dozing on his living room couch when the banging started. “State police! Open up!” The battering ram hit the door seconds later, splintering the frame and admitting a flood of cops into the house.
Nestor says he started toward the stairs, his hands over his head, when he came face-to-face with a trooper in full riot gear. “Get on the floor!” yelled the trooper, leveling his AR-15 at Nestor's face. Nestor complied. The cop ratcheted the handcuffs on Nestor's wrists, yanked him to his feet, and marched him into the kitchen.
For the next two hours, Nestor watched helplessly, handcuffed to a kitchen chair, while the police ransacked his neat home. They flipped over his mattress, ripped insulation from his ceiling, rifled his PC. At about 4 pm, Nestor's roommate, Laverde, arrived home and was arrested on the spot as an accomplice to Nestor's crimes.
It was the first major gambling scandal in Pennsylvania since the state had legalized slots in 2004. The media portrayed Nestor as a real-life Danny Ocean, and prosecutors hit him with 698 felony counts, ranging from theft to criminal conspiracy. The district attorney seized every penny of Nestor's winnings and gave it back to the Meadows. Nestor and Laverde spent about 10 days in the county jail before making bail.
A defiant Nestor vowed to fight the case—no jury would convict a gambler, he was certain, for beating a slot machine at its own game. But on January 3, 2011, when it was time for jury selection, Nestor was hit with another surprise. Two FBI agents showed up and pulled him from the Washington County courthouse. The Justice Department had taken over the case. Nestor and Kane had both been charged federally in Las Vegas.
As the agents walked him to their car, Nestor stopped in front of a television camera and let loose. “I'm being arrested federally now—for winning at a slot machine!” he shouted in disbelief. “This is what they do to people! They put a machine on the floor, and if it has programming that doesn't take your money and you win on their machine, they will throw you in jail!”
The Las Vegas prosecutors charged Nestor and Kane with conspiracy and violations of the Computer Fraud and Abuse Act. Passed in 1986, the CFAA was enacted to punish hackers who remotely crack computers related to national defense or banking. But in the Internet age the government had been steadily testing the limits of the law in cases that didn't involve computer intrusion in the usual sense. Kane and Nestor, the government argued, exceeded their otherwise lawful access to the Game King when they knowingly exploited a bug. The casinos only authorized gamers to play by the rules of video poker. “To allow customers to access previously played hands of cards at will, would remove the element of chance and obviate the whole purpose of gambling,” assistant US attorney for the District of Nevada Michael Chu argued in a court filing. “It would certainly be contrary to the rules of poker.”
The defense attorneys pushed for dismissal of the computer hacking charge, on the grounds that anything the Game King allowed players to do through its interface was “authorized access” by definition: The whole point of playing slots is to beat the machine, and it's up to the computer to set and enforce limits. “All these guys did is simply push a sequence of buttons that they were legally entitled to push,” says Leavitt, Kane's attorney.
The pretrial motions dragged on for more than 18 months, while in the larger legal landscape, the CFAA was going under a microscope for the first time since its passage. In January 2013, coder and activist Aaron Swartz committed suicide after being charged under the same law for bulk-downloading academic articles without permission, spurring calls for reform. Three months later, the US Ninth Circuit Court of Appeals threw out computer hacking charges in a closely watched case against David Nosal, a former executive at a corporate recruiting firm who persuaded three employees to leak him information from the firm's lead database. The Ninth Circuit found that pilfering contacts doesn't become computer hacking just because the data came from a computer instead of a copy machine.
Seeing parallels to the Game King prosecution, the judge overseeing Kane and Nestor's case ordered the government to justify the hacking charge. The prosecutors didn't even try, opting instead to drop the charge—leaving only an ill-fitting “conspiracy to commit wire fraud” count remaining.
Prosecutors had a weak hand, and they knew it. As a December 3, 2013, trial date approached, the Feds made Kane and Nestor separate but identical offers: The first one to agree to testify against the other would walk away with five years of probation and no jail time.
The old gambling buddies had one more game to play together. It was the Prisoner's Dilemma. Without speaking, they both arrived at the optimal strategy: They refused the offer. A few months later, the Justice Department dropped the last of the charges, and they were free.
Kane and Nestor haven't spoken since 2009. After his Silverton arrest, Kane began recording classical music in his house and uploading the videos to a YouTube channel. Last March, after the federal case was dropped, he sent a CD of some of his performances to his high school piano teacher. “I'm essentially now retired from a career in business, have remained single, leading a quiet suburban life,” he wrote.
Nestor's greatest regret is that he let the Game King bug come between him and Kane. “I didn't want it to go that far,” he says. “I thought he and I were friends long enough that these kinds of issues didn't need to happen.” He claims he always intended to pay Kane his cut from the secret jackpots. Now he can't. His roommate, Laverde, signed over Nestor's money in exchange for avoiding a trial of his own. (There are no court filings to suggest that Kane's winnings were seized.) Nestor says the Meadows still has his winnings, and the IRS is chasing him for $239,861.04 in back taxes, interest, and penalties—money he doesn't have.
If there's one silver lining, it's that Nestor has been banned from Pennsylvania casinos. He still gambles occasionally in neighboring states, but his more pressing addiction right now is Candy Crush, which he plays on a cheap Android tablet. He cleared 515 levels in two months, using a trick he found on the Internet to get extra lives without paying.
