How the Hot Lotto was rigged: the security director who wrote the numbers

The man who rigged the Hot Lotto drawing was the lottery group's own information security director, and he wrote the software that picked the numbers.^[1] This case file covers how he built a hidden exception into that software, how an unclaimed $16.5 million ticket gave him away, and the one control that would have stopped it.

What happened

How it worked

The drawing computer was supposed to be unpredictable. It took a reading from a Geiger counter measuring natural radiation in the room and used that as the starting point, or "seed," for picking numbers from nearly 11 million possible combinations.^[3]

Tipton's version of the software carried an extra rule. On most days it behaved normally. But when a drawing fell on one of 3 specific dates a year, in late May, late November and late December, and on a Wednesday or Saturday evening, it quietly swapped the real seed for a predictable one.^[3][5] That shrank the possible outcomes from millions to a small set that could be worked out in advance. The chosen dates tended to fall around holidays, when he was often away on vacation.^[3]

Prosecutors said the altered code was loaded onto the drawing computers from a thumb drive and was designed to delete itself afterward.^[1] In short, the person trusted to protect the machine was also the person who wrote its code and could change what ran on it.

How it was caught

The unclaimed ticket, not a security alert, broke the case. After the withdrawn claim, the Iowa Attorney General's office and the state Division of Criminal Investigation opened a criminal investigation.^[2] In October 2014 investigators released the store surveillance clip to the public.^[3]

The face was hard to see, but the voice was not. A Maine Lottery employee, an Iowa Lottery web developer and the association's own drawing manager each recognized the buyer's distinctive way of speaking as Tipton's.^[3] He was arrested in January 2015 and convicted by a jury on July 20, 2015.^[3] Investigators later found the altered code, and the other rigged jackpots came to light.^[1][4]

What it cost

In June 2017 Tipton pleaded guilty in Iowa to ongoing criminal conduct, telling the court he wrote software with code that let him predict winning numbers.^[5] He also pleaded guilty in Wisconsin to theft by fraud and computer crime.^[2][4] On August 22, 2017, he was sentenced to up to 25 years in prison.^[7] His brother pleaded guilty to conspiracy and served 75 days in jail, and a Texas friend pleaded guilty to a computer crime.^[2][6]

The rigged prizes paid out about $2.2 million, and the brothers agreed to pay $2.2 million in restitution to the Colorado, Kansas, Oklahoma and Wisconsin lotteries.^[2][6] Tipton was paroled in July 2022 after about 5 years.^[8] Hot Lotto itself was retired in October 2017.^[3]

The missing control

The missing control: segregation of duties. One person wrote the random number code, had the access to install and change it, and was in charge of the security meant to catch tampering, with no independent review in between.

Splitting those jobs would have stopped this or cut it short. If a second person had to review every change, the odd rule would have raised an obvious question: why does a random number generator care what day it is? If someone else built and installed the approved version, and checked that the running software matched it, a quiet swap would have stood out. The scheme lasted from 2005 to 2011 because no one other than its author was looking inside.^[4][5]

What to do in your business

• List who can both make and approve changes. For payroll, vendor payments, bank details and key software, write down who can change them and who signs off. Any name that appears in both columns is a gap.
• Require a second set of eyes. Set a simple rule that changes to money-moving systems or core software need approval from someone who did not make the change, even in a 5-person office.
• Keep your tech person out of their own audit. If one employee or IT contractor runs your systems, have an outside party review access and logs once a year.
• Watch results, not just logs. Look for patterns in outcomes, such as refunds, discounts or payouts that keep landing with the same people or on the same dates.
• Make vacations real. Require people in sensitive roles to take time off while someone else covers their duties. Hidden schemes often surface when the person behind them is not there to manage them.

Facts are drawn from court records, government reports and reputable reporting, listed below. People are named only where they were convicted or spoke publicly in an official role.