08/13/2004 12:00AM

New York's broken system


NEW YORK - On April 30, 2002, Catskill Off-Track Betting Corp., a public-benefit company that operates 25 facilities in nine counties in New York, began to offer touch-tone betting to its customers. The feature allowed anyone with a wagering account at Catskill to place bets using a telephone keypad and without talking to a live operator.

But despite laws in New York that require OTB's to file detailed documents describing how their account-wagering systems work and what kind of security procedures are in place, Catskill never sent any reports about its new touch-tone system to the New York State Racing and Wagering Board, the agency that regulates racing and betting in New York. Nor did Catskill ask for the board's approval to install the system.

Catskill's failure to comply with the laws did not prompt an immediate response from the board. Even today, the relationship between Catskill and the board is hardly based on the letter of the law. In early 2002, despite multiple requirements for updates, the board had only one document describing Catskill's bet-processing technology in any detail - a contract between Catskill and its bet-processing partner, Autotote, which was signed nine years earlier, in 1993.

This is business as usual in New York, where six state-franchised OTB companies use local monopolies to compete with each other and the New York Racing Association in the multibillion-dollar business of taking horse racing bets. But in this case, business as usual would take a devastating turn. On Oct. 26, 2002, six months after Catskill launched its touch-tone system, the feature was used to place and then manipulate a wager on the Breeders' Cup pick six by a computer expert who targeted Catskill because of its security deficiencies. The highly publicized scandal, which would have netted $3.1 million in winning pick six tickets, instead landed three people in jail, including the computer expert, Christopher Harn, who worked for Autotote.

Harn had accomplices in two former college fraternity brothers. But he also had an accomplice in the byzantine, ineffectual, and broken regulatory structure of New York racing. In fact, the stage for Harn's crime was neatly set by Catskill's chronic failures to comply with New York racing law, the inability of its officials to recognize either the wagering system's security problems or suspicious betting activity, the racing board's ineffectiveness in enforcing its own regulations, and state laws inadequate to protect account-wagering operations from manipulation. These are the conclusions of an inquiry by Daily Racing Form that has stretched over 21 months and encountered repeated efforts by the board and Catskill to suppress a request under New York's Freedom of Information Law to examine documents that the board is supposed to have on file, many of which were eventually obtained by the Form.

The inquiry shows that Catskill routinely and consistently evaded state law by failing to send many statutorily required documents to the board. Clearly, some of these filings could have alerted regulators to the deficiencies that were exploited in the Breeders' Cup pick six scandal. Further, the inquiry shows that the racing board, hamstrung by the political power wielded by Catskill, did not press Catskill to come into compliance with New York's rules despite a history of problems at the OTB company. Those same rules have not substantially changed since they were written in 1974 and appear ill-suited to regulate account-wagering systems that have grown increasingly sophisticated.

On June 4, 2004, and again on July 22, the racing board's lawyer, Robert Feuerstein, acting on the order of a New York Supreme Court judge, certified that the board, at the time of the Breeders' Cup scandal, did not have a wide range of material about regulatory issues that Catskill is required to provide, including:

* Measures taken by Catskill to safeguard the transmission of wagering data.

* The types and approximate cost of Catskill's data-processing equipment.

* Catskill's organizational plan, including the names and salaries of its top officials.

* A list of Catskill's employees.

* A list of Catskill's independent contractors and consultants.

Many other categories of documents required by law were incomplete, filed intermittently, or routinely filed past deadline. After the Form made its initial request, on Nov. 25, 2002, the board provided a crude organizational chart of Catskill and an equally crude hierarchy of its employees. Although the organizational chart named Catskill's top four officials, it did not include a complete list of employees. Both were dated 1998. The board later produced lists of categories of employees that were filed as recently as this year, but those lists did not include names.

In order to satisfy the Form's request for documents detailing Catskill's method of operation of combining wagers - a filing that is required - the board's records access officer simply forwarded the verbatim state racing statute, which can be found on the Internet.

The 13-page totalizator contract with Autotote from 1993 was the only document on file to satisfy the state law that requires Catskill to submit a "current agreement for totalisator equipment and services." The board did not have any updates to the contract even though Catskill installed new hardware and software for its account-wagering system in 1995 and the touch-tone betting feature in 2002.

Another regulation stipulated that Catskill had to file reports that described the company's computer services used to transmit data, including alternate or backup systems. Catskill officials said that requirement was satisfied by a brief paragraph in a simulcast license application that was filed each year, a paragraph that has not changed in a decade. Officials in other states with account wagering have said that the paragraph would be inadequate to properly regulate a company that offers telephone betting.

The failures by Catskill to disclose this kind of information made it difficult, if not impossible, for the board to provide effective oversight and guarantee that wagers were secure.

Donald Groth, Catskill's only president since the company was formed in 1975, said in a phone interview on Thursday that the board had never required Catskill to provide documents detailing changes to its totalizator system or account-wagering operation, including the installation of the touch-tone system. Groth dismissed concerns about Catskill's security measures, saying that the story of the pick six scandal was one of "human frailty" and that Harn would have succeeded at any site he targeted.

Michael Hoblock Jr., the chairman of the racing and wagering board since 1997, acknowledged on Friday that state laws and regulations regarding account wagering in New York were inadequate to safeguard telephone bets. He said regulators had begun a process in 2001 to develop policies that would require OTB's to provide far more detail about their totalizator and telephone-betting operations, but no such policy was in place by the time that the Breeders' Cup pick six scandal took place.

"We were going to make the requirements contingent on approving the 2003 simulcast applications," Hoblock said. But, like Groth, Hoblock said that the inadequate security measures at Catskill were not the key issue, instead blaming weaknesses in the national bet-processing network. Also, Hoblock said that regulators were unsure whether the law requires OTB's to file documents updating the hardware and software used to process wagers.

Little power to make OTB's comply

Problems at Catskill stretch back a decade, according to dozens of board records. From 1993 to 2002, Catskill withheld millions of dollars in required payments to its member counties despite warnings from auditors and other officials. Catskill was criticized by auditors and other officials for overestimating its expenses in budgets, and board officials have complained over the past three years that Catskill has failed to comply with requirements to spend money from surcharges on winning wagers for "much-needed capital improvements."

While Catskill and the racing board emerged relatively unscathed from the pick six scandal, the rest of the industry, which has an estimated annual economic impact of $34 billion, has shouldered the cost. The National Thoroughbred Racing Association, the sport's marketing group, and other industry organizations have spent millions of dollars to shore up confidence in racing's bet-processing network.

The Form's inquiry suggests that Catskill's problems are symptomatic of deficiencies inherent to New York's OTB system, in which county- and city-owned monopolies have gained enormous political traction over the past 30 years. The system, which has been deliberately avoided by other states, has generated millions of dollars for local governments. At the same time, the system has created an environment that routinely absolves OTB's of any accountability to state regulators or the racing industry at large.

When the board approved a $5,000-a-day fine against Catskill in 2000 for failing to pay a $2.5 million debt to NYRA, Groth sued in New York Supreme Court, and the court ruled unanimously that the board had no power to fine OTB companies except under specific violations of simulcasting law. The board's only disciplinary powers are to remove an OTB's board of directors or suspend or revoke its license - both of which are politically impractical and have been used only once, in 1997, when regulators began a process to remove directors at Capitol OTB before its president, Davis Etkin, pleaded guilty to bribery and corruption charges.

Hoblock said the 2000 court ruling has had a crippling impact on the board's ability to enforce regulations and win support for legislation that would give the board more power.

"Every OTB has a lobbyist, and some have more than one lobbyist," Hoblock said. "You can conclude that these lobbyists have been very successful in limiting legislation that would bring more control over OTB's."

The problems in New York's OTB system have been apparent to other regulators. In Pennsylvania, which established regulations in 1988 to legalize offtrack betting, New York was considered a bad model, according to Ken Kirchner, the director of simulcasting for Breeders' Cup and who led the Pennsylvania OTB project.

"The general impression was that New York OTB's did not have a positive impact on the racing industry or their communities," Kirchner said.

The big score: Breeders' Cup 2002

The lack of proper oversight and the dysfunction between Catskill and the New York racing board came together dramatically on Oct. 26, 2002, in the form of the pick six scandal.

Catskill's direct involvement in the scandal traced to early October 2002 and a pair of bets made by a 29-year-old college dropout named Glen DaSilva.

On Oct. 5, DaSilva capped an extraordinary run of luck by making two multi-race bets in three days through a telephone betting account he opened at Catskill. DaSilva hit a pick four at Balmoral Park on Oct. 3 and a pick six at Belmont Park on Oct. 5, winning a total of $117,259.20.

DaSilva placed only the two bets, selecting multi-race wagers that are among the most difficult to hit and using a ticket structure that experienced players would call naive at best. The bets used single horses in the early races - the first two races in the pick four and the first four races in the pick six - and all the horses in the final two races.

Even more unusual, the Belmont pick six bet was placed in a $16 denomination. In other words, DaSilva made the same $2 pick six bet eight times. Using the same numbers is not only highly unusual, it's also illogical - as if a bettor had decided to play the same lottery numbers on eight different tickets.

Despite the improbability of DaSilva's consecutive bets both becoming winners, and the unusual structure of the tickets, the board had no records to indicate that any Catskill officials reported the suspicious wagers to the racing board, the police, or other regulatory agencies before Oct. 26.

Instead, Catskill's director of operations, Arthur Weinfeld, personally called DaSilva on Oct. 7 and asked DaSilva whether he was aware that he could have saved $6,000 if he had opened a non-surcharge wagering account, according to a Nov. 5, 2002, e-mail written by Gregory Schreffler, a board investigator. Schreffler's e-mail described a conversation he had with Valerie Lucanera, an assistant to Groth at Catskill.

"According to Ms. Lucanera, DaSilva seemed unaware that such an account was available," Schreffler wrote. "Ms. Lucanera further stated that an experienced bettor/handicapper should know this."

After the telephone call, DaSilva sent a letter to Weinfeld in order to withdraw his account balance, writing, "It was nice speaking to you this afternoon," according to a copy of the letter. "I appreciate the advice you gave me regarding tax issues." Catskill cut a check to DaSilva on Oct. 8 for $80,000, the amount left over after taxes and the surcharge were deducted.

Groth said that Catskill did not notify regulators or law-enforcement officials about DaSilva's wagers because "we don't treat all of our winning customers as if they are perpetrators."

On Oct. 18, just eight days before the Breeders' Cup, a new bettor, Derrick Davis - a Maryland resident and longtime friend of DaSilva and Harn - opened a telephone-betting account with Catskill. His application included a checkmark for a non-surcharge account. The account was not used until Saturday, Oct. 26, the day of the Breeders' Cup, when Harn, using Catskill's touch-tone betting feature and a password to Davis's account, placed a $1,152 bet on the Breeders' Cup pick six with a nearly identical structure to DaSilva's Belmont pick six wager. The bet differed in one respect: it was made in a $12 denomination, or six identical $2 bets. Six hours later, those six wagers were the only winners, worth $3.1 million.

The unusual nature of the winning bet set off alarms around the industry on the night of the Breeders' Cup. Yet publicly Catskill officials gave no credence to the possibility that foul play might have been involved. On the following Monday, representatives of the Breeders' Cup and the NTRA wrote a letter to the New York racing board calling for an investigation, and the board complied. That same day, Groth defended the bet.

"There is nothing to indicate that this was anything but a very good day for our customer," Groth told a reporter. "I know why you're suspicious, but that's not my job. I'm familiar enough with the customer that I believe this is legitimate."

As the racing industry would come to realize, the bet was not legitimate. Instead, Harn, who was 29 at the time, had repeated the steps he took to alter the Belmont pick six three weeks earlier. While working in Autotote's office in Delaware, Harn entered Catskill's computer systems after the first four races of the Breeders' Cup pick six had been run and changed the numbers on the initial wager to reflect the actual winners.

Groth said on Thursday that his comments about the legitimacy of the bet were part of a strategy not to alert anyone else involved in the crime about the progress of the investigation. When asked if this was a law-enforcement strategy, Groth said that he came up with the plan on his own.

"I was told not to say anything that would tip anyone off, so I apologize if I misled people," Groth said.

Scammers knew Catskill was vulnerable

In a written interview from federal prison in Lexington, Ky., which was conducted through his attorney last year, Harn noted that Catskill had a number of deficiencies that allowed him to pull off the scheme. Most important, said Harn, Catskill's hardware did not record the actual touch tones that made the wager. Therefore, investigators would not be able to determine if he or Davis or anyone else had actually pressed the numbers that were contained in the winning wager or whether someone had altered the wager after it had been placed.

"The fact that the wagers were not recorded was obviously very important, and it allowed me to place the bet over the telephone and avoid the long drive to Catskill OTB," Harn said.

It is unclear why Catskill failed to install a recording system. Groth said that he believed the recorder was part of the touch-tone system purchased from Autotote, but he could provide no details about its initial cost or design. He also speculated that Harn may have intentionally failed to install the recorder. Autotote officials did not return phone calls requesting comment on that possibility.

Board officials disputed Groth's contention. Hoblock and Stacy Clifford, the board's public information officer, said that regulators were aware before the Breeders' Cup scandal that Catskill and two other New York OTB's, Suffolk and Nassau, had not installed recorders for their touch-tone systems.

Recorders are standard for nearly every account-wagering system, according to several racing officials, who said the only exceptions at the time of the Breeders' Cup scandal were the three New York OTB's.

Joe Wilson, the director of wagering services for Philadelphia Park, which operates the popular Phonebet account-wagering system, said that Philadelphia has had a recording system since 1985, when Phonebet was launched, in part because regulations in Pennsylvania require the devices. Wilson said the recording systems are normally sold separately, and if they were included in a totalizator contract, the costs would typically be reflected in a higher contractual fee per wager, since the systems can be expensive to maintain.

"It's not even the security," Wilson said. "It's protection. We have to know who is right if a customer has a complaint. If someone says he bet on the 2 horse and we need to know if he bet on the 2 horse, we just play the bet back."

In Canada, the Ontario Jockey Club's Internet-betting operation has used a recorder since being launched in 2001, according to Andrew McDonald, the OJC's director of new business initiatives, who said the system costs about $60,000 a year to maintain. McDonald said the OJC installed the recorder not only to verify wagers and resolve disputes but also because of regulations in Canada requiring the system.

To date, no such regulation exists in New York, although Catskill and the two other New York OTB's, Nassau and Suffolk, have since installed recorders. The New York Racing Association, which operates the state's three major racetracks and runs the NYRA One telephone account-wagering system, installed a recorder when it launched the system in 1988, according to Bill Nader, NYRA's senior vice president.

Aside from the lack of the recording device, Harn said he had additional reasons to target Catskill. The company's technicians frequently left their modems turned on, Harn said, meaning that he could access Catskill's bet-processing computers at nearly any time. Catskill had no "back-end database," Harn said, so the company did not have a second, identical record of any wager after it was placed, as security companies recommend.

"While I believe there are ways to get around this security system, not having [a backup database] there made it a lot easier," Harn said.

Five days after the Breeders' Cup, investigators from the New York State Police Computer Crime Unit were highly critical of the security controls at Catskill. In a report dated Oct. 31, the investigators wrote that the Autotote staff at Catskill claimed that they had "very little knowledge about the operation of the IVR [touch-tone system]." An unnamed technical supervisor at Autotote told investigators that the IVR "logged no information about how the wager was placed," another reference to the lack of a recording device or any other method to verify that the actual wager that the totalizator system accepted was the same wager that was bet through the touch-tone system. The report indicated that Catskill was negligent in developing security controls for its system and its employees.

"The physical security of the tote system is questionable - very little control on employee access, little restriction on remote access once the modem is turned on, no security documentation on other connections to the system," the report concluded.

Reports could have flagged deficiencies

Had Catskill filed updated reports about its totalizator hardware and software to the racing board, as required by law, qualified regulators at the board would likely have been able to notice some of the deficiencies that Harn described.

It is unclear why the racing and wagering board did not press for compliance in the filing of documents. However, Steve Richman, a former head of a unit that was set up in 1985 at the racing and wagering board to monitor OTB's, said that the board had required OTB's to file a plan of operation when the companies were formed. These plans, which would ultimately be interpreted to encompass every document filed with the board, would typically be amended by documents describing any changes to the companies' operations, Richman said.

Hoblock said that OTB's acquired a certain inertia over the years that made further regulation difficult, including the ability to dictate what the companies should file.

"OTB's started out that way, and they've developed over the years to be somewhat independent, and any efforts to bring about change have been unsuccessful," Hoblock said.

On May 19, 1999, Jim Gallagher, the board's chief of racing operations, wrote a letter to all of New York's OTB heads claiming that the board "is working at easing the regulatory burden of having the racetracks and off-track betting corporations file repetitive information on an annual basis." The letter asked OTB's to file "what is new or what has changed since the previous simulcast application/license."

"These materials could include an updated feasibility study, revised simulcast plan of operation, and other appropriate materials required by law," Gallagher wrote.

Still, the board could produce few reports that described any change to Catskill's plan of operation from 1992 until the time of the 2002 Freedom of Information request by the Form, with the exception of the simulcast facility license applications, which sometimes detail new OTB sites. Specifically, Catskill never mentioned the installation of its new touch-tone technology or the software and hardware that would be needed to support it.

Acting on the orders of New York Supreme Court Judge SaraLee Evans, Feuerstein, the board's lawyer, wrote a letter to Groth on Feb. 9, 2004, requesting that Catskill comply with the specific state laws requiring reports to be filed, in reference to the Form's ongoing request for documents. But in a March 15 response, Groth said that Catskill OTB files an annual report of operation and monthly financial statements to the board.

In his letter, Groth reiterated that Catskill has been required to file only the annual and monthly statements. Groth repeated the one-paragraph language that was contained in Catskill's "simulcast facility license" about how bets are placed and commingled by Catskill. The language does not include any mention of Catskill's computer-betting system, its telephone-account operation, or the touch-tone technology.

A system in need of regulation

Even if Catskill had complied in making filings under New York law, those filings do not rise to the level of detail required by other jurisdictions. New York laws governing account-wagering include eight paragraphs, nearly all dealing with requirements for minimum balances of cash and distributions of mandatory surcharge revenues. The board's one rule on the subject states that "a bet placed by telephone shall be subject to the rules and regulations which govern the placing of all off-track bets." Account-wagering regulations in states such as California, Oregon, and Pennsylvania are far more extensive.

Hoblock said the board is cooperating with a national effort to develop minimum security requirements for any wagering site that sends bets into national pools. He said that at the time of the Breeders' Cup scandal, "the industry was not keeping up with advancements in technology," and in a separate comment said that there was "no question" that Catskill had security deficiencies in 2002, a reference to the report of the New York Computer Crime Unit.

Catskill's failure to describe its account-wagering system and its security safeguards and its failure to notify regulators of the establishment of its touch-tone system should have set off alarms, according to Steve Barham, the former executive director of the Oregon Racing Commission, which drafted regulations to govern account wagering in the late 1990's. Barham is now an associate coordinator of the University of Arizona Race Track Industry Program.

Barham said that in Oregon, account-wagering companies are required to file detailed plans of operation every year that fill three-ring binders and give details on how the systems operate "from programming to firewall." Barham said that any change to the operation - including the launch of a touch-tone system like the one at Catskill - would require extensive vetting in Oregon.

Barham said regulators have to stay in touch with wagering sites constantly to protect customers, and he said that the process is frequently adversarial.

"If I'm a regulator and a bunch of my people have recording devices, I would have to ask, 'Why don't you guys?' " Barham said. "And if they say, well, a bunch of regulators are getting in our knickers and trying to make us spend money, you have to listen and say, 'Yeah, maybe this business is overregulated. But if you're going to be a part of this business, you better get used to it, and you better learn to live with it.' I'm sure a lot of people in New York are wishing they did that right now."