Privacy commissioner probes BCLC gambling site after breach

The PlayNow.com website went down for maintenance after introducing legal casino games. July 16, 2010. (PlayNow.com)

Dozens of gamblers on B.C.'s new casino-style website were able to place bets with other users' money, forcing the site to shut down almost as soon as it was up and running, the province's lottery corporation revealed Tuesday.

The B.C. Lottery Corp. added casino games such as blackjack, roulette and craps to its PlayNow.com site last week, but the service was quickly shut down in the midst of an immediate flood of virtual gamblers.

It has remained offline as the Crown corporation investigated a glitch that led some users to be suddenly and inadvertently logged in as others. The corporation was still working on a fix Tuesday.

BCLC said the increased load caused the switch in some accounts as users played, leading them to place bets with others' money. In some cases, the users were able to see the other person's account balance and personal information.

About 130 people were affected, and the corporation has identified 12 cases in which a user viewed "sensitive" personal information belonging to someone else.

"Some personal information that would be available on a personal cheque was available to other users," BCLC president Michael Graydon told CTV News.

Some $8000 in winnings was deposited into the wrong hands, he said.

"There was a bit of play with other people's money but as we speak right now the proper money is going to other people's accounts," Graydon said.

In another interview, he said that the gamblers involved have been told of the mistake.

"We have contacted all the impacted players and informed them of what has happened," Graydon told a radio station in Kamloops, B.C., where the corporation's headquarters are based.

He said staff have since reviewed winnings and losses from the time of the breach and applied them to the correct accounts.

Last Friday, Graydon said PlayNow.com wasn't working simply because too many users caused the servers to crash, but the corporation now admits it shut the site down once it learned about the privacy breach.

The lottery corporation said it's working with the province's privacy commissioner to respond, and a third-party investigation uncovered no evidence of hacking.

The privacy commissioner couldn't be reached for comment.

PlayNow.com became the first website in North America to offer legal casino-style games when it added them to its existing roster of lottery purchases and sports betting last Thursday.

The province's social development minister, Rich Coleman, declined comment Tuesday, with his office referring questions back to the lottery corporation.

In announcing the PlayNow.com expansion last week, Coleman said British Columbians gamble an estimated $100 million a year with offshore gambling websites. He said the province wants to encourage those gamblers to spend that money in B.C., where the government can redirect the profits to services like health care and education.

Coleman also said using a government-operated website would insure their information is protected by the "highest levels of integrity and security of any system in the world."

Shane Simpson, the housing and social development critic for the Opposition New Democrats, said the breach suggests the lottery corporation didn't do its homework to ensure the website would be secure.

"That raises real questions about whether the lottery corporation and the minister rushed into getting this thing out there," Simpson said in an interview.

"It's another of these issues that raise questions of confidence."

Meanwhile, the lottery corporation was also facing criticism Tuesday after the revelation it has received hefty fines from the federal agency that monitors money laundering and terrorism financing.

The lottery corporation confirmed the Financial Transactions and Reports Analysis Centre of Canada -- also known as FINTRAC -- fined it more than half a million dollars for more than a thousand infractions related to reporting requirements.

FINTRAC says there are a number of ways criminals can use casinos to launder money, and requires casinos and provincial gambling regulators to file regular reports to help track suspicious activity.

Click here for a speech by FINTRAC's director on efforts to combat money laundering.

Graydon suggested the fines were merely administrative rather than an indication anything nefarious was happening.

Most of those, too, were blamed on a computer glitch that sent filed reports back to B.C. Lotteries. By the time they were re-sent, they were late, he said.

But they weren't all the computer's fault.

In about 230 cases, casino staff failed to obtain enough information from people spending more than $10,000. For such large transactions, the casino is required to check ID and ask a number of questions, including what the person's occupation is, but the reports submitted didn't include detailed enough information.

Do you think your PlayNow.com account has been hacked? Email us at [e-mail]. We want to hear from you!