Memo: Iowa Lottery kept selling games after security warning

The Iowa Lottery kept marketing four games to the public despite a 2015 warning from its security chief that they were vulnerable to fraud by insiders, according to a newly released memo that the state had fought to keep secret.

Steve Bogle, the lottery's then-vice president of security, made a "strong recommendation" in the Aug. 7, 2015, memo that the lottery should immediately suspend sales of the Hot Lotto, Pick 3, Pick 4 and All or Nothing games. He said that the lottery could not ensure that they were being operated fairly following an audit that documented a lack of security protocols and oversight at the contractor that picked the winning numbers.

"Therefore we cannot allow the citizens of Iowa to continue playing these games," Bogle wrote to Lottery CEO Terry Rich. He said that sales should resume only after the lottery could assure customers "they are being conducted using security protocol best practices and with the highest level of integrity."

Bogle's recommendation followed an independent audit of the Multi-State Lottery Association, which built the random number generators that picked combinations for the four games. The association's former security director, Eddie Tipton, had been convicted on lottery fraud charges that summer for allegedly rigging a $16.5 million Hot Lotto drawing for which he purchased the winning ticket and unsuccessfully worked with associates to claim.

The association helps dozens of lotteries run their games by providing equipment and services. Its board agreed to hire the SeNet International Corporation to audit its security practices following the arrest of Tipton, who was later linked to rigged jackpots worth millions of dollars between 2005 and 2011 and sentenced to prison.

The lottery and the association have refused to release the SeNet audit report, saying its disclosure would jeopardize security. But a judge ordered the lottery to release Bogle's memo last week following a request to unseal it by The Des Moines Register.

Rich rejected Bogle's recommendation to halt sales of the four games after speaking with the audit's author, who said there were potential vulnerabilities but no evidence that they were being exploited at that time, lottery spokeswoman Mary Neubauer said. By then, Tipton had been fired from the association and all machines that he'd built had been taken out of service, Neubauer noted.

The four games accounted for $24.2 million in ticket sales in Iowa during fiscal year 2016, a lottery report shows.

The lottery used the information in the audit to help bring improvements to the association and its own procedures, she said, and ultimately abandoned any random-number generator equipment built by the association.

The Register's request to unseal Bogle's memo came in an ongoing lawsuit in which a former Hot Lotto winner alleges his jackpot would have been millions of dollars larger had Tipton not rigged the previous drawing. The lottery had turned over the memo to lawyers for the winner, "Lucky" Larry Dawson, during discovery but marked it as confidential.

The lottery had denied an open records request by the Register for the memo. A state lawyer representing the lottery in June opposed the Register's request to unseal it, arguing the memo was exempt from the open records law and properly designated as confidential in the lawsuit. Judge Karen Romano disagreed in a ruling last week, granting public access.

Bogle, the former director of the Division of Criminal Investigation, has since left the lottery.