2007 NAGRAAnnual ConferenceJune 10-13, 2007

Electronic BingoCard-minding Devices

GoalsGoals

Terms & AbbreviationsTerms & Abbreviations

Presentation ScopePresentation Scope

Electronic Bingo Card-minding DevicesElectronic Bingo Card-minding Devices

To have systems that account for all sales & voidsTo have systems that account for all sales & voids

To verify only legitimate winnersTo verify only legitimate winners

To provide the players, auditors & investigators To provide the players, auditors & investigators with as much information as possiblewith as much information as possible

To identify areas in the ECM systems that are To identify areas in the ECM systems that are open to manipulationopen to manipulation

GoalsGoals

Electronic Card-minderElectronic Card-minder or or

Electronic Card-mindingElectronic Card-minding ECMECM

Point of Sale stationPoint of Sale station POSPOS

Caller/Verifier stationCaller/Verifier station Verifier or Verifier or

Caller Caller standstand

Terms & AbbreviationsTerms & Abbreviations

ECM Site SystemECM Site System

The computers & software, located The computers & software, located at the bingo hall that connects with at the bingo hall that connects with & controls or defines the operation & controls or defines the operation of the card-minding devices. It of the card-minding devices. It includes the point of sale station, a includes the point of sale station, a caller station verifier, printers, & caller station verifier, printers, & proprietary software.proprietary software.

Terms & AbbreviationsTerms & Abbreviations

ECM DeviceECM Device

Portable or fixed-base electronic Portable or fixed-base electronic devices, that are used by a bingo devices, that are used by a bingo player to daub bingo card faces player to daub bingo card faces stored in the device. A portable is stored in the device. A portable is a hand-held, custom-built device. a hand-held, custom-built device. A fixed-base card-minding device A fixed-base card-minding device is a stationary computer usually is a stationary computer usually with a touch screen monitor.with a touch screen monitor.

Terms & AbbreviationsTerms & Abbreviations

Presentation ScopePresentation Scope

Security & AccuracySecurity & Accuracy

Audits & InvestigationsAudits & Investigations

TestingTesting

Keys to Security and Accuracy of Keys to Security and Accuracy of ECM ComponentsECM Components

Point of SalePoint of Sale

VerifierVerifier

Player UnitsPlayer Units

Database/ServerDatabase/Server

SecuritySecurity

Point of SalePoint of Sale

Transaction numbers Transaction numbers should be consecutively should be consecutively numbered without gaps.numbered without gaps.

Point of SalePoint of Sale Gaps in transaction numbers might be Gaps in transaction numbers might be

accounted for on an end of session report.accounted for on an end of session report.

Point of SalePoint of Sale

The transaction counter The transaction counter should not be re-settable.should not be re-settable.

The server/POS should not The server/POS should not repeat card faces within the repeat card faces within the same game and if possible same game and if possible not within the same not within the same session.*session.*

The POS should provide The POS should provide an end of session report.an end of session report.

A listing of all sales of electronic devices, A listing of all sales of electronic devices, including the unit number and number of including the unit number and number of cards sold.cards sold.

No changes can be made to No changes can be made to the sales or voids once the the sales or voids once the end of session report has end of session report has been run.been run.

The The Michigan Michigan

End of End of Session Session ReportReport

Missing

As in Michigan the As in Michigan the report should be the report should be the same for all same for all manufacturers.*manufacturers.*

The end of session The end of session reports or "Z" reports or "Z" reports should be reports should be stored in non-stored in non-volatile format on volatile format on the system.*the system.*

Other POS ReportsOther POS Reports

Detail Transaction Report

Verifier End of Session Report

Paper Only Summary Sales Report

Summary Report

Void ReportVoid Report

POSPOSPlayerPlayer

ReceiptsReceipts

VerifierVerifier

The verifier should read the sales database The verifier should read the sales database before it determines an electronic card face to before it determines an electronic card face to be a winner.be a winner.

The printed card face should show the The printed card face should show the winning pattern.winning pattern.

The printed winning card faces must clearly The printed winning card faces must clearly state it is a winner.state it is a winner.

VerifierVerifier

If possible the verifier should only print If possible the verifier should only print winning card faces.winning card faces.

The printed winning electronic card face The printed winning electronic card face should include the sales receipts should include the sales receipts information.*information.*

VerifierVerifier

The printed winning The printed winning card face should card face should include called ball include called ball information.information.

Verifier

Display monitors and all fixed base screens, should display card faces presented as winners and identify them as winners or non-winners.*

A printed non-winning card faces should clearly state that it is not a winner.

The verifier should provide an end of The verifier should provide an end of session Verifiers report with the winning session Verifiers report with the winning card faces and the balls called by game.*card faces and the balls called by game.*

The end of session winners report The end of session winners report should be accessible by modem.*should be accessible by modem.*

VerifierVerifier

Player UnitsPlayer Units

Card face limits should be hard coded in Card face limits should be hard coded in the player software.*the player software.*

Software versions should display on player Software versions should display on player units.*units.*

Player UnitsPlayer Units

The receipt information should be The receipt information should be viewable on the player screen.*viewable on the player screen.*

The player unit should turn off after The player unit should turn off after the last game.*the last game.*

Database/Server Database/Server

Limited accessLimited access

The database should have report The database should have report generation softwaregeneration software

The database and hard drive should be able The database and hard drive should be able to maintain one years activityto maintain one years activity

Database/Server Database/Server

Database/ServerDatabase/Server

The server should The server should be available for a be available for a connection via a connection via a modem dial-upmodem dial-up

SecuritySecurity

SecuritySecurity Access to Windows desktop, Windows explorer, Access to Windows desktop, Windows explorer,

Windows menu should be blocked.Windows menu should be blocked.

Digital signatures of software versions.Digital signatures of software versions.

Access levels for different job titles should be Access levels for different job titles should be employed.*employed.*

Access to serial and USB ports should be Access to serial and USB ports should be restricted.*restricted.*

Access to the CD player and disk driver should Access to the CD player and disk driver should be restricted.*be restricted.*

Ask the Manufacturer if a Source Control Ask the Manufacturer if a Source Control software is used.software is used.

SecuritySecurity

The laws and rules should The laws and rules should prohibit the addition of prohibit the addition of non-approved software to non-approved software to the system site computers.the system site computers.

The system should have The system should have dial-in capabilities that dial-in capabilities that allow verification of the allow verification of the digital signatures and digital signatures and approved software settings.approved software settings.

The system should log and The system should log and time stamp all users time stamp all users granted access.*granted access.*

Screens for verifier and pos Screens for verifier and pos should be touch screens.*should be touch screens.*

The server/pos/verifier case The server/pos/verifier case should be secure from should be secure from tampering.*tampering.*

Audits and Investigations Audits and Investigations

Investigations or audits of conductorsInvestigations or audits of conductors

Investigations or audits of manufacturersInvestigations or audits of manufacturers

Investigations of complaints Investigations of complaints

TESTINGTESTING

Overview of ECM TestingOverview of ECM Testing

Testing CriteriaTesting Criteria

Submission RequirementsSubmission Requirements

Testing In TexasTesting In Texas

Testing CriteriaTesting Criteria

Criteria are the standards or administrative Criteria are the standards or administrative rules used to perform the test. The criteria rules used to perform the test. The criteria must be established in law and rules. The must be established in law and rules. The criteria are needed to determine whether a criteria are needed to determine whether a card-minding device as presented will be card-minding device as presented will be approved for use in a jurisdiction. approved for use in a jurisdiction.

Submission RequirementsSubmission Requirements

Submission Requirements are guidelines Submission Requirements are guidelines

that the test lab sets up to establish a level that the test lab sets up to establish a level

test base for all submissions and inform test base for all submissions and inform

the manufacturers what will be expected the manufacturers what will be expected

during the submission and testing.during the submission and testing.

Testing in TexasTesting in Texas

Testing in TexasTesting in Texas

Digital signatures are made of critical .dll, Digital signatures are made of critical .dll, ext, .bin files.ext, .bin files.

Crucial software settings are mapped and Crucial software settings are mapped and identified.identified.

Testing in TexasTesting in Texas

A letter of approval A letter of approval or denial is sent to or denial is sent to the manufacture the manufacture which includes a which includes a detail of findings, a detail of findings, a listing of digital listing of digital signatures, and signatures, and approved settings.approved settings.

Items Found in ECM Testing Items Found in ECM Testing

A hand held was able to be loaded with games and cards manually, without using the site system POS to download cards.

A verifier that would print on both winning and non- winning card faces the words “Winning Receipt.”

Items Found in ECM TestingItems Found in ECM Testing

An ECM system that uses cartridges to load An ECM system that uses cartridges to load session game schedules and card faces on to session game schedules and card faces on to hand helds, had a button on the POS to re-charge hand helds, had a button on the POS to re-charge the cartridges. When this recharge occurred no the cartridges. When this recharge occurred no additional sale was recorded. This recharged additional sale was recorded. This recharged cartridge when reinstalled, allowed the hand held cartridge when reinstalled, allowed the hand held to be used in subsequent sessions that used the to be used in subsequent sessions that used the same game schedule.same game schedule.

More ItemsMore Items

A POS that would fail to record the sales properly if A POS that would fail to record the sales properly if more than a 1000 units of pull tabs were sold on one more than a 1000 units of pull tabs were sold on one key in a single transaction.key in a single transaction.

A verifier that was printing the winning card faces A verifier that was printing the winning card faces with the numbers printed horizontal to the word with the numbers printed horizontal to the word BINGOBINGO on top. on top.

More ItemsMore Items

A system allowed an account number, for A system allowed an account number, for card packs sold to be used on two fixed card packs sold to be used on two fixed base units simultaneously during the base units simultaneously during the same session.same session.

More ItemsMore Items

A system had a special key to transfer A system had a special key to transfer card packs from one hand held to card packs from one hand held to another. It was found by pushing this another. It was found by pushing this transfer key a card pack would download transfer key a card pack would download to the next available hand held without a to the next available hand held without a receipt being printed.receipt being printed.

More ItemsMore Items

A system allowed voided Hand Held units to A system allowed voided Hand Held units to continue to play bingo and win as the verifier continue to play bingo and win as the verifier could not recognize voided card faces.could not recognize voided card faces.

A system allowed sales to be changed on the A system allowed sales to be changed on the

database after the session was closed.database after the session was closed.