In a recent EL webinar “Draws, balls, and RNGs”, Thomas Bierbach, a consultant to Bulletproof, a GLI Company, and lottery security authority, shared his perspective about core integrity requirements for electronic draw systems and RNGs. Thomas Bierbach has researched many and reviewed various electronic draw systems (EDS) and the underlying RNGs, and provides a thorough independent perspective of industry best practices and standards. We would like to share his recommendations on RNG integrity as we believe they provide an important guideline for the lottery industry.  His discussion is in alignment with our company vision,  “to have the industry embrace non repudiation and proof of integrity as a standard for random number generation.”

Bierbach begins his panel discussing the “zero requirement”, necessary to any RNG: randomness.  Certification is essential to ensure that the RNG yields random results.  However, certification does not ensure that manipulation, malpractice, or malfunction do not compromise the RNG randomness, such as happened in several lotteries when a machine used for the drawings generated the same winning numbers in consecutive games over a few day period. See the Des Moines Register for historic examples of repeat numbers selected on an Electronic Draw Systems. (here) (See here for more information).

  Bierbach says: “For the longest time everybody thought that if a random number generator is certified that means it is secure and it operates at the highest levels of integrity, which created a bit of a false sense of security. Again, the certification only confirms that the results of the random number generator are random and have fair distribution based on a specification that is tested. It does not confirm that the random number generator and the electronic draw system (EDS) it is deployed in are tamper-proof and work with absolute integrity.”

Other than randomness, unpredictability is another obvious core requirement for EDSs. Unpredictability means that no one can determine from past draw results what the upcoming results will be, or from current draw results what future results will be. Of course, if the draw results are predictable, then some individuals will be able to unfairly win the games.

Bierbach’s number two requirement is non repudiation of the origin of random numbers, which is the proof of the draw outcomes and of their origin, where we can be certain that the result coming out at the end of the electronic draw system really originated from the very source of that electronic draw system.

Draw Non repudiation protects lotteries against draw system vulnerabilities. Draw system weaknesses include hardware failures, software defects, and insider fraud – all which are difficult to spot because incorrect or fraudulent numbers look just like randomly generated outcomes! (For more about non repudiation, read these two blogs posts: “Future Tamper Proof RNG” and “Non Repudiation and Draw Integrity“)

The third requirement is the auditability and repeatability of an electronic draw system. This concept is very simple: Bierbach references the ‘old fashioned’ ball draw systems which are very auditable because they are often observed by millions of players on the television. Prior to the draws, balls are weighed and tested, then the draws take places, and then post-draw testing and weighing happens. They are not repeatable however, as a one-time event, they are compared to shattering a glass, which will never break exactly the same way twice.

In Szrek’s electronic draw system, the draw system creates a proof of integrity record, and then the audit process takes that record and recreates the draw results. By recreating the results, the auditor is able to match them with the original results and confirm that they are correct. If verification fails, it is a proof of a problem, you can analyze what the problem is; and if verification gives positive results, it proves conclusively that there was no problem. See “What is Proof of Integrity?” for more detail. For a case study about proving the validity of a draw, see “Expect the Unexpected“. You may also refer to the WLA article “Random chance is the essence of the lottery”, on page 10, ‘A seemingly unusual draw’.

Bierbach advocates for the importance of transparency in lottery draws, saying

  “Many electronic draw systems that I’ve reviewed are lacking transparency. They’re highly complex and complicated systems that obviously, according to the developers and the creators of those systems, operate at a high level of integrity. However, I can’t see it. I call this the Black Box effect… I can’t really see what’s going on inside the system and inside the process, because all we know about electronic draw systems is we’re looking at a computer. Somebody pushes a button and the number appears on the screen. We don’t really know where that number comes from.”

Concurring with Bierbach about the importance of transparency, we wrote about this very topic in our white paper, “Redefining Transparency in Lottery Draws” .

To say that a problem has not been noticed is not to say that one has not occurred, as random numbers all look alike!

We believe the industry as a whole would benefit from transparency in the draw process through proof of integrity, which guarantees the integrity of the whole random number generation process.

The last core integrity requirement that Bierbach discusses and stresses as extremely important is the understandability of the system.  “Not everybody is able to explain the details where a seed comes from, where the randomness is created, what the chain of custody is… and all these things just leave gaps open. That leaves the security folks of a lottery, for example, deploying an EDS and just having to trust the system to be of highest integrity. Trust as we all know is great but it’s not really a good security control.”

We’ve discussed the black box factor in a recent NASPL article, “Deconstructing the Black Box”.

As experts in RNG, at Szrek2Solutions we concur with this vision of core integrity factors for EDSs. We appreciate Thomas Bierbach’s perspective and share his vision as a helpful guideline to lotteries and other organizations in the industry.