Friday, May 28, 2010
Just Conjecturin', Volume 18: Fakes a-Plenty Among the KGC 31
In the early part of 2010, a partial list containing 15 accounts was leaked out from Cereus. This leak was also suspicious, though an investigation into the accounts listed therein, done by me, showed that the accounts themselves were very real and were indeed part of the cheating scandal. I obtained this list just a couple of weeks ago. This may be the list WCP is planning on releasing, or they may have since then obtained a more complete list via the same source, due directly to the pressure I've been exerting.
The 15 accounts include 14 separate names, with one name (a real person very close to Russ Hamilton) being listed on two different accounts, but with different addresses and the addition of a middle initial in one of the names. The list does include either three or four real people, but the huge problem here is that most of this list is fakes: fake accounts with made-up names or phony addresses allegedly created at Russ Hamilton's behest, later to be used by Hamilton in the cheating.
Today it's time to publish the fakes, noting that all these names are supposed to have been included on the Kahnawake Gaming Commission's official list of 31 people connected to the cheating. The fact that many of these fakes are obvious casts even more suspicion on both the source of the leak and the KGC itself, since either, with even a modicum of effort, could have deduced the fakes and eliminated them from the list. (Or, conversely, published them with a grand proclamation of how things were being done in regard to the scandal.)
So here are the ten fakes:
User Id – 40018
Address: 1221 windbrook San Diego, California
Tele - No Number
Undetermined – 1221 is an invalid street number, but 11221 would be legit, no zip.
This is a play-money account, perhaps even of a real person, that was converted into a cheating account internally at a later date. All such low-ID accounts on the KGC list are of similar origin.
User Id - 966687
Address: 1444 Wagner Las Vegas, NEVADA 89134
Tele - No Number
Fake address (would be in the middle of I-15), wrong zip for street
Confirmed fake. If you’re going to have a lot of fakes, you may as well toss a “Brunson” in there for verisimilitude, right?
User Id - 1676953
Address: 2480 W. 99th Chicago, ILLINOIS 60402
Tele – No Number
Confirmed fake. Google sat maps show a house at this general location, but “Plunto” does not appear as a name in all of Chicago white listings and the houses in this vicinity front on a side street.
User Id - 1676958
Address: 2549 Maple Humeston, IOWA 50123
Tele - No Number
Fake address , confirmed fake
User Id – 2422566
Address: 73 W 53rd Biloxi, MISSISSIPPI 39530
Tele - No Number
User Id - 2510148
Address: 7006 grouse road las vegas, NEVADA 89134
Tele – 7023969970
Probable fake – Grouse St. (not "Road") w/ same zip code exists, but numeric addresses not in same range
User Id – 2561615
Address: 78 Grainger Rd Evanston, ILLINOIS 60427
Tele - No Number
Fake address – zip wrong for Evanston, no such road
User Id - 2561621
Address: 301 Appleton Miami, FLORIDA 10234
Tele - No Number
Fake zip, fake street
User Id - 2561631
Address: 604 e 23rd st grand rapids, MICHIGAN 70469
Tele - No Number
Fake address, fake zip
User Id - 2641649
Address: 4044 Billings Canton, COLORADO 11111
Tele - No Number
False zip code, Canton, Co barely exists, and roads are numeric county roads
* * * * *
These are presented in ID # order for a reason. Notice the tight grouping associated with some of these IDs:
Jason Plunto: 1676953
Frank Dursley: 1676958
Jason DelMonte: 2561615
Thomas King: 2561621
Eli Argo: 2561631
It's no coincidence. These accounts were almost certainly created during two sessions when multiple accounts were being created via Hamilton's directives, and accounts near to these in numeric order could easily be checked to see if more fakes are unearthed. One they'll find for sure is the "Dan Francis" account associated with "ShaqTack" and others, which numerically fits right in with the Plunto/Dursley run:
The Francis grab comes from a 2+2 poster who saved the original "brainwashdodo" screen grabs; I'd love to acknowledge him but I cannot find his message this morning. (Contact me, please.) How the Francis account was missed or not included within the above list of 14-15 names remains beyond me, but it has been alleged to me that many fake accounts used in the cheating have not even been uncovered, and I now believe this claim. Again, it calls into question both the motives of the person who leaked the list and the laughable way in which the KGC report was constructed and presented to the public. It is true that most of the dollar value in cheating attributed to the fakes is probably accounted for by the names in this list, but the fact that the list itself is both so blatantly stuffed with the fakes and so obviously flawed makes its origins and motives suspect.
I'd love to see WCP release the full 31-name list next week, if indeed they have it; they may not. They can release the four real names on this list if they wish, or I can do it at a later date. I'm still researching to see if (a) all four are indeed real, and (b) exactly what benefit(s) they may have received from the cheating.
I know of approximately ten more of the real people who are supposed to be on the full KGC list of 31, but it is likely that the list will be as much a tool of business and political convenience as it is an attempt to get to the truth, and the complete list may well contain parties guilty of the cheating, parties guilty of other things, and perhaps even an innocent party or two.
And of course, it has parties that don't even exist. You now know about these.
(I hereby give permission for the list of ten accounts above and the Dan Francis screen grab to be distributed freely. -- HLH)
* * * *
P.S.: Phil Hellmuth is innocent in the cheating. He remained clueless about the entire scandal until it blew up behind his back, and to the best of my knowledge he still doesn't know jack about what really transpired. Has he been a silly frontman still looking to make a buck off his name? Sure, but that's just Phil.
* * * *
P.P.S.: Okay, so I can't count late at night after working all day. This is Volume 18, not 17. Any bets that the over/under on this series tops 40?
Friday, May 21, 2010
Just Conjecturin', Volume 17: The Real Story of the UltimateBet Refunds
How the $22 million amount was determined and how it was distributed to cheated players is something that's been answered only in overly general, often inadequate terms. The more specific answer begins with a court deposition given by onetime UB programmer Uri Kozai, who was the man finally tasked with developing a refund method for players after other options fell through. Despite being a programmer (and therefore automatically being cast under the general net of suspicion surrounding the UltimateBet affair), Kozai appears to have had no connection to the cheating itself. [Kozai does remain connected to secondary firms still pursuing interests related to Cereus and the old Excapsa matters, and is of course among the many Excapsa shareholders outed through the efforts of a major Excapsa executive seeking leverage, back in the day.]
The cheating, more specifically the surreptitious code that allowed its users to spy on other players' hole cards in real time, was known internally as "God Mode", not the more official-sounding "AuditMonster1" and "AuditMonster2" tags listed in the final Kahnawake Gaming Commission report.
Not only did the hidden God Mode exist long before Kozai entered the scene, but Kozai himself was reported to be "livid" after being clued in as to the code's secret location. Kozai was tipped off, allegedly, by legal counsel to one of the other UB parties ensnared in the affair, this as pressure from the outside for a complete explanation continued to mount.
Ever more cheating accounts were uncovered and the amount needing to be refunded grew and grew, and this was the crux of the $81 million lawsuit filed by official purchaser Blast-Off Limited against Excapsa, the original UB owners, on the basis of Blast-Off having purchased "damaged goods". One round of refunds totaling about $7 million had already been issued, though that was clearly inadequate in the face of additional uncovered cheating accounts.
The scandal's scope grew ever wider, and as the larger second wave of accounts was acknowledged, the span of time that the cheating included was stretched back all the way to 2003. The $22 million was a very real number as estimated by Kozai, based on his examination of the suspect accounts, and is likely the exact figure Kozai himself listed in his deposition in the Blast-Off/Excapsa battle. The deposition is buried deep within the many documents connected to the liquidation of Excapsa. The figure within Kozai's deposition suggesting the total refunds needed was redacted from publicly available documents, meaning it might not match to the penny the $22 million that was refunded, but since Kozai's figures were those used both to compute the refunds and to resolve the "damaged goods" legal battle between Blast-Off and Excapsa, the two can be presumed to match.
In one light, one could say that the $22 million returned over both rounds of refunds was an honest, good-faith effort to compensate all the cheated players -- not forgetting, of course, that Blast-Off expected Excapsa's shareholders to pay for it. [As it turned out, an additional 24 million shares of Excapsa stock were annulled as part of the final legal deal. The owners of those shares and the annulment's relationship to the earlier, more publicized stock forfeiture connected to Russ Hamilton is a topic for a future post.]
In another light, however, one could also say that the whole $22 million in refunds was a giant, approximately-shaped band-aid slapped on the scandal in the hopes that it was enough to make the pressure go away. Not quite a sham, but not quite true, either. It's best described as a desperate measure employed to give all the shareholders -- on both sides -- at least the chance to move forward and continuing collecting revenue from players.
The real story is this: Despite the enormity of the amount refunded, the individual refunds could not possibly be correct, in whole in or in part, and there is likely no affected player who ever received the exact refund that he should have received. Many players received nothing or not enough, while there must be others who received too much.
Kozai's formula involved looking at the net long-term profit of each of the cheating accounts known at that time, adding those accounts' profits together -- which is where the $22 million figure came from. The matching funds, thus secured, were then distributed on a flat-line percentage basis to all player accounts that showed a net loss in action against those cheating accounts.
Kozai's method, as mentioned, was a last resort, and it involved no specific analysis of the hands themselves. It was utterly impossible for Cereus to determine what hands involved cheating by a God Mode-using account, and what hands didn't which isn't to say they didn't try. Cereus even enlisted the help of a World Series of Poker Main Event world champion -- one not named "Hamilton" or "Hellmuth" -- who looked at thousands of hands and finally gave it up as a lost cause. At that point there was nothing left to do but use Kozai's calculations.
So why was it impossible to go back into the records and determine more specifically who was cheated, when, and for how much? Because of this: The God Mode tool was written early on in UB's history, and it was written in such a way that it stood outside of UB's standard cache of auditing tools. Neither UltimateBet in the days before the merger with AP, nor Cereus today, have ever had any capability to track exactly when God Mode was being used. Worse, there were accounts that were used both for cheating and for innocent, straight-up play, and the real play and the cheating play within these accounts were intertwined over months, even years of action. The end result was a morass that defeated all detailed attempts at a hand-by-hand or session-by-session reckoning of the affair.
Players who still hope to receive a to-the-penny accounting of the cheating that took place at their tables will be perpetually disappointed, because no such accounting is possible. Cereus COO Paul Leggett stated, in a recent interview, "[E]verybody got every penny back...." While a huge amount of money was refunded, the fact that the God Mode play could not be tracked internally makes Leggett's statement a frivolous claim. Other factors weaken the claim even more, including the probable existence of additional cheating accounts never included in the calculations, along with entire secondary cheating episodes not acknowledged to date.
Next time out it's a re-visit to the topic of the hand histories provided to cheated UB players.
Monday, May 17, 2010
Just Conjecturin', Volume 16: The Curious Case of 'brainwashdodo'
One of the most intriguing episodes in the annals of the UltimateBet scandal was the appearance on the 2+2 poker forums in late 2007 of a poster named "brainwashdodo", a poster who shared, via screengrabs and anecdotal tales, a tantalizing helping of inside information connected to the cheating. Information posted by brainwashdodo at the time was vital to the wronged poker players' investigative efforts in covering some of the user accounts and possible money trails used in the scandal, and in fact directly contributed to the uncovering of Russ Hamilton himself. Hamilton may well have been outed via other lines of inquiry that were also underway at the time, but the information brainwashdodo provided all but removed any doubt in the matter.
What was perhaps most intriguing, however, was that brainwashdodo himself disappeared from the scene, as abruptly as he first appeared. Even stranger was that many of the screen grabs this poster served up on a file-sharing service were quickly deleted as well, leading onlookers to question brainwashdodo's motives in posting about the matter in the first place. Brainwashdodo posted 14 times between June 30 and July 8, 2008, disappeared for almost five months, then served up three more quick posts on December 2, 2008 before vanishing forever into the electronic ether.
Here's a quick visual overview of brainwashdodo's posting history on 2+2. [While the forum's owners retain proprietary rights to content in its entirety, the nature of this tale involves 2+2 itself, and because there is another part to this, these images fall under "fair use" for editorial purposes.] The list is presented in reverse chronological order (most recent posts at top), and clicking on any of these images should bring up a larger version:
Brainwashdodo's final December posts on 2+2, in fact, were little more than a wish for happy holidays for posters amid what might have been a veiled threat: "Anyway, more cht to hit t fan, will be back tmrw." In a July post, with much more gravitas, brainwashdodo had written this: "Out of curiosity, I have started my own audit within, since I saw no KGC or any other investigator coming or going. All the results will be shared with you soon, a website is coming together." However, Brainwashdodo's first series of posts ceased that very day, and after the no-new-information return in December, brainwashdodo never posted again. The hosted images were long gone as well, with nothing more than unreadable Google thumbnails to hint at the account information that once was opened to all.
It was in those earlier summer posts, of course, that other hard information was presented, with scathing and lengthy account-transfer histories that directly implicated Russ Hamilton at the heart of the cheating scandal and to many of the accounts later included in the Kahnawake Gaming Commission's "official" final report on the matter. Those histories had been posted in text format on 2+2, an independent site, and were thus no longer so easily removed. The transfer and play histories ran many hundreds of lines and included entries such as these, taken from an internal transfer account called "-Fred-", which was allegedly solely controlled by UB employee Fred David, but which was in fact under the direction of one or more top-level UB people, including Russ Hamilton. A second internal transfer account, "-russh-" (standing for Russ H[amilton]) was also directly tied via the -Fred- account to many of the proven and acknowledged cheating accounts, in transactions such as these:
377361587 40000.00 Transfer From -russh- 2006-SEP-03 05:40:03 PM customer req
377269310 -10000.00 Transfer To ShaqTack 2006-SEP-03 04:26:02 PM customer req
33412309 70000.00 Transfer From HeadKase01 2006-MAR-19 02:30:16 PM
31566264 50000.00 Transfer From RussHamilton 2006-MAR-18 04:02:45 PM customer req
The reason the -fred- account was used is that it was already a familiar account internally for high rollers to swap money back and forth for big games. Many of these big players were and are peripherally tied to the scandal despite being wholly innocent of the cheating. Since the -fred- account had lots of high-dollar swaps running through it, it would have served well as camouflage for similar-sized, illegitimate transfers. These transfers to cheating accounts were done amid this larger sea of far more legitimate swaps, which were done to help get big games running. It's possible, perhaps even likely, that the majority of the cheating transfers weren't done through the -fred- account at all, but rather the -russh- one.
These transactions first appeared via brainwashdodo's posts, and brainwashdodo himself disappeared within days, all but without a trace. So what was up with that? The comments in July about doing a personal audit implied a good motive, but the subsequent removal of associated screen grabs and the veiled threat in December -- "Anyway, more cht to hit t fan, will be back tmrw." -- instead lent credence to the blackmail theory, the one since confirmed by a confidential but proven source. It's been alleged to me that brainwashdodo was paid off, for some $80,000, by an important figure long since implicated in the matter. Brainwashdodo has even been reported to have made a second, more recent attempt to obtain additional funds for remaining quiet.
Brainwashdodo's real name has been provided to me, though I'll refrain from publishing it here on the very slim chance (perhaps 1 in 1,000) that the blackmail tale, though reported to me with specific names, was somehow altered along the way. It's not the only such tale to come out of the UB and AP messes, though the others can wait for future telling.
As for brainwashdodo, it's easy enough for a 2+2 owner or moderator to do a quick IP check and verify that the account did indeed post to the forum from somewhere in Costa Rica. This actually wasn't my first guessed location for the account, though I suspected all along the posting was done with less than altruistic motives.
Though the money involved may not seem like much, the brainwashdodo episode deserves a historical footnote. It will likely go down as the first time that a poker forum (2+2) was itself used as a tool of blackmail. Such a revelation should be of interest to 2+2's owners and to interested followers throughout the poker world.
Tuesday, May 11, 2010
Just Conjecturin', Volume 15: The Graycat File
I also reported that while cheating accounts such as the infamous "PotRipper" and "doubledrag" were relatively new, the history of known cheating account "graycat" was much older, being an account controlled primarily by Scott Tom and dating back to the early days of AP itself. The following series of images shows the transfer history for the "graycat" account, presented in reverse chronological order, newest to oldest.
A thoughtful examination of this account shows that the cheating may have been the final stage of a much longer process of losing control. While the large transfers to fellow cheating accounts "payup" on 8/20/07 and "doubledrag" on 9/02/07 are further evidence of the interrelated nature of these accounts, they're far from the only curious transactions. One can presume, that the money transferred in came from some internal AP general-funds account, which makes the many in-transfers noted as "overlay reduction" seem odd: Why would an overlay reduction involve transferring funds from a general account into a private one, even one controlled by a top management player? (Update: one possible explanation has been offered by a blog commenter.)
Also curious is the single transaction marked as an affiliate transfer; it could certainly be a legitimate transaction, but its timing (during the 2007 WSOP) and solo nature could've raised at least a red flag to double-check for any accounting-style inquiries.
In any event, the images speak for themselves:
Tuesday, May 04, 2010
Just Conjecturin', Volume 14: More Snared Images from Absolute
This time we return to two more of the top-level images of cheating accounts, to hammer home the point that there was a coordinated, perhaps even frantic cover-up of the cheating taking place at AP in the days immediately following the PotRipper tourney in September in 2007. Weeks of denials and cover stories followed, until the company finally conceded to the statistical evidence demonstrated in Michael Josem's won-loss charts and acknowledged the affair. But as to responsibility, disinformation has been disseminated for weeks, months, even years. It's high time it stopped.
Presented next is the account overview for "doubledrag", another acknowledged cheating account. Here's the snared image:
(Larger version of image available at http://img220.imageshack.us/img220/764/doubledragacctinfo.jpg)
Included just in that are: Another warning to general customer-service workers to not touch the account on the orders of management; a couple of irate calls from customers about the doubledrag cheating; and the September 17, 2007 closure of the account itself, by "AJ" -- referring to AJ Green, the member of the inner circle who took the hit when the bus of public opinion had to run over somebody. The cover-up, however, clearly extended across top management. The following image shows that when the doubledrag account was shut down, some $34,000 had been pulled back from the account:
(Larger version of image available at http://img443.imageshack.us/img443/8485/doubledragacctbals.jpg)
Remember that the Potripper account was blacklisted at the same time:
(Larger version of image available at http://img80.imageshack.us/img80/3180/scottom6.jpg)
And then there was "graycat" (a reference, I've been told, to Phil Tom's cat). First comes the overview, another one that features AP's own customer-service number in the phone field, along with plenty of other phony information:
(Larger version of image available at http://img443.imageshack.us/img443/9256/graycat1.jpg)
Here's the account balances overview, showing the final adjusted cash after certain adjustments had been made, leaving a nice round $15,000:
(Larger version of image available at http://img153.imageshack.us/img153/3910/graycat3.jpg)
The problem, though, was that graycat was an older and well known account, prompting another probe into the details of graycat's then-recent history. Here's what another glimpse into the graycat transaction file provided:
(Larger version of image available at http://img153.imageshack.us/img153/3910/graycat3.jpg)
There was another blacklisting and forced withdrawal on this account, with the funds moved off into the online wallet service ePassporte, to the account "SPTOM", likely short for Scott Philip Tom, his full name. That withdrawal went through on late 9/16 or early 9/17 (the screens likely track different aspects of the transaction) but was tied to the 9/16 blacklisting. Then, later on 9/17, a second withdrawal or series of withdrawals was denied, per AJ Green's (Allan Grimard's) request.
However, it's a secondary look into the transactions file of graycat that offers a clearer glimpse into that last tangle of transactions:
(Larger version of image available at http://img404.imageshack.us/img404/7961/graycat4.jpg)
The image indicates that a majority ($150,000) of the money that was in the account was moved off the site, with a smaller amount -- a bit over $30,000 -- remaining when the account was blacklisted. Again, published claims that no money left the site are false and are a further indicator of the larger cover-up.
At some point, $15,000 remained in the account, when the earlier screen was snared. It's important to note that as of 9/17, graycat was one of only several accounts under suspicion, and denials were still the order of the day. It would be several more weeks before even the most generalized admissions of insider cheating were acknowledged.
Still, it may have been necessary to keep the graycat account functioning, since it was an important house account at Absolute. Next time out, a historical look at graycat, the little house account that could.
Saturday, May 01, 2010
Just Conjecturin', Volume 13: Absolute and the Snared Screen Names
XXCASHMONEYXX also known as SUPERCARDM55
RONFALDOXXB also known as ROMNALDO
Each of these accounts, per the KGC's report, was directly and inextricably tied to the cheating through analysis of hand histories, including impossible win rates and blatant chip-dumping between the accounts. The problem, though, is that no outsider truly knows how much other cheating might have occurred. The KGC, elsewhere in the same report, admitted that other gaming logs had been intentionally destroyed.
Meanwhile, the vaunted ieSnare software program implemented by ieLogic at UltimateBet as an anti-fraud detection tool had also been in use at Absolute Poker. One aspect of ieSnare's capabilities, as it was represented to me, was shown in the first handful of screen grabs presented two posts back. Another was the program's capability to develop more complex inter-relational matrices between various accounts, and thus fine-tune the connections between these accounts. ieSnare's capabilities were highly touted in a number of industry pieces, and indeed, the software was an effective anti-fraud tool.
As generalized earlier, a snare of the PotRipper cheating account at Absolute was done sometime shortly after it became the focus of attention, and it indeed showed connections to other cheating accounts. However, the list snared as directly associational to PotRipper and the list of cheating accounts published by the KGC differ a bit. Here's what the PotRipper ieSnare seems to have shown:
(Larger versions of images also available at http://img100.imageshack.us/img100/339/potrippersnare1.jpg and http://img98.imageshack.us/img98/3340/potrippersnare2.jpg)
Clearly, those account names present in the PotRipper snare but absent from the KGC list would be the logical targets into any further investigations. (One additional account from the lengthy list below, "baller", shows a high correlation to each of the other known cheating accounts and should also be upgraded for additional scrutiny.)
The PotRipper account, however, had a very brief lifespan as an AP account, as previously shown in that earlier post. Another of the cheating accounts, "doubledrag", was similarly short-lived. By comparison, cheating accounts "graycat" and "steamroller" existed for much longer, and as a result, generated their own longer lists of associated devices and accounts when those screen names were similarly snared.
It's one of those open-ended questions one must ponder when considering candidates for other possible cheating accounts. The farther one chases down a given tree branch, the less likely any single link would be to be involved in the scandal, yet it seems first-level associations with known cheating accounts beg for more detailed investigation. That list is quite extensive, even if most or all of the new screen names presented below may turn out to be uninvolved in the cheating itself.
However, when one combines the direct device-usage correlations between PotRipper, PotChopper, graycat and steamroller against all directly associated accounts, as many as 147 other AP account screen names emerge. Showing complete imagery for all of these snares and screen names would kill this post's readability, but I'll upload the images for public scrutiny as opportunity arises. Here's a sample or two, though, to illustrate the snares' existence:
(Larger version of images also available at http://img594.imageshack.us/img594/4827/graycatassoc1.jpg and http://img594.imageshack.us/img594/8228/steamrollerassoc1.jpg)
While many of these accounts were likely used for testing purposes, or are innocent altogether, it's possible that some among these may have had illicit use in either known or unknown cheating affairs or related chip-dumping, hence their inclusion here. The total list of accounts meriting examination is closer to 150 than 10, including both the screen names already acknowledged by the KGC and a handful of probable duplicates in this list, likely caused by system-data mismatches in processing capitalized and uncapitalized letters. With those duplicates accounted for and that original KGC list added in, it's around 145 or 150 screen names, all told. Readers can sift it if desired.
Again, note that the inclusion of a screen name on this list that follows does not necessarily mean that the account was used for cheating. One such account bearing special mention is the "chairman" entry, which has been alleged to me to be associated with Scott Tom's father, Phil, who has in turn been alleged to be a primary investor at AP's inception. The inclusion of such an account in the ieSnare may have been caused through something as simple as a log-on from a different computer, but the account was snared, nonetheless, in both lower-case and ALL CAPS versions. To repeat, inclusion here does not necessarily equal cheating; inclusion is merely an indicator of an account probably needing another look. Likewise, since two of the accounts acknowledged by the KGC to be involved (SUPERCARDM55 and ROMNALDO) are not on the combined list, the ongoing issue of still other accounts possibly used for chip-dumping remains an open question.
One also has to chuckle at the names made up in imitation of many well-known players or real-life people, including "negreanu", "jen harman", "dave barry", "lou kreiger", "ted forrest", "andy beal", "humberto." and "mikemizrachi". All fakes, to the best of my knowledge; these are not connected to the real players of similar name. Poor Lou, his name wasn't even spelled right, and I checked with him -- he's never played on AP anyway.
Anyway, here's the list:
XXCASHMONEYXX also known as SUPERCARDM55
RONFALDOXXB also known as ROMNALDO
Additional ieSnare entries:
STEAMROLLER (ALL CAPS version)
up with ap!
school of glen
iq at zero