Incident: Online Betting Firm 888 Penalized for Self-Exclusion System Failure

Published Date: 2017-08-31

Postmortem Analysis
Timeline 1. The software failure incident involving the online betting firm 888 occurred in the year leading up to the end of 2016 [62029].
System 1. Self-exclusion system of the online betting firm 888 [62029]
Responsible Organization 1. The online betting firm 888 [62029]
Impacted Organization 1. Customers who had voluntarily banned themselves from gambling [62029] 2. The employer from which money was stolen [62029]
Software Causes 1. The software failure incident at the online betting firm 888 was primarily caused by technical failures in the company's systems that allowed customers who had signed up to its self-exclusion scheme to still access their accounts and gamble, leading to significant financial losses and harm to vulnerable customers [62029].
Non-software Causes 1. Lack of proper interaction with the customer despite visible signs of problem gambling [62029] 2. Failure to prevent customers who had voluntarily banned themselves from gambling from accessing their accounts [62029] 3. Inadequate protection of vulnerable customers leading to significant flaws in safeguarding against gambling harm [62029] 4. Insufficient measures to address problem gambling and protect vulnerable customers [62029]
Impacts 1. The software failure incident at the online betting firm 888 led to a record penalty of £7.8m imposed by the industry regulator, the Gambling Commission, for significant flaws in protecting consumers from harm [62029]. 2. More than 7,000 people who had voluntarily banned themselves from gambling were still able to access their accounts due to the technical failure in the company's systems, resulting in these individuals depositing £3.5m into their accounts and gambling nearly £51m in deposits and recycled winnings [62029]. 3. One customer was allowed to make 850,000 bets worth £1.3m in one year, using money stolen from their employer, which highlighted the failure of the self-exclusion scheme to prevent problem gambling [62029]. 4. The software failure incident raised concerns about the lack of interaction with customers displaying visible signs of problem gambling, leading to calls for the gambling industry to do more to protect vulnerable customers and address problem gambling [62029].
Preventions 1. Implementing robust and effective self-exclusion systems that accurately prevent individuals who have voluntarily banned themselves from gambling from accessing their accounts could have prevented the software failure incident [62029]. 2. Conducting regular and thorough audits of the systems and processes related to customer protection to identify and address any flaws or vulnerabilities could have prevented the software failure incident [62029]. 3. Enhancing customer interaction and monitoring for signs of problem gambling, such as frequency, duration, and sums of money involved in gambling, to promptly intervene and safeguard vulnerable customers could have prevented the software failure incident [62029]. 4. Ensuring that technical systems are designed to prevent individuals who have self-excluded from one brand from being able to gamble with other brands under the same operator could have prevented the software failure incident [62029].
Fixes 1. Implement a more robust self-exclusion system to prevent customers who have voluntarily banned themselves from gambling from accessing their accounts [62029]. 2. Enhance customer interaction and monitoring to detect visible signs of problem gambling, such as high frequency and large sums of money involved in gambling [62029]. 3. Conduct independent audits of processes related to customer protection to ensure compliance and effectiveness of safeguards [62029]. 4. Improve data analysis capabilities to identify patterns of problem gambling and intervene more effectively [62029].
References 1. The Gambling Commission 2. Department of Culture, Media and Sport 3. Labour party 4. GambleAware 5. 888 (the online betting firm) 6. Investors of 888 7. Paddy Power 8. Gala Coral 9. Betfred 10. Bookmakers Commission

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to the online betting firm 888 involved a technical failure in the company's systems that allowed customers who had signed up to its self-exclusion scheme to still access their accounts and gamble significant amounts of money [62029]. (b) The article mentions that the fine imposed on 888 is part of a string of penalties imposed on the gambling industry by the regulator for various failings, including failure to prevent problem gambling and money laundering. Other companies like Paddy Power, Gala Coral (now merged with Ladbrokes), and Betfred have also faced penalties for similar issues, indicating that similar incidents have occurred at multiple organizations within the gambling industry [62029].
Phase (Design/Operation) design, operation (a) The software failure incident in the case of 888 was primarily due to design-related factors introduced by system development. The technical failure in the company's systems allowed customers who had signed up for the self-exclusion scheme to still deposit money and gamble, leading to significant flaws in protecting consumers from harm [62029]. (b) Additionally, the failure can also be attributed to operational factors related to the misuse of the system. One customer was able to make 850,000 bets worth £1.3m in one year, using money stolen from their employer. This misuse of the system by the customer, who resorted to crime to fund their gambling habit, highlights operational failures in detecting and preventing such behavior [62029].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident at the online betting firm 888 was primarily due to significant flaws in the company's systems that led to customers who had signed up for the self-exclusion scheme being able to deposit money and gamble despite their self-imposed bans [62029]. (b) outside_system: The failure was also influenced by the lack of interaction with the customer, given the frequency, duration, and sums of money involved in the gambling, which raised serious concerns about 888's safeguarding of customers at risk of gambling harm [62029].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the case of the online betting firm 888 was primarily due to non-human actions, specifically a technical failure in the company's systems. This technical failure allowed customers who had signed up for the self-exclusion scheme to still deposit money into their accounts and continue gambling, despite their intention to ban themselves from gambling [62029]. (b) However, human actions also played a role in this software failure incident. The Gambling Commission found that 888 failed to spot the "visible signs of problem gambling" displayed by one customer who resorted to crime to fund their gambling habit. This customer was able to make over 850,000 bets worth £1.3m, including money stolen from their employer, over a 13-month period. The failure to intervene and address the problem gambling behavior of this customer was a human action contributing to the software failure incident [62029].
Dimension (Hardware/Software) software (a) The software failure incident in the case of 888 online betting firm was primarily due to contributing factors originating in software rather than hardware. The incident involved a technical failure in the company's systems that allowed customers who had signed up for self-exclusion to still access their accounts and gamble significant amounts of money [62029]. This failure was related to flaws in the software systems that were supposed to prevent such access and protect vulnerable customers from harm. The company acknowledged the need to fix its self-exclusion systems, which arose from a software issue where customers who self-excluded from some brands were still able to gamble with others [62029]. (b) The software failure incident was also attributed to contributing factors originating in software. The Gambling Commission found "significant flaws" in 888's efforts to protect consumers from harm, indicating a failure in the software systems designed to safeguard customers at risk of gambling harm [62029]. The company mentioned that changes were being made to its systems to better identify patterns of problem gambling in the future and to tighten up its self-exclusion system, indicating a software-related issue that needed to be addressed [62029].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident in the article is non-malicious. The failure was due to technical flaws in the company's systems that allowed customers who had voluntarily banned themselves from gambling to still access their accounts and continue gambling, leading to significant financial losses and harm to vulnerable customers [62029].
Intent (Poor/Accidental Decisions) poor_decisions The software failure incident related to the online betting firm 888 was primarily due to poor decisions rather than accidental decisions. The incident involved significant flaws in the company's systems that allowed customers who had self-excluded themselves from gambling to still access their accounts and gamble large sums of money, leading to harm and financial losses [62029]. The failure to properly implement and monitor the self-exclusion scheme, as well as the lack of interaction with customers displaying signs of problem gambling, indicated a failure in decision-making processes within the company.
Capability (Incompetence/Accidental) development_incompetence, unknown (a) The software failure incident related to development incompetence is evident in the case of the online betting firm 888. The Gambling Commission found "significant flaws" in 888's efforts to protect consumers from harm, highlighting a technical failure in the company's systems that allowed customers who had signed up for self-exclusion to still deposit money and gamble, leading to serious consequences such as one customer stealing money from their employer to fund their gambling habit [62029]. (b) The software failure incident related to accidental factors is not explicitly mentioned in the provided article.
Duration temporary The software failure incident reported in the articles related to the online betting firm 888 was temporary. The incident involved a technical failure in the company's systems that allowed customers who had signed up for the self-exclusion scheme to still access their accounts and continue gambling [62029]. This temporary failure was due to specific circumstances within the company's systems that led to the flaw in the self-exclusion mechanism, rather than being a permanent issue affecting all aspects of the software.
Behaviour omission, other (a) crash: The software failure incident in this case did not involve a crash where the system loses state and does not perform any of its intended functions. The issue was related to flaws in the company's systems that allowed customers who had self-excluded themselves from gambling to still access their accounts and continue gambling [62029]. (b) omission: The software failure incident can be categorized as an omission where the system omitted to perform its intended functions at instances. Specifically, the self-exclusion system failed to prevent customers who had voluntarily banned themselves from gambling from accessing their accounts and gambling, leading to significant harm and financial losses [62029]. (c) timing: The software failure incident was not related to timing issues where the system performed its intended functions correctly but too late or too early. Instead, the failure was more about the system's inability to enforce self-exclusion measures effectively and in a timely manner to protect vulnerable customers [62029]. (d) value: The software failure incident did not involve the system performing its intended functions incorrectly in terms of producing incorrect outputs or results. The issue was more about the system's failure to prevent individuals from accessing their accounts despite being self-excluded, leading to excessive gambling and financial harm [62029]. (e) byzantine: The software failure incident did not exhibit characteristics of a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. The primary issue was the lack of proper safeguards and controls in place to enforce self-exclusion measures effectively, rather than erratic or inconsistent behavior of the system itself [62029]. (f) other: The software failure incident can be categorized as a failure related to oversight and negligence in implementing proper self-exclusion mechanisms. The company's failure to identify and prevent problem gambling behaviors, allowing individuals to continue gambling despite being self-excluded, highlights a significant oversight in their systems and processes [62029].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure. The software failure incident at the online betting firm 888 resulted in significant financial consequences for the affected individuals. More than 7,000 people who had voluntarily banned themselves from gambling were still able to access their accounts due to a technical failure in the company's systems. This allowed customers to deposit £3.5m into their accounts, leading to gambling nearly £51m in deposits and recycled winnings. One customer, in particular, was able to make 850,000 bets worth £1.3m in one year, using money stolen from their employer [62029].
Domain finance, entertainment (a) The failed system was related to the finance industry, specifically online gambling. The software failure incident involved the online betting firm 888, which was penalized for significant flaws in its efforts to protect consumers from harm related to problem gambling [62029]. The incident highlighted the failure of the company's self-exclusion system, which was meant to prevent individuals who had voluntarily banned themselves from gambling from accessing their accounts and engaging in gambling activities. The technical failure in the company's systems allowed customers to deposit large sums of money and gamble extensively, leading to serious consequences such as theft and false accounting by one customer who resorted to crime to fund their gambling habit. The Gambling Commission found that 888 failed to spot visible signs of problem gambling displayed by customers, indicating a failure in safeguarding vulnerable individuals within the online gambling industry. The penalty imposed on 888 included repayment of deposits made by self-excluded customers and compensation to the employer from which money was stolen, reflecting the seriousness of the failings in protecting consumers at risk of gambling harm.

Sources

Back to List