Incident: Flaws in GamStop Online Self-Exclusion Scheme Allow Gambling Continuation

Published Date: 2019-01-13

Postmortem Analysis
Timeline 1. The software failure incident regarding the flaws in the GamStop self-exclusion scheme happened around April 2018, as that was when GamStop was launched [80286].
System 1. GamStop self-exclusion scheme [80286] 2. Multi-Operator Self Exclusion Scheme (MOSES) [80286]
Responsible Organization 1. GamStop [80286] 2. Multi-Operator Self Exclusion Scheme (MOSES) [80286]
Impacted Organization 1. Problem gamblers using the GamStop self-exclusion scheme were impacted by the software failure incident [80286].
Software Causes 1. Lack of proper validation and verification mechanisms in the GamStop self-exclusion scheme, allowing users to bypass the system by changing small details like misspelling a surname [80286].
Non-software Causes 1. Lack of effective ID verification processes in place for online gambling platforms [80286]. 2. Inadequate oversight and enforcement by regulatory bodies such as the Gambling Commission [80286]. 3. Insufficient coordination and monitoring of self-exclusion schemes like GamStop and MOSES by the responsible organizations [80286].
Impacts 1. The software failure incident allowed individuals to bypass the self-exclusion scheme designed to help problem gamblers, leading to continued gambling despite being banned [80286]. 2. The incident exposed serious flaws in the GamStop self-exclusion scheme, indicating that it was not working effectively to prevent addicts from accessing online betting platforms [80286]. 3. The failure resulted in a lack of protection for hundreds of thousands of betting addicts across the country, highlighting the ineffectiveness of the industry's current measures [80286]. 4. The investigation revealed that individuals could easily open new online betting accounts by making minor changes to their details, undermining the purpose of the self-exclusion scheme [80286]. 5. The incident raised concerns about the overall reliability and functionality of self-exclusion schemes in the gambling industry, prompting calls for improvements and stricter ID verification measures [80286].
Preventions 1. Implementing stricter ID verification processes could have prevented the software failure incident by ensuring that users cannot bypass the self-exclusion system by using incorrect details [80286]. 2. Conducting regular audits and testing of the self-exclusion scheme to identify and address any vulnerabilities or loopholes that could be exploited by users [80286]. 3. Enhancing the overall security measures of the online gambling platforms to prevent unauthorized access and ensure compliance with self-exclusion requests [80286].
Fixes 1. Implement tougher ID checks to prevent users from bypassing the self-exclusion system [80286]. 2. Enhance the self-exclusion scheme by improving the verification process for user details to ensure the effectiveness of the ban [80286]. 3. Address the flaws in the self-exclusion scheme by making it more robust and resistant to deliberate attempts to circumvent the ban [80286].
References 1. GamStop's Fiona Palmer 2. Adam Bradford 3. Chief executive of GamStop, Ms Palmer 4. The Gambling Commission 5. The Association of British Bookmakers (ABB) 6. Sarah Grant 7. The Senet Group 8. Shadow culture secretary Tom Watson 9. Labour MP Carolyn Harris [80286]

Software Taxonomy of Faults

Category Option Rationale
Recurring multiple_organization (a) In the provided articles, there is no specific mention of the software failure incident happening again within the same organization or with its products and services. Therefore, there is no information available to indicate a repeat incident within one organization. (b) The articles do mention a similar incident happening at multiple organizations. The investigation revealed flaws in the self-exclusion schemes for both online gambling platforms and High Street bookmakers. The GamStop scheme and the Multi-Operator Self Exclusion Scheme (MOSES) were found to have serious flaws that allowed individuals to bypass the exclusion system and continue gambling despite being banned. This indicates that the software failure incident related to the flawed self-exclusion schemes occurred at multiple organizations within the gambling industry [80286].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the case of the GamStop self-exclusion scheme for online gambling addicts. The article highlights serious flaws in the system that allowed individuals to bypass the exclusion mechanism by making minor changes to their user details, such as misspelling a surname or using a different email address. This design flaw enabled users to continue gambling online even after self-excluding themselves [80286]. (b) The software failure incident related to the operation phase is evident in the Multi-Operator Self Exclusion Scheme (MOSES) for High Street bookmakers. Despite individuals attempting to self-exclude themselves from multiple betting shops, the operation of the scheme failed as they were still able to place bets in a significant number of the excluded locations. This operational failure indicates a gap in the system's functionality during its actual use by customers [80286].
Boundary (Internal/External) within_system (a) within_system: The software failure incident related to the GamStop self-exclusion scheme was primarily due to contributing factors that originated from within the system. The investigation by BBC Radio 5 Live Investigates revealed serious flaws within the scheme that allowed individuals to bypass the self-exclusion process by making minor changes to their details, such as misspelling a surname or using a different email address [80286]. These internal vulnerabilities within the system enabled users to continue gambling online even after they had self-excluded themselves, indicating a failure within the system itself.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The article reports on a software failure incident related to the GamStop self-exclusion scheme for problem gamblers. The failure was due to flaws in the system that allowed individuals to bypass the self-exclusion mechanism by making simple changes like misspelling a surname or using a different email address. These flaws in the software system enabled users to continue gambling online even after self-excluding themselves [80286]. (b) The software failure incident occurring due to human actions: - The failure in the self-exclusion scheme for problem gamblers was also exacerbated by human actions. For example, individuals exploited the flaws in the system by intentionally changing their details to circumvent the self-exclusion process. Additionally, the chief executive of GamStop acknowledged the need to improve the scheme in response to the findings, indicating human involvement in addressing the software failure incident [80286].
Dimension (Hardware/Software) software (a) The articles do not provide information about a software failure incident occurring due to contributing factors originating in hardware [80286]. (b) The software failure incident reported in the articles is related to flaws in the online self-exclusion scheme designed to help problem gamblers. The scheme, known as GamStop, was found to have serious flaws that allowed individuals to bypass the exclusion system by simply changing user details or creating new accounts with different information [80286].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident related to the GamStop self-exclusion scheme can be categorized as malicious. The incident involved individuals being able to cheat the system by changing their user details to continue gambling online despite being banned through the scheme. This was highlighted by the BBC investigation, where a gambler was able to open a new online betting account by simply using a different email address and changing a letter in their name, even after registering with GamStop [80286]. The ability to bypass the exclusion system and continue gambling indicates a malicious intent to exploit the flaws in the software for personal gain, rather than accidental or non-malicious factors leading to the failure.
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident related to the GamStop self-exclusion scheme for problem gamblers can be attributed to poor decisions. The head of GamStop, Fiona Palmer, admitted that the service was not working well enough, indicating a failure due to contributing factors introduced by poor decisions [80286]. Additionally, the investigation by BBC Radio 5 Live Investigates revealed serious flaws in the scheme, such as being able to bypass the exclusion system by simply changing a few small details like misspelling a surname or using a different email address, highlighting poor decisions in the design and implementation of the software [80286].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident occurring due to development incompetence: - The article reports on a software failure incident related to the GamStop self-exclusion scheme for problem gamblers. The investigation found serious flaws in the scheme, allowing individuals to bypass the exclusion system by simply changing small details like misspelling a surname or using a different email address [80286]. - The head of GamStop, Fiona Palmer, admitted that the service was not working well enough, indicating a lack of professional competence in ensuring the effectiveness of the self-exclusion scheme [80286]. (b) The software failure incident occurring accidentally: - The incident where individuals were able to cheat the GamStop self-exclusion system by changing small details like misspelling a surname or using a different email address could be seen as a failure introduced accidentally, as these loopholes may not have been intentionally designed but rather overlooked during the development process [80286].
Duration permanent (a) The software failure incident in this case appears to be more of a permanent nature. The article highlights serious flaws in the GamStop self-exclusion scheme for problem gamblers, where individuals were able to easily bypass the system by making minor changes to their details, such as misspelling a surname or using a different email address. This indicates a fundamental issue with the design and implementation of the software, allowing for a persistent loophole that undermines the intended purpose of the system [80286].
Behaviour omission, other (a) crash: The articles do not mention any instances of a crash where the system loses state and does not perform any of its intended functions. (b) omission: The articles highlight instances of omission where the system omits to perform its intended functions at an instance(s). For example, in the case of the GamStop self-exclusion scheme, individuals were able to bypass the system's restrictions by simply changing minor details like misspelling a surname or using a different email address, allowing them to continue gambling despite being banned [80286]. (c) timing: There is no mention of timing-related failures where the system performs its intended functions correctly but too late or too early. (d) value: The articles do not specifically mention failures due to the system performing its intended functions incorrectly. (e) byzantine: The articles do not describe any instances of the system behaving erroneously with inconsistent responses and interactions. (f) other: The other behavior observed in the software failure incident is the system's inability to effectively prevent individuals from circumventing the self-exclusion scheme's restrictions, leading to a failure in protecting problem gamblers from accessing online betting platforms despite being banned [80286].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (a) unknown (b) unknown (c) unknown (d) [80286] The software failure incident related to the GamStop self-exclusion scheme allowed problem gamblers to bypass the system and continue gambling online, leading to financial harm. For example, David Bradford lost over £100,000 due to his online gambling addiction, which was facilitated by the flaws in the self-exclusion scheme. (e) unknown (f) unknown (g) unknown (h) unknown (i) unknown
Domain entertainment (a) The failed system was intended to support the gambling industry, specifically online gambling platforms. The system in question, GamStop, was designed to help problem gamblers self-exclude themselves from online betting sites [80286].

Sources

Back to List