By Gilbert M. Gaul
Washington Post Staff Writer
Sunday, November 30, 2008; A01

Whenever Todd Witteles signed on to an Internet poker site, the first thing he did was look around for inexperienced players. One day in August 2007, the Las Vegas poker pro thought he had found an easy mark on AbsolutePoker.com.

A newcomer using the name "Greycat" was making unusually big bets off weak hands. "He seemed like a bad player who had just been getting incredibly lucky," Witteles recalled. "When you see someone like Greycat, you stop everything you're doing to play."

But in a series of one-on-one games, Witteles quickly found himself down $15,000. Worse, Greycat began taunting him. Soon, some of Witteles's online poker friends began wondering publicly whether Greycat was cheating. It was almost as though he could see Witteles's hole cards.

It turned out that was exactly what Greycat was doing. After months of pressure from a small group of players who took it upon themselves to investigate the claims, AbsolutePoker was forced to admit that a cheater had cracked its software, and it refunded $1.6 million to Witteles and dozens of other players.

It appeared to be a huge victory for the players and the self-policing nature of the Internet. Yet just weeks later, rumors of a new scandal rocked the world of online poker, this time at AbsolutePoker's sister site, UltimateBet.com. The stakes were dramatically higher: more than $20 million cheated from players over four years. The alleged culprits included a former world poker champion and UltimateBet employees who had hacked into the site.

Even as Internet gambling grows in popularity and profits, with millions of players and billions of bets, the two biggest cheating scandals in online gambling are raising fresh questions about the honesty and security of a freewheeling industry that operates outside of U.S. law.

Unlike brick-and-mortar casinos that undergo rigorous security checks, many Internet gambling sites operate in a shadowy world of little regulation and even less enforcement, a joint investigation by The Washington Post and CBS's "60 Minutes" has found. Dozens of these sites are located in countries with no reporting requirements. The licensing agencies there essentially operate as pay-as-you-go boutiques, generating millions of dollars in fees while showing little interest in policing rogue sites.

As it has given birth to Amazon.com, eBay and scores of other 21st-century businesses, the Internet has also spawned its own gambling boom, with estimated revenue more than tripling over five years, to $18 billion annually, including about $4 billion from virtual poker.

Millions of the bets originate in the United States, where online poker and gambling sites are banned, forcing players to reach out across the Internet like modern-day bootleggers. Yet players have little way of knowing who is watching their bets or where their money is going. Often, owners hide behind multiple layers of limited partnerships, making it difficult to determine who controls the sites or to lodge complaints about cheating.

In the AbsolutePoker and UltimateBet cheating scandals, players decided to investigate the matter themselves after managers and regulators did not respond to their complaints. "No one would listen to us," said Serge Ravitch, a 28-year-old lawyer-turned-poker pro who played a key detective role.

AbsolutePoker and UltimateBet operate out of a shopping mall in Costa Rica, run their games on computer servers housed on an Indian reservation near Montreal, and are licensed by a Mohawk tribe that has no background in casino gambling and does not answer to federal or provincial regulators.

Joseph Tokwiro Norton, who owns both Web sites, is the former grand chief of the Mohawk tribe. He was instrumental in setting up the licensing agency and a highly profitable companion business that owns the server farm. Yet until he issued a news release in October 2007, even some of the most powerful members of his tribe had no idea Norton owned the poker sites.

"I was as surprised as anyone else," said Michael Delisle, the current grand chief of the Mohawk Council of Kahnawake. He added that he had not spoken with Norton about the cheating. "I have had no opportunity," he said in an interview, "and honestly I don't think it's any of my business."

The Kahnawake collect millions in fees each year by licensing Internet gambling companies and hosting the Web sites on servers inside a high-tech building converted from a mattress factory. Recently, they took a 40 percent stake in another Internet server firm on the Isle of Man, in the Irish Sea. They collect more than $1 million a year from that investment, which aims to expand and protect their Internet gambling footprint.

Norton, a former ironworker, purchased AbsolutePoker and UltimateBet in 2006 and folded them into a newly created holding company, Tokwiro Enterprises ENRG. The company says it is "properly registered as a proprietorship in Canada." He declined repeated requests to be interviewed for this article, but has denied he knew about the cheating. Managers at AbsolutePoker and UltimateBet also declined interviews, as did the Kahnawake's licensing and regulatory body, the Kahnawake Gaming Commission.

In January, the commission fined Norton's company $500,000 for the AbsolutePoker scandal. But the apparent victory by the player-detectives quickly soured when the Kahnawake declined to name the cheater or turn his name over to prosecutors.

In September, the panel slapped UltimateBet with a $1.5 million fine. But it stopped short of following through on a recommendation by an outside investigator to suspend or close the site.

The three-member commission largely operates in secret, and it would not disclose the size of its staff. It outsources background checks to a security firm in Horsham, Pa., and uses a small company in Australia to audit its licensee's software. It called on Frank Catania, former head of the New Jersey Division of Gaming Enforcement, to investigate UltimateBet and reopen the AbsolutePoker probe.

In an interview, Catania said there was no comparison between New Jersey and the Kahnawake when it came to oversight. "I don't think they have -- they don't have the staff, first of all," he said. "With the New Jersey Gaming Commission, I had about 400 people there. I had CPAs. I had our big budget."

AbsolutePoker's origins are sketchy. Records and interviews point to a poker aficionado named Scott Tom, who attended the University of Montana in the late 1990s. After graduating, Tom and several partners headed to Costa Rica and started the business.

A number of online gambling sites already existed. But it was not until a few years later that Internet poker exploded. The impetus was a former Tennessee accountant and aptly named player, Chris Moneymaker. In 2003, Moneymaker came from nowhere to win the main event at the World Series of Poker in Las Vegas. His $2.5 million victory was televised on ESPN and is widely credited with igniting a worldwide surge.

"When I am being glib, I refer to it as the Moneymaker effect," said David G. Schwartz, director of the Center for Gaming Research at the University of Nevada at Las Vegas.

Soon, scores of sites began popping up in Antigua, Costa Rica, Malta, the Isle of Man and other exotic locations. The Kahnawake alone license 450 sites run by 60 permit holders. By 2007, Internet gambling sites had revenue of $18.4 billion, up from $5.9 billion in 2003, according to Christiansen Capital Advisors, a New York firm that tracks online gambling.

Thousands of those players found their way to AbsolutePoker, which boasts on its Web site that it has handled more than 300 million hands since it started accepting bets and that at its peak accounted for as much as 5 percent of the multibillion-dollar online poker market.

"It was probably pulling in between $150,000 and $250,000 a day," estimated Bobby Mamudi of the Gaming Intelligence Group, which tracks worldwide gambling issues from England. Hundreds of customer service employees worked at its office in a mall in San Jose, Costa Rica, and at a smaller office in Panama.

Generally, Internet poker is divided into two types of games: cash games in which winners collect the money on the table, just as in a live casino game, and tournaments in which players put up an entry fee and the winning pots are divided based on play. A key difference is that games are played on computers, not face to face. Players cannot see one another to gauge expressions or tics. The online style of play is also faster and more aggressive than that of live games. Some players may have four or five games going at once. Poker sites use a variety of payment methods, including prepaid debit cards, electronic transfers and bank wires.

In addition to tournament fees, Internet poker sites make money from advertising and by taking a small percentage of the pot, called a rake. The rake can be as little as pennies but adds up over millions of pots, industry analysts say.

One of the regulars at AbsolutePoker was Witteles, a former computer scientist whose screen name is "Dan Druff." At 36, he jokes that he is often the oldest player in Internet games. "It's a very young crowd," he said. "Most of them are in their early 20s."

Witteles said he plays almost exclusively in cash games. When he squared off against Greycat in 2007, it was to play Texas hold 'em, currently the most popular poker game, in which bluffing is critical. "So if the other guy can see your cards," Witteles said, "it's a real disaster. I quickly got slammed for $6,000."

Witteles waited for Greycat's luck to run out. But he continued to make one unlikely winning bet after another. Witteles's losses mounted to $15,000. Although frustrated, he didn't yet suspect cheating. And had Greycat not taunted him -- ridiculing his skills in the game's instant-message box -- Witteles said he might have gone undetected. "There was a real arrogance and vindictiveness to the thing," he said.

It is not uncommon in Internet poker for other players to follow the games. Some started to post comments on a popular poker forum about Greycat's improbable winning streak and several other suspicious accounts on AbsolutePoker. Witteles wondered whether Greycat somehow had access to a "superuser" account, which would allow him to use the site's software to spy on his cards. But when he complained to AbsolutePoker, Witteles said, "I got a different story every time."

A few weeks later, in September 2007, a 21-year-old player named Marco Johnson paid $1,000 to enter a tournament sponsored by AbsolutePoker. Johnson, who uses the screen name "Crazy Marco," reached the final against a player called "Potripper." They played 20 hands and Potripper won them all, collecting $428,520.

At first, Johnson shrugged off the loss. But others watching the final games online insisted that he, too, had been cheated. Johnson requested his hand histories for the games. Poker sites generally promise to keep players' archives for as many as five years.

A few days later, Johnson received a confusing Microsoft Excel spreadsheet containing 65,000 lines. At first, he set it aside.

While players heatedly debated Potripper's play in poker forums, the management at AbsolutePoker released the first of several statements denying the cheating allegations. "While we are continuing with our investigation, we have yet to find any evidence of wrong doing," the first statement said. "A super-user account does not exist in our software," stated the second. "Absolute Poker remains a 100% secure place to play."

Players continued to attack AbsolutePoker in online forums, complaining that they could not get answers to their questions or tell who owned the site. A few frustrated players decided it was time to start their own investigation.

Although players can be fiercely competitive during a match, it is not unusual for them to share information afterward. "Most of the top players know one another," said Ravitch, who plays on his laptop from his home in Queens. "If I don't know someone in the seat next to me, chances are I know his friends."

Ravitch is a graduate of the University of Michigan Law School who realized he enjoyed playing poker more than filing legal briefs. "Sunday is my work day," he said. "That's when all the big tournaments are."

Each week, Ravitch said, he averages about 20 hours of play while spending an additional 10 hours studying a large database of hand histories he has compiled, searching for competitors' tendencies. "Poker has become mathematically much more sophisticated," he said. Among the successful participants, he added, "there are no dumb players."

Ravitch offered to help analyze the suspect hand histories. He was joined by Nat Arem, a former auditor in the Philadelphia office of the consulting firm Deloitte & Touche. Like Ravitch, the 26-year-old Arem is good at math and with computers. In 2006, he attended Emory Law School in Atlanta for a semester but dropped out after selling a software program that players use to track the results of poker tournaments. He now lives in Costa Rica, where he develops poker-related businesses.

In the fall of 2007, Arem and Ravitch obtained copies of Marco Johnson's spreadsheet file and started analyzing the data. Arem wrote a software program to decode the information. Joined by a handful of other poker detectives, they quickly identified improbable betting patterns for Potripper and several other suspect accounts. The patterns suggested that the players with improbable win rates could somehow see their opponents' face-down, or hole, cards.

"Obviously, if you can see your opponents' hole cards, you have a huge advantage," Ravitch said. "That helped to explain how the suspect accounts never seemed to lose."

One of the first things the poker detectives noticed was that Potripper was playing exclusively in "nosebleed stakes," games with the biggest pots. "He got caught because it was easy to catch," Ravitch said. "There are only a handful of other players playing those stakes, and everyone knows one another."

Instead of losing a few hands to deflect attention, Potripper continued to win every time. "It would have been so easy if he had just lost a few hands. No one would have ever suspected a thing," Ravitch said.

In addition to hand histories, the poker detectives said, Johnson's spreadsheet contained e-mail and Internet addresses that appeared to connect one of the suspicious accounts to Costa Rica, to a home owned by Scott Tom, the founder of AbsolutePoker who sold the business to Joe Norton in October 2006. When the poker detectives posted their findings on a popular poker forum called Two Plus Two, bloggers pounced on the information as proof that Tom must have known about the cheating, if not have cheated himself.

It was not clear from the information, however, whether Tom used the account or whether someone else may have had access to it. AbsolutePoker officials did not address the bloggers' charges. Instead, they released a statement saying that Tom had not worked at the site for more than a year -- a claim that they would later be forced to retract. In fact, Tom continued to manage day-to-day operations at AbsolutePoker until October 2007, when he resigned as the cheating scandal was heating up.

Norton was "aware of the press releases but did not [initially] realize they were false," the company said in response to written questions from The Post. "The fact that they were misleading, if not outright false, contributed to Joe's decision to change the management" in October 2007. AbsolutePoker officials have said that Tom was not involved in the cheating, but they have declined to say who was. Tom declined requests for comment.

Tom's father, Phil, defended his son in interviews and via e-mail, saying Scott was "attacked viciously and unfairly by bloggers" who tried to link him to the cheating. "I couldn't believe some of the things they were saying, how he was the cheater," he said.

According to his father, Scott Tom is still living in Costa Rica but is hard to contact. "Even I have trouble reaching him," Phil Tom said. "I don't call him. He calls me."

If Scott Tom wasn't the cheater, who was?

The poker detectives kept pushing. By mid-October 2007, they were focusing on an employee at AbsolutePoker's Costa Rica office. They posted their findings online, setting off a new wave of charges and increasing pressure on AbsolutePoker's management and the Kahnawake Gaming Commission to address the cheating.

Shortly thereafter, the commission announced that it had hired Gaming Associates, a small Australian computer security firm, to audit the poker site's software. Two days later, AbsolutePoker released an e-mail acknowledging that it had identified "an internal security breach that compromised our systems for a limited period of time." It added: "The cause of the breach has been determined and completely resolved."

The company's statement did not detail how the breach occurred, how many players were cheated or how the cheater was able to spy on cards without being noticed.

Unbeknown to the players, AbsolutePoker had already cut a secret deal with the cheater, whom it characterized as a "consultant with managerial responsibilities." The company agreed not to release his name in return for a "full and detailed explanation" of how he cheated, according to company officials and other interviews. AbsolutePoker also agreed not to sue the cheater or turn him over to Costa Rican authorities, company officials told The Post.

"Of course we considered going to the police, but we decided that it was in the best interest of our cheated players and of AP to get the perpetrator to tell us how the cheating was done," company officials wrote in response to questions from The Post. "We also recognized that prosecutions for white collar crimes in Costa Rica can be time-consuming and sometimes unsuccessful."

(The name of the alleged cheater has circulated widely among poker players on the Internet. The Post is not publishing his name because, even though he purportedly confessed to AbsolutePoker, the company did not release its records and would not discuss the matter. The alleged cheater declined requests to be interviewed.)

Witteles and other players said they were appalled by AbsolutePoker's decision not to seek prosecution of the cheater. "Yeah, we were paid back," he said. "But they made absolutely no attempt to bring any of the people to justice. If someone stole that amount of money from a casino, they would be thrown in jail."

AbsolutePoker said it fired the cheater on Oct. 20, 2007, the day before it started sending $1.6 million in refunds to the cheated players. "Our previous business culture was entrepreneurial, decentralized and individualistic," company officials wrote The Post. "In retrospect, this decentralized approach was not conducive to strict oversight and accountability." The company says it "installed a completely new management team" in order to "build a solid security foundation."

In January 2008, the Kahnawake Gaming Commission released a four-page report on the AbsolutePoker scandal. It said a single cheater using several screen names had taken advantage of a flaw in the software to spy on players' cards during a six-week period starting in August 2007.

It fined Norton's firm $500,000. But it also declined to name the cheater, contending that there "would be no material benefit to the affected players."

"I don't know about that," said Frank Catania, the former New Jersey gambling official who helped the Kahnawake write their Internet gambling regulations, and who was hired by the commission last summer to investigate Norton and his poker sites. "Maybe what they should have done is named the person."

A day after the Kahnawake commission released its report about AbsolutePoker, managers at UltimateBet were alerted to new allegations of cheating involving a player using the screen name "NioNio."

One of those who had played against NioNio was David Paredes, 29, a Harvard graduate and lawyer-turned-hedge fund employee. As a childhood math whiz, Paredes had been good enough at chess to travel to national tournaments. In high school, he and his friends played poker for as much as $100 a game. During breaks from law school at New York University, he played at the Foxwoods Resort Casino in Connecticut and in the city's network of underground clubs.

Paredes started playing online around 2005. "I made money almost from the start," he said. Over time, he said, he used his winnings to pay off his law school bill, rent a Manhattan apartment and pay private tuition for a high school student he mentors.

In July 2007, Paredes lost $70,000 to NioNio in a series of games. NioNio had played recklessly, Paredes recalled, making one improbable bet after another, yet winning most hands.

Paredes said he did not suspect cheating until he discussed his hands with another player who also had lost to NioNio. They did a statistical analysis of hand histories, and what they found shocked them: During one brief stretch, NioNio had managed to win $300,000 while rarely losing. Another poker detective calculated that his win rate was about equal to winning the Powerball jackpot three days in a row.

Moreover, it appeared that NioNio was not the only unusually lucky player. Their investigation turned up seven other suspicious accounts that had won a total of $1.5 million on UltimateBet. Later, UltimateBet officials determined that the cheaters had used as many as 88 screen names to avoid detection.

It was as though the cheaters were playing against a "bunch of blind men," Catania recalled. "I mean . . . you're the only one that can see. Everyone else is blind."

In news releases, UltimateBet said that former employees had secretly installed a back door in the software allowing them to spy on players' cards. They stressed the gaming commission's finding that the breach took place before Norton bought UltimateBet in 2006 through a limited partnership in Malta called Blast Off Ltd.

The company told The Post that it performed full financial and operational due diligence before the sale but that it did not find the unauthorized software. Catania, the outside investigator, said that UltimateBet officials did "no due diligence on the technical part. None." At the same time, he said he did not think Norton was aware of the cheating.

UltimateBet officials acknowledged to The Post that the "winning-hand statistics were certainly suspicious and should have been flagged for investigation." They said the accounts belonged to professional players who had been designated as VIP players by the prior owners, and as such were not subject to the same level of scrutiny as other accounts. They added that they did not review the VIP accounts until after the cheating allegations surfaced.

Citing what they said were UltimateBet player logs and real estate records, some of the poker detectives this summer linked former World Series of Poker champion Russ Hamilton to the scandal. In online posts, they alleged that several of the suspect accounts were traced back to property Hamilton owns in Las Vegas, where he is based.

Hamilton did not respond to the accusations. In September, the Kahnawake Gaming Commission announced that there was "clear and convincing evidence" that Hamilton "was the main person responsible for and benefiting from the multiple cheating incidents" at UltimateBet.

The commission did not disclose its evidence allegedly linking Hamilton to the cheating. But Catania said the player accounts "point directly to Russ Hamilton." He added that six to eight accounts were involved in the cheating. "And we know Russ Hamilton was . . . part of those accounts."

Hamilton's lawyer, David Chesnoff, scoffed at the accusations. "Have I heard these allegations? Yes," he said. "We deny them." He added: "Without having an opportunity to review what is alleged to exist, we can't answer the questions and don't think we should dignify it with answers."

In a statement, UltimateBet's owner, Tokwiro Enterprises, cited the commission's finding that Hamilton was responsible for the cheating. The company noted that Hamilton "was never employed by Tokwiro or any of its companies," though he briefly had a "relationship" with the company in which he referred players from his Web site to UltimateBet.

To date, UltimateBet has issued $6.1 million in refunds. Catania said the poker site has promised to reimburse players an additional $15 million, at which point he expects UltimateBet to lose its license or be sold.

The gaming commission fined UltimateBet $1.5 million "for its failure to implement and enforce measures to prohibit and detect fraudulent activities." It defended its handling of the case but said its actions "were not well communicated to the poker industry or public at large, creating an incorrect perception that the [commission] was doing nothing."

The Kahnawake now say they operate one of the most secure Internet gambling operations in the world. Tokwiro says it has "established cutting-edge security systems that make us the safest site in the industry." But Catania said he does not expect cheating to stop: "I'm sure there are people out there right now figuring out, let's say, 'Here's a way we can do it again.' "

Steve Kroft, Ira Rosen and Sumi Aggarwal of "60 Minutes" and special correspondent Gary Wise contributed to this report.