Casinos are at greater risk of cybercrime

David Strow

Friday, Nov. 30, 2001 | 3:53 a.m.

Las Vegas' famed resorts haven't been victimized by cybercriminals yet.

But Lt. Steve Franks, head of Metro Police's financial-crimes unit, figures it's only a matter of time. To draw that conclusion, he recalled the words of Willie Sutton.

Decades ago the notorious criminal was asked why he robbed banks. Sutton replied: "That's where the money is."

"It's a matter of time, because where's the money (in Las Vegas)?" Franks said. "If you want the money, the casinos are where to go."

And there are those who have tested the electronic locks, a casino security chief said.

"There are always people trying to get into the system to see if they can do it," David Shepherd, Venetian security director, said.

It was a battle police and casino security directors were fighting well before the Sept. 11 attacks. But it's a battle that has taken on added importance since the deadly attacks.

Investigators have found that terrorist "sleeper cells" were largely self-funding, Franks said, and used credit card fraud and theft to finance operations.

Since Sept. 11, Congress ordered the Secret Service to form task forces to combat cybercrime and cyberterrorism. One has been formed in Las Vegas, and on Dec. 6 agents on the local task force will speak at a casino security seminar at the Orleans.

Carter Kim, assistant special agent in charge of the local Secret Service office, said his goal is to make contacts with the gaming industry before incidents happen.

Electronic threats to a casino can come both from internal sources -- for example, employees -- and external hackers, Kim said.

But Kim declined to go into specifics about the Secret Service's plans for fighting cybercrime in Las Vegas.

"If something should happen, we're ready to take steps in a quick and efficient manner," Kim said. "We just want to get everyone on the same page, basically."

"There have been some incidents here," Kim added, without elaborating.

So far, cyberattacks in Las Vegas have been aimed outside the casino industry, Franks said. In one case, a hacker broke into a credit union's computer system. Five separate banks were affected before the hacker was caught three hours later, Franks said.

In another case, a hacker broke into doctors' computer systems and stole patient lists, Franks said.

"Once you take that, you have the credit card (numbers), and everything you need to do identity assumptions," Franks said.

Within casino systems, there are a wealth of records that contain similar information for gamblers and employees. Business plans and high-roller lists can also be targets of industrial espionage, Shepherd said.

But the risk for casinos goes beyond stealing cash or information. There's also the risk of outright sabotage, especially since much of a resort's operations are controlled by computers.

"The degree to which you could do malicious things if you get access to networks ... is almost unlimited," Las Vegas gaming attorney Tony Cabot said.

"We're not just talking about cash, but some really malicious things that can affect people's health. Imagine someone getting into a water-processing unit and changing the amount of chlorine in the water.

"If you worry about bombs, you have to worry about the security of your network systems."

Saboteurs might have blackmail on their minds as well, Franks said.

"If I can make an elevator shut down at a hotel on New Year's Eve, how much would they (resort executives) pay to get it turned on again?" Franks said.

The risk of sabotage also makes disaster recovery important, Shepherd said.

Backing up computer records by companies based at the World Trade Center didn't work unless the information was backed up on networks in other locations, Shepherd said.

"Then you have to have security at the offsite network," Shepherd said.

But Shepherd said Las Vegas casinos are prepared. When it comes to security on the Strip, all thoughts of competition go out the door.

"This is not something where you try to keep secrets from each other," Shepherd said. "How can you protect your place if you don't protect the entire city?"