Cigar Aficionado

David Paredes put himself through law school by playing online poker. After landing a plum job in the financial sector, he continued to play, and profited nicely. Despite viewing Texas Hold'em as an avocation, Paredes soon dominated some of the highest games on the poker site UltimateBet.com.

During a good month, he'd win $100,000. If things went horribly wrong, he'd drop $30,000—nothing too earth-shattering. But after blowing $150,000 in August 2007, he understandably felt a little stung. To make matters worse, Paredes lost to an opponent who played like a stone-cold fish and seemed eager to blow off his chips as efficiently as possible. Logged in under the name NioNio, he played a weak style of poker: way too loose, way too aggressive. It was a recipe for disaster. Long-term, it seemed virtually impossible for NioNio to win. Paredes figured that the guy had gotten obscenely lucky against him.

Chatting online with another high-stakes internet poker wizard, a player who goes by the name trambopoline, Paredes bemoaned his recent spate of losses. Trambopoline had similar experiences—and similar results—against NioNio on UltimateBet. ing forces, the two players decided to delve deeper into NioNio's play. "I'm a big proponent of using statistical analysis to get better," says Paredes. "So I suggested that we go to the software."

Employing a program called PokerTracker, he and trambopoline were able to see 3,000 hands that they had played against NioNio (too small a sample to prove anything definitively, but big enough to provide some answers as to what was happening). On one level, it promised to be an intellectual exercise; on another level, there was a small chance that NioNio was doing something special, something that the high-stakes players could learn from.

As they scrutinized the hands and took apart NioNio's strategy, unusual patterns emerged. "He was playing 65 percent of his hands and raising 35 percent of the time," explains Paredes. "Most good players play 25 percent of their hands and raise 18 percent of the time. It may be impossible to win by playing as loosely as he was. He was winning 75 big blinds per hour. Most good players would be happy to win five."

Clearly, more scrutiny was warranted. So the players analyzed specific hand histories and individual pots. Here's where it got really creepy. "Every time trambopoline had a good hand, NioNio folded," recounts Paredes. "Often when trambopoline bluffed or was on a draw, NioNio re-raised. He check-called on [his own] draws." NioNio was either uncannily skilled at reading online opponents, incredibly lucky or doing something more sinister.

The more sinister scenario seemed glaringly possible in light of an incident that had taken place months earlier on a site called AbsolutePoker.com, which is owned and managed by the same entity as UltimateBet. A tournament player seemed to be operating with an extraordinary degree of luck, cleaning up in the events and doing it so aggressively that he called a lot of attention to himself. It became clear that he had some kind of backdoor entry into AbsolutePoker, and was able to see his opponent's cards. That player's run lasted six weeks. Absolute refunded money to people who were cheated (the company paid out $1.6 million, awarding the victims twice the amount of their losses) and the perpetrator, at the time a consultant of Absolute with some managerial responsibilities, was neither prosecuted nor exposed. In exchange for anonymity, he explained to Absolute executives how he did what he did, and he assisted in finding players who had been victimized.

The perpetrator of that scam was clumsy and greedy. NioNio, on the other hand, if he was cheating, did it in a cagey way. "Sometimes he would call with the worst hand," says Paredes, who believed early on that something was amiss. "The Absolute guy always raised or folded on the river."

Paredes and trambopoline posted their findings on twoplustwo.com, a bulletin board frequented by online players. (It's the Internet entity of the respected book publisher 2 + 2, co-owned by renowned poker theoretician David Sklansky.) Both Paredes and trambopoline are frequent posters to the site, and they have high credibility among online poker players.

On January 8, 2008, when their suspicions went up on the site, they expected at least a show of curiosity from fellow players. Instead, as Paredes puts it, "We got ripped by the community. They thought we were crying over spilled milk. People pointed out that NioNio lost some hands. I now think he had to call sometimes with [inferior holdings] so it wouldn't look like he was folding [good hands that happened to be second best]."

Very quickly, however, the tone on the site changed. Players began posting their experiences against NioNio and others who exhibited similar patterns. As evidence built, it became increasingly difficult to attribute NioNio's success to luck or superior poker skills. "You know someone's cheating when you miss your flush draw and bet with, say, Queen-high on the river and a guy calls you with King-high," says Nat Arem, vice president of information technology at a company that runs Web sites, who did some of the later detective work. "That can happen once or twice for a lot of different reasons. But if it happens 10 times, something is most definitely wrong."

One day later, a poster by the name of Michael Josem ran the numbers and came up with the probability of NioNio winning at his extraordinary rate. Josem pointed out that NioNio operated at nine standard deviations above the mean. This would be the equivalent of winning three consecutive one-in-a-million lotteries. Within three days, it became clear that at least $600,000 had been heisted from the stacks of UltimateBet's legitimate no-limit Hold'em players. What nobody realized was that the six-figure amount was just the tip of the iceberg. It has recently been estimated that UltimateBet's high-limit players have been scammed out of a sum that exceeds $6.1 million.

Paul Leggett, chief operating officer of UltimateBet, says he found out about the cheating on January 12, after receiving "a complaint from a customer." A couple of months after the original discovery, he issued a press release, acknowledging his awareness of the scam.

"I've been told that it was [built around] a dormant auditing tool," he says, speaking to me via telephone from a hotel room in Vancouver. The tool in question was a piece of software that creates a so-called super- , which allows the to see players' hole cards in real time. "The super- viewed hole cards and another sat at the table and played." When you can see your opponent's cards, the biggest challenge is to not get greedy and to not arouse suspicion. Winning money is a given.

For all the success that the cheaters had, their execution is not technologically outré or inventive. It's simply a modernized version of the old-fashioned peeps that served the exact same purpose. Somebody would drill a hole in a hotel room ceiling, outfit it with a lens, signal a confederate in the game and fleece unsuspecting victims. Leggett says that the primary perpetrator—who, according to an investigation headed up by Catania Gaming Consultants, has proven to be 1994 World Series of Poker champion Russ Hamilton—was involved with UltimateBet at a high level when it was under previous ownership. (The current owners, who hired Leggett, purchased the site in October 2006.)

Leggett says that the scam was perpetrated with 19 s and 88 names—such as Sleepless, NoPaddles and nymobser. "Because [these people who pulled off the scam] used to work for the company, they knew how to move money around. There was a complex web of money movement." Complicating things further is a $75 million lawsuit, related to the cheating scandal, that came to light as this issue was going to press. According to MSNBC, Blast-Off Ltd., a Malta-based company that has an ownership stake in UltimateBet, is suing Canada's Excapsa Software Inc., which formerly owned and licensed UltimateBet's poker software. For Annie Duke, a poker pro who's had consulting deals with UltimateBet almost from its inception, the fact that large sums of money changed hands on the site without arousing suspicion was symptomatic of a systemic problem. "People would break rules on the site"—often relatively small rules, like letting loose with offensive chat—"and if they were big players, the site would let it go," she says. "Rules applied differently to some people than they did to others." Duke says she argued for everybody to follow the same rules, and she says that if equality had been part of UltimateBet's DNA, cheating would have been much more difficult to pull off. "Huge sums of money were transferred, and they should have been investigated. But because the person doing the transfers was a friend of the site, they did not get looked at. That should have raised red flags." And the red flags, in turn, would have led to a closer look at how those large sums were generated. But because Hamilton had a longstanding affiliation with site management, scrutiny was dispensed with.

The flouting of rules allowed the scam to run smoothly for almost three years. And if not for a chance conversation between two disgruntled players, none of this would have even come to light. How does Leggett feel about the customers who policed his site in this manner? "It was impressive," he allows. "The people who uncovered this are some of the smartest people I've ever met."

Nat Arem resides among that brainy contingent. As news of the cheating spread, Arem used s in the industry to find real identities behind the screen identities. Long before the recently completed investigation that placed Hamilton at the center of the scam, Arem began naming names and going public. Hamilton (who declined to be interviewed for this story), at the time, denied it vociferously. Leggett vows that Hamilton will be prosecuted to whatever degree possible. That ambition may prove to be a little tricky since online poker remains unregulated in the United States. Considering that Arem had long-ago uncovered damning evidence that pointed toward Hamilton, few in the poker world are now surprised that Hamilton is the primary culprit. More unexpected is that he has been publicly named. Prior to the revelation, players speculated that a fall guy would be paid to take the rap. Others believed that Hamilton's identity would never be officially exposed for reasons best understood by Leggett. Why UltimateBet would have super- s, which allow access to hands in real time, is not exactly clear. "Some people say it was designed to monitor what is going on while hands are being played," says Arem. "Some people say it was designed for cheating in the first place. Some people say that it was designed for development."

Whatever the original purpose, it evolved into a serious liability for the new owners of UltimateBet. Once it became clear what had been perpetrated and the damage that it could inflict on the company's reputation, Leggett took action. His first step was an attempt to resolve the problem. "We went on a three- to four-week rampage to find the code that allowed this to happen," he says. "We eventually found code on the server for a specific that was getting information."

The code was dismantled. But it still left UltimateBet with a number of damaged, angry players. Hanging in the balance was the site's credibility. The scandal ran so deep, and was so destructive, that it jeopardized the very existence of the company. If UltimateBet was a rogue site, why would anybody play on it? In an effort to rebuild the site's reputation, Leggett vowed to make players whole. "We are refunding everything that players on our site lost to the cheaters," says Leggett. "But if you won a pot, you don't get to keep the cheater's money. We are refunding net loss."

It's a complex, arduous process, but players have found funds added to their online s. David Paredes and trambopoline received six figures between them. Daniel Alahi, who's best known as a live-game cash player, logged many an hour on UltimateBet. He says that during 2005 and 2006 he played virtually every day. He knows that he has been cheated. More specifically, he re a particular hand, against one of the cheaters playing under the name Blueberry101. On the turn, Alahi over-bet the pot, pushing all in for $25,000 while on a straight draw with a raggedy board. The idea was to induce Blueberry101 to fold. But when the cheater called with deuces (because he was able to see Alahi's cards and knew he had the best hand), Alahi re telling himself, "Wow, this game is really good." He now knows that it was really crooked.

Despite coming up against the cheaters, Alahi says, there were enough inferior players in the games that he managed to clear a profit. While he's waiting on money, Alahi points out that what transpired with cheating on UB has repercussions that extend beyond cash lost. "When you lose, you question why you're losing and you make adjustments in your game," says Alahi, explaining that players do that because they think their approach to poker has ceased working. So, under those circumstances, you not only lose money in the short run, but your style of play can deteriorate in the long run. Citing the psychological impact, which, for a poker player, can easily lead to a financial impact, Alahi adds, "It affects you as a person and really messes with your head. Your poker-playing abilities can be damaged, and it can change your life completely. I know of people who lost everything [to the cheaters] and had to quit playing poker. That's just wrong."

Alahi, like most pros, has not stopped playing online poker. But he's moved to FullTilt, a site he considers to be more secure than UltimateBet. He recognizes that in online poker, as in every financial arena, nothing is 100 percent fail-safe, but he'll live with what he views to be minimal risks. Chris "Jesus" Ferguson, the computer scientist turned poker player who helped develop the software used on FullTilt, agrees that a perfectly safe poker site is too much to hope for. But he says FullTilt has gone to great lengths to avoid a situation like the one plaguing UltimateBet. "We do not have super- s, and that was very intentional; anything you can do in real time, you can do two minutes later," says Ferguson. "At FullTilt there is a very thick wall between player knowledge and people who play on the site. We use the same encryption that banks have." As for UltimateBet's super- , Ferguson adds, "To me, whether it was well intentioned or not, it's a design flaw."

That said, as can be seen from UltimateBet's efforts to pay back every- one who's been scammed, online poker, by its nature, has transparency and a way to backtrack through history. "If you had been cheated in the stock market or in a brick-and-mortar casino," says Annie Duke, "it would be very difficult for you to be made whole. UltimateBet is behaving as if it were regulated, and its management is doing the right thing—not only for UB but for online poker in general."

Not wanting to see his company completely disintegrate, which could happen if this situation repeats itself, Leggett says he is doing everything he can to prevent nefarious deeds from transpiring again. He acknowledges that the site had been lax in the past, and maintains that he has since "built layers of security" into his system. "We've had gaming mathematicians help us design a solution that will catch people and flag abnormal winning statistics. If you go on a big run, you now get flagged and we look at the hands. We built a sophisticated program that is probably leading the industry, and we are sharing specifications of what we built." Leggett hesitates for a beat, then dryly adds, "Not that any site will want to claim that they are working with us on security."

Alahi says the vulnerability of UltimateBet was further exacerbated by the site's unusual policy of allowing customers to play under multiple names and to change those names frequently. At most sites, limit- ing participants to a single name helps ensure that players know whom they are going up against. Had the cheaters been unable to alter their names, and appear to be untested players without patterns, the scam would have been much harder to maintain. That weakness, according to UltimateBet, has been resolved.

Regardless of what UltimateBet does to make its site more secure and to compensate those who've been cheated, it's hard for some players to get beyond what's happened. Alahi points out that people who've lost money over the years are using the cheating scandal as a way to explain inferior play. "I know really bad players who now think they got cheated, and that's ridiculous," he says. "For everyone who was break-even or slightly losing, and figured that online was a waste of time anyway, this is the perfect excuse for them to quit. It makes the games tougher for me."

Even winning players are thinking twice about what they're getting involved with. Alahi acknowledges that he is "now more aware of what is going on." Paredes, a big winner online who is not a pro, finds himself cutting back. He says he hasn't played on UB since the scandal broke. He says, "I keep less money in the sites than I used to. I worry that these companies may one day run off with the deposits. You never know what can happen. One day Neteller [the money transfer service that players commonly use] shuts down. You need to be careful." When it comes to online poker, he says, "You need to anticipate scenarios that you can't anticipate."

Michael Kaplan is a Cigar Aficionado contributing editor.