JEANNE VAN DER MERWE

National lottery operator Gidani insisted this week that it had been unfairly fined R7.5m for a security breach and that its lottery security systems were sound.

In a statement, the company’s spokeswoman, Thembi Tulwana, denied that there had been any security breach and said the theft was “not a case of systems’ failure but an act of betrayal of trust, a criminal act”.

“That is why Gidani called for internal disciplinary processes to be instituted and for a charge of fraud to be laid with the South African Police Service,” she said.

Gidani said its own security systems had picked up the theft. But evidence leaked to Media24 Investigations shows that this was only after three months, during which time the culprit was able to make off with R250 592 in unclaimed prize money.

Tulwana said: “We pleaded that we should not have been found guilty and fined anything in the first place, but in the end elected to live with the eventuality of paying R7.5 million with an equal amount suspended for two 2 years. We still thought that the ultimate penalty was stiff but there had to be a conclusion.

Lotteries Board spokesman Sershan Naidoo said Gidani’s initial fine of R15m was halved and the other half was suspended for two years after Gidani appealed and presented mitigating factors.

“The board is comfortable that the breach was not severe enough for the licence to be revoked, although that option was initially considered,” he confirmed.

Tulwana denied claims made in Board meetings that Gidani had initially not wanted to report the matter to police, but had only done so after obtaining legal advice that any theft of more than R100000 had to be reported.

Tulwana admitted that R250592 was stolen, but had been repaid into the trust fund holding the prize money.

Asked whether any special circumstances had existed within the local Gidani/Intralot operation which could have made a breach possible, she responded that “all security controls are already embedded in the system and have been implemented in South Africa from the first day of the lottery operations”.

However, she did not deny assertions made in board meetings that the theft had followed two audits on Gidani and Intralot’s systems which identified security concerns.

She said that Gidani had “thoroughly considered their findings and recommendations and implemented the recommendations where such interventions were not in place already”.

Yet the rogue IT manager started forging the tickets a mere two months after the last audit had been done, and in Lotteries Board meetings board members found parallels between vulnerabilities the auditors had found and aspects present within Gidani and Intralot’s systems that had made it possible for the employee to steal the money.

In board meetings, Lotteries Board members also expressed concern over whether similar breaches might have been possible in Intralot’s overseas operations, but Intralot’s parent company in Greece referred questions in this regard back to Intralot SA.

The Lotteries Board confirmed this week that it was satisfied with the steps Gidani took after the fraud was discovered.

Asked whether the incident would influence Gidani’s future chances to qualify for a lottery licence, Naidoo said the decision was made by the Minister of Trade and Industry and “each application […] is considered on the merit of the information in the application”.

He said Gidani – whose licence expires in 2014 – “regularly appraises the Board of the status of the SAPS investigation” into the fraud.

Intralot SA’s CEO – also the chief operating officer of Gidani – Yannis Rondiris, referred all requests for comment to Gidani, which said that the Intralot systems in use conformed to international industry standards.

Gambling law expert Wayne Lurie said: “I don’t think that R15m or even R7,5m is a trifling amount of money in anyone’s terms and in simple terms and a ‘fine’, as a penalty, is meant to be ‘felt’ in order that, amongst other things, the party fined is circumspect of their conduct the next time around.

“I think ultimately it seems pretty certain that the operator allowed an unacceptable situation to develop within its employee base, which led to the theft. Whether the operator took ‘adequate steps’ in terms of the law to prevent the theft was a matter for the board to determine and it seems to have determined that the operator had taken adequate steps to avoid the revocation of the licence, something with major ramifications for the public at the end of the day.”