If you discover a reproducible flaw in a blackjack game -- the card shuffler at a certain table isn't random -- is there a penalty for that? Because just having a computer in the mix doesn't seem like it really changes the moral equation.
Blackjack already has a reproducible flaw, it is called card counting. It is not illegal, but casinos frown upon it and often ban people who are suspected of card counting. I would argue that noticing and exploiting a flaw in the blackjack card shuffler falls along the same lines. You are using meta-knowledge to reduce the house edge. But this is not what Kane did, he didn't alter his chances of winning, he altered the payout.
The real argument is not if pushing the buttons in the right order is cheating, but is it hacking? That issue seems to come down to whether or not there was an escalation of access. Did those button presses give him unauthorized access to data? He exploited a flaw to alter the payout of the game, and that is at the very least fraud. If we are using your blackjack analogy this is like he somehow Jedi mind tricked the dealer to change the payout for a 21. If I used a software exploit to get a bank computer to double my money I have no doubt that would be seen as hacking. So how is the gambling machine different?
"Now when Kane returned to Triple Double Bonus Poker, he’d find his previous $820 win was still showing. He could press the cash-out button from this screen, and the machine would re-award the jackpot. Better yet, it would re-calculate the win at the new denomination level, giving him a hand-payout of $8,200."
To me it seems analogous to placing a $1 bet on a table game, then swapping the $1 bet for a $10 bet if your wager paid out. That kind of cheating/fraud is fairly commonplace (and dealers are trained to prevent it).
That doesn't sound too different from finding and exploiting a bug in an online bank.
If e.g. someone found a way to log in as other users, that would reflect poorly on the bank's security, but it wouldn't entitle them to withdraw all the money they could access, even through "a sequence of buttons that they were legally entitled to push."
I think categorizing it as hacking makes sense in that light. The issue seems to be that the current laws treat hacking as an exotic crime with federal scope, which makes the legal cases a bit quirky.
I agree, now that I think about it. Claiming the reward is based on winning the game, but the payout is due to a bug (which the casino is not aware of) and not a win, so it is a deception (fraud).
When I was a teenager, an ATM once reported my checking account balance had a few extra thousand dollars in it. Withdrawing that money would be fraud, even though it was a computer error. Luckily I was not a stupid teenager and I left it alone. The next day it was back to the correct value.
FYI - gaming regulators in different states deal with card counters in different ways. In NV, the casino is allowed to ask you to leave and ban you from the casino. But, not in NJ. in NJ you cannot be barred from a casino for counting cards. The casino can shuffle the deck after every hand to make the game fair again (or unfair in the right way).
Not that I agree with it in the slightest but when incrementing sequential user IDs on a website is "hacking" then the courts will find this is "hacking" just the same.
