Gaming with smart cards

published: Tue, 30-Sep-2003   |   updated: Sun, 23-Jul-2006

I subscribe to a few news sources via AvantGo on my Sony Clie. There was one articlefrom Wired recently that made me think that some people in the gaming business Just Don't Get It. (By the way, that's gaming as in gambling, not as in playing deathmatch Halo with three friends.) Here's the quote:

In a speech laying out his vision of the "casino of the future," American Gaming Association president and CEO Frank Fahrenkopf argued that by 2020, gambling institutions won't be doing business in cash.

Instead, Fahrenkopf suggested that technologies such as smartcards will be at the heart of casino loyalty programs. Because cards can hold large amounts of player data, such as preferred games or spending habits, he said, casinos would be able to use the information to offer more personalized service to players.

Although the first part has a some ring of truth to it, I dare say that the lure of gambling with real money (that is, untraceable) would mean that you'd still get action on the tables without a player card. (Don't ask me what's fun in gambling though: although I worked for a year in Las Vegas, I didn't gamble on the tables once.) As for slots, sure, I can see the day when you don't put bills or coins in.

The second part, however... I would venture my opinion as this is a load of bollocks. During my time working for Aristocrat Technologies, Inc, every now and then we would get the "why don't you support smart cards" spiel.

A little background first. Nowadays, when you visit a casino, you are encouraged to join their player's club, for which you get a card. It's a magnetic stripe card, much like your credit cards. In bulk, they cost proabably 5 cents each. The card's stripe contains, in essense, two items of information: your name and a (fairly) unique player id. The casinos give these out like jellybeans.

So you have a card. You use it in a slot machine. the machine says "Hi, Julian" in its tiny little display. Wow, cool, you think. Actually, no: your name is being read off the card, big deal. Meanwhile the slot machine is sending (via serial communications at 9600 baud, wowee, feel the heat) your player id — also read from the card — to the casino's CMS (Casino Management System). The CMS recognizes your id. hopefully, and sends back a packet that contains the number of points you've earned (these points can get converted to extra goes on the machine, or for hotel bills, or whatever), and lo, the slot machine displays a message in the timy display saying you have 5000 points, and, oh, it's your birthday, etc.

It's great, it works, and in general the punter is unaware that this is going on in the background. In the future, the serial comms will eventually go by the wayside, along with the funny little screens, and high-bandwidth network cable will be laid to each slot machine. The communications will be faster, and, if anyone in the CMS industry actually understands how to write software, the systems will get faster as well.

Where in this does the smart card fit? Practically nowhere. There's no point in being able to store a whole bunch of data on a card. The system already has it anyway. Why put it on a card that hackers can break into perhaps and dupe? Although duping a mag stripe card is simplicity itself, it doesn't get you anywhere: you'll have two cards accessing the same player information. (Yes, you could steal someone's card and dupe it and extract out his points and, uh, you still have the original card so why bother duping it...) The system having the data makes it more secure (ignoring other types of attacks against the system). Smart cards are more expensive than mag stripe cards as well; after all, they've got a chip onboard.

Frank might argue that having a smart card with all your gaming info on it means that you can go from casino to casino. Hello? You earn 10,000 points in casino X and casino Y is going to let you spend them on its floor? Absolutely, sure, whatever. If they do, it'll be because they have the same corporate parent (and hence their casino systems will be linked).

OK, then, Frank says, what about your preferences? Sorry, Frank, wrong again: the casino's system holds that kind of stuff in excruciating detail. Casinos can see how much you gamble, when, and on what machines. With downloadable games, they'll be able to track which ones you like and how long you play them. The waitresses will enter your drink preferences into the system. The casinos will use the information to market to you (they do this now). Putting that information on a card is just plain stupid from their viewpoint: if it's there they can't analyze it, so they won't put it there.

Already there is a growing movement away form cards by the gaming public. The reason? The IRS. You have to pay taxes on your winnings, remember? If you gamble with your player card, the casino is storing how much you won, when, and how. Already they're supposed to report your winnings of over $3000 (or whatever the limit is, I forget); and mostly they do. What if the rules are tightened? After all the Bush Administration is way in the red; taxing more gaming winnings could be a nice little earner.

So smart cards? Nah. They're great for authentication because you can encode a unique unfakeable digital certificate onto them (Microsoft use them for its employees to log in remotely; we all get smart card readers for our home PCs), so I can see the casino employees having them. But punters? Come on.