How a Bookmaker and a Whiz Kid Took On a DDOS-based Online Extortion Attack PART II

100% Sign Up Sportsbook Bonus

WAGERWEB BONUS CODE: AF4517

Hackers create zombies by scanning for exposed systems that they can manipulate remotely. Often these are home and office broadband users. (Lately, existing bot networks have been found scanning for more computers to turn into bots when they're not launching attacks of their own—akin to an army recruiting its soldiers in peacetime. One security consultant said he connected an unsecured computer to the Internet to see what would happen, and it was recruited within three minutes.) Hackers can also insert their attack code through phishing, spyware, viruses and social engineering. Universities have long been popular spots for creating zombies because of the number of easily accessible, unsecured public computers. With a zombie network in place, the only issue left is scale. The more zombies on a network, and the more aggregate upstream bandwidth they have, the swifter and more severe havoc they can wreak. Several hundred computers could generate 100MB of traffic, enough to knock a small network offline. A 10,000-computer bot network could deliver a 1Gb attack, enough to knock anyone offline who hasn't installed some rudimentary anti-DDoS infrastructure. Some experts believe that right now different sets of hackers are engaged in an arms race to see who can build the biggest zombie network. Not for bragging rights, but for renting out the networks to anyone who wants to launch an attack, the raw capitalist idea being that the biggest network will generate the best rental business. Tuesday, Nov. 25, 2003: Running Out of Time The extortionists' e-mail that arrived on this morning demonstrated that they were losing whatever patience they had: [all typos sic] "I told you that if you try and f*** with us that your site will be down forever.... The excuse that you were in the hospital does not matter to me. So here are your choices: 1) You have until 4pm est today to send us our $40K. 2) You have until 4pm est Wednesday to send us $50K if you can not send the $40K today. 3) You do not pay and your site will be down for 4 days starting Thursday and it will cost you $75K to come back up Monday. 4) You do nothing and do not respond to this email within an hour and we will make sure you are down forever...." Richardson was panicked. He can't remember precisely when—the entire week has blurred in his memory—but by this time, he had reported the crime to the National Hi-Tech Crime Unit (NHTCU) in Scotland Yard. According to an NHTCU spokeswoman, the unit had already opened a similar investigation with a British gaming site called CanBet.
According to Richardson and Lyon, the NHTCU encouraged Richardson to wire two extortion payments of a few thousand dollars each to separate Western Union offices in Eastern Europe. The NHTCU wanted to nab anyone who showed up to take the cash. (NHTCU won't confirm this; the spokeswoman said the unit does not discuss investigative tactics.) Richardson agreed, but for a different reason: He wanted his site back up. "I knew another person [in the industry] who was successful getting back online by sending three or four small payments like this," Richardson says, "and those guys didn't even have a solution to the problem when they paid. I knew Barrett was getting closer and closer to a solution. So I sent the payments, thinking maybe I can get a good week out of this." But no one took the bait. After about two weeks, Richardson pulled the money back. Wednesday, Nov. 26, 2003: Barrett's Big Bet From Sacramento, Lyon instructed the PureGig engineers who would turn on his system 630 miles southeast, in Phoenix. Another 2,400 miles southeast from Phoenix, everyone at BetCris waited impatiently. Lyon's system intercepted traffic headed for BetCris's servers in Costa Rica, diverted it to his creation in Phoenix, scrubbed off the attack traffic and delivered legitimate traffic back to Costa Rica. It was designed to bar DDoS traffic from touching BetCris. If the system failed, it couldn't defend BetCris, and it wouldn't be able to send legitimate traffic to Costa Rica. But BetCris itself wasn't getting attacked. The system did a lot of other stuff too: monitoring, capacity planning, logging and analysis. It wasn't perfect. After it was installed, Lyon had to tweak routers on the network, install new versions of software and add capacity to his system. The extortionists kept changing attack vectors, and Lyon and his team kept tweaking. It was a constant battle, but Lyon was confident that the system would enable BetCris.com to stay online. Wilson at PureGig called Lyon's system "ingenious" not because it was unique—it was monitoring and filtering at a proxy location—but because Lyon's monitoring and filtering seemed to stop attacks better than any other effort he'd seen. But when it was first turned on, the extortionists stuffed too much traffic down its throat. Wilson recalls the math: "We had 100MB links to the DNS servers. We went from handling under 2MB per link to, all of a sudden, 600MB." That's six times a full load. Imagine Fenway Park, which holds about 35,000 people. Now imagine 200,000 people trying to get inside Fenway Park at one time. The DNS servers were overloaded, and Phoenix got tense. Costa Rica had been tense for nearly a week (as much as half a million dollars in lost revenue), but now BetCris was bordering on despair. Mickey Richardson lacked sleep, and he struggled to make decisions and lead. His IT staff was fracturing, feeling impotent as they watched the attacks and waited for Lyon. BetCris's small call center staff was getting abused around the clock by customers calling in to vent frustration and demand to know what the heck was going on. The simple task of creating a smart message about what was happening eluded Richardson. "You can't just have your call center staff tell people you were hacked," Richardson says, because it creates more questions than answers. At the same time, his decision not to pay the extortionists was affecting other wagering sites that shared the same ISP and were experiencing network problems. "I'm getting calls from friendly competitors saying, 'Look, Mickey, we paid. Just pay. We're going down because of you.'" He was running out of time and energy. Richardson remembers around this time having to update his staff—275 or so people who weren't entirely sure they'd have a job soon—and he couldn't even find words. He thought, "I wish they could read my mind because I'm too exhausted to explain it anymore. I don't have any answers." In hindsight, Richardson says, he would have spent more time preparing for these human issues attached to the crisis—decision making under pressure, keeping the staff together—and less time worrying about technical defenses. Yes, create those technical defenses and make sure you have a crisis response plan. But also focus more on issues like exhaustion and emotional distress, and how they can be handled. It was in this context that Richardson received an e-mail, at 11:12 a.m. It caused him to feel, for the first time, "blind fear." "I would like to thank you for not keeping your end of the deal and making this upcoming weekend an enjoyable one for me." The extortionists demanded $75,000, but then seemed to disregard the money. "I do not care how long I have to destroy your business and I will. You will learn the hard way that you do not make a deal and then f*** around with us.... Let the games begin." Richardson would soon learn they were not bluffing. They could destroy his business, and they were going to try. For BetCris to survive, Lyon's slapdash system in Phoenix, which was just starting to find its purchase, would have to stand up to the biggest DDoS attack any of them had ever seen.


The DNS servers that had overloaded in Phoenix were brought back online in a couple of hours, after Lyon and Wilson adapted some filtering scripts and increased the size of their network pipes. Lyon then spent Thanksgiving and Friday eating leftover turkey his girlfriend delivered and tweaking his system to absorb bigger DDoS attacks. On Friday, he believed it could handle a 1Gb attack, and he felt good about that. He assured a frayed Richardson that he'd never see an attack that big. It would take tens of thousands of zombie computers. Which is exactly what happened. It turns out the extortionists had more than 20,000 zombies. PureGig's data center suffered badly, which affected several of its ISP customers. PureGig decided to take Lyon's system offline to fix it. "The attack went to 1.5Gb, with bursts up to 3Gb. It wasn't targeted at one thing. It was going to routers, DNS servers, mail servers, websites. It was like a battlefield, where there's an explosion over here, then over there, then it's quiet, then another explosion somewhere else," says Lyon. "They threw everything they had at us. I was just in shock." Richardson recalls the attack: "So I have Barrett on the line, who I think is the second coming, and he says, 'Let me think about this. Give me some time.' And I say, 'OK, I don't want to pressure you. I have faith. But if you don't fix it, I'm out of business.'" Why Online Extortion Works It was never supposed to have gotten to this point; Richardson was supposed to have paid long ago. The extortionists expertly optimized the chances of it. To ensure a quick, quiet transaction, the extortionists did what all extortionists (in the physical or online world) do: They exploited the problem of the commons. An ecological principle, the problem of the commons states that people will act in self-interest if it profits them in the short term, even if that act will hurt everyone, including themselves, in the long term. Every act, every threat, every negotiation tactic, every single move extortionists make is designed to make paying the protection fee not only appealing, but in fact, the smartest business decision you can make in the short term, even if you know in the long run that you haven't stopped the problem at all. Thus, extortionists attack when it hurts the target the most; they ask for $10,000 to $100,000 (generally considered the sweet spot of extortionist profitability versus victim willingness to pay, depending on the size of the victim company).


In BetCris's case, the extortionists revealed they were Eastern European, which would make them hard to find, never mind prosecute. Online crime laws are weaker in Eastern Europe than in the United States and the desire to enforce them weaker still (and the FBI wouldn't get involved with offshore gaming sites being extorted from overseas). The online version of extortion provides unique advantages (relative anonymity, low probability of prosecution, lots of easy targets, diminished chance of physical violence) that have made it a highly lucrative business alternative for bad guys. BetCris was just another easy target. What the extortionists didn't count on was the unlikely confluence of Richardson's resolve, Lyon's ingenuity and an ISP that would provide them a place to fight back. Friday, Dec. 12, 2003: BetCris Wins the War of Attrition The extortionists must have screamed "Hooy na ny!" or some other Russian expletive after their blitzkrieg, when Lyon "got the chemistry down" and managed to absorb the massive amounts of attack traffic and get PureGig and BetCris back up and running. Lyon assumed the bad guys would come back with something bigger, as hard as that was to imagine, so he set out to scale up his system "for whatever was next, a 6Gb attack or something." But for the next week, the attack stayed steady at around 1Gb. BetCris, Lyon and PureGig had entered a war of attrition. The extortionists would find a way to kick Lyon's system, Lyon and Lebumfacil would tweak it and get back up. Cat and mouse. "Attack, counterattack, back and forth," Lebumfacil says. "It was 24-by-7 monitoring for two weeks." Wilson and PureGig stopped noticing any of this because the attacks had been segregated from PureGig's other traffic. And then, suddenly, the attacks stopped. At 8:46 a.m. on Friday, Dec. 12, two weeks after the assault that nearly put him out of business and three weeks after he first read the words "Your site is under attack," Richardson received an e-mail: "Dear Mickey, I tried getting to your site today and I could not. I thought with all the money you spent you would not have these problems anymore. I guess you wasted your money instead of keeping your word. Good luck. P.S. I bet you feel real stupid that you did not keep your word. I figure by now you have lost 5 times what we asked and by the end of the year your decision will cost you more than 20 times what we asked."
Richardson knew this was an admission of defeat, even if it was disguised as braggadocio. His site was up. The extortionists couldn't get to it because they were blocked. He hadn't paid them a dime. They made no more threats. They couldn't because they couldn't back them up with action. The extortionists had lost. And yet, the e-mail was not far off. Richardson figures it cost him a million dollars in lost revenue and IT investments to win this war. "It was worth it," he says. "I just didn't know it would take a couple years off my life." "It was amazing we made that system work against that attack," Lyon says. "It was a wake-up call on how good the bad guys had gotten." And Lyon knows the bad guys have gotten even better since. They've built zombie networks of 35,000 machines, capable of delivering a steady stream of 3Gb traffic. Peter Rendell, CEO of Top Layer Networks, which makes intrusion prevention and anti-DDoS hardware, says he expects botnets to pass 50,000 machines (and 4Gb to 5Gb) by the end of this year. It's an arms race, as defenses scale, then offenses scale, though Lyon is convinced the defenses have far outpaced what extortionists can throw at them. But the bad guys have a response. Extortionists have encrypted DoS attack scripts and have put them on peer-to-peer networks, making criminals who use them nearly impossible to track or contain. They're registering domains and then attacking those domains, only those domains are redirected to other targets. "The only way to stop that is to delete the domain," Lyon says, "and that's not something you can just do." Lyon stopped an attack but certainly didn't stop the problem. Still, he wouldn't learn of all this until later, after he decided to start a business and, as he did with Don Best, track down the BetCris extortionists. At that moment, though, after the extortionists admitted defeat, he was ready to relax. He booked a vacation in San Jose, Costa Rica, for New Year's. Finally, he'd meet the people he saved and celebrate with them. New Year's, 2004: Visit to an Online Gaming Hotbed Costa Rica is about the size of West Virginia, bookended by Nicaragua to the northwest and Panama to the southeast on the Central American isthmus. With coastlines on both the Pacific Ocean and Caribbean Sea, and mountainous terrain inland, Costa Rica sits along the Ring of Fire, so volcanoes and earthquakes are native. Political strife is not. The CIA calls Costa Rica a "Central American success story."
Lured by its stability, BetCris located there in 1993. Richardson joined as a "utility man" in 1996. Back then, the business wasn't online, it was a call center. BetCris's call center once employed more than 500 operators at peak hours, but the number dwindled as the business moved online. Today, maybe 30 operators will man a call center at peak hours, or during an extortion crisis. As the Internet took off, so did San Jose as an offshore gaming mecca, for several reasons. The government encouraged the industry to expand its economy. (BetCris supports an industry group to lobby local politicians.) Also, the people are educated, with an excellent work ethic, Richardson says. Costa Rica has a 96 percent literacy rate. More high-level employees at gaming companies are Costa Ricans, including all of BetCris's accounting staff and 90 percent of its managers. The other reason gaming companies swarmed here is, of course, because it's not the United States, where gambling laws are difficult to negotiate. Today, hundreds of offshore gaming companies, most of them online ventures, operate from San Jose. In BetCris's seven-story headquarters alone, Richardson says, there are 10 such enterprises, two software companies and a telecom company—pretty much offering everything you need to get started in the online gambling business in one building. The competition is mostly friendly. Richardson says it's not unusual to bump into competitors at a restaurant and join them for dinner. The valley that makes up the San Jose metropolitan area holds almost half the country's 4 million people. Richardson says the valley gets blistering hot, and downtown San Jose is "undesirable." But BetCris, and most of the gaming and tourism industries, are above all that, nestled in the higher elevations of the valley's surrounding mountains, where Richardson compares the weather—and the lifestyle—favorably to San Diego. When Lyon arrived here, he felt a sense of pride for helping. He saw "this beautiful building with this top-notch data center," he recalls. "And I met all the people who work there, and I kept thinking, I protected all of this. Me and my keyboard helped all these people keep their jobs. It was so neat to see how good a thing it was that we did." Richardson and Lyon bonded immediately. There was a party with professional-grade fireworks launched from Richardson's front lawn. They went to dinner, talked about life and the attacks. Lyon had developed antipathy to the extortionists; he wanted to nail them. He told Richardson and Lebumfacil he was going to start a business, a service whereby people could subscribe to his anti-DDoS attack infrastructure. Lyon recruited Lebumfacil to help him start DigiDefense. BetCris was his first customer. Richardson gave them office space to start.



NFL Betting 100% Bonus CODE: AF4517 @ Wagerweb.com

Mr. Bookmaker

100% Sign Up Sportsbook Bonus

WAGERWEB BONUS CODE: AF4517

It's about 12:30 p.m. Eastern standard time. At football stadiums from Detroit to Miami, kickoffs loom and excitement builds. But even in cities where the home team must win to ensure a playoff berth, the intensity level is nothing compared to what's going on in San José, Costa Rica -- a place where 10 years ago football could have only meant soccer.
From one end of the city to the other, in shiny office buildings and low-slung suburban developments, telephones ring incessantly. Digital pipelines overload with information. Computer screens grind through many megs of mathematical computations. All of this takes place within the walls of operations bearing names such as BoDog, 5dimes, Wager Web and Hollywood, online sports books that take massive numbers of wagers from gamblers across the United States.
A guard holding an enormous rifle, its barrel poking up toward the overcast sky, stands outside the building owned by an enterprise called CRIS (Costa Rican International Sports). Inside, a fluorescent-lit, airy white-walled room is crowded with about 200 telephone clerks handling the incoming wagers. But many more bets arrive invisibly, via the Internet. A gray-haired, slender line-maker (the person who decides how many points each team should give up or receive) introduces himself as "Mac, just Mac, from southern California," before marveling at the flow of action. "If not for the Internet, we'd never be able to handle nearly this much," he says, keeping both eyes glued to a computer monitor that allows him to track the incoming wagers and manipulate his lines so that he doesn't get stuck with too much of a liability on one side of a game or the other. "If everything came in over the phone, there could be a thousand clerks in here and it wouldn't be enough."
Mac is one of hundreds of American sports-betting professionals (i.e. bookies, marketers, money movers and line-makers) who've found refuge in Costa Rica, the reigning world capital of sports betting. While there are gambling operations scattered around the Caribbean, Costa Rica currently ranks as the hub, housing anywhere from 200 to 300 sports books (depending on whom you ask) that combined generate at least tens of billions of dollars in wagers each year. It's no accident that hundreds of American bookies have settled in Costa Rica. This Central American nation boasts a good technical infrastructure, a reasonably friendly government (only in the last year have Costa Rican officials begun pressing the betting operations to buy licenses for $45,000 to $90,000), loose laws, close proximity to offshore banks (gambling money is not allowed to pass through Costa Rica, so the books do their banking in places like
Curaçao, the Dominican Republic and Antigua), and so many beautiful, available women that one happily married sports-book manager comments, "If I didn't have a wife, I would lose my mind here." Another American, pointing out that cocaine is dirt cheap and plentiful, adds, "I've lost good guys to women and to coke. They get too involved with one or the other and stop coming to work."
Back at CRIS, with only 15 minutes until game time, the phone action escalates. Digital chirps ring out with the mounting intensity of a symphony reaching its crescendo. Sitting behind a raised dais-style table called the stage, Mac continually yells out changes to the lines, answers clerks who want to know whether or not particular gamblers can exceed their limits, and keeps an especially close eye on what he calls Wise Guy Row. It's a single table occupied by a small cadre of elite phone clerks who facilitate the bets of professional gamblers: players who are capable of moving lines at the last minute, then catching the other side of a wager and essentially risking no money while hoping that the final score will fall inside the point spread and result in a risk-free payday. Or else they simply are so smart about sports-betting that they're far more likely to win than they are to lose.
Told that a lot of his competitors eschew the wise guys, Mac says, "I happily take their action. Sharp players
bring a lot of volume. Then we nudge the line to generate action on the other side."
He looks at his monitor and grimaces. "Right now I'd like to have a little more money on Cincinnati," he says, acknowledging an imbalance of $90,000 weighted toward the opposing team. Then, as chaos swirls around him, he calmly adds, "But I'd rather book an extra bet than give away a number I don't want to give away."
CRIS, founded by Ron "Cigar" Sacco, the godfather of offshore gambling, is run like an old-school operation. Bereft of gimmicks, technologically low-key, not at all caught up in marketing gambits, CRIS is philosophically similar to the small, independent sports books that once dotted the Vegas Strip. Just across the parking lot, however, resides BoDog, a successful operation that is CRIS's antithesis. Where CRIS is stripped down, BoDog is a flashy, swaggering beast of a company, taking 90 percent of its action over the Internet (as compared to 70 percent for CRIS) and even featuring its own mascot: a tooth-baring canine that looks ready to pounce. CRIS's name is obvious to the point of sounding generic; BoDog's was devised as strategically as a soft-drink's: it had to sound aggressive, bear fewer than six letters (a preference for Web surfers) and be available as a URL.
Unlike CRIS, BoDog discourages wise guys -- going so far as to have two separate point spreads, one for the wise guys and one for the squares or recreational bettors that it aggressively courts. The site gets mass-marketed as if it's trying to compete with Amazon or Orbitz. "We only market on the Internet -- not in print or broadcast -- and in two seasons we've become the dominant brand on the Web," maintains Cole Turner, BoDog's Chief Executive Officer and founder. "Companies here in Costa Rica are run by one of two types of people: a bookmaker who somehow managed to educate himself on e-commerce and technology, or a technology person, like myself, who came in from the other direction. I believe that the most powerful person is the one who's strong in technology. You can dominate this industry with an average bookmaker if your technology and marketing are world-class. But you will never dominate this industry with a world-class bookmaker and average technology. Make mistakes on the marketing side and you get lost in the chaff of the industry. Nobody will even know that you exist."
It's a headstrong sentiment that generates controversy among the hardworking bookies here. But, judging by the late-game activity in BoDog's phone room, the approach seems to work. Clerks are busy, line-makers frantically massage the numbers being offered to their square customers, and Cole Turner stands on the edge of the stage with a self-satisfied look as a second round of kickoffs nears.
Turner entered the offshore sports-betting business after being accused of insider trading in Canada and carving out a niche for himself as a provider of e-commerce software. He shrugs off his crime as a youthful indiscretion, acknowledges that he changed his name and insists that he did nothing more than sign the wrong papers. Whatever the case, he is not alone in coming to Costa Rica after having a slightly sketchy situation up north.
If, as Casino author Nicholas Pileggi once wrote, Las Vegas is a morality car wash, then Costa Rica is the morality car wash of the morality car wash. One successful sports book owner here abandoned a similar operation in Vegas after he was robbed of millions and supposedly stiffed his winning gamblers for the dough; he's generally regarded as a great guy among his fellow expats. A highly esteemed oddsmaker got busted for money laundering, imprisoned and deported from the United States; he relocated to Costa Rica where he's since been embraced as an upstanding citizen. And even the guys who did nothing blatantly illegal inevitably turn squirrelly when questioned about their old lives in the States.
For all of that, the Costa Rican operations appear stunningly well run and efficient. Telephone rooms, with their long tables of bilingual clerks, are as antiseptically comfortable as any telemarketing setup in the United States. The businesses (which are run by men whose ambitions rarely exceeded 20 clerks in a little broom closet of a bookmaking office operating on the down-low) are solid enough that one was sold for $14 million and another supposedly went for $30 million, plus some $270 million in stock options. Both were purchased by the British company sportingbets.com. Hearing those amounts, though, and finding out that one bought-out company had the particularly enviable URL of sportsbook.com, I wonder if it was purchased partly for its online handle. Reggie Reggoni, who runs a mid-level sports book called Blue Marlin and was among the first half-dozen bookies to begin working down here, looks at me with some disbelief. "No," he says. "They bought it because they wanted the company's 80,000 American gamblers."
With deals like those, it's clear that bookies' lives in Costa Rica are as legit as it gets in this world. Undoubtedly, they're out of the shadows, perfectly legal and part of society. Collectively employing tens of thousands of young Costa Ricans, they pay better than average salaries, employ bodyguards (especially if they like to wear their diamond-encrusted Rolexes while swanning around town) and occasionally own the buildings that they occupy. Bet-On-Sports, one of San José's more successful books (it takes 1.6 billion bets per year), boasts an Olympic-sized swimming pool, a private club for its premier players and a free daycare center for the children of its employees. "The idea," says Bet-On-Sports' CEO David Carruthers, "is for our customers to realize that we are a substantial operation" few months later de DOJ went so hard on them that erase them from the map, but that is another story.
While CRIS's Mac goes so far as to say that the sports books have created a middle class in San José (a somewhat dubious assertion, as many Costa Ricans believe that the books are a corrupting influence on the good Catholic kids who work there), his boss, Mickey Richardson, gives the impression that being a bookie here has become too much of a real job. "It was more fun before," admits Richardson. "It used to be a party atmosphere. What used to be considered a racket is now a real business and we're dealing with things we couldn't even have imagined 10 years ago.
The watershed moment for all of this can be traced to the evening of December 13, 1992. That's when Steve Kroft of "60 Minutes" interviewed Ron "Cigar" Sacco, the lifelong bookmaker, who looked cocky with his shock of red hair, shirt pocket crammed with pens, and a signature Cohiba jammed between his teeth. Speaking from the Dominican Republic, to which he had relocated and set up dozens of toll-free phone lines, Sacco told Kroft that he was doing nothing illegal. Sacco insisted that he felt comfortable taking bets from U.S. customers in the Dominican Republic, where sports wagering had long been legal.
Sacco's message was a seductive one for bookies across the United States. "Seeing that interview changed me," remembers Richardson. "Suddenly, bookmaking seemed like something that could be done outside of the United States. It immediately appeared to be the ticket." In no time, the Dominican Republic was home to more than 200 expatriated American bookies, plying their trades beyond the reach of stateside authorities.
Within a couple years, however, the Dominican Republic ceased to be a gambler's Eden. "The government got greedy," says Reggoni. "You'd pay one general $50,000 and the next week his brother would show up demanding another $50,000." Following a false start in Antigua, Sacco moved his operation to Costa Rica; he was the first one in the industry and, once again, other bookies followed. Then, in the late 1990s, the Internet blew wide open. With easy access to information, the ability to place bets hassle-free, and an opportunity to monitor ever fluctuating lines (via services such as Don Best), the Web seems to have been custom-made for sports betting -- and it has ignited the multibillion dollar explosion in wagering.
However, all is not perfect in paradise. On the consumer end, gamblers run the risk of getting ripped off. It can happen surreptitiously or blatantly (in a well-publicized event, one of the major books in town stiffed a professional from Las Vegas for nearly half a million dollars, claiming that it simply didn't want wise-guy action, maintaining that the Vegas gambler knew this and bet anyway). "Some of these places get set up specifically for the purpose of not paying people," says one bookie, who did not want to be named. "They attract a lot of post-ups [the betting bankroll that you deposit up front] and then disappear, only to reopen under a whole other name." And it's not only the gamblers who face financial risk. "Sport Bucks [which worked as a bank for local sports books] recently went out of business, owing the books a total of $1.5 million," remembers Reggoni, adding that Sport Bucks got into trouble after its owners got hooked on betting games with money they were supposed to be minding. "We lost $30,000 on that one and felt lucky."
Even worse is the constant vulnerability to high-tech terrorists who cripple computer systems by flooding them with calls and demanding payments of $30,000 be sent to Saint Petersburg, Russia, or else the site will remain unusable. "We could have paid those guys who were putting out the denial of service attacks or stood up to them," says Will Gatten, a goateed hipster from Texas who does marketing for a respected sports book called Hollywood. "We did the latter and paid way more than $30,000 to upgrade our system" -- and make the attacks impossible -- "but it was the right thing to do."
Questions loom as to whether Costa Rica will be the gambler's refuge for much longer. In light of the recently activated licensing fees, those in the industry fear that politicos in their adopted homeland will get as greedy as the Dominicans had once been. And while few bookies are currently prepared to say hasta la vista, baby, they are looking at alternatives to Costa Rica. "Right now Panama is a front-runner," says one sports-book manager who recently returned from a trip to Panama City. "The place is completely modern. It's got a skyline that rivals those in many American cities, and it's cheaper than San José. From what I understand, the government is looking to bring in 10 big sports books." The manager's cell phone rings, he deals with some business involving a line move for an NBA game, then he softly adds, "One problem, though, is that Panama has a closer relationship with the United States than Costa Rica does."

And therein lies the rub. Never mind that it's legal to book bets in Costa Rica, the true lawfulness of what the offshore books are doing remains fuzzy. Consider this: if an American citizen opens a sports-betting business in a place such as Costa Rica and takes bets from customers in the United States, is he breaking the law? Maybe. Since hardly anyone in America has ever been busted for placing a bet (only for taking them) and taking bets is legal in Costa Rica, you have an area so gray that even attorneys who specialize in representing gaming-related cases can't provide a straight answer.
What's indisputable is that Ron Sacco -- who supposedly became a massive FBI target after showboating on "60 Minutes" -- was recently arrested while trying to go from Costa Rica to Nicaragua. The Costa Rican government maintained that his passport was not in order, and, rather than take his chances waiting for slow justice in Central America, Sacco turned himself in to U.S. authorities where an old bookmaking warrant led to his receiving a nearly two-year prison sentence.
Sacco's arrest had a chilling effect on Costa Rica's sports-book community and has led to much speculation about the future of online gambling as a big public enterprise. Already the U.S. attorney general has advised publications such as Maxim and radio programs such as the "Howard Stern Show" (both beneficiaries of advertising dollars from Costa Rican sports books) that running ads for offshore gambling may put them in the position of aiding an illegal activity. "Right now the American government is the biggest threat to the future of online gambling," says one bookmaker who believes that the business will be forced to return to its underground roots. "Supposedly the NBA and NFL are at least partially behind it. But the really ridiculous thing is that sports betting helps keep basketball and football and everything else going. Without having a little something riding on the game, how many people do you think would really bother to watch?"

Sports Betting 100% Bonus CODE: AF4517 @ Wagerweb.com