July 3rd, 2009. Silverton Casino, Las Vegas. A 50-year-old man in a polo shirt is sitting at a video poker machine pressing buttons.
He has been sitting there for nearly 6 hours drinking only water. In the last 40 minutes, he has won approximately $150,000 from a single machine. He has not used a hidden device.
He has not slid a card. He has not touched the machine in any way that any security camera in Las Vegas can identify as cheating. [music] He has only pressed the buttons the machine itself is displaying.
This is John Kaine, 50 years old, a Pennsylvania retired sales manager who has played video poker on and off for 30 years. In the previous 4 months, he and a partner have taken approximately $429,000 from [music] at least nine casinos across the United States. So, how does a 50-year-old retiree from suburban Pennsylvania take $429,000 from Las Vegas casinos using nothing but the buttons every other player in the building had access to?
And what was the one detail John Kaine had noticed about the most played video poker machine in America? A detail nobody at the casino, the FBI, or the company that built the machine had. To understand what John Kaine did, you have to understand the machine he was sitting in front of.
In 2009, the most deployed video poker platform in the world was called Game King. It was made by International Game Technology, IGT, a Reno, Nevada company with annual revenues approaching $3 billion. By 2009, IGT controlled approximately 70% of every video poker machine on a casino floor in the United States.
If you sat down at a video poker machine in any major casino on Earth in 2009, the odds were better than even you were sitting in front of a Game King. Slot machines in the United States are class 3 regulated gambling devices governed by the Nevada Gaming [music] Control Board and 49 similar state level bodies. Every firmware version must be individually certified before it is allowed to take a single dollar from a player.
The Game King firmware running in 2009 had been certified across all variants over 600 times. It had been audited by independent security firms at least four [music] times. There were no known bugs.
There were no known exploits. There was no documented case in IGT's history of any Game King platform being [music] successfully manipulated by a player on the casino floor. By 2009, video poker machines in the US generated approximately $8 billion in annual revenue.
Game King machines alone generated more than half of that. This was the system John Kaine was sitting in front of on a Friday evening in July 2009, pressing buttons. He had been sitting in front of Game King machines in one casino or another for almost 20 years, long enough to notice when one of them did something it was not supposed to do.
John Kaine was born in 1959 in a workingclass neighborhood of suburban Pennsylvania, 20 m from Pittsburgh. By his early 20s, he was working in industrial sales. By his early 40s, he had saved enough money to take early retirement and pursue full-time the hobby that had occupied most of his evenings for 15 years, video poker.
He was not a flashy gambler. He did not play blackjack. He did not play roulette.
He did not play any of the games that by 1990s casino convention required the player to be seen. By his late 40s, Cain had been studying video poker. not playing it, studying it for 20 years.
He owned every published strategy guide printed in the United States. He owned three software programs that calculated expected return on every variant. [music] He had memorized the expected return of 47 different Game King variants to four decimal places.
He had not, by his own testimony and bank records, lost money playing video poker, net of winnings and losses in more than 10 years. He was not by 2008 a gambler. He was a professional.
This was the man who on a Wednesday afternoon in mid 2008 was sitting at a Game King machine in the Fremont Hotel and Casino in downtown Las Vegas playing a low stakes variant called triple double bonus poker when something on the screen briefly [music] did not behave the way it had behaved for 20 years. He noticed it. Most players would not have.
He did not understand what he had just seen, but he understood that he had seen something. He drove home to Pennsylvania. He told [music] his wife he was taking another trip to Vegas in 3 weeks.
He spent the next 9 months trying to make it happen again. What John Kaine had found was, in software engineering terms, a state management bug. The Game King platform supported a feature called double up.
After a winning hand, instead of collecting, the player could risk the winnings on a single high card draw. Most experienced video poker players, including Kain, ignored it. The math favored the casino, but the feature was wired into the firmware in a way IGT engineers between 1996 and 2009 had never tested.
If the player did several specific things in a specific order, collected the winnings, navigated to the denomination menu, increased the denomination to its maximum value, and re-engaged the double up, the machine's internal state would not fully reset. The machine would calculate the next payout using the original hand at the new higher denomination. A $400 win at a $1 denomination became with a single subsequent button press a $20,000 win paid as a single jackpot.
The sequence required six button presses in order within approximately 15 seconds. The first time Kane reproduced it intentionally at the Fremont on March 14th, 2009, a $1 hand became in fewer than 20 seconds an $18,000 payout. He stayed at the machine for another 4 hours.
He repeated the sequence 11 more times. He walked out of the Fremont at 3:00 in the morning with more than $100,000 in markers. The Fremont cashed him out without questioning him.
He drove back to Pennsylvania the next day. There was one immediate problem. Every Game King machine on Earth had the same bug.
But Cain could only sit at one machine at a time. A high six figure payout from a single machine in a single shift would eventually attract floor management. To produce serious money, Cain needed a second pair of hands.
He had one person in mind. Andre Nester lived in Swissvil, Pennsylvania, 7 mi east of Pittsburgh. He had known Cain for 15 years from the regional casino circuit.
He was not, by professional standards, particularly skilled. He was not, by standards, particularly disciplined. He was, by every available account, occasionally desperate for money.
He had filed for personal bankruptcy in 2007. He had a wife and two children and a mortgage. He was by spring 2009 several months behind on.
When Cain reached out in April 2009 to suggest a trip to Vegas, Nester agreed within 4 seconds. Cain explained the sequence over coffee at a Denny's outside [music] Pittsburgh. He made Nester write it down.
He made him practice on a video poker simulator [music] for 2 weeks before they flew out. By the time the two men landed in Las Vegas on May 1st, 2009, Nester could execute the six press sequence in less than 14 seconds. For the first 6 weeks, Cain and Nester never sat at the same casino on the same day.
They flew separately. They stayed at different hotels. Their only contact was through prepaid mobile phones, replaced every 4 to 5 days.
Kane's rules were specific. No single Game King machine for more than $50,000 in a single shift. No single casino floor for more than two consecutive nights.
No single state revisited within 40 days. Cain took Las Vegas. Nester took the Eastern Circuit, the Borgata in Atlantic City, the Meadows Racetrack outside Pittsburgh, the Tribal Casinos of New York and Connecticut.
By midJune 2009, the operation had taken approximately $260,000 from at least 11 casinos in five US states. Then Andre Nester stopped [music] following the rules. By the third week of June, his share was approximately $120,000.
He had paid down his mortgage. He had bought his wife a car. He had begun in his Pittsburgh neighborhood to spend money in a pattern that for a video poker player previously six months behind on his mortgage was difficult [music] to explain.
By late June, Nester was hitting Game King machines at the Meadows racetrack [music] on consecutive days, taking payouts that exceeded what the casino's surveillance manager had ever recorded for a single video poker machine. By the end of June 2009, casino security at three separate Las Vegas properties had begun reviewing surveillance footage of unusual Game King payouts. What they noticed was not Cain or Nester individually.
What they noticed was the machines. The same Game King units in different properties had been producing payouts at multiples of statistical expected return to different players on different shifts in different denominations. By July 1st, IGT's Reno engineers had been notified.
By July 2nd, IGT had alerted the Nevada Gaming Control Board. By July 3rd, the board had distributed advisories to [music] every casino security operation in Las Vegas, the casino floor of the Silverton in Las Vegas. He did not know that the Silverton security team had received the Nevada Gaming Control Board advisory 40 minutes earlier.
He did not know that the surveillance manager was specifically instructed to watch for the six press sequence he had spent 14 months learning. He did not know that he was that evening the most watched man on the most surveiled casino floor in Las Vegas. He drank only water.
He pressed the buttons. For the next 6 hours, he won approximately $150,000. At 11:47 p.
m. on July 3rd, 2009, three Silverton security officers approached John Kaine at his machine. They asked him to step away.
They asked him to come with them. Cain did not protest. He did not panic.
He stood up, left his markers on the seat, and walked calmly [music] between the three security officers off the casino floor. The Silverton's surveillance manager took Cain to a small windowless room on the second floor and played the surveillance footage of the previous 6 hours of Cain's play. Cain watched calmly without comment.
The surveillance manager asked Cain to explain how he had won approximately $150,000 in 6 hours. Cain said he had been lucky. This was by Nevada law not enough to detain Cain indefinitely.
The casino had no evidence he had used a hidden device, slid a card, or done anything Nevada criminal statute classified as cheating at a gambling game. The Las Vegas Metropolitan Police Department arrived at 1:00 in the morning. The responding officers spent 45 minutes reviewing the footage.
They did not arrest John Kaine. They told him he was free to leave, but that the Nevada Gaming Control Board was going to want to speak with him. The Silverton seized his winnings.
[music] approximately $150,000 in markers pending further investigation. King left at 2:30 in the morning of July 4th. He flew home to Pennsylvania the same day.
Andre Nester,400 m east, was not as fortunate. At 7:00 on the evening of July 4th, 12 hours after Cain had walked out of the Silverton, Nester sat down at a Game King machine at the Meadows racetrack in Washington County, Pennsylvania. The Meadows surveillance team had received that morning the same advisory forwarded by IGT to the Pennsylvania Gaming Control Board and distributed to every Pennsylvania casino by lunchtime.
Nester began executing the six press sequence within 3 minutes of sitting down. Pennsylvania State Police arrested him at the machine 45 minutes later. He was charged with theft by deception, attempted theft, and computer trespass.
He spent the night in the Washington County Jail. He was released on July 5th on $20,000 bail. In the first days after July 4th, the two incidents did not appear to be related.
It took approximately 6 weeks of investigation by IGT, two state gaming control boards, and three casino [music] security firms to confirm that they were almost certainly part of the same operation. By mid August, the FBI's Las Vegas field office had opened a formal investigation. By early October, they had requested cooperation from the FBI's Pittsburgh field office.
On the morning of October 6th, 2009, three months after the Silverton incident, 12 FBI agents knocked on the front door of John Cain's house in a quiet residential neighborhood of suburban Pennsylvania. Cain was sitting at his kitchen table, drinking coffee, reading the morning paper. He stood up.
He answered the door. He did not ask the agents what the visit was about. He had been expecting them since July 4th.
By the end of October 2009, Cain and Nester had been formally indicted in the United States District Court for the District of Nevada on charges of conspiracy to commit wire fraud and unauthorized access to a protected computer system. The statute was the Computer Fraud and Abuse Act of 1986. The maximum sentence per count, 10 years in [music] federal prison.
Cain and Nester faced between them eight counts. The CFAA had been written by Congress [music] to prosecute the kind of person who in the early 1980s dialed into a corporate mainframe at 4 in the morning using a stolen username and password to copy files he was not authorized to read. The statute's key phrase repeated in nearly every prosecution under it for 23 years was unauthorized access.
By the prosecution's theory, Cain and Nester had committed federal computer fraud because they had accessed Game King machines in a manner nobody in the chain of authority had authorized. Kane's defense attorney was Andrew Levventhal, a Las Vegas litigator. Ners was Leonard Solomon, a Pittsburgh public defender.
The two, working separately, arrived independently at the same observation. The Game King machine was, by any reasonable definition, a publicly accessible computer terminal. It sat on a casino floor open to the public.
It accepted paper currency from anyone who walked up. It displayed a set of buttons inviting any user to press them. The programming included the entire sequence of menu navigation steps Cain had used.
The machine had not been locked. It had not been password [music] protected. It had not been hidden behind a firewall.
Under the CFAA, accessing a publicly accessible computer system using only the input methods the system itself was inviting could not, by any sensible reading, be unauthorized access. The argument on paper was elegant. In practice, it took two years to get a federal court to seriously consider it.
Magistrate [music] Judge Cam Farenbach was assigned. The case sat in pre-trial motions throughout 2010, 2011, and most of 2012. The DOJ had by 2010 won more than 90% of every CFAA case it had brought.
The federal prosecutors did not want to lose. They did not want to set the precedent that pressing buttons on a video poker machine could not be hacking. But on November [music] 4th, 2013, Farenbach issued his ruling.
The operative finding was a single paragraph. The defendant's actions did not exceed authorized access. The Game King machine, as configured by IGT and as deployed by the casino, was a publicly accessible terminal.
The buttons the defendants pressed were the buttons the machine itself was displaying. The fact that pressing those buttons in a particular sequence produced a payout the manufacturer did not anticipate is not under the plain language of title 18 section 1030 an act of unauthorized access. The magistrate judge recommended dismissal of all CFAA charges.
The federal district court accepted the recommendation in February 2014. The wire fraud charges were dismissed by the prosecution shortly thereafter. The Pennsylvania state level charges against Nester had already been quietly dropped.
In November 2009, 4 months after the FBI raid, 4 years before the ruling that would clear him, IGT issued a firmware update for every Game King platform machine in service worldwide. Approximately 130,000 gaming devices. The patch did one thing.
It corrected the state management bug in the double up feature that Kane had spent 14 months learning to exploit. By spring 2010, every Game King machine in commercial service in the world had been silently updated. The bug, which had cost Kane nearly 15 years of methodical study and four years of federal prosecution, no longer existed.
Patches every machine on Earth. The amount Cain and Netor had kept after the dust settled [music] was difficult to calculate. The Silverton seizure of Cain's $150,000 in markers was never returned.
Pennsylvania state authorities had seized approximately $90,000 in cash from Nester's home. The Borgata had reversed approximately $40,000 in payouts. Of the approximately $429,000 the operation had taken, the two retained after legal fees and civil clawbacks somewhere between $80,000 and $120,000.
Given four years of federal prosecution and the FBI raid that had seized approximately $40,000 in computer equipment from Kane's home, the operation was almost certainly a net loss. Cain and Nester had, in narrow financial terms, beaten Las Vegas. They had then, in broader terms, been beaten by it.
What Kane's silent, methodical defense did was redefine for the first time in the 27-year history of American federal computer crime law, what unauthorized access meant. [music] The ruling in US versus Kain and Nester was cited directly [music] or by analogy in every major CFAA dismissal between 2014 and 2026, including the 2021 Supreme Court ruling in Van Beern versus United States. By 2026, it had extended far beyond the casino industry.
Cited in cases involving website scraping researchers, security vulnerability disclosures, employee data access, and academic computational journalism. It had become the single most cited precedent in modern American computer crime law for the proposition that pressing buttons a system invites you to press cannot, under federal law, constitute a crime. A 50-year-old retired sales manager from suburban Pennsylvania had by his decision to walk into a federal courtroom and not settle quietly rewritten the legal architecture of the American digital economy.
In 2026, there are approximately 140,000 Game King machines in commercial service in casinos around the world. They accept paper currency from anyone who walks up. They display the same set of buttons IGT has been deploying since 1996.
The buttons are still in the same order. The denomination menu is still in the same place. The double up feature is still wired into the firmware.
The bug, however, is not. John Kaine is in 2026 years old. He has not in 12 years been to Las Vegas.
He has not in 12 years been asked by the United States federal government to walk into another courtroom. The legal precedent he set in 2013 is now cited in every major American computer crime case argued in federal court. He did not break a casino.
He did not break a federal computer system. He did not, by any subsequent ruling in the largest legal system on Earth, break a single American law. He just pressed the buttons in a specific order until the machine paid.
