Security isn’t a lottery! –
Germany’s WestLotto protects lottery data with email encryption

West German Lottery (WestLotto) is a trustworthy and reputable gambling company and takes its security and confidentiality responsibilities very seriously. The company rules dictate that all lottery and player data is protected from manipulation and theft. Consequently it was a logical decision to encrypt all emails. When WestLotto became aware of Zertificon’s Z1 SecureMail Gateway encryption solution in 2002, the impact that this discovery would have for Germany and European lottery providers couldn’t have been forseen.

Secure Data Transfer within Germany’s State and Federal Lotteries

WestLotto is a member of Germany’s State and Federal Lottery Association (DLTB). Due to the fact that gambling is regulated by state law, each federal state has a lottery provider which is responsible for managing the lottery within their state. In order to calculate the nationwide odds, the stakes and winnings have to be collected and collated from each state. The collection of this sensitive information from each state is one of the core processes of the DLTB and security is paramount to prevent any manipulation of the stakes and prizes.

Originally, the DLTB used dedicated ISDN connections to transfer the lottery data. However, because there wasn’t a central clearing house, each lottery company had to send its data to every other company which was a complicated and time consuming process. Small companies with only a few ISDN connections had to wait for up to 2 hours before they were able to complete the data transfer. The DLTB was skeptical about transmitting the data via the Internet. Amongst other reasons, the complicated and time-consuming manual management of the PGP keys was considered to be a show-stopper.

Gateway solution delivers convenient Email Communication

Dr. Arne Fischer, IT Security Administrator at WestLotto, first became aware of Zertificon’s Gateway solution in 2002 from an article in the industry press. The product had just been voted product of the year at the “Internet World” in Berlin. Dr. Fischer recognized, that using a gateway solution for email encryption would immensely simplify the exchange of lottery data between the lottery companies and instigated an evaluation of the software by the DLTB.

The DLTB instructed the lotto companies in Bavaria and Saarland to evaluate – together with WestLotto – Z1 SecureMail Gateway from Zertificon as well as two other solutions for email encryption. The Z1 SecureMail Gateway won the evaluation through its wide ranging functionality, ease of use and good interoperability. Due to its clear advantages, the product quickly became established amongst the lottery companies. WestLotto, who already had Z1 SecureMail Gateway during the evaluation phase was one of the first companies to use the encryption software in a live environment.

Implementation at WestLotto

WestLotto runs Z1 SecureMail Gateway on a Linux system. Within a day, Westlotto was able to install the software themselves and get the system up and running. The Zertificon technicians were able to competently answer all questions which arose during the installation and integration. Starting with one of the first gateway versions in 2004 and continuing up to the current version, WestLotto has been on the leading edge of Z1 SecureMail Gateway’s dynamic development. During this time, Westlotto has witnessed the development of the technology leader from an easy to install product with compelling functionally to a fully mature, highly functional & scalable system.

Z1 SecureMail Gateway in use

Initially, Z1 SecureMail Gateway was only used for communication between the lottery companies themselves because many external partners were not aware of the need for email encryption. Meanwhile, WestLotto not only encrypts all emails to German and European lottery companies, but also with partners, IT service providers and agencies. Official company guidelines state that if possible, all outgoing mails should be encrypted and WestLotto’s communication partners are actively encouraged to deploy email encryption systems.

A key factor in rolling out email encryption to all departments at WestLotto is Z1 SecureMail Gateway’s flexible policies. The policies enable the automatic encryption and signing of incoming mails as well as the decryption and signature validation for incoming items. This automation guarantees that the day to day work of WestLotto’s staff isn’t complicated with email encryption.

The centralized certificate management offered by Z1 SecureMail Gateway facilitates an efficient processing of email traffic. The software automates the exchange of certificates between employees and external communication partners thereby eliminating the need to manually search, validate and publish X.509 certificates and PGP public keys.

WestLotto recommends Zertificon for the Eurojackpot

Based upon the positive experience gained with the Z1 encryption solution, WestLotto was glad to recommend Zertificon during the Eurojackpot planning in 2010. For this new Europe-wide lottery, the winner and also the odds need to be encrypted and transmitted electronically to a control center. This requires that the lottery companies in all participating countries agree to a single detailed specification for email communication.

The participating companies were free to choose a product, which led to Viking Lotto – the association of Scandinavian lottery companies – initially to push their own in-house solution. This however, proved to be costly to operate and had usability deficits. In the end the Scandinavian association decided to evaluate the recommendation of the DLTB.

Employees from the Viking Group asked about the Z1 product, the manufacturer’s support and the company structure before choosing the solution from Zertificon. As long term customers who have been using the Z1 SecureMail Gateway from the very start and without any significant problems, we were able to recommend the product with utmost confidence.
– Dr Arne Fischer from WestLotto recalls the Scandinavian inquiry

Besides the technical features of the encryption solution, the Viking Group was convinced by Zertificon’s customer support – such as during the initial setup of the gateway solution or the integration of extensions – with dedicated support staff and fast response times.

Once the Scandinavian lottery associations opted for Zertificon’s solution, the remaining 29 Eurojackpot lottery associations from 14 countries came on-board. In addition, companies which wish to take part in the Eurojackpot in the future are obliged to integrate Z1 SecureMail Gateway in order to guarantee a secure and efficient email exchange within the Eurojackpot association.

Z1 CertServer – more than just efficient certificate management

Since 2011, WestLotto not only uses Z1 SecureMail Gateway’s built-in certificate management, but also Zertificon’s standalone Z1 CertServer which offers extended functionality. Amongst other features, Z1 CertServer provides interfaces to users and applications for accessing the certificate pool. Z1 CertServer monitors the Eurojackpot certificates so that partners can automatically find out about the status of their internal certificates.

For more than 10 years, WestLotto has placed its trust in the innovative Z1 products for secure email communication and convenient certificate management. Z1 products will continue to play an important role in future projects such as signing of internal documents.