Current through Register Vol. 49, No. 13, September 23, 2024
Subpart 1.
Scope.
In addition to the provisions of parts
7861.0270 and
7863.0260, subparts
1
and 1a, and Minnesota Statutes, sections
349.12, subdivisions
12a, 25a, and 25c; 349.17, subdivisions 6, 8, and 9; and 349.211, subdivision
1a, an electronic linked bingo game system must meet the requirements contained
in this part.
Subp. 2.
Activating play.
Coded entry to activate play may include manual entry or the
use of a magnetic strip card or bar-coded receipt provided at the point of
sale.
Subp. 3.
Initial screen.
An initial screen must appear displaying a main menu
containing:
A. the linked bingo game
provider's logo;
B. the compulsive
gambling hotline telephone number; and
C. electronic linked bingo games available
for play.
Subp. 3a.
No simultaneous play.
An electronic game device may be used to play an electronic
linked bingo game or an electronic pull-tab game. The electronic game device
must not allow for the purchase of an electronic pull-tab from any screen of an
electronic linked bingo game.
Subp.
4.
Electronic monitoring by board.
Electronic monitoring of the operation of the electronic linked
bingo device by the board will be limited to read-only access of transaction
logs and status of devices. The board is not allowed to alter any data or game
play.
Subp. 5.
Secured data transmission.
An electronic linked bingo game system must provide secured
data transmission to all participating locations.
Subp. 6.
Changes in software or
hardware.
If there is any change in software or hardware by a linked
bingo game provider, the linked bingo game provider must assign a new version
or code build number and must submit the new software version or code build
number to the board for approval. The new version or code build number must be
approved by a certified independent testing laboratory.
Subp. 6a.
Same version or
updates.
An electronic linked bingo providers devices must operate on
the same version of all installed software.
Subp. 7.
Changes in version of system
or game.
A. If there is a change in the
version or code build number of a system or game, the linked bingo game
provider must assign a new version or code build number for any changes or
upgrades to the electronic linked bingo system or game to indicate a change of
the version or code build number of the system or game.
B. Any changes to the electronic linked bingo
game or system must be approved by the director before the game or system is
placed into operation.
C. Any
changes in a version or code build number that have an effect on the outcome of
a previously approved game must be retested by a certified independent testing
laboratory.
Subp. 7a.
Daily system close for update.
All electronic linked bingo game systems must automatically
close and update all site activity from the previous day to the central server
by 2:30 a.m. central standard time.
Subp. 8.
Application software.
All application software must be owned by the linked bingo game
provider. Software developed by the linked bingo game provider must also meet
the requirements of this subpart.
A.
For purposes of this subpart, application software is developed by the linked
bingo game provider if the linked bingo game provider designs the central
system, database, user interface, the program architecture, and programs the
source code.
B. A licensed linked
bingo game provider may jointly develop application software for an electronic
linked bingo system and an electronic pull-tab system with a licensed
electronic pull-tab manufacturer if the jointly developed application software
permits the operation of electronic linked bingo games and electronic pull-tab
games on the same electronic linked bingo device or electronic pull-tab
device.
C. Any application software
to be used by the linked bingo game provider must be wholly owned free and
clear and without any obligation or condition by any entity other than the
licensed linked bingo game provider.
D. The linked bingo game provider must
provide the board with documentation establishing ownership of the intellectual
property rights to the entire game application software and system.
Subp. 9.
Secure
communication.
Connections between all components and access points of the
electronic linked bingo game system must only be through the use of secure
communication protocols that are designed to prevent unauthorized access or
tampering, employing:
A. Advanced
Encryption Standard (AES) specifications as defined by the National Institute
of Standards and Technology (NIST); and
B. IEEE 802.11 standards contained in the
Wi-Fi Protected Access II (WPA2) authentication protocols.
Subp. 10.
Independent verification
check.
The electronic linked bingo game system and all devices that
communicate with the electronic linked bingo game system must have the ability
to allow for an independent verification check of the system's software from an
authorized source approved by the board. The independent verification check
ability is required for all application software that the board determines may
affect the integrity of the game. The verification check must provide a means
for on-site and off-site field verification of the software and applicable
devices to identify and validate the program. All Minnesota board-approved
games must be identical to the games presented to a certified independent
testing laboratory.
Subp.
11.
Electronic accounting data.
Electronic accounting data must be at least ten digits in
length and must be maintained in dollars and cents.
Subp. 12.
Cash and inventory
verification.
The system must record the value of bingo faces purchased and
played, and prizes won.
Subp.
13.
Restricted use.
A. Local and central servers and electronic
linked bingo devices must not be capable of being used as stand-alone units for
the purposes of engaging in any function or use not permitted by these
standards at any time.
B. External
ports on the device, if any, must be secured or disabled from unauthorized
use.
Subp. 14.
Memory backup.
Local and central servers must have nonvolatile backup memory
or its equivalent, which must be maintained in a secure compartment on each
local and central server for the purpose of storing and preserving a redundant
set of critical data which include:
A.
error corrections that may have occurred on electronic linked bingo devices or
local and central servers, such as an invalid PIN or a game
interrupt;
B. program error check
and verification and authentication of any mismatch;
C. recall of all wagers and other play
information, such as electronic linked bingo face number, serial number, and
permutation number of game, associated with all games in play and prior to
closeout of daily activity;
D.
electronic accounting data capturing the record of transactions for electronic
linked bingo devices in use for each local and central server including:
(1) bingo faces purchased and prizes
won;
(2) electronic devices in play
for each site;
(3) software state
(the last normal state or last status before interruption); and
(4) a log of all current-day transactions
prior to interruption;
E. comprehensive checks of critical memory
for each device in operation following game initiation including each specific
bingo face in play, bingo numbers selected, and winner verification. An
unrecoverable corruption of critical memory must result in an error
notification and cause all electronic linked bingo devices in play to cease
further function. An unrecoverable critical memory error report must be
immediately generated to the board and must include the name of the authorized
person who performs any recapture or memory clear of the local or central
server; and
F. the ability to
immediately, accurately, and securely cash out all players who have funds in
the system in the event of power or communications network loss or other time
of game or play interruption.
Subp.
15.
Randomization.
An electronic linked bingo game system must use randomizing
procedures in the creation of games for electronic linked bingo faces that have
been created using a method previously approved by the board. As used in this
subpart, unless the context requires a different meaning, "face position" means
the first bingo face dealt, second bingo face dealt, in sequential order, and
"number position" means the first number drawn in sequential order. Any random
number generation, shuffling, or randomization of outcomes used in connection
with an electronic linked bingo system must be by use of a random number
generation application that has successfully passed standard tests for
randomness and unpredictability as defined in part
7861.0210, subpart 44.
Subp. 16.
Game information
on system.
Prior to the commencement of an electronic linked bingo game,
the following data must be maintained and be viewable electronically on the
electronic linked bingo game system:
A. a unique serial number identifying each
game or session ID and each bingo face ID;
B. a description of the game sufficient to
categorize the game or session relative to other games or sessions;
C. the jackpot prize for the game or session
based on the number of electronic linked bingo faces in play for each game and
the cost for each face; and
D. the
purchase price per electronic linked bingo face assigned to the game or
session.
Subp. 17.
Game information on device.
The following data must be maintained and be viewable
electronically on the electronic linked bingo device:
A. the pattern;
B. the cost;
C. confirmation that a game is
active;
D. the estimated prize
amount;
E. the number on the ball
selected;
F. the number of balls
called; and
G. the site of the
winner.
Subp. 18.
Electronic linked bingo face generation.
Upon purchase initiation request from an electronic linked
bingo device, the electronic linked bingo system must dispense an electronic
facsimile of a bingo face. Once dispensed, such face or outcome must not be
reused until the bingo permutation is exhausted.
Subp. 18a.
Animated win
determination.
Electronic linked bingo games may contain animated win
determinations, but displays may not simulate spinning reels or nonstraight win
line graphic representations.
Subp.
19.
Game status and auditing.
A. Only upon the game termination shall the
details of that game be revealed to the person performing the game audit or
status check.
B. If an audit or
other game determination is conducted while a game is in play, termination of
the entire game must immediately occur. An audit or game determination includes
a determination of the prizes won or prizes remaining to be won.
Subp. 20.
Game
definition.
All games and sessions must contain the following
information:
A. game ID;
B. game pattern type;
C. game version;
D. linked bingo game provider;
E. game name;
F. purchase price per electronic linked bingo
face; and
G. prize payout for
jackpot.
Subp. 21.
System security and access.
A.
The electronic linked bingo game system must be located in Minnesota in a
secure location with limited, authorized access.
B. Any system elements that hold game data,
other than the electronic linked bingo devices, must be in a locked area or in
a locked case or compartment with access limited to designated
personnel.
C. The linked bingo game
provider must register employees having authorized system access with the
board.
D. The system must be in a
secure location and provide electronic security for the games against
alteration, tampering, or unauthorized access.
E. The system must allow the board and other
authorized state representatives real-time access to data and equipment,
including all accounting for sales, prizes, and credits per device, per
site.
Subp. 22.
Data alteration.
The electronic linked bingo system must not permit the
alteration of any accounting or significant event log information that was
communicated from the electronic linked bingo device without board-approved
access controls. In the event financial data is changed, the electronic linked
bingo system must be able to produce an automated audit log documenting
the:
A. data element
altered;
B. data element value
prior to alteration;
C. data
element value after alteration;
D.
time and date of alteration; and
E.
user log-in of personnel that performed alteration.
Subp. 23.
Backup and recovery.
A. An electronic linked bingo system must
have a separate physical medium for securely storing required data on the
computer, which must be backed up in real time by a backup medium.
B. All data required to be available or
reported by this subpart must be retained for a period of not less than 3-1/2
years.
C. All storage of critical
data must use error checking and be stored on a nonvolatile physical
medium.
D. The database must be
stored on redundant media so that no single failure of any portion of the
system would result in the loss or corruption of data.
E. In the event of a catastrophic failure
when the electronic linked bingo system cannot be restarted in any other way,
it must be possible to reload the electronic linked bingo system from the last
viable backup point and fully recover the contents of that backup, to consist
of at least the following information:
(1) all
date and time indicators associated with data failure and linked bingo system
reload;
(2) all accounting
information;
(3) auditing
information, including all open game schedules and the summary of completed
games; and
(4) employee files with
access levels.
Subp.
24.
System access; password requirements.
A. The linked bingo game provider must
maintain password access for the linked bingo game provider; the distributor
must maintain password access for the distributor; and the organization must
maintain password access for the gambling manager and sellers.
B. The linked bingo game provider, the
distributor, and the organization must register employees with authorized
system access with the board.
C.
The operating system software and application software must have multiple
security access levels to control and restrict different classes of access. The
accounts for the access levels must be unique when assigned to the authorized
personnel and only one user per account is allowed.
D. The operating system software and
application software must provide comprehensive password security or other
secure means of ensuring data integrity and enforcing user permission. It is
required that:
(1) all programs and data files
must only be accessible via the entry of passwords that will be known only to
the linked bingo game provider and the gambling manager;
(2) the storage of passwords must be in an
encrypted, nonreversible form;
(3)
a program must be available that will list all registered users on the system
including their privilege level;
(4) the password must have a length of at
least six alphanumeric characters; and
(5) the system must automatically log out
after a period of inactivity in excess of five minutes.
Subp. 25.
System log-in and
log-out requirements.
System log-in and log-out requirements apply to linked bingo
game providers, distributors, gambling managers, assistant gambling managers,
and sellers.
A. The operating system
and any local and central servers must have a password log-in with two level
codes comprised of a personal identification code and a personal
password.
B. The system must
include log-in and log-out procedures for system and point-of-sale
devices.
Subp. 26.
Electronic accounting and reporting; record of daily system
transactions.
A. One or more electronic
accounting systems must perform reporting and other functions in support of the
electronic linked bingo system. The electronic accounting system must not
interfere with the outcome of any gaming function.
B. A permanent record of daily transactions
played on the electronic linked bingo game system must be maintained by the
electronic linked bingo game system on a database other than on the local
server. The database and central server must be accessible to the board at all
times.
Subp. 26a.
Point-of-sale system requirements.
A. The point-of-sale system used for the
conduct of electronic games must require entry of the sellers unique
identifying code to open the point-of-sale system.
B. The point-of-sale system must record the
unique identifying code of any person making any transaction at any time. The
user list naming each seller with the sellers unique identifying code must be
available on the linked bingo game providers portal.
C. The point-of-sale system must be capable
of immediately producing an electronic game occasion report, using the
prescribed terminology, that includes the following information:
(1) electronic pull-tab gross receipts, if
applicable;
(2) electronic linked
bingo gross receipts;
(3) total
electronic pull-tab prizes awarded at premises, if applicable;
(4) total electronic linked bingo prizes paid
at premises;
(5) total value of
credits purchased;
(6) total value
of credits redeemed;
(7) electronic
net value of credits; and
(8) total
value of unredeemed credits.
D. The point-of-sale system may only include
game-related transactions.
Subp.
27.
Reporting requirements of electronic accounting
system.
The electronic linked bingo game system must provide the
following reports to the Gambling Control Board and the Department of
Revenue.
A. An electronic linked bingo
game report must be available to the board on demand for each game currently in
play and prior to winner verification. The report must contain the following
information:
(1) a unique serial number
identifying each game;
(2) a
description of the game sufficient to categorize the game relative to other
games;
(3) the total number of
electronic linked bingo faces in play in the game;
(4) the jackpot prize of the entire
game;
(5) the purchase price per
electronic linked bingo face assigned to the game;
(6) the time and date that the game became
available for play; and
(7)
locations where the game is being played.
B. An electronic linked bingo game report
must be available to the board on demand for each completed game. The report
must contain the following information:
(1) a
unique serial number identifying each game;
(2) a description of the game sufficient to
categorize the game relative to other games;
(3) the total number of electronic linked
bingo faces played and sold;
(4)
the time and date that the game became available for play;
(5) the time and date that the game was
completed or removed from play;
(6)
the ball draw;
(7) locations where
the game was played;
(8) the
detailed accounting for each site, including total faces played, and prizes
awarded;
(9) the final payout
percentage of the game when removed from play; and
(10) the purchase price per electronic linked
bingo face assigned to the game.
C. Other electronic linked bingo game reports
that must be available to the board on demand are:
(1) Active site reports:
(a) site name, address, and telephone
number;
(b) licensed organization
name and license number;
(c)
premises permit number and number of devices at site; and
(d) must be able to distinguish sites that
are not active.
(2)
Revenue reports:
(a) daily activity by site,
by organization, and for all sites;
(b) site name and license number;
(c) premises permit number;
(d) number of devices in use at the
site;
(e) bingo faces sold and the
gross receipts;
(f) prizes
awarded;
(g) net
receipts;
(h) payout
percentage;
(i) actual cash sales
(dollar amount);
(j) actual cash
redeemed (dollar amount); and
(k)
unredeemed cash credits.
(3) Month-end reports for each site totaling
all daily sales activity, detail of all games closed during the month, and
status of games remaining in play.
(4) Inventory reports:
(a) current site inventory showing beginning
of the day inventory, additions, faces sold, and ending inventory;
and
(b) month-end reports for each
site showing faces received, put into play, and removed from play.
(5) Faces purchased, sold, and
maintained by distributor.
(6)
Real-time site activity report with the ability to:
(a) view live activity at site;
(b) view each active device noting the device
number, current credits, and game being played; and
(c) view each transaction with date and time
stamp, including seller log-in and log-off, device load, game play, device
redeemed, and any malfunction.
(7) System user list:
(a) full name of sellers, assistant gambling
managers, and gambling managers;
(b) position (seller, assistant gambling
manager, gambling manager, distributor, linked bingo game provider, or Gambling
Control Board investigator);
(c)
site name, organization name, or other description;
(d) seller, assistant gambling manager,
gambling manager, board investigator, and distributor user ID;
(e) access level; and
(f) contact telephone number and
e-mail.
(8) A seller's
system access must be limited to the following information within the end of
shift reports and end of day reports:
(a) cash
in;
(b) cash out;
(c) unredeemed credits;
(d) gross receipts;
(e) prizes paid; and
(f) net receipts.
D. Other statistical and activity
reports as required by the board and maintained by the linked bingo game
provider must be provided in a format prescribed by the board upon
request.
Subp. 28.
Electronic game system.
A. Each
component of an electronic game system must function as indicated by the
communication protocol implemented by the licensed linked bingo game provider
of the electronic linked bingo game system.
B. All communication between a server and the
electronic linked bingo devices must use authentication and encryption
protection employing Advanced Encryption Standard (AES) specifications as
defined by the National Institute of Standards and Technology (NIST) to provide
secure authentication of the device and the server, ensure the integrity of the
data communicated, and for confidentiality.
C. The communicated data must be encrypted.
All systems must require virtual private network (VPN) or secure sockets layer
(SSL) encrypted tunneling protocols unless otherwise approved by the board. The
certified testing laboratory must examine each submitted electronic game system
to ensure that the proposed field configuration will be secure. The certified
testing laboratory may provide additional security recommendations to maintain
the integrity of the configuration.
D. The electronic game system must be capable
of being tested by the board to verify approved product.
Subp. 29.
Electronic game system
security.
A. The electronic game system
security must be designed or programmed in such a way that it may only
communicate with authorized electronic devices using a nonbroadcasting
encrypted system.
B. The electronic
game system security must include the ability to automatically disable an
electronic linked bingo device if the device goes beyond a physical property
restriction at a sales location. The device must remain disabled until
reactivated at the point of sale.
C. The electronic game system must be secure
from all other site communication systems and users at a gambling
site.
Subp. 30.
Firewall protection.
All communications must pass through at least one
application-level firewall recognized by the certified testing laboratory.
Alternative network paths are allowed if equally protected by a firewall. The
firewall application must maintain an audit log of the following information
and must disable all communications if unauthorized access is detected:
A. all changes to configuration of the
firewall;
B. all successful and
unsuccessful connection attempts through the firewall; and
C. the source and destination IP addresses
and port numbers.
Subp.
31.
Remote access.
Where permitted by the board, remote access must authenticate
all computer systems based on the authorized settings or firewall application.
The following are additional requirements:
A. no unauthorized remote user administration
functionality;
B. no unauthorized
access to any database other than information retrieval using existing
functions;
C. no unauthorized
access to the operating system and application software; and
D. maintenance of an activity log that
includes:
(1) the IP address where any change
originated;
(2) log-in
name;
(3) time and date the
connection was made;
(4) duration
of connections;
(5) activity while
logged in, including the specific areas accessed and changes made;
and
(6) the time and date must be
accurate on all components of each system at each site.
Subp. 32.
Data access by
board.
The system must include on-demand remote access at all times by
the board to all electronic reporting data without participation of the linked
bingo game provider or the distributor.
Subp. 33.
Test system and
equipment.
Linked bingo game providers must provide a test system and
equipment to the Gambling Control Board, at the linked bingo game provider's
expense, to test pending and approved games.
Subp. 34.
Test software.
A. Linked bingo game providers must provide
identical software to the board as part of system approval by an independent
testing laboratory and must disable the ability to write to the hard
drive.
B. Linked bingo game
providers must allow regulatory test software to be added to an electronic game
system to verify approved product.
Subp. 35.
Activation of daubing.
The system must acknowledge that a player has activated the
daubing process.
Subp. 36.
Prior board approval required for electronic gambling equipment;
conformance with standards for previously approved electronic gambling
equipment; independent laboratory testing required for certain electronic
gambling equipment.
This subpart applies to board approval of electronic gambling
equipment, conformance with standards for previously approved electronic
gambling equipment, and independent laboratory testing required for certain
electronic gambling equipment.
A.
Before the sale, lease, or distribution of any electronic gambling equipment in
Minnesota, a linked bingo game provider must obtain prior board approval for
the electronic gambling equipment. The linked bingo game provider must provide
to the director at no charge the following:
(1) the list of proposed equipment in an
electronic format or other format approved by the board;
(2) the electronic linked bingo games;
and
(3) the electronic linked bingo
test system and equipment to be used to determine compliance with this
part.
B. Electronic
gambling equipment must be received by the board on or before the 15th day of
the month to ensure consideration at the board's meeting the following
month.
C. The board must notify the
linked bingo game provider in writing no later than five days after a board
meeting of the board's decision on whether the product is approved for sale in
Minnesota.
D. For changes to the
payout structure for any approved game, the linked bingo game provider must
assign a new game identification and submit the game to the board for approval
before being offered for sale in Minnesota.
E. For changes to approved electronic
gambling equipment, the linked bingo game provider must submit the changes to
the director for review and, if required by the director, equipment must be
submitted for review and approval by the board. Electronic gambling equipment
approved prior to June 16, 2014, must become compliant within 180 days of June
16,2014.
F. Within 14 days of
receipt of an electronic linked bingo game, the director must notify the linked
bingo game provider in writing of the director's decision to recommend approval
or recommend denial.
(1) The written notice of
the director's recommended denial must state the basis for the director's
recommendation of denial. Within 14 days of receipt of a notice of the
director's recommended denial, the linked bingo game provider may request a
contested case hearing under Minnesota Statutes, chapter 14.
(2) The written notice of the board's denial
must state the basis for the board's denial.
G. Linked bingo game providers are in
compliance if the electronic gambling equipment is approved by the board and is
produced in compliance with the standards prescribed in this part. Once
approved, a linked bingo game provider may not change the equipment without
prior approval of the board, in compliance with this subpart and part
7863.0260, subpart 1a.
The board shall withdraw its approval if it determines that the
electronic gambling equipment was not manufactured in compliance with standards
in this part. If the board decides that its approval should be withdrawn, the
board will notify the linked bingo game provider of its right to request a
contested case hearing under Minnesota Statutes, chapter 14.
H. Not later than December 31 of each
calendar year, a linked bingo game provider must submit to the board, on a form
prescribed by the board, a list of all board-approved games that it intends to
sell in Minnesota. Any board-approved game not included on the linked bingo
game provider's list, or any board-approved game that has not been played by a
licensed organization in Minnesota in the previous two calendar years, will be
considered abandoned by the linked bingo game provider and will be removed from
the board's approved games database. Nothing in this subpart prohibits a linked
bingo game provider from voluntarily informing the board at any time of an
abandoned game. A voluntarily abandoned game may not be provided by a linked
bingo game provider for play in Minnesota unless the game is reapproved by the
director.
I. Independent testing of
electronic gambling equipment includes:
(1)
electronic linked bingo game devices;
(2) programmable electronic
devices;
(3) electronic linked
bingo game systems;
(4) upgrades or
changes to previously approved and tested equipment;
(5) other technical hardware devices used in
conjunction with lawful gambling equipment; and
(6) software applications and version
upgrades used in conjunction with lawful gambling equipment.
Statutory Authority: MS s
349.151;
349.163
