The VGCCC has fined Tabcorp $1 million for not complying with Commission directions issued during an investigation of the company’s major system outage in 2020.
This is the largest ever fine imposed by the Victorian Gambling and Casino Control Commission (VGCCC) on Tabcorp, and is said to reflect repeated failure to comply with directions on information concerning the outage, which left the gaming giant’s Wagering and Betting System (WBS) unavailable for approximately 36 hours.
Global Switch Ultimo (GSU) data centre houses a dedicated Tabcorp space for storage, networking and computer equipment. On Saturday, 7 November 2020, Tabcorp’s WBS suffered a major outage to internal and customer-facing systems, causing a shutdown of core customer services.
Approximately 700 servers were affected, impacting applications in the managed private cloud environment across Gaming, Lotteries and Keno, Wagering and Tabcorp’s corporate systems. The next business day, Tabcorp announced to the ASX that lost turnover was estimated to have impacted EBITDA by less than $10 million.
Victoria entered into the Agreement (WBA) with Tabcorp Wagering (Vic) P/L on 19 December 2011. The agreement carries an obligation for the WBS to be continuously available. As a result of the outage, the Victorian Commission for Gambling and Liquor Regulation (VCGLR) – predecessor to the VGCCC – commenced an investigation.
After Tabcorp failed to voluntarily provide adequate information, the Commission used its powers to issue directions.
First was for an independent expert assessment of the suitability of the system’s business continuity and disaster recovery infrastructure and processes, and to provide a copy of the report to the Commission upon completion.
A report prepared by Deloitte was provided, but the Commission determined it did not confirm whether the continuity and disaster recovery arrangements established since the outage were fit for purpose – to deliver the “continuously available” requirement by the Agreement, and as required by the first direction.
The second direction was for an independent assessment of the Disaster Recovery (DR) capabilities of the WBS.
The Commission extended the original deadline on this until 31 May 2022, but the final report was not submitted until 27 September, which was deemed by the regulator to represent another failure to comply. (Full Decision HERE.)
Victoria’s WBA with Tabcorp includes a Clause [2.3], which provides that the Licensee must at all times act reasonably and in good faith in its dealings with the State.
The maximum penalty for contravening Commission directions is $9.087 million.
Tabcorp’s conduct over the course of the investigation and in response to the directions were said to have impacted the Commission’s ability to both understand the cause of the outage, and to gain confidence that it would not happen again.
VGCCC Chair Fran Thorn described Tabcorp’s conduct as “unacceptable” and warns licensees must be forthcoming and cooperative during an investigation.
“The Commission had to use its compulsory powers and issue directions because Tabcorp did not provide the information we required about the business continuity and disaster recovery capability of its systems.”
The Commission stresses that Tabcorp’s failure to comply led to the major fine, and expressed “concern” about its lack of co-operation but also its apparent “lack of interest” in engaging positively, proactively and promptly to resolve issues.
“All entities we regulate — no matter how big or small — have an obligation to be open and honest with the Commission and responsive to its lawfully issued directions,” says Thorn.
“We will not tolerate attempts to frustrate our investigations.”
Tabcorp’s own submissions suggested its current management would do things differently.
