Myths and strategy, tested
Gravity-pick machines let millions verify a draw by watching; software draws replace that with certificates and code audits. Both can be honest — but the one insider fraud in modern history hit the software side, and the industry noticed.
Every lottery faces a foundational engineering choice: mix numbered balls in a chamber on live television, or ask a computer for numbers. Both can be honest. Both can be tested. But they are honest in fundamentally different ways, and the difference — transparency versus auditability — explains one of the industry's most interesting conservatisms: in an age of cheap computing, the flagship games of the world's biggest lotteries still revolve around perspex drums and bouncing balls.
A physical draw is transparent. The randomising event — dozens of balls churning under gravity or air jets — happens in public, in real time, on camera. Anyone watching verifies the process directly: the balls are visibly mixed, visibly drawn, visibly numbered. The supporting controls (weighed ball sets, certified tolerances, sealed storage, on-the-night machine selection, external auditors) exist to guarantee the objects on screen are what they appear to be. Verification scales to the whole audience: a million viewers are a million witnesses.
A software draw is auditable. The randomising event happens inside silicon in a fraction of a millisecond. No audience can witness it even in principle; what exists instead is a paper trail — source-code review, entropy-source analysis, statistical batteries run over billions of outputs, change control, and a certificate from a testing laboratory. Independent labs such as Gaming Laboratories International certify RNGs by verifying statistical randomness, unpredictability, uniform distribution and absence of bias across software, hardware and hybrid generators, under standards regulators adopt by reference. Done properly this is rigorous — arguably more statistically rigorous than anything ever demanded of a ball machine. (How those lab tests actually work is covered in certified RNGs and testing labs.)
The asymmetry: transparency is verified by everyone, continuously; auditability is verified by a few experts, occasionally. A ball draw's integrity fails loudly and publicly. A software draw's integrity fails silently, in a place only insiders can see.
This isn't a hypothetical distinction. Between 2005 and 2011, Eddie Tipton — information-security director of the Multi-State Lottery Association, and a builder of its draw computers — kept rootkit-style code in RNG machines that produced predictable "winning" numbers on a few specific dates each year, rigging draws in five states before a suspicious $16.5 million claim unravelled the scheme. The full anatomy is in our Tipton article; what matters here is which trust model failed and how.
Every audit of those machines passed. Every test draw looked clean. Every statistical property of the output was impeccable, because the machines were properly random on every day the auditors looked. The failure wasn't detectable in the code's behaviour or the numbers' statistics — it was a trusted insider subverting the artefact that everyone else had to take on faith. That is the precise failure mode the auditability model is weakest against: certification tells you the system as reviewed was fair, not that the system as running tonight is the one that was reviewed.
Now run the same attack against a televised ball draw. To rig it, an attacker would need to physically alter balls that are weighed against certified tolerance ranges before each draw, stored under seal, selected from rotating sets on the night, and handled in front of external CPA auditors, public witnesses and a live camera — as documented in Texas and Pennsylvania drawing procedures. Not impossible in some cosmic sense, but requiring physical conspiracy across multiple independent people and surviving physical measurement that same evening. The attack surface shrinks from "one privileged mind" to "a roomful of adversarial witnesses plus a scale".
So why do many major lotteries — Powerball's twin drums, EuroMillions' machines, UK Lotto's — keep gravity-pick hardware that is slower, costlier and occasionally jams on live TV? Because for a flagship jackpot game, trust is the product. A lottery sells a 1-in-292-million dream, and the dream requires total public confidence in the draw; the theatre of balls on television isn't decoration, it is the security model, legible to every viewer without a single certificate. After Tipton, that logic strengthened — insider-play rules tightened, RNG governance was overhauled industry-wide, and the case became the standard argument for keeping flagship draws physical.
Software draws still make sense, and are used honestly at scale — for rapid-fire games with draws every few minutes, for instant tickets, for online games where no broadcast exists anyway. There, certification plus layered oversight is the only feasible model, and post-Tipton practice (independent labs, hardware entropy, output logging, separation of duties) is far harder to subvert than one man with root access. The public statistical record gives everyone a backstop either way: results histories are open, and tools like our randomness tester let you probe them — with the honest caveat, from the ball-bias maths, that statistics detects biased processes slowly and predicted outcomes never.
Neither model is "the honest one". But if you ever wonder why your national lottery still pays a camera crew to film balls falling down a tube, the answer is that transparency is the one security property you cannot download.
Last verified: 2026-08-29