ELECTRONIC RAFFLE SYSTEMS MINIMUM TECHNICAL STANDARDS FOR MEGA RAFFLES

ELECTRONIC RAFFLE SYSTEMS MINIMUM TECHNICAL STANDARDS FOR MEGA RAFFLES DRAFT - SEPTEMBER 2016

AGCO VISION A leader in the alcohol, gaming and horse racing sectors through effective regulation and services that are fair, responsive and in the broader public interest. AGCO MANDATE To regulate the alcohol, gaming and horse racing sectors in accordance with the principles of honesty and integrity, and in the public interest. Alcohol and Gaming Commission of Ontario 90 SHEPPARD AVE E - SUITE 200 TORONTO ON M2N 0A4 Fax: 416 326-8711 Tel: 416 326-8700 or 1 800 522-2876 toll free in Ontario http://www.agco.on.ca Queen s Printer for Ontario, 2016 Disponible en Français

Table of Contents Introduction 4 Operational Requirements 4 Definitions 5 1. Operational Requirements 7 2. Technical Standards 8 Part A: RAFFLE GAME MANAGEMENT 8 General 8 Administration of Raffles 8 Raffle Game Design 8 Raffle Game Rules and Displays 9 Part B: RAFFLE GAME PROCESS 10 Ticket Purchasing 10 Ticket Assignment 10 Communication to Player 11 Ticket Cancellation 11 Raffle Draw(s) 11 Verification of Draw 12 Distribution of Prize 12 Part C: ELECTRONIC RAFFLE SYSTEM (ERS) 13 Design 13 Recovery 13 Software Random Number Generator (RNG) 14 Physical Randomizers 14 Records and Data Governance 15 Reporting 16 Access Control 16 Secure Configuration 17 Monitoring and Incident Response 18 Software Authentication 18 Part D: OTHER REQUIREMENTS 20 Independent Security Assessment 20 Remote Access 20 Forensic Capability 20 Submission Requirements 20

Introduction The Registrar of Alcohol, Gaming and Racing is appointed under the Alcohol and Gaming Regulation and Public Protection Act, 1996 and has powers and duties under the Gaming Control Act, 1992 and its Regulations. Under section 3.8 of the Gaming Control Act, 1992, the Registrar is authorized to establish standards and requirements for the conduct, management and operation of Gaming Sites, lottery schemes or businesses related to a Gaming Site or a lottery scheme. The Registrar has specified these technical standards as the minimum standards to be used in assessing Electronic Raffle Systems (ERS) for mega Raffles with Prize boards over $1 million for approval in Ontario, as applicable to a specific solution. The AGCO has developed minimum Raffle standards based on vulnerability-risk analysis of mega Raffle products, and review of other jurisdictional standards. These standards reflect typical mega Raffle system architecture and Raffle Game processes when addressing general technical integrity, safety, security and accounting capability of Raffle products, including those related to Random Number Generator (RNG), authentication of Critical Raffle Software, IT security, ERS audit capability, and similar considerations. These minimum technical standards will become effective on September 1, 2016. Stakeholders are encouraged to initiate consultations with the AGCO at the concept and/or design phase(s) in their product development life cycle in order to minimize any deficiencies being discovered during the product assessment and approval. From time to time, as necessary, modifications will be made to the Standards. Operational Requirements These standards should be read in conjunction with Operational Requirements in section one of this document. 4 Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016

Definitions AGCO: Alcohol and Gaming Commission of Ontario. Cancelled Ticket: A Raffle Ticket whose purchase was cancelled. The ERS is designed to either return the Raffle Numbers to the pool for sale or not. Charity: An organization that has met the eligibility criteria to hold a lottery licence under which it may conduct and manage a Raffle. Critical Data: Data that is considered vital to Raffle. This includes, but is not limited to: a. Ticket transactions; b. Prize distribution; c. Raffle configurations; d. Results of Raffle Draws; and, e. Software state (the last normal state the ERS was in before interruption). Critical Raffle Software: Any software and data which affect the integrity or outcome of the Raffle or the interpretation of Raffle outcome. This includes, but is not limited to, any software that is used to control Raffle functions, Raffle outcome, Prize distribution, security or accounting functions, and related data including fixed data and graphics files used to interpret Raffle outcome. Critical Raffle Software does not include Critical Data. Draw: A random selection of winning Raffle Number(s) (or winners) conducted at a predetermined and scheduled time by means of a Random Number Generator. Electronic Raffle System (ERS): A type of Gaming System for the purpose of conducting Raffles. Game: A lottery scheme with the outcome based on chance. Gaming Equipment: means products including bingo paper, Lottery Tickets, equipment, systems and software if they are used, a. in the conduct, management or operation of lottery scheme, b. to record or transmit information about a lottery scheme or related transactions, or c. to provide security and surveillance services for a lottery scheme. Gaming Site: A premises or an electronic channel maintained for the purpose of playing or operating a lottery scheme. Gaming Supplier (also known as Supplier): The provider of the Gaming Equipment. Gaming Supplies: Gaming Equipment that could influence or is integral to the conduct, management or operation of a lottery scheme. Gaming System: Hardware, software, applications and all associated components of Gaming Supplies and the technology environment. Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016 5

Lottery Ticket: A chance to participate in a lottery scheme. Operator: A person who operates a Gaming Site, and includes the Charity. Prize: A payout associated with winning Raffle Number(s). Raffle: A lottery scheme where Tickets are sold for a chance to win a Prize at a Draw, and includes 50/50 Draws. Raffle Number: Unique ERS-generated number assigned to Raffle Ticket. Raffle Ticket (also known as Ticket): A type of Lottery Ticket in the form of an electronic record or paper Ticket with Raffle Numbers for the purpose of participating in Raffle Draw(s). Randomness or Chance: Observed unpredictability and absence of a pattern in a set of events that have definite probabilities of occurrence. Random Number Generator (RNG): Hardware and/or software used to generate numbers which exhibit Randomness. Voided Ticket: A Raffle Ticket whose Raffle Numbers are removed from the pool of valid Raffle Numbers by ERS. 6 Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016

1. Operational Requirements 1.1 All Electronic Raffle Systems (ERS), including any subsequent modifications to the approved ERS, shall be submitted to the Registrar for assessment and approval, at the expense of the Supplier, prior to being made available for use. 1.2 ERSs shall be provided, installed, configured, maintained, repaired, and operated in accordance with the Registrar s approval and in a way that ensures the integrity, safety and security of the approved ERSs. Requirements At a minimum: a. Only ERSs approved by the Registrar shall be used; b. The Registrar shall be immediately notified where there is any problem with the integrity or security of the ERS; c. Monitoring and testing shall be performed throughout the life of the ERS to ensure it is operating as approved; and d. In the event of any suspected integrity or security problem with an ERS, the current state of the ERS and any supporting evidence shall be preserved until the Registrar has provided direction. 1.3 Procedures shall be established and documented for IT operations and incident management, including managing, monitoring and responding to security and integrity events. Requirement At a minimum a. Proactive monitoring and detection of errors in the ERS and related components shall be in place. 1.4 Player information (which must be owned by the Licensee) shall be securely protected. Requirements At a minimum: a. Data collection and protection requirements for player personal information shall meet those set out in applicable legislation; and b. Player information shall only be used for the Licensee s business unless there is prior approval from the Licensee. 1.5 Gaming-related Suppliers shall stay current on security trends, issues and solutions. Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016 7

2. Technical Standards PART A: RAFFLE GAME MANAGEMENT GENERAL 2.1 All ERSs, including any subsequent modifications to the approved ERS, shall be submitted to the Registrar for assessment and approval, at the expense of the Supplier, prior to being made available for use. 2.2 The Electronic Raffle System (ERS) must ensure integrity of all computerized aspects of the Raffle Game, including but not limited to: a. Sale (ordering, collection of player s data and payment process), assignment to Draw(s) and cancellations/voiding of Raffle Tickets; b. Selection of winner(s); and c. Distribution of Prize(s). ADMINISTRATION OF RAFFLES 2.3 Only authorized personnel shall be permitted to configure the Raffle Draw and Ticket information. 2.4 Any and all setting or changing of Raffle configurations must be logged sufficiently for audit purposes, including: user, date/time and details of the change. 2.5 The ERS must have ability to enable only approved production Raffle configurations e.g. single Ticket for multi-event Draw or single event Draw, and single Ticket for multiple Draws. 2.6 The ERS must have the ability to set the date and time period during which Raffle Tickets may be purchased for a Raffle Draw. 2.7 The ERS must not allow change of Raffle configurations once the sale of Raffle Tickets has commenced. RAFFLE GAME DESIGN 2.8 Raffle Game design and features shall be clear and shall not mislead the player. 2.9 All possible Game outcomes (winning and losing outcomes) shall be available in each play, unless clearly explained in the rules of play. 8 Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016

RAFFLE GAME RULES AND DISPLAYS 2.10 Meaningful and accurate information shall be provided to enable individuals to make informed choices. Requirements At a minimum: a. Meaningful and accurate information on the rules of play shall be clearly stated and made available to players; b. Meaningful and accurate information on the odds of winning shall be clearly stated and made available to players; c. Odds of winning each Prize shall be clearly stated and made available to players. In Raffles where the odds depend on the number of Tickets sold, the maximum number of Tickets and number of Prizes must be clearly stated and made available to players; d. The value of each Prize shall be clearly stated and made available to players; and e. The purchase price of each Ticket, or multiple Tickets, must be clearly stated and made available to players. 2.11 Relevant information about the AGCO shall be displayed and easily accessible to the player. Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016 9

PART B: RAFFLE GAME PROCESS TICKET PURCHASING 2.12 Prior to participating in Game play, players must affirm that they are fit for play, if online. 2.13 Players shall acknowledge and accept the terms of the contract between the player and Charity prior to the purchase of a Ticket. 2.14 ERS must have ability to enable only approved production options for ordering of Raffle Tickets. 2.15 Lottery schemes shall be provided only within Ontario, unless the lottery scheme is conducted in conjunction with the government of another province. 2.16 Relevant player information to uniquely identify a player for the purposes of sale, distribution and audit of Prizes shall be collected and saved upon Ticket purchase and shall be verified to be complete and sufficient before a Raffle Ticket is sold to a player. Requirements At a minimum, the following information shall be gathered at the time of Ticket purchase: a. Full name; b. Age range; c. Address; and d. Phone number. 2.17 Only eligible individuals are permitted to purchase Raffle Tickets. An individual under 18 years of age shall not be permitted to play. 2.18 Tickets must not be issued until payment is confirmed. 2.19 If credit cards payments are offered by ERS, the Supplier and ERS must be compliant with current Payment Card Industry s Data Security Standards (PCI DSS). TICKET ASSIGNMENT 2.20 Upon verification and authorization of payment, player must be provided a Raffle Ticket, or receipt of their Ticket purchase, containing information necessary for identifying the Raffle Draw and for validating the Ticket following the Raffle Draw. Requirements At a minimum, the following must be displayed: 10 Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016

a. Ticket price; b. Event identifier; c. Draw identifier; d. Raffle Ticket Number(s); and e. Draw date(s). 2.21 There shall be no duplicate Raffle Numbers issued or in the Draw. 2.22 Voiding Raffle Tickets and Cancelling Raffle purchases may only be performed by authorized personnel and must be fully auditable. 2.23 The ERS must ensure that Voided Raffle Ticket Numbers cannot be resold or reissued. COMMUNICATION TO PLAYER 2.24 Players must be provided information, or a method to obtain such information, to be able to identify their Raffle Ticket Number prior to time of the Draw. TICKET CANCELLATION 2.25 The ERS must support cancellation of purchased Tickets prior to the close of the Raffle sales. All Cancelled Tickets must be logged and be auditable and any completed payments must be refunded to the player. RAFFLE DRAW(S) 2.26 Raffle Draw(s) shall only be conducted after: a. Closure of the Raffle sales for the Draw(s); b. Full reconciliation of all valid and Voided Tickets; c. Full financial reconciliation of Tickets eligible for the Draw; d. Full financial reconciliation of sales, if necessary to determine Prize amounts of the Draw(s); and e. Verification that only valid Raffle Numbers are entered into the Draw(s). 2.27 The Raffle Draw(s) must be conducted using a random selection process. 2.28 The Draw(s) must include all valid Raffle Numbers, and exclude all invalid Raffle Numbers, e.g. Voided Tickets. Raffle Numbers from Cancelled Tickets that are not returned to the pool for sale must not be in the Draw. Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016 11

2.29 The ERS must accurately and securely log any Raffle Draw and its related information for each Raffle Draw. VERIFICATION OF DRAW 2.30 The ERS must provide the ability to independently verify the results of each Raffle Draw if the outcome and recording of winning Tickets is not a fully automated process. At a minimum, the following must be independently reconciled for each Draw prior to distributing the Prizes: a. Selection of winners; and b. Assignment of Prizes. DISTRIBUTION OF PRIZE 2.31 If displayed, the outcome of the Raffle shall be accurate, clear and easy to understand. 2.32 The Prize(s) must be awarded according to the advertised Game rules. 2.33 Winners must be notified in accordance with the approved rules of play. 2.34 ERS shall only enable approved production options for distribution of Prizes. 2.35 Prizes shall be distributed to the holder of the winning Ticket. 12 Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016

PART C: ELECTRONIC RAFFLE SYSTEM (ERS) DESIGN 2.36 All ERSs critical to the outcome of the Raffle shall reside in Ontario, unless the lottery scheme is conducted in conjunction with the government of another province. 2.37 Industry accepted components, both hardware and software, shall be used where possible. 2.38 The ERS architecture shall limit the loss of critical and sensitive data and Draw information. 2.39 Mechanisms shall be in place to ensure the reliability, integrity and availability of the ERS. 2.40 If other non-critical Game Software and systems are present, they must not affect the integrity or outcome of Raffle Game or the interpretation of Game play or Game outcome. 2.41 Production, testing and development ERSs shall be logically separated. 2.42 The ERS shall only display the minimum information about itself to unauthorized users and during ERS malfunctions. 2.43 The ERS components must have a method of synchronizing clocks. 2.44 The ERS and all devices shall validate inputs before inputs are processed. 2.45 User input fields must be validated to prevent malicious inputs from being processed 2.46 Architecture and infrastructure must be designed and tested to ensure the integrity of the ERS under anticipated load. 2.47 The ERS architecture and all its related components shall demonstrate security in depth. 2.48 Communication of sensitive data shall be protected for integrity using industry good standards. RECOVERY 2.49 The ERS shall be recoverable so that there is no impact on the integrity of the Raffle or the ability to audit the Raffle. Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016 13

2.50 Where the ERS is not recoverable, the rules of play shall clearly define the Operator s policies in respect of treating the player fairly when resolving the player s transactions. SOFTWARE RANDOM NUMBER GENERATOR (RNG) The following requirements are applicable to software Random Number Generators and their implementation. 2.51 Random number generators must generate numbers which are: a. Statistically independent; b. All values within the desired range must have an equal chance of being generated; c. Able to pass various recognized statistical tests; and d. Unpredictable. 2.52 The range of randomly generated numbers must correspond to the range of sold Raffle Numbers, including both high and low end range of sales. Specifically, the random numbers must produce statistics that lie within the 99% confidence interval for various empirical statistical tests, including but not limited to frequency test, runs test and serial correlation test. 2.53 The RNG output must not exhibit detectable patterns or correlation with any previous RNG output. 2.54 The ERS must not make any secondary decision to change the winning Raffle Numbers. 2.55 The RNG and/or ERS must implement a mechanism to prevent the determination of RNG seeds. 2.56 RNG seed must be reinitialized, if corrupted. 2.57 Where the selection process of winning Raffle Numbers is interrupted, the original selection must be preserved until full ERS recovery. 2.58 The ERS must use secure communication protocols to protect RNG and random selection process. 2.59 Pools of Raffle Numbers must be stored securely. PHYSICAL RANDOMIZERS 2.60 If applicable, physical randomizers that use the laws of physics to determine winning 14 Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016

Raffle Ticket, must preserve Raffle Game integrity and Randomness of Raffle Draws (e.g. shuffling of Tickets). Note: The Randomness and implementation of physical randomizers will be assessed on case-by-case basis. RECORDS AND DATA GOVERNANCE 2.61 There shall be appropriate, accurate and complete records of transaction and Raffle information kept and made available to the Registrar for the purposes of audits and resolving player disputes. At a minimum there should be an adequate amount of storage, capacity and retention of logged information. 2.62 The ERS must record and store complete player information, Ticket and financial transactions, and Draw accounting data for all valid and Voided Tickets, including at a minimum: a. Name of organization conducting Raffle event; b. The Draw ID, date and time; c. Date and time of Ticket issuance; d. Ticket price(s); e. List of Prizes; f. Winning Raffle Numbers and Prize values; g. Financial information sufficient to reconcile Ticket sales, including payment method, price points of sold Tickets; h. Personally identifiable information for the players, including name, address, age and contact information; i. Individual Ticket information per section 2.20; j. Ticket status; k. Ticket transactions history, including voiding and cancellation of Tickets; l. Type of transaction or other method of differentiating Ticket types; and m. Prize distribution status. 2.63 Adjustments and corrections to Critical Data are permitted by authorized individuals, provided the following information is recorded in unalterable log: a. Name of authorized user who performed the change; b. Date and time of change; Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016 15

c. Type of data changed; and d. The value before and after change. 2.64 Data governance shall be in place to address data processing integrity and protection of sensitive data. 2.65 Sensitive data, including player information, financial transactions, credit/debit card information and data relevant to determining Raffle outcomes, shall be secured and protected from unauthorized access or use at all times. REPORTING Requirements At a minimum: a. The ERS shall ensure that data is appropriately backed up in a manner that allows it to be completely and accurately restored. 2.66 The ERS must at a minimum contain the following information in reports for complete audit trail, capable of being generated on-demand, for specific time periods, and for specific activities: a. Raffle Transactions - Information on all Ticket transactions and Draw accounting handled by the ERS, including: all valid, Cancelled and Voided Tickets with Raffle Ticket Numbers, Ticket price, total sales, winning Raffle Ticket Numbers and Prizes distributed; ACCESS CONTROL b. Security Events any information on access and attempted authentication including: component accessed, username, success or failure of authentication, time, any changes made; and c. Error Logs All critical errors, such as ERS application crashes, failed software authentication and communication errors. 2.67 Users shall be granted minimal access to the ERS based on business need. Requirements At a minimum: a. Access privileges are granted, modified and revoked in a timely manner based on the person s job requirement; b. Access privileges shall be clearly documented; c. Access privileges are independently reviewed and confirmed on a periodic basis; and d. All ERS accounts shall be uniquely assigned to an individual. 16 Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016

2.68 Any changes to user access privileges must be logged by the ERS to track: user performing the change, nature of the change, and time of the change. At a minimum, the following actions must be logged: a. Account creation; b. Account removal; c. Disabling/suspension of an account; d. Password change; e. Change in role; and f. Change in permissions. 2.69 A mechanism shall be in place to ensure that the assignment of administrator accounts is approved by the Operator s management and that usage is regulatory reviewed for appropriateness. 2.70 Inappropriate use of ERS accounts shall be logged, reviewed and addressed within a reasonable period of time. 2.71 A secure authenticator that meets industry good practices (e.g. password, fingerprint) shall be used to identify a user and his or her account to ensure that only authorized individuals are permitted to access their ERS account. Requirements At a minimum: a. The ERS shall automatically lock out accounts should identification and authorization requirements not be met after a defined number of attempts; b. Passwords shall not be communicated in plain text; and c. The ERS must not have hardcoded passwords. 2.72 Physical and logical access to the ERS must be fully auditable and all related events must be logged. SECURE CONFIGURATION 2.73 ERS, infrastructure, data, activity logs and all other related components shall be protected from threats, vulnerabilities, attacks or breaches to ensure the integrity and security of the ERS. Requirements At a minimum: a. All users shall be authenticated; b. All ERS components and connections between the ERS and any other system, whether internal or external third party, shall be hardened in accordance with Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016 17

industry and technology good practices prior to going live and prior to any changes; c. The appropriateness and effectiveness of steps taken to harden technology components shall be regularly assessed; d. The ERS shall be protected against malware; and e. Patches to correct any security risks shall be updated regularly. MONITORING AND INCIDENT RESPONSE 2.74 Security activities shall be logged in an auditable manner, monitored, promptly analyzed and a report prepared and escalated as appropriate. Requirements At a minimum: a. Attempts to attack, breach or access ERS components in an unauthorized manner shall be responded to in a timely and appropriate manner; b. Intrusion attempts shall be actively detected and where possible prevented from causing disruption or outage of the ERS; and c. There shall be adequate logging to capture and monitor any attempts to attack, breach or access in an unauthorized manner any components of the ERS. There shall be an appropriate escalation procedure. SOFTWARE AUTHENTICATION 2.75 The Gaming System shall be able to detect unauthorized changes. 2.76 A mechanism shall be built into the Gaming System to verify the integrity of the Critical Game Software that is deployed to production, including before changes are implemented, as well as on an ongoing basis to ensure the approved software is being used, and to ensure no unauthorized changes are made to the approved software. At a minimum, the ERS must be successfully authenticated: a. Immediately prior to each Draw; b. Automatically at regular intervals during operation; and, c. On demand by the Supplier, Charity or AGCO. Note: The authentication method will be evaluated on a case-by-case basis and approved by the Registrar based on good industry practices, e.g. calculation of software SHA-1 values which are compared against a protected master list of signatures (i.e. encrypted SHA-1 values). 18 Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016

2.77 If the ERS does not have the capability to self-authenticate, the Charity may perform this authentication manually in the interim. 2.78 If the self-authentication fails, the software that fails authentication must enter an error condition, safely stop operation and notify the Supplier. The AGCO and the Charity must be immediately notified of the failure, including the details of the failed authentication. 2.79 Modifiable files such as configuration settings do not need to be included in any of these software verifications required by 2.76. However, the configurations that are critical must only be settable in a way that does not compromise Game integrity. Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016 19

PART D: OTHER REQUIREMENTS INDEPENDENT SECURITY ASSESSMENT 2.80 Prior to the ERS being made available for play, periodically once the ERS has gone live, and following any significant infrastructure or application upgrade or modification, the ERS must be assessed in accordance with industry good practice security frameworks by independent and qualified individuals to ensure that security vulnerabilities are identified and assessed, and risks are confirmed to be negligible through security/ penetration testing of the applications and infrastructure, as applicable. REMOTE ACCESS 2.81 Any remote access methods and associated procedures must limit access to authorized users and systems to perform specific tasks only through a secure link. 2.82 Remote access to ERS may only be granted to either the Charity or the registered Supplier from their respective secure business network such as VPN client with two-factor authentication, provided the ERS automatically monitors and records the log-on name, time and date the connection was made, duration of the connection, and activity while logged-in, including the specific areas accessed and Raffle related changes made. FORENSIC CAPABILITY 2.83 Critical Data related to the Raffle must be preserved under irregular conditions, e.g. malfunctions and error conditions, where technically possible. 2.84 Forensic tools must be provided to extract all Critical Data onto a duplicate device without compromising the integrity of the source device. 2.85 Event data shall be retained to provide chronological information and logs to enable the reconstruction, review and examination of the time sequences of processing. 2.86 The appropriate capacity, design and monitoring of the logging facilities should be in place to ensure that logging is not interrupted for a technical reason that could have been prevented. SUBMISSION REQUIREMENTS 2.87 Submission and training requirements are outlined in Electronic Raffle Systems for Mega Raffles submission guidelines available upon request. 2.88 All submissions for approval of ERSs must be accompanied with all necessary AGCO submission forms. 20 Electronic Raffle Systems Minimum Technical Standards For Mega Raffles - Draft - September 2016