CAPTCHA farms in the courts

As soon as a screen is developed to protect a valuable activity, the incentive is on the table to work around it. Screening works by demanding a test or task that is more costly for the undesirables to perform (the technical requirements are a bit more subtle than this). If it is too costly to perform as well as a desirable, the undesirables are identified and can be blocked (or charged a different price, etc.)
Incentive designs spawn incentive designs (I also wrote about this in May 2006). If the service or product or information the undesirables want is sufficiently valuable, it is worth it to them to invest in circumventing the screen to get the cost of performing as well as a desirable low enough.
CAPTCHAs, developed by Luis von Ahn and his colleagues at Carnegie-Mellon, are one such screen for keeping undesirables — in this case software bots — out of certain valuable information services (like free webmail accounts). Or, in the case of Ticketmaster, from robotically buying large numbers of hot tickets.
Ticketmaster has sued RMG (preliminary injunction) for its business selling PurchaseMaster software, which allegedly enables ticket brokers to score large numbers of desirable tickets in the first few minutes the events go on sale. One of Ticketmaster’s protections against bots is a standard CAPTCHA. RMG, in its defense, has publicly stated that it is using one of the now standard low-cost ways of circumventing the CAPTCHA: the bots are hiring low-wage humans (in India in this case) to break the CAPTCHAs, so the bots can get on with their business. (The Matrix is coming.)

RMG answered Ticketmaster’s Captchas — the visual puzzles of distorted letters that a customer must type before buying tickets— not with character recognition software, he said, but with humans: “We pay guys in India $2 an hour to type the answers.? (NY Times, 16 Dec 2007)

Another way bots hire humans to do their CAPTCHA work for them is with porn bribes: set up a site giving free access to porn as long as the human solves a CAPTCHA or three, and feed them CAPTCHAs thrown up by other sites to block the bots entrance.