listen to an audio version of this post, read by the author
After a 15-year hiatus, I started our local cell of the Cartoonist Conspiracy back up earlier this year. We meet on the second Tuesday of each month to draw comics and chat at Finjan Qahwa coffee shop. We mostly use fliers and a WordPress site to promote the group, and an email list to keep our members connected.
We use Google Groups for the email list because it’s simple, low-maintenance, and fits the old-school vibe of our group. We have a link to the group on our website, and that’s been running fairly smoothly since 2006, until a new wave of spambots started joining this year.
It wasn’t a sudden wave, it’s only about 5-10 per week, with seemingly authentic Gmail handles and very descriptive reasons for why they wanted to join the group. Each message was different and fairly well written.
Of course, internet spam has been around forever, but this new wave of spam was far more convincing due to their use of generative-AI to write compelling messages that were specific to our group and not just cut-and-paste like previous attempts.
The Spam Problem
There was no easy way to weed out the real requests from the spam ones. Many of the spammer’s emails were using structures like “firstnamelastname1234@gmail“, but half of our real members use the same structure for their email handles. The written messages varied drastically, too. Some short, some long, but they all looked similar to the real requests we were getting. Sometimes there would be a giveaway, like messages that had quotation marks in them, but most were really believable. Even with my guard up, I still approved a few requests that turned out to be spam.
I’ve been organizing meetups and groups for most my life, and have been using Google Groups for at least 20 years, but this new wave of AI written bots were far more annoying than anything I’d previously encountered. I thought about shutting down the email list all together.
The Punk Rock Turtle Test
After pausing all sign-ups for a month, I saw a suggestion from Matthew Newell about implementing a “DIY captcha” for artists and decided to give it a try. Whenever someone requested to join the CCSF group, I’d ask them to verify their humanity by either:
- Sharing a social media profile.
- Drawing a quick black-and-white picture of a punk rock turtle.
It felt silly at first, but I think it actually worked!
A few folks did send back real art, the rest were probably spammers. One of my favorite turtle drawings, shown below, came from Luis. They’ve been an active participant in our comic jams, and I’m really glad I didn’t prevent them from joining the group because their firstnamelastnameNUMBERS email account sounded suspicious at first.
“The internet is chock-full of bots.” they wrote. “Here’s my punk rock turtle cuz I don’t use social media! Thanks.”
punk rock turtle by Luis Booth
A solution for Now
The group has been spam free for a few months, so the “punk rock turtle” seems to be working for now, though I do worry that a few of the requests that I rejected were from real people who wanted to join our art group, but felt turned off by my email request (or maybe didn’t understand it).
At some point, the person sending this spam will probably reply with AI-generated art, which means I’ll have to be second guessing everything again.
I often talk about how the rise of generative AI has made things harder for artists and organizers like myself. This is yet another example.
I run these meetups as a way for artists to meet and interact with each other, but dealing with AI-generated spam makes me feel like just shutting down the email list altogether.
And that’s just on my end… I’m sure it sucks to be a local artist asking to join an art group, then getting asked to make free art or share personal social media information.
Fediverse Reaction
I have to give props to Matthew Newell on Mastodon for suggesting a “DIY catpcha” as a means of sussing out the spammers.
@docpop look very suspicious. I would do a DIY captcha. You're a cartoonist; draw a highly stylised object (like those amazing walkie-talkies you posted – I think that was you if not apologies) and ask what they are and how the applicant would do their own version . You can be quite open and say that lots of groups are getting bulk scam applications and this is your version of I am not a robot.
And to all the Fediverse users who shared their punk rock turtle drawings:
https://mastodon.social/@MichelPatrice/114978907129196851
@yojimbo
https://mastodon.social/@jgilbert/114979107526285114
https://mastodon.social/@dan_kn/114978943424457739
The post Fighting AI-generated Spam with Punk Rock Turtles appeared first on Doc Pop's Weblog.