Spam-bot tests flunk the blind

Many companies have recently begun requiring users to pass a verification test in order to access their services--typically by typing into a Web form a few characters that appear on the form in a guise that prevents a computer or software robot from recognizing and copying them.

The technique, now used by Web giants Yahoo, Microsoft, VeriSign and others, seeks to block software bots from signing up for Web-based e-mail accounts that can be used to launch spam and from scraping e-mail addresses from online databases.

Learn more about fighting spam

The scheme is winning high marks in the battle against unwanted junk e-mail. But it is also increasingly hindering the progress of Web surfers with visual disabilities--raising the ire of advocates for the blind, spurring plans for alternatives from a key Web standards group, and eliciting warnings from legal experts who say that the practice could expose companies to lawsuits brought under the Americans with Disabilities Act.

"It seems that they have jumped on a technological idea without thinking through the consequences for the whole population," said Janina Sajka, director of technology research and development for the American Foundation for the Blind in Washington, D.C. "These systems claim to test whether there's a human on the other end. But it's only technology that can challenge certain human abilities. So someone who doesn't have that particular ability is excluded from participation. That's really inappropriate."

Efforts to create tests aimed at distinguishing humans from machines go back decades, with the most famous formulation of the problem posed in 1950 by the English mathematician and World War II "Enigma" code breaker Alan Turing. Turing's controversial hypothesis was that a machine could be defined as "intelligent" if a questioner could be fooled into believing it was a person.

Visual tests in a sense turn that theory on its head, assuming that a machine is defined by its inability to perform a task that is easy for most humans to accomplish.

The increase in use of visual tests--Yahoo in recent weeks has started springing them on users of its mail service--comes as Internet service providers and other companies are acknowledging and attacking the spam problem with unprecedented energy. Assaults on spam have come fast and furious this year on the litigation, legislation and technology fronts.

Companies that have implemented the technique call it a winner. Microsoft last month said it had achieved a 20 percent reduction in e-mail account registrations after implementing the test.

VeriSign, in another example, uses the technique to prevent automated queries to its WhoIS database of Web addresses and their registrants, in part to keep bots from harvesting the database for potential spam recipients.

Some Web sites using visual tests provide work-arounds for the visually impaired; some don't. But existing work-arounds are less than perfect and less than universally implemented.

Of the three above-mentioned companies with visual verification tests on their Web sites, only VeriSign's provided no alternative for the visually impaired. The company did not respond to requests for comment.

Microsoft's Hotmail service provides an audio alternative to its visual test, in which letters are read aloud instead of being displayed in a graphical file. But one such audio file--deliberately garbled to prevent its being read by a computer--was unintelligible to four out of four CNET News.com reporters, all with good hearing, who tried to decipher it.

Microsoft said it would review the audio work-around and defended its accessibility efforts generally.

"Microsoft has been exploring and evolving accessibility solutions that are integrated with products for more than a decade and takes its responsibility here very seriously," wrote a Microsoft representative in an e-mail exchange. "They're committed to raising the standard for the whole industry in the making of accessible technology."

Microsoft maintains a Web page listing its resources and products for the visually impaired.

Yahoo lets people who can't see its visual verification test fill out a Web form that it promises it will process within 24 hours. But even that slower work-around is not available to all Yahoo sign-up services--for example, for people signing up for a new ID through Yahoo's instant messenger application.

Yahoo said engineers were working on a customer support option for YIM, and that it would be added to the next version. The company added that the option is currently available for those who register through the IM Web site.

Looking for a better way
The increasingly popular visual test, and the difficulty of using current work-arounds, has raised enough hackles among advocates for the disabled that working groups within the World Wide Web Consortium's (W3C) Web Accessibility Initiative have begun discussions on how to standardize an alternative.

Two WAI working groups are hashing out proposals to guide Web sites in designing blind-friendly bot repellants, and the WAI hopes to address the issue in the next working draft of its Web Accessibility Guidelines, Version 2.0, which is due by year's end. So far, published working drafts of the guidelines are silent on the issue.

"What visual verification is testing is whether someone is a sighted human, even if that's not the intent of the organizations using it," said Judy Brewer, director of the WAI. "This has been a known problem for several years, and I know that we've received different complaints about it. But it's not necessarily an easy problem to solve."

Brewer did not specify what alternatives the WAI working groups were debating.

The American Foundation for the Blind's Sajka, who is himself blind, stressed that the technique posed problems also for those with less than total visual impairment. The camouflaged characters common to the tests are often impossible for the color blind to make out. They also thwart people who have trouble with contrast, he said.

Sajka raised the specter of bringing discrimination lawsuits against companies that implement similar tests.

In light of an October ruling that said the Americans with Disabilities Act did not apply to Web sites, and a May 15 ruling by a federal court that distinguished Web sites from the "public accommodations" that fall under federal civil rights statutes, Sajka acknowledged that suing implementers of visual verification might require asking Congress to pass additional legislation mandating accessibility for the disabled.

"The industry would like to avoid regulation, and if that's the case, thinking through this kind of thing would be a good idea," Sajka said. "I think we would rather they realized they have a responsibility, than our having to go up to the Hill or go to court. The technology is so entrenched in day-to-day living, and just because something is a cool idea doesn't mean it's the right thing to do."

But one lawyer with extensive experience in discrimination law said Web companies shouldn't consider themselves out of the ADA woods just because of the October ruling in "Access Now and Robert Gumson v. Southwest Airlines," decided by the U.S. District Court for the Southern District of Florida.

"That is something for which sites would almost certainly be required to make an accommodation for people with visual impairments who want to access them," said Kerry Scanlon, a partner with Kaye Scholer, and formerly Deputy Assistant Attorney General in the Civil Rights Division of the U.S. Department of Justice.

Noting that the Southwest Airlines decision had been appealed, Scanlon also cited comments by Judge Richard Posner indicating his opinion that the ADA covered the Internet, and predicted that the courts would ultimately overturn the Southwest Airlines ruling.

"I think it's unlikely that the courts will ultimately hold that the ADA does not apply to the Internet," Scanlon said. "I don't think, given the role the Internet plays in commerce today, that the courts are going to say that the provisions passed to protect 50 million people with disabilities in this country aren't going to apply to the Internet."

One spam opponent came to the defense of companies with visual tests, calling the tests crucial weapons against the growing legions of spam-sending machines.

"Anything that restricts people's ability to use e-mail lessens its usefulness as a communications medium," said Laura Atkins, president of the SpamCon Foundation. "On the surface, it's not a good thing. But there's so much abuse out there that the (Internet service providers) have to do it. Any site that does it should provide an alternate way for a blind person to sign up. But you can't condemn the ISPs for doing what they're doing to minimize the abuse."