If you’re having trouble booking a tee time, it might be a programmer in Thailand, not a golfer, that you’re up against.
Bot makers can use software to generate fake accounts that repeatedly check sites for booking times. As soon as a spot is free, the software will bypass anti-bot security, input payment details and auto-reserve the spot within seconds.
“It’s a bit of a niche issue now,” said Matthew Hatfield, executive director at OpenMedia, a non-profit that advocates for an ethical internet in Canada. “I don’t think it will be at all in a couple of years.”
AI tech is vastly improving programmers’ ability to create booking bots solely focused on snagging sought-after reservations faster than humans can.
Free coding tools such as Amazon CodeWhisperer use billions of lines of open-source code to create booking bots. Programmers can input a sentence in English and receive recommended code snippets to create bots.
“The barrier to build those tools is getting lower and lower,” said Thomas Pasquier, an assistant computer science professor at the University of British Columbia who studies malicious website traffic.
Those with the money to hire bot makers can easily do so on websites that offer up the services of freelance coders, such as Fiverr or Upwork.
Alberta, B.C. and Ontario have recently passed legislation banning the use of bots to buy event tickets, following years of consumer frustration over ballooning ticket prices in resale markets such as StubHub and Ticketmaster. Ticket scalpers use bots to book event tickets and re-sell them for exorbitant prices.
Still, years after ticket bot laws came into force, the president of Ticketmaster’s parent company, Live Nation, told a US Senate judiciary committee that ticket bots had interfered with their Taylor Swift’s Eras Tour booking process.
In June, a ticket to Swift’s Eras Tour averaged $253.56, according to Pollstar, an organization that provides data on concerts. The next month, these tickets were resold for an average of $3,801, according to Pitchfork, an online music publication.
Using bots to book event tickets is punishable by up to 12 months in prison and a $10,000 fine under B.C.’s Ticket Sales Act, which came into force in 2021.
But automation software is difficult to police. Critics say B.C.’s law is not effective because perpetrators are often outside of Canada and ticketing companies have little incentive to deter bots when their profit is derived from service fees, not ticket prices.
“If anything, maybe they just want to get in on it,” said Brett Caraway, a professor of media economics at the University of Toronto.
Secondary markets
Ticket bot legislation also does not restrict bots that perform actions other than buying tickets.
“The Ticket Sales Act does not extend to things like dinner reservations, golf tee times or appointment bookings,” said Tatiana Chabeaux-Smith, a spokesperson for Consumer Protection BC, a provincial regulator of consumer transactions.
Experts say booking bots could open the door to situations similar to ticket resales, where bots book hard-to-get appointments for free and sell them online. Last month, the Los Angeles Times reported that online tee-time brokers were booking up scarce reservations at city golf courses and selling them for a premium.
“It will potentially make secondary markets, where the prices of all kinds of things that we take for granted could potentially be driven up,” said Caraway. “It’ll make it impossible for you to get your tee time or whatever it is.”
On freelancing websites, tee-time bots are widely available. Some promise to beat golf courses’ reservation pages for $50. Freelance bot-makers quoted Canadian Affairs an average of about $200 to guarantee a permanent tennis court reservation at the UBC’s tennis facility in Vancouver.
The UBC tennis facility did not respond to emailed questions about their website’s anti-bot security.
One programmer with an established presence on Fiverr claimed that before they create automation software, they check the client’s location and regional laws to stay “within the allowable boundaries.” Still, the programmer refused to share their identity, citing privacy and confidentiality.
The programmer said effective bots can replace the market for “click farms,” by doing the tasks a human on a click farm would. Click farms often employ low-paid workers from developing countries to simulate users on social media that will follow clients’ social media accounts.
“How are the bots more bad than simply hiring 50 people from a very poor country to click for the tickets instead,” said the bot maker.
‘Cat and mouse game’
Defending a website against these bots requires constantly upgrading technology, such as Captcha, to detect bots, says Ivan Beschastnikh, an associate professor in the computer science department at UBC.
Captcha makes website users pass a test, such as selecting squares that show a bicycle, to prove they are human.
Beschastnikh points to the near-constant upgrading of Captcha tests to underscore the persistent improvements developers make to booking bots that can crack Captchas.
“We only update Captchas when we know that the bots are getting through,” said Beschastnikh.
“It’s a cat and mouse game,” said a freelance programmer on Fiverr.
Effective security software can be expensive, especially for smaller businesses. Anti-bot security costs range from hundreds to thousands of dollars a month.
“If you’re a small business owner I really feel for you,” said Beschastnikh.
He said overly stringent website security has its problems too. It can weed out actual human users, meaning a website loses business.
Beschastnikh says one way for smaller, local websites to protect their booking pages is to limit the geographic area where users can book, because most customers will be nearby.
“If I’m booking golf in Vancouver, there shouldn’t be a reason why I am doing that from Cincinnati or from Thailand.”
Experts predict AI assistants to the public could eventually make booking bots obsolete, as these assistants will be able to automate simple tasks such as booking appointments online.
“At some point, I think everybody will have access to this sort of technology,” said Caraway.
