Lax Security and Moderation at Goodreads Allows Trolls to Spoof People, Harass Authors

Note: This article is available free to the public. If you like my writings on genre issues, consider backing my Patreon.  

Goodreads is currently experiencing one of the book review site’s largest-ever harassment campaigns as trolls spoof the identities of numerous authors in a coordinated attack against author Patrick S. Tomlinson. The spoofed accounts use the names and photos of Tomlinson’s fellow authors to post negative and attack reviews on the Goodreads pages for his books. 

Examples of the attacks can be found on the Goodreads reviews page for Tomlinson’s book In The Black, which currently has 135 ratings and 121 reviews despite not being released by Tor Books until October 2020. Advanced reader copies aren’t even available as the book is still in the editing process.

Many of the spoofed accounts use the identities of Tomlinson’s friends and peers in the author community, creating the illusion that people he knows are giving one-star reviews and saying bad things about him. Dozens of authors have been spoofed in this manner, including the entire board of directors of the Science Fiction and Fantasy Writers of America.

Not all of these fake reviews are one stars – some give five star or other highly rated ratings. The catch with these highly rated reviews is many of them are created to give the false appearance that they were written by Tomlinson to raise his own Goodreads ratings, spoofing his name and photo and sometimes even using his own copyrighted writings. These spoofed reviews often also show Tomlinson falsely saying things which would hurt his own reputation.

Gareth L. Powell and Beth Cato were among the authors spoofed, with their photos and names used to create fake accounts to attack Tomlinson’s books.

“I spend a lot of time encouraging other authors and recommending books,” Powell said. “To have someone impersonating me in order to slag off novels undermines all that and makes me look bad.”

Powell responded by deleting his Goodreads account to avoid any confusion in the future. Cato complained to Goodreads about the review from an account impersonating her. However, a few days after she reported the fake review to Goodreads there were 10 more accounts spoofing her name, all attacking Tomlinson.

The families of authors have also been spoofed to attack Tomlinson. Three days after the father of author Cat Rambo passed away, someone used the personal information and photo from his obituary to post a negative review of one of Tomlinson’s books on Goodreads.

Attacks Succeed Because of Security and Moderation Issues at Goodreads

The coordinated attacks on Tomlinson arose out of his work helping to shut down a controversial Reddit community (see interview with Tomlinson below for more details). Since being banned by Reddit the attackers now coordinate through a website in Russia. Messages on this new site show they are using Goodreads for their harassment campaign because of the book review site’s lax security and moderation policies.

"The only policy (Goodreads) might change, and I say might is email verification and even that is a stretch,” said one poster on this site. “Thst (sic) would slow the trolls down by maybe."

 This poster was talking about the fact that Goodreads doesn’t currently use true email verification prior to users setting up a new account. While Goodreads requires new accounts to provide an email address and sends a “verification” email to that account, new users are immediately able to review books and have their reviews and ratings appear on the site without actually verifying the email Goodreads sends them.

Goodreads also allows multiple accounts to be set up under already existing member and user names, as happened with many of the authors mentioned here. And while Goodreads allows authors and users to flag suspicious reviews, the site has no way for users and authors to report or flag individual user accounts. This allows a fake user to repeatedly post fake reviews before their account is shut down.

All of these security and moderation flaws are dealt with differently by almost every other major social media site, but Goodreads has yet to address these problems. 

Tomlinson has complained to Goodreads and reported these false reviews, but for every account or false review that is taken down many more pop up.

Escalation of Harassment on Goodreads

The attacks on Tomlinson represent a serious escalation of issues at Goodreads, especially since previous problems with the site didn’t involve both coordinated spoofing attacks and targeted harassment.

For example, in 2015 author Chuck Wendig was subject to a campaign to give his Star Wars: Aftermath novel one-star reviews on Goodreads and Amazon after some fans grew angry over him creating the first major gay hero in the Star Wars universe. And around the same time the Stop the Goodreads Bullies campaign arose after a group of authors including Anne Rice complained about users posting "bad" reviews of their books on Goodreads.

However, in these cases the negative reviews were generally being created by actual users of Goodreads. And while Wendig’s situation was a coordinated harassment campaign, it wasn’t being run through fake and spoofed user accounts.

According to Tomlinson, the trolls behind this Goodreads harassment campaign have stated publicly that their goal is to drive him to suicide. And he says this campaign has definitely hurt his bottom-line.

“When you have a book out and you have 200 one-star reviews, that has an effect,” he said.

Tomlinson added that Goodreads needs to change their policies in response to these attacks.

“I’m not the only author this can happen to,” he said. “And if they succeed in these attacks, they’ll definitely go after others.”

# # # 

Interview with Patrick S. Tomlinson

Jason Sanford: When did you first notice the issue of fake Goodreads accounts targeting your books with bad reviews and comments?

Patrick S. Tomlinson: This has been ongoing for more than a year. This particular group of cyberstalkers has been fixated on me since Sept. 2018. I first became aware of their existence when my Twitter account with 38k followers (@stealthygeek) was mysteriously suspended. It wasn't long before an eagle-eyed fan spotted them cackling with glee over their mass false reporting attack on Reddit. After that, they started attacking my Facebook, Instagram, YouTube channel, blog, and eventually my book reviews on Goodreads and Amazon.

Jason: Any idea who is behind all this? And why are they spoofing your fellow authors to make it appear your friends and peers are attacking you?

Patrick: I know exactly who is behind this. They're dead-enders from a now-banned Reddit community dedicated to the defunct Opie and Anthony shock jock radio show. As to why they're doing it, well, this has been their entire culture for years, picking random innocent people to cyberbully past the breaking point. That was the culture of the show, too. The hosts would encourage their listeners, who they called "pests," to harass and stalk whomever had the poor fortune of falling into their sights for whatever arbitrary reason. Eventually, the monster they created ended up destroying them when the pests turned on one of the hosts, Anthony Cumia, causing the show to implode. There's a great deal of karma at work there, but the community of obsessive trolling psychopaths they nurtured lived on and started picking their own victims to attack. I was not the first, not by a long shot. Previously they'd made targets of comedian Patton Oswald, trying to spread the libelous rumor that he'd murdered his first wife. They jumped around from there, preying on a transgender adult performer because of course they're transphobic, then singer-songwriter Logan Lynn for being gay because of course they're homophobic. In every case, their playbook is the same, right down to the entirely false accusations of pedophilia. Their attacks on Logan were so vicious and sustained that it was actually written up in People Magazine. Then, they fixated on me, which was a mistake. Their 27,000 subscriber subreddit, and thousands of their accounts, were eventually banned by Reddit for harassment and copyright infringement as a result of months of reporting their abuses. They thought they were invincible and could stalk and bully people with impunity, free from consequence. I proved them wrong. That's why they're so obsessed with me, enough to create literally hundreds of fake accounts stealing the identities of my colleagues in a desperate attempt to harm my reputation and tank my sales. No one ever hurt them before.

Jason: It appears your upcoming novel In The Black is being particularly targeted by these trolls, with many negative reviews even though the book won't be released until October 2020. What has been the response from Goodreads when you contact them about this issue?

Patrick: In a word, abysmal. The reviews you see are just the tip of the iceberg. Hundreds have been deleted, and hundreds of fake accounts banned. But the mods at GR, for whatever reason, never quite finish the job. The listing for this book went live around Dec 15th, and within a day it already had three dozen fake 1 Star ratings on it from impersonation accounts using names and pictures stolen from my Twitter followers. Goodreads was made aware of this immediately, but it wasn't until I grew frustrated enough to start blasting them on Twitter was any action taken. The problem persisted, though, because the stalkers would just make dozens of new fake accounts every day and leave new fraudulent reviews. Not just on this book, but often on every single listing I have on the platform. This ended up totally literally thousands of fake ratings and reviews dragging down my average.

Jason: Why do you think Goodreads doesn't recognize this as harassment?

Patrick: I don't know that it's a question of whether they recognize it as harassment or not, but of whether or not they care. As I said earlier, their response times have been terrible. My most recent book to come out, STARSHIP REPO, was targeted by these people from literally the second it came out. They had a an online countdown timer to remind everyone in their degenerate community to go to Amazon and Goodreads the day it published and flood it with fake reviews. That was in May. Goodreads was provided with screengrabs and other proof of this coordinated attack even before it happened, but took months to do anything meaningful about it. Meanwhile, in the first week of release, REPO had over 200 fake 1 Star reviews on it, dragging its rating below 2 Stars. The same happened on Amazon, although to a lesser extent because it's not as easy to create an amazon account. Even still, the most "popular" review of REPO on Amazon is a fake 1 Star review that explicitly accuses me of anti-Semitism, and goes on to "quote" specific pages from the book with characters and events that never occur anywhere in it. My publisher reached out to Amazon with scanned copies of the pages listed to prove that the review was not just lying, but libelous. Amazon did nothing, and the review remains to this day.

Jason: I saw one troll spoofing your name and picture post an extremely nasty, long-winded comment on Goodreads, discussing intimate details of your family life and making it sound like you want to kill yourself. None of this could be considered a review of your book by any conceivable means, yet Goodreads still hasn't removed it. What's going on here?

Patrick: It has been the publicly, repeatedly stated goal of this group's harassment campaign to drive me to suicide. They revel in performative cruelty and the perceived suffering of the people they torment. Nothing is beyond them, including creating identity theft accounts of Cat Rambo's recently departed father to further their aims of hurting the maximum number of people possible in the most vile ways. They've often created impersonation accounts of me, using my name and images without permission on multiple platforms to try and make me appear racist, sexist, homophobic, etc to the casual reader. Goodreads has removed many such accounts, but again it’s a problem of timing. Often these fake accounts are left in place for days, weeks, or even months. When their accounts remain in place for any length of time, the stalkers consider it a "win" and double down on the behavior because they know they've found a site with lax moderation that can be exploited. So instead of shutting them down immediately, they multiply like roaches, creating even more work for moderators as the problem snowballs.

Jason: What changes does Goodreads need to make in how they handle people spoofing authors and others and using their site to harass authors?  Any reason Goodreads couldn't do like Rotten Tomatoes and block user reviews until the book is closer to release or actually released? 

Patrick: There are a lot of measures Goodreads can take immediately to help curb this issue and slow these people down. First and easiest would simply be to require email verification for new accounts. That throws up a roadblock to creating masses of fake profiles. It won't stop them entirely, but you can see the difference in volume of fake reviews on GR compared to Amazon, then compared to say, Audible. From there, GRs needs to expand their moderation team and train them more comprehensively on spotting fake or abusive accounts. The signs are pretty obvious. Brand new account immediately goes and review bombs all of a particular author's books is a dead giveaway. Also, the reporting system needs to be expanded from not just reporting abusive reviews and comments, but to reporting entire profiles as fake/impersonation, etc. Every other major social media platform has a way to report individual users for bad behavior. GR should be no different. And for God's sake, if an author has a verified account on GR, there should be some sort of process in place to screen any new profiles attempting to use their name. Otherwise, what's the point of being a part of the GR author program? As for reviews coming prior to release, I think there's real value in letting reviewers who have gotten ARCs post their thoughts ahead of publication. It helps build excitement and word of mouth. It can boost preorders. However, there needs to be some sort of screening in place to ensure that people claiming to have read an ARC actually got one. Even just limiting early reviews to a list of trusted reviewers who get ARCs from publishers would go most of the way to solving this problem. Everyone else has to wait until the book drops. Simple.

God this is horrifying :( Thank you for your reporting as always, Jason.
This is even worse when you consider that Goodreads is owned by Amazon, so this isn't some resource-constrained tiny startup. Amazon has the ability to indicate which reviews are written by verified purchasers. Considering how dependent Amazon is on authors, you'd think they'd take this more seriously.
They also own Audible and Book Depository. ..
What would be the top 3 reasons or features that would make you switch from GR to an alternative? Do you use the desktop or mobile app more?
Log in to comment ...
By becoming a patron, you'll instantly unlock access to 99 exclusive posts
8
Images
96
Writings
Tier Benefits
SF dystopian love
$1 or more per month
Reward
Access to my basic Patreon feed including my regular Genre Grapevine column featuring insider news and updates about the publishing world and exclusive analysis of publishing markets. This is information I won't share anywhere else.
Publishing isn't a magical fantasy land
$2 or more per month
Reward
All of the above plus essays and commentary.
Exploding robot heads
$3 or more per month
Reward
All of the above plus excerpts of my current writing and updates on my current projects.
Spacesuits in purgatory
$5 or more per month
Reward

All of the above plus e-book or PDF copies of my books several times each year and exclusive access to my previously published short stories. I will also provide a signed print copy of my books as they are released. Love my stories but have trouble finding them? This is for you!

Peacemakers never shoot the truth
$10 or more per month
Reward
All of the above plus your name listed as a patron in new e-book editions of my short stories.
Paprika's dancing illusion
$20 or more per month
Reward
All of the above plus a signed, limited edition chapbook of my novelette "Blood Grains Speak Through Memories," which was a finalist for the Nebula Award.
Blood grains speak through art
$50 or more per month
Reward
All of the above plus a signed copy of the out-of-print Million Writers Award: The Best Online Science Fiction and Fantasy, which I edited.
Scientifiction, future, medieval fantasy
$100 or more per month
Reward
All of the above plus I will write one story story each year based on any topic you suggest. You name the topic, I write the story. You'll see a draft of the story before I submit it for publication. Plus acknowledgment (if you desire) if the story ends up being published. I can't promise the story will be published but I'll try my best. Note: draft of the story will be due before end of your first year as a patron.