While The New York Times did a stellar job investigating Devumi, the Florida firm doesn't appear to be a particularly sophisticated player in the large market for social media fraud. It acquired Twitter bots wholesale from shadowy operations like Peakerr, Cheap Panel and YTbot and then retailed them with a huge markup to people too lazy to source the bots on their own.

Impersonation and deception are illegal under New York law. We’re opening an investigation into Devumi and its apparent sale of bots using stolen identities. https://t.co/uvxGOp7soQ

— Eric Schneiderman (@AGSchneiderman) January 27, 2018

The market, meanwhile, is large, diverse and often bizarre. Marketplaces exist for Facebook likes and fake reviews (University of Iowa's Shehroze Farooqi and collaborators explored a big one, SEOClerks.com, in an April, 2017 paper). People create internet-of-things botnets that use routers and smart TVs infected with malware to register and exploit fake social network accounts. Canadian cybersecurity researcher Masarah Paquet-Clouston and collaborators documented the activity of such a botnet, Linux/Moose, in a July, 2017 paper. 

In April, 2017, Juan Echeverria and Shi Zhou at University College London described a network of more than 350,000 Twitter bots that only tweeted quotes from novels based on Star Wars movies. The bots kept a low profile and helped bloat follower counts for years. Even the singer Lady Gaga counted 14,315 of the Star Wars bots among her more than 70 million followers. How much of the rest of that huge audience is fake? It would take dozens of investigations like Echeverria and Zhou's, or The New York Times', to find out.

Drawing on a stock of at least 3.5 million automated accounts, each sold many times over, a company named Devumi has provided clients with more than 200 million Twitter followers, a New York Times investigation found https://t.co/A4Z8xzEJA8 pic.twitter.com/9ypaStXrAh

— The New York Times (@nytimes) January 27, 2018

The Devumi story focuses on Twitter, the easiest network to exploit because of its purposely lax identification policies. Twitter followers are the cheapest on the black market. Devumi, which, according to The New York Times, charged $17 per 1,000 followers, was more expensive that most of the competition.

YouTube subscribers command the highest prices because, thanks to the way YouTube shares ad revenue with content creators, they are potentially the most lucrative.

The most difficult part of launching a social media bot is registering a fake account. On some of the networks, a bot needs to cheat Captcha robot detection. Others require a working phone number, a feature bypassed though the use of voice over internet telephony. The registration barriers are never high enough that it would become prohibitively expensive for the bot farms to jump over them. Paquet-Clouston and collaborators pointed out that to register accounts on Instagram, the Linux/Moose botnet simply generated email addresses like Groe****elwub*nhwt@wzgvf.org on the fly. Instagram didn't even check them by sending an email with a confirmation link. 

After failing to set serious entry barriers, the networks make a show of diligently detecting and suspending the bots. But some of them -- like the Star Wars botnet, set up as long ago as 2013 -- avoid detection because their creators know how the algorithms works. Others are disposable: They're just needed to spread some spam or help a political campaign. It's easy enough to produce more as needed.

Why are the account registration policies of the social media networks more lax than the entry policies of your standard US nightclub? The usual argument is that they make it easier for dissidents living under oppressive regimes or for whistleblowers to make their voices heard. That explanation is harder to buy than a million Twitter followers, though. Oppressive regimes tend to ban US-based social media and, if they don't, to develop detection mechanisms that work far better than the networks' algorithms mean to weed out fakes. As a dissident or whistleblower, one would be extremely unwise to set up a public social media account, anonymous or not.

Another question to ask is why the social platforms make users' follower and subscriber numbers, as well as the numbers of likes and shares, so easily available. Taking them out of public access would remove the temptation to inflate them by paying for robotic "mercenaries" -- and it wouldn't detract from the content. Why turn one's life on the internet into a public competition? It should be enough for all practical purposes to release the audience numbers to the user and perhaps to advertisers, but not to the entire world.

It would be easy to stop fraud if the platforms really wanted to. How long will it take for someone like Attorney General Schneiderman to stop messing around with the likes of Devumi -- a fleck of dust on the tip of the iceberg -- and start digging into the social platforms' business models? It's not right that the only estimates of the number of fake accounts come from the platforms themselves. Nor is it right for these companies' stock valuations and ability to attract advertisers to be based on their own, unaudited user numbers. So far authorities have allowed this; in doing so they have let the enormous fraud market develop.

This column does not necessarily reflect the opinion of the editorial board or Bloomberg LP and its owners.

Popular

Kadin urges stability after Constitutional Court ruling

Jokowi says transition to new government to begi

BCA loan disbursement surges 17.1 percent yoy in first quarter