A New York Times story about a company, Devumi, that has sold more than 200 million fake followers to second-tier celebrities and “influencers”, has made a big splash; New York Attorney General Eric Schneiderman said his office has opened an investigation into Devumi’s “impersonation and deception”. But the firm is just a tiny outfit with an office above a Mexican restaurant in West Palm Beach, Florida.
What really needs to be investigated is to what extent social networks’ user bases are fake and what benefits the giant companies that own them — Facebook, Google, Twitter — draw from the widespread fakery.
While the New York Times did a stellar job investigating Devumi, the Florida firm doesn’t appear to be a particularly sophisticated player in the large market for social media fraud. It acquired Twitter bots wholesale from shadowy operations like Peakerr, Cheap Panel and YTbot and then retailed them with a huge markup to people too lazy to source the bots on their own.
The market, meanwhile, is large, diverse and often bizarre. Marketplaces exist for Facebook likes and fake reviews — the University of Iowa’s Shehroze Farooqi and collaborators explored a big one, SEOClerks.com, in an April 2017 paper. People create internet-of-things botnets that use routers and smart TVs infected with malware to register and exploit fake social network accounts. Canadian cybersecurity researcher Masarah Paquet-Clouston and collaborators documented the activity of such a botnet, Linux/Moose, in a July, 2017, paper. In April 2017, Juan Echeverria and Shi Zhou at University College London described a network of more than 350,000 Twitter bots that only tweeted quotes from novels based on Star Wars movies. The low-profile bots helped bloat follower counts for years. Even singer Lady Gaga counted 14,315 of the Star Wars bots among her more than 70 million followers. How much of the rest of that huge audience is fake? It would take dozens of investigations to find out.
The Devumi story focuses on Twitter, the easiest network to exploit because of its purposely lax identification policies. Twitter followers are the cheapest on the black market. Devumi, which according to the Times charged $17 (Dh62.52) per 1,000 followers, was more expensive that most of the competition.
YouTube subscribers command the highest prices because, thanks to the way YouTube shares ad revenue with content creators, they are potentially the most lucrative.
The most difficult part of launching a social media bot is registering a fake account. On some networks, a bot must cheat Captcha robot detection. Others require a working phone number, a feature bypassed through the use of voice-over internet telephony. The registration barriers are never high enough that it would become prohibitively expensive for the bot farms to jump over them. Paquet-Clouston and collaborators pointed out that to register accounts on Instagram, the Linux/Moose botnet simply generated email addresses like ‘Groe****elwub*nhwt@wzgvf.org’ on the fly. Instagram didn’t even check them by sending an email with a confirmation link.
After failing to set serious entry barriers, the networks make a show of diligently detecting and suspending the bots. But some — like the Star Wars botnet, set up as long ago as 2013 — avoid detection because their creators know how the algorithms work. Others are disposable: They’re just needed to spread some spam or help a political campaign. It’s easy enough to produce more as needed.
Why are the account registration policies of the social media networks more lax than the entry policies of a standard United States nightclub? The usual argument is that they make it easier for dissidents living under oppressive regimes or for whistleblowers to make their voices heard. That explanation is harder to buy than a million Twitter followers, though. Oppressive regimes tend to ban US-based social media and, if they don’t, to develop detection mechanisms that work far better than the networks’ algorithms mean to weed out fakes. As a dissident or whistleblower, one would be extremely unwise to set up a public social media account, anonymous or not.
Another question is why the social platforms make users’ follower and subscriber numbers, as well as the numbers of ‘likes’ and ‘shares’, so easily available. Taking them out of public access would remove the temptation to inflate them by paying for robotic “mercenaries” and it wouldn’t detract from the content. Why turn one’s life on the internet into a public competition? It should be enough for all practical purposes to release the audience numbers to the user and perhaps to advertisers, but not to the entire world.
It would be easy to stop fraud if the platforms really wanted to. How long will it take for someone like Attorney General Schneiderman to stop messing around with the likes of Devumi — a fleck of dust on the tip of the iceberg — and start digging into the social platforms’ business models? It’s not right that the only estimates of the number of fake accounts come from the platforms themselves. Nor is it right for these companies’ stock valuations and ability to attract advertisers to be based on their own, unaudited user numbers. So far authorities have allowed this; in doing so they have let the enormous fraud market develop.
— Bloomberg
Leonid Bershidsky is a Bloomberg View columnist. He was the founding editor of the Russian business daily Vedomosti and founded the opinion website Slon.ru.
