(Bloomberg View) -- A New York Times story about a company, Devumi, that has sold more than 200 million fake followers to second-tier celebrities and "influencers," has made a big splash; New York Attorney General Eric Schneiderman has tweeted that his office has opened an investigation into Devumi's "impersonation and deception." But the firm is just a tiny outfit with an office above a Mexican restaurant in West Palm Beach, Florida. What really needs to be investigated is to what extent social networks' user bases are fake and what benefits the giant companies that own them -- Facebook, Google, Twitter -- draw from the widespread fakery.
While The New York Times did a stellar job investigating Devumi, the Florida firm doesn't appear to be a particularly sophisticated player in the large market for social media fraud. It acquired Twitter bots wholesale from shadowy operations like Peakerr, Cheap Panel and YTbot and then retailed them with a huge markup to people too lazy to source the bots on their own.
The market, meanwhile, is large, diverse and often bizarre. Marketplaces exist for Facebook likes and fake reviews (University of Iowa's Shehroze Farooqi and collaborators explored a big one, SEOClerks.com, in an April 2017 paper). People create internet-of-things botnets that use routers and smart TVs infected with malware to register and exploit fake social network accounts. Canadian cybersecurity researcher Masarah Paquet-Clouston and collaborators documented the activity of such a botnet, Linux/Moose, in a July 2017 paper.
In April 2017, Juan Echeverria and Shi Zhou at University College London described a network of more than 350,000 Twitter bots that only tweeted quotes from novels based on Star Wars movies. The bots kept a low profile and helped bloat follower counts for years. Even the singer Lady Gaga counted 14,315 of the Star Wars bots among her more than 70 million followers. How much of the rest of that huge audience is fake? It would take dozens of investigations like Echeverria and Zhou's, or The New York Times's, to find out.
The Devumi story focuses on Twitter, the easiest network to exploit because of its purposely lax identification policies. Twitter followers are the cheapest on the black market. Devumi -- which, according to The New York Times, charged $17 per 1,000 followers -- was more expensive that most of the competition.
YouTube subscribers command the highest prices because, thanks to the way YouTube shares ad revenue with content creators, they are potentially the most lucrative.
The most difficult part of launching a social media bot is registering a fake account. On some of the networks, a bot needs to cheat Captcha robot detection. Others require a working phone number, a feature bypassed though the use of voice over internet telephony. The registration barriers are never high enough that it would become prohibitively expensive for the bot farms to jump over them. Paquet-Clouston and collaborators pointed out that to register accounts on Instagram, the Linux/Moose botnet simply generated email addresses like Groe****elwub*nhwt@wzgvf.org on the fly. Instagram didn't even check them by sending an email with a confirmation link.
After failing to set serious entry barriers, the networks make a show of diligently detecting and suspending the bots. But some of them -- like the Star Wars botnet, set up as long ago as 2013 -- avoid detection because their creators know how the algorithms works. Others are disposable: They're just needed to spread some spam or help a political campaign. It's easy enough to produce more as needed.
Why are the account registration policies of the social media networks more lax than the entry policies of your standard U.S. nightclub? The usual argument is that they make it easier for dissidents living under oppressive regimes or for whistleblowers to make their voices heard. That explanation is harder to buy than a million Twitter followers, though. Oppressive regimes tend to ban U.S.-based social media. If they don't, they focus on developing detection mechanisms that work far better than the networks' algorithms dedicated to weeding out fakes. As a dissident or whistleblower, one would be extremely unwise to set up a public social media account, anonymous or not.
Another question to ask is why the social platforms make users' follower and subscriber numbers, as well as the numbers of likes and shares, so easily available. Taking them out of public access would remove the temptation to inflate them by paying for robotic "mercenaries" -- and it wouldn't detract from the content. Why turn one's life on the internet into a public competition? It should be enough for all practical purposes to release the audience numbers to the user and perhaps to advertisers, but not to the entire world.
It would be easy to stop fraud if the platforms really wanted to. How long will it take for someone like Attorney General Schneiderman to stop messing around with the likes of Devumi -- a fleck of dust on the tip of the iceberg -- and start digging into the social platforms' business models? It's not right that the only estimates of the number of fake accounts come from the platforms themselves. Nor is it right for these companies' stock valuations and ability to attract advertisers to be based on their own, unaudited user numbers. So far authorities have allowed this; in doing so they have let the enormous fraud market develop.
This column does not necessarily reflect the opinion of the editorial board or Bloomberg LP and its owners.
Leonid Bershidsky is a Bloomberg View columnist. He was the founding editor of the Russian business daily Vedomosti and founded the opinion website Slon.ru.
To contact the editor responsible for this story: Therese Raphael at traphael4@bloomberg.net.
For more columns from Bloomberg View, visit http://www.bloomberg.com/view.
©2018 Bloomberg L.P.
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.
