A New York Times story about a company, Devumi, that has sold more than 200 million fake followers to second-tier celebrities and “influencers,” has made a big splash; New York Attorney General Eric Schneiderman has tweeted that his office has opened an investigation into Devumi‘s “impersonation and deception.”

But the firm is just a tiny outfit with an office above a Mexican restaurant in West Palm Beach, Florida. What really needs to be investigated is to what extent social networks’ user bases are fake and what benefits the giant companies that own them -- Facebook, Google, Twitter -- draw from the widespread fakery.

While the New York Times did a stellar job investigating Devumi, the Florida firm doesn’t appear to be a particularly sophisticated player in the large market for social media fraud. It acquired Twitter bots wholesale from shadowy operations like Peakerr, Cheap Panel and YTbot and then retailed them with a huge markup to people too lazy to source the bots on their own.

The market, meanwhile, is large, diverse and often bizarre. Marketplaces exist for Facebook likes and fake reviews. People create Internet of Things botnets that use routers and smart TVs infected with malware to register and exploit fake social network accounts.

In April 2017, Juan Echeverria and Shi Zhou at University College London described a network of more than 350,000 Twitter bots that only tweeted quotes from novels based on “Star Wars” movies. The bots kept a low profile and helped bloat follower counts for years. Even the singer Lady Gaga counted 14,315 of the Star Wars bots among her more than 70 million followers.

The Devumi story focuses on Twitter, the easiest network to exploit because of its purposely lax identification policies. Twitter followers are the cheapest on the black market. Devumi -- which, according to the New York Times, charged $17 per 1,000 followers -- was more expensive than most of the competition.

YouTube subscribers command the highest prices because, thanks to the way YouTube shares ad revenue with content creators, they are potentially the most lucrative.

The most difficult part of launching a social media bot is registering a fake account. On some of the networks, a bot needs to cheat Captcha robot detection. Others require a working phone number, a feature bypassed via the use of voice over internet telephony. The registration barriers are never high enough that it would become prohibitively expensive for the bot farms to jump over them.

After failing to set serious entry barriers, the networks make a show of diligently detecting and suspending the bots. But some of them -- like the “Star Wars” botnet, set up as long ago as 2013 -- avoid detection because their creators know how the algorithms works. Others are disposable: They’re just needed to spread some spam or help a political campaign. It’s easy enough to produce more as needed.

Why are the account registration policies of the social networks more lax than the entry policies of your standard nightclub? The usual argument is that they make it easier for dissidents living under oppressive regimes or for whistleblowers to make their voices heard. That explanation is harder to buy than a million Twitter followers, though. Oppressive regimes tend to ban US-based social media. As a dissident or whistleblower, one would be extremely unwise to set up a public social media account, anonymous or not.

Another question to ask is why social platforms make users’ follower and subscriber numbers, as well as the numbers of likes and shares, so easily available. Taking them out of public access would remove the temptation to inflate them by paying for robotic “mercenaries” -- and it wouldn’t detract from the content. Why turn one’s life on the internet into a public competition? It should be enough for all practical purposes to release the audience numbers to the user and perhaps to advertisers, but not to the entire world.

It would be easy to stop fraud if the platforms really wanted to. How long will it take for someone like Attorney General Schneiderman to stop messing around with the likes of Devumi -- a fleck of dust on the tip of the iceberg -- and start digging into the social platforms’ business models? It’s not right that the only estimates of the number of fake accounts come from the platforms themselves. Nor is it right for these companies’ stock valuations and ability to attract advertisers to be based on their own, unaudited user numbers. So far authorities have allowed this; in doing so they have let the enormous fraud market develop. 


Leonid Bershidsky
Leonid Bershidsky is a Bloomberg View columnist. -- Ed.

(Bloomberg)