Bot or Not

Attack of the Bots!

They harass you with links for free iPads. They feed on your personal information while you sleep. They cannot be contained or controlled and they have permeated the pores of the World Wide Web.

Twitter has bedbugs.

Social media sites have provided bots with a new platform to launch their campaigns — a cyber stage where millions of people are vulnerable to having their accounts hijacked, their personal information stolen and their computers plagued with viruses.

Bots have the power to misrepresent a website’s page traffic and create a skewed perception of what is influential. And as a relatively new phenomenon, they operate in a legal gray area — one without any real guidelines, restrictions or oversight.

Twitter is infested with bots: fake, computerized accounts that latch on to certain websites and continuously re-post stories, flooding the social media network.

How bad is the problem? An analysis of more than 18,000 Twitter users who shared links to one of three popular technology blogs — ReadWriteWeb, Mashable and TechCrunch — over a period of a week found that at least 15 percent were bot accounts.

Climbing the Social Ladder: The Business of Bots

Marshall Kirkpatrick, vice president of content development and lead writer at ReadWriteWeb, said content that receives an increased number of tweets from bots can enhance its appearance of legitimacy, and for that reason many websites are indifferent to the number of those shares coming from bot accounts.

“It doesn’t do any harm to the sites. If anything it might even help them,” he said. “It’s not worth doing anything about it if there’s a slight benefit to the website. It validates their content.”

Some users are willing to purchase followers, real or not, in order to increase the appearance of their influence. In this way, Twitter has inadvertently provided a financial incentive for bots.

Martin Goulet manages Antares Marketing, a company that sells Twitter followers by using what he calls the “follow” method.

Employees at Antares Marketing target specific accounts to follow in order to increase followers for the client. Those who don’t follow back are unfollowed and replaced by others, and the method is repeated until the number of followers agreed upon is reached. Goulet said his company makes it a point to follow real Twitter accounts, not bots.

“I can’t guarantee that all accounts are real, but a very, very good percentage is,” he said. “My lists are built upon active accounts and when I do targeted searches, I make sure to use accounts that are active too.”

Goulet sells follower packages ranging from 1,000 to 100,000 followers and has worked with around 400 clients in total.

“I really don’t think I am hurting the Twitter universe,” Goulet said. “Yes, people are buying Twitter followers, but it is much more than that. It’s about getting the type of followers they want to have, that they deserve.”

“I provide an expertise to connect people or companies on Twitter and that can only be beneficial in the long run,” he said. “This is exactly what Twitter is about: connecting, sharing and meaningful exchanges.”

Goulet distinguished himself from companies that program and sell Twitter bots.

“I operate very ethically and with high standards of business,” he said. “[Bot companies] are total scams as those accounts are bound to be short lived and get suspended when Twitter discovers them.”

A user on eBay who sells Twitter bots under the name Jim’sBigDeals said people are okay with the fact that some followers are bot-generated.

“It is more cost effective and gives a start-up video, artist or business social proof that aids in their word of mouth advertising,” he said.

When employed by everyday people, bots aren’t dangerous, so much as they’re annoying. But when public figures purchase bots and fabricate how many followers they have, the result can be a drastic exaggeration of their public support.

A recent and controversial example of this practice occurred in August 2011, when a former staffer for presidential candidate Newt Gingrich told the media that the majority of Gingrich’s Twitter followers were purchased.

Gingrich’s staff denied the charge, saying his follower count was boosted by being on Twitter’s list of suggested accounts to follow. But at the time, Gingrich had over one million Twitter followers, while fellow candidates Mitt Romney and Michele Bachmann had less than 100,000.

Why purchase followers? Michael Hussey, the founder and CEO of PeekYou, said Bots are an easy way “to create an illusion that you have more followers than you actually do.”

And indeed, on the campaign trail, Gingrich pointed to his follower count as one indicator of the level of grass roots support for his candidacy.

“It’s for impression,” Hussey said. “If you have a million people who want to hear what you have to say, or it looks like you do, for someone who doesn’t know you, that might be an impressive number.”

But even if Gingrich didn't purchase the Twitter followers, many agree the possibilities for manipulation are real. There’s a high potential for political opponents to spread rumors quickly, cheaply and with wider circulation according to Paul Maslin, an longtime Democratic pollster.

“While political campaigns have always been filled with gossip, sabotage and accusations, Twitter makes it easier for that to happen,” he said.

“This is essentially a process where the vicious rumor can be injected and put out there without spending a lot of money,” Maslin said. “It’s scary.”

The Dangers of Phishing

More and more often, experts are seeing bots used in ways that could actually result in harm.

Social media spam comes in the form of so-called phishing attacks: Bots are programmed to send out a link that, when clicked, allows the spammer to collect a user’s information. Those behind phishing attacks are often trying to hijack accounts and ultimately make money, said Chester Wisniewski, a senior security advisor at the software security company Sophos.

Because of the nature of the platform, these attacks are especially effective on sites like Twitter and Facebook, Wisniewski said. These site makes it relatively easy to launch attacks on 5,000 to 10,000 accounts at a time -- and after obtaining a user’s account information use those accounts to send out more spam, he said.

“The ability for them to do that [use personal information in a criminal way] is quite scary,” Wisniewksi said. “Especially on Facebook, where people have more personal information — even their addresses and cell phone numbers. That’s a gold mine for identity theft.”

Kevin Haley, a security intelligence expert at Norton, agrees.

“If I’m looking to target somebody, I can go online and find a tremendous amount of information by following them on Twitter and looking at their Facebook,” Haley said. The personal information made available by Twitter and Facebook has allowed bots to easily personalize messages to make them look less like spam.

By viewing a user’s information — for example, by looking at a user’s friends, photos and comments — a spammer can craft a more realistic-looking message. A “personalized” message often tricks more people into clicking the link, he said.

“You send out a link, maybe a funny picture or something,” Haley said. “Or you make it about something they’re interested in — like golf. And you write, ‘Hey, here’s some tips to improve your game. Good seeing you at the country club last month!’”

Man vs. Machine

While Twitter does delete bot accounts, efforts to battle the bots are often futile.

Twitter’s Trust and Safety team is comprised of 30 members who seek to eliminate spam accounts. Twitter has opted against filtering content on the website, so it’s up to the team to decide whether or not an account’s behavior warrants a red flag.

Charles Arthur, The Guardian’s technology editor, argues the fight against automated accounts is a losing battle. He points out that some bots are forthcoming, while others try to mask their “botness.”

“Spam bots can sometimes try to disguise themselves: they're created in 'nests' of mutually following accounts. Those lie quiescent before they're used to spam people,” Arthur said. “They make it harder for Twitter to create an algorithmic method of spotting Twitter spambots by mixing it up.”

Peek You’s Hussey said that these ploys make Twitter an easy target for spammers. Only about one person in 100,000 would actually click a bot-generated link, but since the cost to buy or create mechanized bots is so low, users don’t need a high conversion rate.

“Until the cost of spamming becomes more than the reward, it’s going to keep happening,” Hussey said.

As a relatively new phenomenon, the legal consequences of bots remain uncertain even to organizations that monitor digital rights and media law.

Organizations like the Federal Trade Commission and the Word of Mouth Marketing Association have established guidelines for Internet businesses, but no rules or regulations yet exist.

And even if the FTC had some legal mandate to crack down on bots, enforcement would be difficult. David Sorkin, a cyberspace law expert and professor at The John Marshall Law School, said the FTC has limited control and generally only takes action in cases that are widespread.

In the end, Hussey from Peek You said the biggest issue is that bots diminish trust in the social media network.

“It totally devalues the whole system if all you’re seeing is spam,” he said. “If you lose trust in the system, people will rapidly fall away from it.”

Take the bot test Enter any Twitter username
to see how bot-like the user is


The Bot or Not project was created by the students of Investigative Journalism in the Digital Age, a class taught at Eugene Lang The New School for Liberal Arts. Our semester-long project began by researching the tweet patterns of social media news articles.