REAL JESSICA RYCHLYis a Minnesota teenager
with a broad smile and wavy hair. She likes reading and the rapper
Post Malone. When she goes on Facebook or Twitter, she sometimes muses
about being bored or trades jokes with friends. Occasionally, like
many teenagers, she posts a duck-face selfie.
on Twitter, there is a version of Jessica that none of her friends or
family would recognize. While the two Jessicas share a name,
photograph and whimsical bio — “I have issues” — the other Jessica
promoted accounts hawking Canadian real estate investments,
cryptocurrency and a radio station in Ghana. The fake Jessica followed
or retweeted accounts using Arabic and Indonesian, languages the real
Jessica does not speak. While she was a 17-year-old high school
senior, her fake counterpart frequently promoted graphic pornography,
retweeting accounts called Squirtamania and Porno Dan.
these accounts belong to customers of an obscure American company
named Devumi that has collected millions of dollars in a shadowy
global marketplace for social media fraud. Devumi sells Twitter
followers and retweets to celebrities, businesses and anyone who wants
to appear more popular or exert influence online. Drawing on an
estimated stock of at least 3.5 million automated accounts, each sold
many times over, the company has provided customers with more than 200
million Twitter followers, a New York Times investigation found.
accounts that most resemble real people, like Ms. Rychly, reveal a
kind of large-scale social identity theft. At least 55,000 of the
accounts use the names, profile pictures, hometowns and other personal
details of real Twitter users, including minors, according to a Times
don’t want my picture connected to the account, nor my name,” Ms.
Rychly, now 19, said. “I can’t believe that someone would even pay for
it. It is just horrible.”
accounts are counterfeit coins in the booming economy of online
influence, reaching into virtually any industry where a mass audience
— or the illusion of it — can be monetized. Fake accounts, deployed by
governments, criminals and entrepreneurs, now infest social media
calculations, as many as 48 million of Twitter’s reported active
users — nearly 15 percent — are automated accounts designed to
simulate real people, though the company claims that number is far
November, Facebook disclosed to investors that it had at least twice
as many fake users as it previously estimated, indicating that up to
60 million automated accounts may roam the world’s largest social
media platform. These fake accounts, known as bots, can help sway
advertising audiences and reshape political debates. They can defraud
businesses and ruin reputations. Yet their creation and sale fall into
a legal gray zone.
continued viability of fraudulent accounts and interactions on social
media platforms — and the professionalization of these fraudulent
services — is an indication that there’s still much work to do,” said
Senator Mark Warner, the Virginia Democrat and ranking member of the
Senate Intelligence Committee, which has been investigating the spread
of fake accounts on Facebook, Twitter and other platforms.
rising criticism of social media companies and growing scrutiny by
elected officials, the trade in fake followers has remained largely
opaque. While Twitter and other platforms prohibit buying followers,
Devumi and dozens of other sites openly sell them. And social media
companies, whose market value is closely tied to the number of people
using their services, make their own rules about detecting and
eliminating fake accounts.
founder, German Calas, denied that his company sold fake followers and
said he knew nothing about social identities stolen from real users.
“The allegations are false, and we do not have knowledge of any such
activity,” Mr. Calas said in an email exchange in November.
Times reviewed business and court records showing that Devumi has more
than 200,000 customers, including reality television stars,
professional athletes, comedians, TED speakers, pastors and models. In
most cases, the records show, they purchased their own followers. In
others, their employees, agents, public relations companies, family
members or friends did the buying. For just pennies each — sometimes
even less — Devumi offers Twitter followers, views on YouTube, plays
on SoundCloud, the music-hosting site, and endorsements on LinkedIn,
the professional-networking site.
actor John Leguizamo has Devumi followers. So do Michael Dell, the
computer billionaire, and Ray Lewis, the football commentator and
former Ravens linebacker. Kathy Ireland, the onetime swimsuit model
who today presides over a half-billion-dollar licensing empire, has
hundreds of thousands of fake Devumi followers, as does Akbar
Gbajabiamila, the host of the show “American Ninja Warrior.” Even a
Twitter board member, Martha Lane Fox, has some.
a time when Facebook, Twitter and Google are grappling with an
epidemic of political manipulation and fake news, Devumi’s fake
followers also serve as phantom foot soldiers in political battles
online. Devumi’s customers include both avid supporters and fervent
critics of President Trump, and both liberal cable pundits and a
reporter at the alt-right bastion Breitbart. Randy Bryce, an
ironworker seeking to unseat Representative Paul Ryan of Wisconsin,
bought Devumi followers when he was a blogger and labor activist, as
did Louise Linton, the wife of the Treasury secretary, Steven Mnuchin,
when she was trying to gain traction as an actress.
products serve politicians and governments overseas, too. An editor at
China’s state-run news agency, Xinhua, paid Devumi for hundreds of
thousands of followers and retweets on Twitter, which the country’s
government has banned but sees as a forum for issuing propaganda
abroad. An adviser to Ecuador’s president, Lenín Moreno, bought tens
of thousands of followers and retweets for Mr. Moreno’s campaign
accounts during last year’s elections.
Binns, a Twitter spokeswoman, said the company did not typically
suspend users suspected of buying bots, in part because it is
difficult for the business to know who is responsible for any given
purchase. Twitter would not say whether a sample of fake accounts
provided by The Times — each based on a real user — violated the
company’s policies against impersonation.
continue to fight hard to tackle any malicious automation on our
platform as well as false or spam accounts,” Ms. Binns said.
some social media companies, Twitter does not require accounts to be
associated with a real person. It also permits more automated access
to its platform than other companies, making it easier to set up and
control large numbers of accounts.
Types of Twitter Bots
botposts messages based
on the time. TheBig
Ben bottweets every hour.
Twitter accounts or websites and tweet when something
changes. When the United States Geological Survey
posts about earthquakes in the San Francisco Bay Area,
QuakeBottweets the relevant
bots, like those sold by Devumi, follow,
retweet and like tweets sent by clients who have
bought their services.
Rich Harris and Danny DeBelius
media is a virtual world that is filled with half bots, half real
people,” said Rami Essaid, the founder of Distil Networks, a
cybersecurity company that specializes in eradicating bot networks.
“You can’t take any tweet at face value. And not everything is what it
it turns out, Devumi itself.
year, three billion people logged on to social media networks like
Facebook, WhatsApp and China’s Sina Weibo. The world’s collective
yearning for connection has not only reshaped the Fortune 500 and
upended the advertising industry but also created a new status marker:
the number of people who follow, like or “friend” you. For some
entertainers and entrepreneurs, this virtual status is a real-world
currency. Follower counts on social networks help determine who will
hire them, how much they are paid for bookings or endorsements, even
how potential customers evaluate their businesses or products.
follower counts are also critical for so-called influencers, a budding
market of amateur tastemakers and YouTube stars where advertisers now
lavish billions of dollars a year on sponsorship deals. The more
people influencers reach, the more money they make. According to data
collected by Captiv8, a company that connects influencers to brands,
an influencer with 100,000 followers might earn an average of $2,000
for a promotional tweet, while an influencer with a million followers
might earn $20,000.
fame often translates into genuine social media influence, as fans
follow and like their favorite movie stars, celebrity chefs and
models. But shortcuts are also available: On sites like Social Envy
and DIYLikes.com, it takes little more than a credit-card number to
buy a huge following on almost any social media platform. Most of
these sites offer what they describe as “active” or “organic”
followers, never quite stating whether real people are behind them.
Once purchased, the followers can be a powerful tool.
see a higher follower count, or a higher retweet count, and you assume
this person is important, or this tweet was well received,” said Rand
Fishkin, the founder of Moz, a company that makes search engine
optimization software. “As a result, you might be more likely to
amplify it, to share it or to follow that person.”
and Facebook can be similarly influenced. “Social platforms are trying
to recommend stuff — and they say, ‘Is the stuff we are recommending
popular?’” said Julian Tempelsman, the co-founder of Smyte, a security
firm that helps companies combat online abuse, bots and fraud.
“Follower counts are one of the factors social media platforms use.”
on Google for how to buy more followers, and Devumi often turns up
among the first results. Visitors are greeted by a polished website
listing a Manhattan address, displaying testimonials from customers
and a money-back guarantee. Best of all, Devumi claims, the company’s
products are blessed by the platform for which they are selling
followers. “We only use promotion techniques that are Twitter approved
so your account is never at risk of getting suspended or penalized,”
better understand Devumi’s business, we became a customer. In April,
The Times set up a test account on Twitter and paid Devumi $225 for
25,000 followers, or about a penny each. As advertised, the first
10,000 or so looked like real people. They had pictures and full
names, hometowns and often authentic-seeming biographies. One account
looked like that of Ms. Rychly, the young Minnesota woman.
on closer inspection, some of the details seemed off. The account
names had extra letters or underscores, or easy-to-miss substitutions,
like a lowercase “L” in place of an uppercase “I.”
to Spot a Devumi Bot
profile and background images
Rychly’s original profile picture was color-shifted
and recompressed, possibly to evade automated
first letter of Ms. Rychly’s account name was changed
from a lowercase “i” to a lowercase “l” — something
very difficult to notice at first glance.
Rychly follows a little under 200 accounts, similar to
the average Twitter user. But Devumi bots typically
follow thousands of accounts, with very few followers
bot account, including the fake Ms. Rychly, retweeted
content on a dizzying assortment of topics and in
Rich Harris and Danny DeBelius
next 15,000 followers from Devumi were more obviously suspect: no
profile pictures, and jumbles of letters, numbers and word fragments
instead of names.
August, a Times reporter emailed Mr. Calas, asking if he would answer
questions about Devumi. Mr. Calas did not respond. Twitterforbidsselling
or buying followers or retweets, and Devumi promises customers
absolute discretion. “Your info is always kept confidential,” the
company’s website reads. “Our followers look like any other followers
and are always delivered naturally. The only way anyone will know is
if you tell them.”
company records reviewed by The Times revealed much of what Devumi and
its customers prefer to conceal.
of Devumi’s best-known buyers are selling products, services or
themselves on social media. In interviews, their explanations varied.
They bought followers because they were curious about how it worked,
or felt pressure to generate high follower counts for themselves or
their customers. “Everyone does it,” said the actress Deirdre Lovejoy,
a Devumi customer.
some said they believed Devumi was supplying real potential fans or
customers, others acknowledged that they knew or suspected they were
getting fake accounts. Several said they regretted their purchases.
fraud,” said James Cracknell, a British rower and Olympic gold
medalist who bought 50,000 followers from Devumi. “People who judge by
how many likes or how many followers, it’s not a healthy thing.”
Ireland has over a million followers on Twitter, which she often uses
to promote companies with whom she has endorsement deals. The
Wisconsin-based American Family Insurance, for example, said that the
former model was one of its most influential Twitter “brand
ambassadors,” celebrities who are paid to help promote products.
in January last year, Ms. Ireland had only about 160,000 followers.
The next month, an employee at the branding agency she owns,
Sterling/Winters, spent about $2,000 for 300,000 more followers,
according to Devumi records. The employee later made more purchases,
he acknowledged in an interview. Much of Ms. Ireland’s Twitter
following appears to consist of bots, a Times analysis found.
spokeswoman said that the employee had acted without Ms. Ireland’s
authorization and had been suspended after The Times asked about the
purchases. “I’m sure he thought he was fulfilling his duties, but it’s
not something he should have done,” said the spokeswoman, Rona
Ms. Lane Fox, a British e-commerce pioneer,member of
Parliamentand Twitter board member, blamed a
“rogue employee” for a series of follower purchases spanning more than
a year. She declined to name the person.
Devumi customers or their representatives contacted by The Times
declined to comment, among them Mr. Leguizamo, whose followers were
bought by an associate. Many more did not respond to repeated efforts
to contact them.
few denied making Devumi purchases. They include Ashley Knight, Mr.
Lewis’s personal assistant, whose email address was listed on an order
for 250,000 followers, and Eric Kaplan, a friend to Mr. Trump and
motivational speaker whose personal email address was associated with
eight orders. A Twitter account belonging to Paul Hollywood, the
celebrity baker, was deleted after The Times emailed him with
questions. Mr. Hollywood then sent a reply: “Account does not exist.”
of these celebrities, business leaders, sports stars and other
Twitter users bought their own followers, records show. In other
cases, the purchases were made by their employees, agents, family
members or other associates.
two years, the Democratic public relations consultant and CNN
contributor Hilary Rosen bought more than a half-million fake
followers from Devumi. Ms. Rosen previously spent more than a decade
as head of the Recording Industry Association of America. In an
interview, she described the purchases as “an experiment I did several
years ago to see how it worked.” She made more than a dozen purchases
of followers from 2015 to 2017, according to company records.
buyers said they had faced pressure from employers to generate social
media followers. Marcus Holmlund, a young freelance writer, was at
first thrilled when Wilhelmina, the international modeling agency,
hired him to manage its social media efforts. But when Wilhelmina’s
Twitter following didn’t grow fast enough, Mr. Holmlund said, a
supervisor told him to buy followers or find another job. In 2015,
despite misgivings, he began making monthly Devumi purchases out of
his own pocket.
felt stuck with the threat of being fired, or worse, never working in
fashion again,” said Mr. Holmlund, who left in late 2015. “Since then,
I tell anyone and everyone who ever asks that it’s a total scam — it
won’t boost their engagement.” (A Wilhelmina spokeswoman declined to
Devumi customers acknowledged that they bought bots because their
careers had come to depend, in part, on the appearance of social media
influence. “No one will take you seriously if you don’t have a
noteworthy presence,” said Jason Schenker, an economist who
specializes in economic forecasting and has purchased at least 260,000
surprisingly, Devumi has sold millions of followers and retweets to
entertainers on the lower and middle rungs of Hollywood, such as the
actor Ryan Hurst, a star of the television series “Sons of Anarchy.”
In 2016 and 2017, he bought a total of 750,000 followers, about
three-quarters of his current count. It cost less than $4,000,
according to company records. Mr. Hurst did not respond to multiple
requests for comment.
also sells bots to reality television stars, who can parlay fame into
endorsement and appearance fees. Sonja Morgan, a cast member on the
Bravo show “The Real Housewives of New York City,” uses her
Devumi-boosted Twitter feed to promote her fashion line, a shopping
app and a website that sells personalized “video shout-outs.” One
former “American Idol” contestant, Clay Aiken, even paid Devumi to
spread a grievance: hiscustomer
service complaint against Volvo. Devumi bots retweeted his
complaint 5,000 times.
Aiken and Ms. Morgan did not respond to requests for comment.
than a hundred self-described influencers — whose market value is even
more directly linked to their follower counts on social media — have
purchased Twitter followers from Devumi. Justin Blau, a popular Las
Vegas-based D.J. who performs as 3LAU, acquired 50,000 followers and
thousands of retweets. In an email, Mr. Blau said a former member of
his management team bought them without his approval.
least five Devumi influencer customers are also contractors for
HelloSociety, an influencer agency owned by The New York Times
Company. (A Times spokeswoman said the company sought to verify that
the audience of each contractor was legitimate and would not do
business with anyone who violated that standard.) Lucas Peterson, a
freelance journalist who writes a travel column for The Times, also
bought followers from Devumi.
need not be well known to rake in endorsement money. According to arecent
profilein the British tabloid The Sun, two
young siblings, Arabella and Jaadin Daho, earn a combined $100,000 a
year as influencers, working with brands such as Amazon, Disney, Louis
Vuitton and Nintendo. Arabella, who is 14, tweets under the name
her Twitter account — and her brother’s — are boosted by thousands of
retweets purchased by their mother and manager, Shadia Daho, according
to Devumi records. Ms. Daho did not respond to repeated attempts to
reach her by email and through a public relations firm.
Devumi sells millions of followers directly to celebrities and
influencers, its customers also include marketing and public relations
agencies, which buy followers for their own customers. Phil Pallen, abrand
strategistbased in Los Angeles,offers
customers“growth & ad campaigns” on
social media. At least a dozen times, company records show, Mr. Pallen
has paid Devumi to deliver those results. Beginning in 2014, for
example, he purchased tens of thousands of followers for Lori Greiner,
the inventor and “Shark Tank” co-host.
Pallen at first denied buying those followers. After The Times
contacted Ms. Greiner, Mr. Pallen said he had “experimented” with the
company but “stopped using it long ago.” A lawyer for Ms. Greiner said
she had asked him to stop after learning of the first purchases.
records show, Mr. Pallen bought Ms. Greiner more Devumi followers in
consultants sometimes buy followers for themselves, too, in effect
purchasing the evidence of their supposed expertise. In 2015, Jeetendr
Sehdev, a former adjunct professor at the University of Southern
California who calls himself “the world’s leading celebrity branding
authority,” began buying hundreds of thousands of fake followers from
did not respond to requests for comment. But in his recent
best-selling book, “The Kim Kardashian Principle: Why Shameless
Sells,” he had a different explanation for his rising follower count.
“My social media following exploded,” Mr. Sehdev claimed, because he
had discovered the true secret to celebrity influence: “Authenticity
is the key.”
the followers delivered to Mr. Sehdev was Ms. Rychly — or at least, a
copy of her. The fake Rychly account, created in 2014, was included in
the purchase orders of hundreds of Devumi customers. It was retweeted
by Mr. Schenker, the economist, and Arabella Daho, the teenage
influencer. Clive Standen, star of the show “Taken,” ended up with Ms.
Rychly’s stolen social identity. So did the television baker Mr.
Hollywood, the French entertainer DJ Snake and Ms. Ireland. (DJ
Snake’s followers were purchased by a former manager, and Mr. Standen
did not respond to requests for comment.)
fake Ms. Rychly also retweeted at least five accounts linked to a
prolific American pornographer named Dan Leal, who is based in Hungary
and tweets as @PornoDan. Mr. Leal, who has bought at least 150,000
followers from Devumi in recent years, is one of at least dozens of
customers who work in the adult film industry or as escorts, according
to a review of Devumi records.
an email, Mr. Leal said that buying followers for his business
generated more than enough new revenue to pay for the expense. He was
not worried about being penalized by Twitter, Mr. Leal said.
“Countless public figures, companies, music acts, etc. purchase
followers,” he wrote. “If Twitter was to purge everyone who did so
there would be hardly any of them on it.”
has sold at least tens of thousands of similar high-quality bots, a
Times analysis found. In some cases, a single real Twitter user was
transformed into hundreds of different bots, each a minute variation
on the original.
be golfer..die hard browns fan..cleveland
proud..awful speller...I bite back
behind the scenes with@ChefSymonto
see what happened during a commercial
Hint: Lots of cooking!
Symon, a celebrity chef and Devumi
client, has almost a million followers.
followers have been identified asbotsby
a New York Times investigation, including Ms.
Rychly’s stolen profile. Others appear to be human.
an individual basis, bot detection can be tricky,
but when bots are examined as a group, distinct
first @chefsymon follower wasCorey
Cova, a real person who worked with Mr.
Symon in Cleveland, Ohio. Mr. Cova joined Twitter in
the online retailer, which joined the platform in
time more people followed @chefsymon.
in early 2013 a distinct pattern emerged.
“families” of accounts appeared—
all created within a short period of time, and all
following Mr. Symon almost simultaneously.
the bot impersonating Ms. Rychly.
families contain thousands of similar accounts using
stolen profiles. Patterns like these are clear
evidence of bot activity.
reviewed by The Times show Mr. Symon bought 100,000
Twitter followers from Devumi in September 2014, and
another 500,000 in November 2015. An earlier tranche
of bots appears to have been purchased in early
thought it would drive traffic,” said Mr. Symon. “I
thought it was going to be influencers and people in
my field. It’s embarrassing.”
clients exhibit the same pattern.
Lane Fox, a businesswoman and member of
Britain's House of Lords, blamed a rogue employee
for at least seven Devumi purchases made using Ms.
Lane Fox’s email address. The biggest — 25,000
followers — was made days after she became a Twitter
board member in April 2016.
Klein, a radio talk show host and the
Jerusalem bureau chief for Breitbart News, bought at
least 35,000 followers from Devumi, according to
records. A Times analysis found that the majority of
his followers were bots, as demonstrated by the
unusual patterns seen here.
Cracknellis a rowing
world champion and Olympic gold medalist for Britain
who made a series of Devumi purchases over 2016. Mr.
Cracknell expressed regret, saying, “I don’t want
anybody following me who is not interested in me.”
Rosen, a political commentator and CNN
contributor, paid for over a half-million Twitter
followers. Many of those accounts have since
vanished, but nearly half of her followers —
including the fake Jessica Rychly — also follow Mr.
Rich Harris and Mark Hansen
fake accounts borrowed social identities from Twitter users in every
American state and dozens of countries, from adults and minors alike,
from highly active users and those who hadn’t logged in to their
accounts for months or years.
Dodd, a college studentand
aspiring filmmaker, set up his Twitter account as a high school
sophomore in Maryland. Before he even graduated, his Twitter details
were copied onto a bot account.
fake account remained dormant until last year, when it suddenly began
retweeting Devumi customers continuously. This summer, the fake Mr.
Dodd promoted various pornographic accounts, including Mr. Leal’s
Immoral Productions, as well as a link to a gambling website.
don’t know why they’d take my identity — I’m a 20-year-old college
student,” Mr. Dodd said. “I’m not well known.” But even unknown, Mr.
Dodd’s social identity has value in the influence economy. At prices
posted in December, Devumi was selling high-quality followers for
under two cents each. Sold to about 2,000 customers — the rough number
that many Devumi bot accounts follow — his social identity could bring
Devumi around $30.
stolen social identities of Twitter users like Mr. Dodd are critical
to Devumi’s brand. The high-quality bots are usually delivered to
customers first, followed by millions of cheaper, low-quality bots,
like sawdust mixed in with grated Parmesan.
of Devumi’s high-quality bots, in effect, replace an idle Twitter
account — belonging to someone who stopped using the service — with a
fake one. Whitney Wolfe, an executive assistant who lives in Florida,
opened a Twitter account in 2008, when she was a wedding planner. By
the time she stopped using it regularly in 2014, a fake account
copying her personal information had been created. In recent months,
it has retweeted adult film actresses, several influencers and an
escort turned memoirist.
content — pictures of women in thongs, pictures of women’s chests —
it’s not anything I want to be represented with my faith, my name,
where I live,” said Ms. Wolfe, who is active in her local Southern
victims were still active on Twitter when Devumi-sold bots began
impersonating them. Salle Ingle, a 40-year-old engineer who lives in
Colorado, said she worried that a potential employer would come across
the fake version of her while vetting her social media accounts.
been applying for new jobs, and I’m really grateful that no one saw
this account and thought it was me,” Ms. Ingle said. Once contacted by
The Times, Ms. Ingle reported the account to Twitter, which
emailing Mr. Calas last year, a Times reporter visited Devumi’s
Manhattan address, listed on its website. The building has dozens of
tenants, including a medical clinic and a labor union. But Devumi and
its parent company, Bytion, do not appear to be among them. A
spokesman for the building’s owner said neither Devumi nor Bytion had
ever rented space there.
the followers Devumi sold, the office was an illusion.
real life, Devumi is based in a small office suite above a Mexican
restaurant in West Palm Beach, Fla., overlooking an alley crowded with
Dumpsters and parked cars. Mr. Calas lives a short commute away, in a
LinkedIn profile, Mr. Calas is described as a “serial
entrepreneur,” with a long record in the tech business and an advanced
degree from the Massachusetts Institute of Technology. But Mr. Calas’s
persona, too, is a mixture of fact and fantasy.
Calas, who is 27, grew up in South Florida, where as a teenager he
learned web design and built sites for local businesses, according to
earlier versions of his personal web page available on the Internet
he taught himself techniques for search engine optimization — the art
of pushing a web page higher in search results. While in high school,
he began taking classes at Palm Beach State College, where he earned
an associate degree in 2012, according to a school spokeswoman. Within
a few years, Mr. Calas was claiming to have built dozens of online
businesses serving 10 million customers, now under the Bytion
started this company with a thousand dollars in the bank, without
investors, and only the burning passion for success,” Mr. Calas wrote
last year on the job-listing site Glassdoor.
Mr. Calas’s ambitions grew, so did his embroidery.A copy of
his résuméposted online in 2014 claimed that
he earned a physics degree from Princeton University in 2000, when he
would have been about 10 years old, and a Ph.D. in computer science
from M.I.T. Representatives for both schools said they had no record
of Mr. Calas’s attending their institution. His current LinkedIn page
says that he has a master’s degree in “international business” from
M.I.T., a degree it does not offer.
to former employees interviewed by The Times, turnover was high at
Devumi, and Mr. Calas kept his operation tightly compartmentalized.
Employees sometimes had little idea what their colleagues were doing,
even if they were working on the same project.
ex-employees asked for anonymity for fear of lawsuits or because they
were subject to nondisclosure agreements with Mr. Calas’s companies.
But their comments are echoed inreviews on
Glassdoor, where some former employees said that Mr. Calas was
uncommunicative and demanded that they install monitoring software on
their personal devices.
of Devumi’s customer service and order fulfillment personnel are based
in the Philippines, according to a company records. Employing overseas
contractors may have helped Mr. Calas hold down costs. But it also
appears to have left him vulnerable to a kind of social identity theft
August, Mr. Calas sued Ronwaldo Boado, a Filipino contractor who
previously worked for Devumi as an assistant customer support manager.
After being fired for squabbling with other members of his team, Mr.
Boado took control of a Devumi email account listing more than 170,000
customer orders, Mr. Calas alleged in court papers. Then Mr. Boado
created a fake Devumi.
copycat company used a similar name — DevumiBoost — and copied the
design of Devumi’s website, Mr. Calas alleged. (Mr. Boado did not
respond to emails seeking a response to Mr. Calas’s claims.) The fake
Devumi even listed the same phantom Manhattan address. Over a stretch
of days last July, Mr. Boado, posing as a Devumi employee, emailed
hundreds of Devumi customers to inform them that their orders needed
to be reprocessed on DevumiBoost. Then he impersonated the customers,
too, emailing Devumi under different aliases to ask that Devumi cancel
the original orders. Mr. Boado, according to Mr. Calas, was trying to
steal his customers.
Calas’s lawsuit also revealed something else: Devumi doesn’t appear to
make its own bots. Instead, the company buys them wholesale — from a
thriving global market of fake social media accounts.
Social Supply Chain
around the web is an array of obscure websites where anonymous bot
makers around the world connect with retailers like Devumi. While
individual customers can buy from some of these bare-boned sites —
Peakerr, CheapPanel and YTbot, among others — they are less
user-friendly. Some, for example, do not accept credit cards, only
encrypted currencies like Bitcoin.
each site sells followers, likes and shares in bulk, for a variety of
social media platforms and in different languages. The accounts they
sell may change hands repeatedly. The same account may even be
available from more than one seller.
according to one former employee, sourced bots from different bot
makers depending on price, quality and reliability. On Peakerr, for
example, 1,000 high-quality, English-language bots with photos costs a
little more than a dollar. Devumi charges $17 for the same quantity.
price difference has allowed Mr. Calas to build a small fortune,
according to company records. In just a few years, Devumi sold about
200 million Twitter followers to at least 39,000 customers, accounting
for a third of more than $6 million in sales during that period.
month, Mr. Calas asked for examples of bots The Times found that
copied real users. After receiving the names of 10 accounts, Mr.
Calas, who had agreed to an interview, asked for more time to analyze
them. Then he stopped responding to emails.
Binns, the Twitter spokeswoman, said the company did not proactively
review accounts to see if they were impersonating other users.
Instead, the company’s efforts are focused on identifying and
suspending accounts that violate Twitter’s spam policies. In December,
for example, the company identified an average of 6.4 million
suspicious accounts each week, she said.
of the sample accounts provided by The Times violated Twitter’s
anti-spam policies and were shut down, Ms. Binns said. “We take the
action of suspending an account from the platform very seriously,” she
said. “At the same time, we want to aggressively fight spam on the
Twitter has not imposed seemingly simple safeguards that would help
throttle bot manufacturers, such as requiring anyone signing up for a
new account to pass an anti-spam test, as many commercial sites do. As
a result, Twitter now hosts vast swaths of unused accounts, including
what are probably dormant accounts controlled by bot makers.
employees said the company’s security team for many years was more
focused on abuse by real users, including racist and sexist content
and orchestrated harassment campaigns. Only recently, they said, after
revelations that Russia-aligned hackers had deployed networks of
Twitter bots to spread divisive content and junk news, has Twitter
turned more attention to weeding out fake accounts.
Miley, an engineer who worked on security and user safety at Twitter
before leaving in late 2015, said, “Twitter as a social network was
designed with almost no accountability.”
critics believe Twitter has a business incentive against weeding out
bots too aggressively. Over the past two years, the company has
struggled to generate the user growth seen by rivals like Facebook and
Snapchat. And outside researchers have disputed the company’s
estimates for how many of its active users are actually bots.
Evolution of Twitter’s Timeline
does not have retweet or favorite buttons visible
seven years after its launch.
thereafter, icons for replies, retweets and favorites
are introduced. They do not display counts for those
early 2014, Twitter begins displaying the number of
replies, retweets and favorites for each tweet in a
June of last year, Twitter began updating the counts
of replies, retweets and favorites in real time,
drawing even more attention to them.
Rich Harris and Danny DeBelius
working with completely unregulated, closed ecosystems that aren’t
reporting on these things. They have a perverse incentive to let it
happen,” said Mr. Essaid, the cybersecurity expert. “They want to
police it to the extent it doesn’t seem obvious, but they make money
January, after almost two years of promoting hundreds of Devumi
customers, the fake Jessica Rychly account was finally flagged by
Twitter’s security algorithms. It was recently suspended.
the real Ms. Rychly may soon leave Twitter for good.
am probably just going to delete my Twitter account,” she said.
was contributed by Manuela Andreoni, Jeremy Ashkenas, Laurent Bastien
Corbeil, Nic Dias, Elise Hansen, Michael Keller, Manuel Villa and
Felipe Villamor. Research was contributed by Susan C. Beachy, Doris
Burke and Alain Delaquérière.
and development by Danny DeBelius and Rich Harris. Art direction by
Antonio De Luca and Jason Fujikuni. Illustration photo credits:
Ireland, Rodin Eckenroth/Getty Images; Lewis, D Dipasupil/FilmMagic;
Leguizamo, Amanda Edwards/WireImage, via Getty Images; Ingle, Morgan
Rachel Levy for The New York Times.