# Bots Umbrella entry covering *bots* (automated social-media accounts), *botnets* / *bot armies* (coordinated networks of them), and the related *social bot*, *cyborg account*, *spam bot*, and *LLM bot* variants. The category is one of the load-bearing operational primitives of contemporary digital-disinformation work; pair with [[Sockpuppet Accounts]] (the human-operated equivalent) and [[Troll Farms]] (the industrial-scale operation that often runs both). ## The vocabulary A bot, in the social-media-disinformation sense, is an account that is fully or substantially automated — posting, replying, liking, sharing, and following actions are executed by software rather than by direct human attention. The technical implementation may use the platform's official API (Twitter's now-deprecated v1.1 API, the various Facebook Graph API endpoints, paid APIs), reverse-engineered platform endpoints, or browser-automation tooling (Selenium, Puppeteer, Playwright). Posting may use scheduled-content libraries, RSS-driven content pipelines, AI-generation backends (the post-2022 LLM-era escalation), or human-curated content queues. Variants commonly distinguished: - **Social bot** — generic term for automated social-media account - **Bot army / botnet** — coordinated network of many bots, typically operated as a unit by a single controller - **Spam bot** — high-volume automated posting of advertising or scam content; the older general-internet category, less narrowly political - **Influence bot** — bot whose purpose is opinion-shaping rather than commercial spam; the post-2016 vocabulary subset - **Amplification bot** — bot whose purpose is boosting existing human-generated content (likes, retweets, follows) rather than producing original content - **Honey bot** — bot designed to lure interaction (often for follow-up phishing, harassment, or social-engineering) - **Cyborg account** — human-operated account using automation to scale activity (scheduled posts, automated keyword-replies, automated follow/unfollow); structurally between bot and sockpuppet - **LLM bot** — post-2022 specialization; bot whose content is generated by a large-language-model rather than from a fixed content queue or template The cybersecurity-vocabulary sense of *botnet* (a coordinated network of compromised computers used for DDoS, cryptocurrency mining, or large-scale spam) is older and distinct, though the term is borrowed into the social-media context. When a context is ambiguous, *social bot* and *social botnet* disambiguate. ## What bots actually do (the work product) In contemporary disinformation operations bots typically perform: 1. **Amplification** — liking, retweeting, sharing chosen content to push it into algorithmic-recommendation ranges that promote it to broader audiences. Most bot work is amplification rather than original content production 2. **Manufactured consensus** — creating the appearance that many independent voices share a position; one of the standard astroturf primitives 3. **Hashtag flooding** — saturating a hashtag with off-topic or distracting content to drown out organic conversation, often during crisis or breaking-news events 4. **Reply-floor pollution** — posting reply-section content under target posts to bury counter-arguments, intimidate the original poster, or flood reply space with distracting material 5. **Follower-count inflation** — adding follower numbers to accounts the operator wants to appear more prominent than they are; often combined with amplification to make a coordinated push look organic 6. **Sentiment manipulation** — coordinated like/dislike, upvote/downvote, or rating actions to shift algorithmic-ranking signals 7. **Distributed surveillance** — high-volume monitoring of mentions, keywords, target accounts; bot-staffed reconnaissance ahead of harassment-cascade operations 8. **DDoS-via-Mention** — coordinated mass-mention of a target account designed to bury the user's notifications and effectively silence them 9. **LLM-content production** (post-2022) — automated generation of plausibly-human-sounding original content at scale; the major operational escalation of the early-LLM era ## The detection / counter-detection arms race The history of bot detection is a literature in itself; the major techniques include: - **Posting-pattern analysis** — posting volume, timing distribution across the day, regularity of intervals — bots historically posted with mechanical-regularity signatures - **Account-creation correlation** — bot stables typically created in narrow time windows on similar IPs with similar profile-completion patterns - **Cross-account behavior correlation** — accounts that follow each other, like each other, post in coordinated bursts on narrow topics - **Linguistic-stylometry** — historical bot content showed measurable stylistic uniformity; LLM-era bots make this signal much weaker - **Profile-image analysis** — bot-stable avatars often sourced from stock-photo sites, AI-generation services, or stolen real-user profile photos - **Network-graph analysis** — bot stables typically exhibit graph-structural signatures (high cluster coefficients, low triangle counts in interaction with real-user populations) - **Behavioral-anomaly detection** — accounts that follow tens of thousands of users in their first day, that post at 3am local time for the supposed user-location every day, that show implausible engagement-rate patterns Each detection technique invites a counter-measure. The contemporary operator-side toolkit includes residential-proxy networks, regional-VPN rotation, AI-generated diverse avatar imagery, sophisticated LLM stylistic-variation, randomized posting schedules calibrated to specific time-zone work-hours patterns, and account-aging programs that operate accounts on benign-looking content for months before pivoting to disinformation work. The Indiana University *Botometer* (Davis, Varol, Ferrara, Menczer et al.) was the most-cited public bot-detection tool through the late 2010s; commercial detection services (Graphika, Yonder, Logically) provide platform-and-policy-level analysis; academic research has progressively moved toward *coordination signatures* (CIB) over *bot vs human* binary classification, because the binary has progressively less analytical traction in the LLM era. ## The contested-estimate question The question *what fraction of social-media activity is bots?* is famously hard to answer precisely. Estimates vary by platform, by definition (does *cyborg account* count? does *aged-then-activated bot* count?), and by detection methodology: - **Twitter, 2017–2018 estimates** — variously 9–15% of accounts as bots (Pew / Botometer estimates of varying methodology) - **Twitter (pre-Musk) official position** — under 5% monetizable Daily Active Users were bots / spam - **Musk's 2022 acquisition challenge** — claimed bot share was much higher (used as basis for trying to exit the acquisition) - **Post-acquisition X data access** — limited researcher access has made independent verification harder - **LLM era (2023+)** — the difficulty of distinguishing AI-generated content from human content has further blurred the estimate The honest analytical position: *some non-trivial fraction* of activity on major platforms is automated; the fraction varies considerably by topic (politically-contested topics show higher bot density), by event (crisis events show spikes), and by platform; precise headline numbers should be treated with skepticism in either direction. ## Why bots matter for the right-wing-disinformation ecosystem Two analytical claims worth keeping distinct: 1. **Direct persuasion effect is modest** — most empirical research suggests bot content rarely changes minds at scale; the audience-side academic literature is consistent on this 2. **Structural effects are substantial** — bots inflate apparent support for chosen positions, manipulate trending-topic and ranking algorithms, drown out opposition voices, and degrade the *epistemic infrastructure* of platforms by training all users to discount strangers' statements The 2016 Russian-interference operations were partly built on bot infrastructure (the IRA operated automated accounts alongside its sockpuppet operations); subsequent state-actor operations from China, Iran, [[Saudi Arabia]], India, and others continue the pattern. The post-2022 LLM-era escalation has reduced operator costs and made content harder to detect; the equilibrium of the next few election cycles will substantially turn on whether platform-side and regulatory-side responses keep pace. ## See Also - [[Sockpuppet Accounts]] — the human-operated equivalent; bots and sockpuppets share most operational use-cases - [[Troll Farms]] — the industrial-scale operation that often runs both bots and sockpuppets - [[Astroturfing]] — the strategic objective bot operations typically serve - [[Internet Research Agency]] — canonical operational case - [[Doxxing]] — bot-amplified harassment-cascade workflow - [[Microtargeting]] — the data-targeting layer often paired with bot-content delivery - [[Disinformation Hub]] — Subject hub - [[Disinformation Lexicon]] — alphabetical MOC