Elon Musk is likely correct in his claims that Twitter provided inaccurate and insufficient information about the platform's spam and robot accounts, according to former CIA cyber officer Dan Woods.

As F5's global head of intelligence, Woods leads a team of data scientists that identify bots, the applications bots target, and their objectives. Each day he says nearly two billion interactions enter F5's bot defense infrastructure, and based on his experience he argues Twitter's bot traffic is “almost certainly far greater than they have expressed publicly and even greater than they believe internally.”

Musk recently estimated that at least 20% of Twitter's accounts are spam bots and admitted 20% is likely a low-ball percentage. And based on Woods' research and industry experience, he estimates that more than 80% of Twitter accounts are actually bots.

Assuming Musk and Woods are correct in Twitter's underreporting of bot accounts, this scenario is a likely reality for any organization targeted by malicious and unwanted bots that isn't using the right tools to eliminate them, Woods explained.

“I’m sure Twitter is trying to prevent unwanted automation on its platform, similar to every company. But they are likely dealing with highly sophisticated automation from extremely motivated actors. In those circumstances, bot remediation is not a DIY project. It requires equally sophisticated tools,” he said.

So why does Woods think he, and by extension, Musk, are right and Twitter isn't?

First of all, bots always have a goal, Woods said. A key user incentive on Twitter is increasing follower count, and accounts with more followers are perceived as more influential.

“The objective to amplify influence is where this model can become concerning,” he said, citing the attraction of highly motivated nation-state actors with unlimited resources to automated control of millions of Twitter accounts that interact with real users' accounts.

With that incentive in mind and the plethora of online services selling Twitter accounts, likes, and followers, there will undoubtedly be an increase of bot activity, Woods reasoned.

In an effort to prove his claims, Woods says he spent less than $1,000 on aforementioned Twitter services and amassed almost 100,000 illegitimate followers. “I once tweeted complete gibberish and paid followers to retweet it. They did. These accounts have names like TY19038461038, and they follow a lot of other accounts, too,” he said.

Exactly how difficult is it to create an account on Twitter using automation? With not much of a programming background and a bit of YouTube research, Woods found it was pretty easy.

He spent just one weekend writing a script that creates Twitter accounts automatically and claims his “unsophisticated” script wasn't blocked by the platform even though he left his IP address and user agent alone in an effort to not conceal what he was doing.

“If it’s that easy for a person with limited skills, imagine how easy it is for an organization of highly skilled, motivated individuals,” Woods said.

F5 says it deployed its bot defense with an unnamed U.S. social networking site a few years ago and found 99% of the site's login traffic was automated, which was “devastating news to the company. They knew they had a bot problem but never imagined it was that bad,” Woods said.

This meant only a small portion of customer accounts were actually human customers, and the rest were bots. This led to serious implications as social networking companies' valuations rely heavily on the number of daily active users (DAU).

In fact, most applications see about 80% to 90% automated traffic, Woods said. “These findings are not a corner case — they’re common across many organizations” including retail, financial institutions, fast food restaurants, and telecom operators. It's not unusual for companies to grossly underestimate bot activity or to be unmotivated to report accurate DAU numbers.

A lot of enterprises that benefit from inflated DAU numbers don't really want to know the real details on their bot activity, Woods added. “One could argue it would have been better for that company’s shareholders if the organization had never learned the truth and instead simply asserted that their bot problem was less than 5%,” he said.

And this motivation to stay in the dark extends far beyond social media platforms to companies that sell high-demand products with limited inventory like sneakers, event tickets, or consumer tech, for example.

“When these products sell out in minutes to bots, only to be resold on the secondary market for highly inflated prices, it annoys customers,” Woods said. But the company still appears to have quickly sold their entire inventory.

Companies like these are motivated to look like they're doing all they can to mitigate the bot problem while doing essentially nothing behind the curtain, Woods explained.

The volume and velocity of F5's automation reporting isn't just a Twitter vs. Musk issue. “There is something much more important at stake here. ... Allowing this problem to persist threatens the entire foundation of our digital world,” Woods said.

Unmitigated bot activity results in massive fraud, ruins lives, promotes the spread of misinformation, sparks conflicts, and even influences political processes. Allowing it to continue unchecked will lead to the augmentation of all those issues and impact the ability to communicate and relate to one another globally.

“If we as a society want to have all of the conveniences, knowledge, entertainment, and other benefits of the internet and our mobile, connected world, we must do something about automated traffic online. The only way to fight bots is with highly sophisticated automation of our own,” Woods concluded.