I've been asked to provide an explanation on how we treat rule violations by bots, since this varies a lot, while bots can look all the same to some people.
This post is meant to be a plain-English explanation of current policies and practices. It shouldn't be read as modifying or superseding any existing rules or rulings.
Intro
"Bots" might be programs, apps, scripts, or tools. It's a catch-all term for something that's been programmed to perform an automated activity. Some bots just gather information while others perform actions, like sending telegrams.
NationStates permits and even encourages some types of bot while prohibiting others. In general, we want to support innovation and clever third-party tools that make life better for NationStates users, while prohibiting tools that bestow an unfair advantage on their users or consume excessive amounts of system resources.
Over time, bot activity has grown from zero to hundreds of thousands of requests per day. They often send vastly more traffic than a single human user, because they operate much faster, sending dozens or even hundreds of requests at once.
We primarily combat this by strongly encouraging, and sometimes requiring, bots to use the NationStates API, which is capable of managing automated requests much more efficiently than the regular HTML site.
Regulation
From our point of view, bots fall into three categories:
Category 1: General internet bots - e.g. Google, Bing, Facebook, Yandex. These don't particularly care about NationStates, but rather crawl the entire net. They can be very disruptive when they send floods of requests, but are largely irrelevant to this discussion, because they don't run nations.
Category 2: API bots, e.g. Gloomspider, <Nation:> Recruitment Tool, AutoTelegram, Cerb, Storm. These use the NationStates API to interact with the site. Ideally, every bot written by an NS user would fall into this category. The API provides auto-rate-limiting, and ensures bots can't do anything illegal -- which frees the bot author from having to worry about accidentally breaking site rules. They identify themselves by providing a nation name or contact email in their UserAgent.
The great majority of our heaviest bot users fall into this category. It's rare for an API bot to cause major problems, because of the auto-rate-limit and because API requests are generally fast to service, although it can happen occasionally. For example, Storm produced truly astounding numbers of (broken) requests, which required server time even to refuse. In order to protect site performance, we will sometimes contact API bot authors or even block their bot if it seems broken or especially inefficient.
There's really only one way an API bot author can get into serious trouble, and that's if they spread their bot's activity across multiple different users or IP addresses in order to evade the API's auto-rate-limiting.
Category 3: HTML bots. These bots don't use the API but instead interact with the regular HTML site. They are governed by the special Script Rules for HTML site. We heavily discourage this practice because it's prone to all kinds of problems. The HTML site doesn't know who's a bot and who isn't, so it's up to bot authors to ensure their bots abide by the special HTML site rules, which in practice can be tricky. These bots often have an outsized impact on site performance, because requests to the HTML site are slower to service than the API.
This category can be further broken down into:
Category 3A: Rule-abiding HTML bots. These bots are careful to send no more than 10 requests per minute, don't do anything we prohibit, and identify themselves as bots. We still don't like these, as they could go wrong at any moment and become Category 3B bots, but technically they're fine.
Category 3B: Accidentally illegal HTML bots. These bots try to follow the Script Rules but screw up. The majority of bot-related problems we deal with come from here. Usually the bot correctly identifies itself and is attempting to do something legal, but has developed a bug that causes it to spam requests, and the author doesn't notice. A common example is a bot that is careful to stay within the permitted ratelimit when everything is normal, but as soon as it gets an unexpected result, like a missing nation, it gushes forth retries at maximum speed. We generally respond to these bots by contacting the owner and informing them of the problem. We may also block the bot from the site. If the bot's intended purpose is legal, and we can see that the author made efforts to follow the rules, we tend to be lenient, since we understand that bugs happen to the best of us. But often they shouldn't be on the HTML site in the first place, and bot authors who choose this path rather than the API are responsible for what happens.
Category 3C: Deliberately illegal HTML bots, e.g. Predator, bots that cheat at Challenge or other mini-games. These automate things we don't permit to be automated, or execute actions that we require to be performed via the API (e.g. sending telegrams, answering issues), in order to avoid the API's rate limit and restrictions. Many operate in stealth mode, pretending to be regular human traffic, which means they're difficult for us to detect and may operate undercover for some time. Because the purpose of a 3C bot is to break the rules, we deal with them harshly: We may punish users regardless of whether or not they are the bot's author, or understood what the bot was doing--especially if the purpose of the bot was to gain an advantage over other players.
Summary
It's hard to get in trouble from a Category 2 bot. Even if your bot spins wildly out of control (e.g. Storm), its impact will be fairly limited, and we will probably just block it and contact you to fix it.
It's easy to get in trouble from a Category 3 bot, but if we think your bot is buggy rather than trying to do something illegal, and you made efforts to comply with the rules, we will again probably just block it and contact you.
Anyone using a Category 3C bot is in trouble.
