Most botnets would easily have more than that number of computers.
So yeah it can be done.
So yeah it can be done.
Not only do you have to bypass the captcha, but also the heuristics that google could (does?) employ to detect fake accounts.
If the votes were weighted by account activity then the spammers would not only have to sign up and vote; they would also have to keep all these accounts busy with fake queries or other means.
Of course, anything can be gamed... But it's better than nothing.
If I were to create a web-app with user-generated content, I would try to create a "trust" system based on a "reputation" / "real person" metric. It may come from his StackOverflow / reddit / HN reputation, his Google Account activity, Facebook activity...
Before buying a product based on a review I read on a forum, I always look at the author's post count / history / reputation. That's why I like HN / Reddit and their Karma systems. We need to automate that
Keeping all those accounts active, cycling out dead accounts etc. could take quite an ongoing infrastructure investment.
Moreover google could give significantly more weight to accounts that look very real (i.e. actively using multiple google products for a long time) and thereby further devalue the botnet impact.
It's yet another arms race of course. But one with fairly good odds I would think.
If you have a botnet, you shouldn't have much trouble doing that.