Wikipedia talk:Sockpuppet investigations/Archive 11

Private evidence system for SPI

This idea came to me recently, and since apparently the proposed clerk mailing list isn't going anywhere, I'm posting this for discussion:

• We are now insisting that SPI requests be accompanied by evidence in the form of diffs and an explanation on why the accounts are likely related. This approach usually works, but there are cases where it is not advisable to post the evidence in public (WP:BEANS, etc.).
• The way this has been dealt with in practice right now is for the private evidence to be emailed or otherwise sent (e.g., IRC) to a clerk/CU or several off-wiki. Several problems with this approach include: emails can and do get lost in the cracks, record-keeping is extremely difficult if not impossible, only very few individuals ever look at the case (thus increasing the potential for confirmation bias), and the blocking admin may not be around when the blocked party requests an unblock.
• So the proposal is to solve this problem by creating a system in which case filers can post private evidence. It will work - roughly - in this manner:
  • The filer will enter their private evidence (with diffs, etc.) in the system.
  • The system will generate a ticket number and a key.
  • (maybe) The filer can use the key to modify the contents of the ticket - for example, to update it if new socks are added to the SPI.
  • The filer will open an SPI case in the usual manner, posting the ticket number instead of the actual evidence.
  • Only the SPI clerks and CUs will be able to read the tickets, but they cannot comment on them in the system - to hopefully avoid the scenario of a CU accidentally posting raw CU data (although since it's an entirely separate system and not just another mailing list, it might not even be a big issue).
  • Tickets are kept by default for three months then purged, but may either be kept for longer or deleted early if a clerk/CU sets the respective flag.

Comments? T. Canens (talk) 12:21, 5 March 2012 (UTC)

How will you prevent abuse of such "sekrit testimony"? I have noted (as has ArbCom) that "the usual reasons" are used for way too many bad accusations - and the new system proposed seems like it would prevent others from noting just how weak the accusation is, as there would then be a presumption that sufficient reasons were provided privately. Rather I would suggest that SPI accusations made in that manner should not be publicly posted unless and until a "positive finding" was made by at least three CUs or clerks based on solid evidence (not just claims that the diffs fit a "pattern" or the like). In other words, require all such proceedings to require more than a "likelihood" but a "certainty" that the posts are by directly related accounts. Cheers. Collect (talk) 13:06, 5 March 2012 (UTC)

If the private case was weak, we can and probably will make a public notation to that effect. The whole point is that right now usually only one person sees the evidence (either in email or IRC) and act on them, while with a system like this we can get a lot more eyes on it. T. Canens (talk) 03:53, 6 March 2012 (UTC)

People who want a CU check based on private evidence can already e-mail CUs directly, or send a post to the functionaries mailing list. There seems to be no need to create a parallel system of private evidence for SPI, particularly when private evidence has been a subject of much controversy over the years. Additionally, any system like Tim's above would have to be hosted off-wiki - giving rise to a lot of potential issues related to the access, retention and use of private information. Nathan ^T 23:53, 5 March 2012 (UTC)

Well, first private evidence are also helpful for some behavior-based blocks when CU is useless (all old accounts are stale, etc). Second, the system would allow for much better record keeping. As to the private information, whatever posters decided to post themselves is fair game. I retain all my emails (including lots of WP-related emails) indefinitely, and no one seems to mind. This is IMO pretty close to a mailing list. Because we don't allow clerks/CUs to post comments, no CU data should be posted in the system. If you are referring to the data collected by the server hosting the system, if we are going along with this it will most likely be the toolserver, and they have a pretty well-established policy for this. T. Canens (talk) 03:53, 6 March 2012 (UTC)

Tim: overall I think it's a good idea, but I worry that it would fall into disuse. We'd have to make a real effort to keep it up to date, so it'd have to integrate pretty well with the current SPI tools. From a system design perspective, you could spend hours building that sort of thing... — HelloAnnyong ^{(say whaaat?!)} 03:33, 6 March 2012 (UTC)

I'm speaking purely hypothetically since I'm not sure we need such a system, but couldn't we just use a private queue on OTRS for this? We could set it to only be viewable by WMF staff and checkusers. OTRS could be set to reply to any email sent to that queue telling the user their ticket number. They can then use this ticket number as described above. Checkusers are already identified so obtaining OTRS access is not an issue. --(ʞɿɐʇ) ɐuɐʞsǝp 11:58, 6 March 2012 (UTC)

Not all the clerks (e.g. me) are OTRS, though... — HelloAnnyong ^{(say whaaat?!)} 04:33, 7 March 2012 (UTC)

If the evidence truly needs to be private then the clerks shouldn't be reviewing it anyway; it should only be sent to the checkusers to minimise the number of people that see it. --(ʞɿɐʇ) ɐuɐʞsǝp 12:18, 7 March 2012 (UTC)

• And we already have an existing implementation for the Oversight queue. - Mailer Diablo 11:31, 18 March 2012 (UTC)

Can I get a merge done

I'm just about to head out the door, so could someone merge these cases and their archives pls? :)

• Wikipedia:Sockpuppet investigations/AkramBinWallid - Master
• Wikipedia:Sockpuppet investigations/ProfessorJane
• Wikipedia:Sockpuppet investigations/114.229.254.215 -- DQ (ʞlɐʇ) 20:58, 21 March 2012 (UTC)

User:DavidYork71 investigation, problems with template

I believe that User:DavidYork71 has shown up again in User:SternComradeLoyalFascist but I am having problems with the template WP:Sockpuppet investigations/DavidYork71. The template is showing SternComradeLoyalFascist as Sock 1, but is all the code and pipes. Can we correct this? the evidence section is fine.Coffeepusher (talk) 17:51, 30 March 2012 (UTC)

never mind, the template fixed itself.Coffeepusher (talk) 18:08, 30 March 2012 (UTC)

Wikipedia:Sockpuppet investigations/Matt Giwer

Doesn't seem to be showing on the main page. Dougweller (talk) 10:39, 17 March 2012 (UTC)

That's because we're over the transclusion limits for the page again. We could think about restructuring the page, but it's generally a sign that we have a backlog. Get to work, admins/clerks/CUs. Amalthea 11:13, 17 March 2012 (UTC)

Thanks for the explanation. Dougweller (talk) 17:48, 17 March 2012 (UTC)

Hmm, why didn't the bot update the main SPI page directly? I've always wondered about that. T. Canens (talk) 03:33, 18 March 2012 (UTC)

I don't know. Nixeagle ‎subpaged it early during SPCUClerkbot development, but at a glance can't find out where it was discussed (there's no BRFA for it). Tiptoety may know. Amalthea 12:02, 18 March 2012 (UTC)

There was a good reason, but I can't recall what it is. Let me dig through some notes/archived discussions and see if I can come up with something. Tiptoety ^talk 17:08, 18 March 2012 (UTC)

Noting here that I didn't find anything in my notes that explained the reason for the current set up. Tiptoety ^talk 05:25, 1 April 2012 (UTC)

And this one is also not showing up, but, perhaps it'll be automatically added, not sure (I'm not savvy with bots and such!) Wikipedia:Sockpuppet investigations/Helpalot. Sarah (talk) 22:34, 3 April 2012 (UTC)

Superfluous report

I've posted a report that may've been rendered moot, or just plain incorrect, by a CU block as different sockpuppeter. I don't know how to withdraw my report; strike it? blank it? make a statement describing the situation? The checkuser in question hasn't responded to my post on their user talk...it's lunchtime where I am and maybe for them as well. Thanks Tiderolls 16:46, 1 April 2012 (UTC)

K, nevermind. The CU is about so my embarrasing post should be cleared up momentarily. Tiderolls 17:00, 1 April 2012 (UTC)

Don't worry! Cases like that need only a quick tagging with {{unnecessary}} and then they can be archived away within seconds. You're not wasting any time or anything. --(ʞɿɐʇ) ɐuɐʞsǝp 13:22, 9 April 2012 (UTC)

Wikipedia:Sockpuppet investigations/Koov

Is this SPI properly closed? It was marked as closed by MuZomikx (an impersonator of MuZemike), who was reverted by Boing said Zebedee, who then self-reverted; his edit summary makes me think that he didn't realise that MuZomikx was an impersonator. It's since been closed by Spitfire, but I'm not sure if that's because it should be closed or simply because it was already marked as closed. Nyttend (talk) 12:51, 9 April 2012 (UTC)

Looking at the last case, it looks like everything was completed. Roadkill1x was confirmed by Deskana to be a Koov sock. The account was blocked and the case archived. TNXMan 13:16, 9 April 2012 (UTC)

Good. I was afraid that it had fallen through the cracks due to vandalism. Nyttend (talk) 13:45, 9 April 2012 (UTC)

Design flaw

When filing a CU via the form, there is a clear instruction not to fill out the headline section. There being such a section, there is no edit summary box. It is therefore reasonable to assume some kind of automatic edit summary will be used. This, however, is not the case. Some of us do make a point of always using some kind of edit summary, so it is annoying to be forced into making an edit without one; especially given it is something so important as (re-)opening an SPI. Blood Red Sandman ^{(Talk) (Contribs)} 15:25, 4 April 2012 (UTC)

That is really a design flaw with MediaWiki. The problem is that MediaWiki uses the same parameter for both edit summaries and section headlines, which does not seem to me good software engineering practice since the two have rather different semantics. The only way we can show a preloaded report is if we use the "new section" interface, and in order to not mess up with the formatting, the headline section must be left blank so that it does not create L2 headings. T. Canens (talk) 14:07, 9 April 2012 (UTC)

<nods> I suspected as much. I wonder if a warning can go in, somewhere... Perhaps in the same place as the warning not to modify the heading? Blood Red Sandman ^{(Talk) (Contribs)} 19:50, 10 April 2012 (UTC)

Navigation links

What has happened to the links box at the bottom of the page? It has been replaced by the text "Template:Noticeboard links". This seems to have happened in an edit by Amalthea2[1], but I can't understand how, or how to repair this. Could someone please help. RolandR (talk) 17:14, 14 April 2012 (UTC)

There are other problems, too. "Open cases: awaiting Checkuser processing" seems to be malformed, as does the LTA section and some others. Please investigate and resolve! RolandR (talk) 17:24, 14 April 2012 (UTC)

Transclusion limit. See also top section. Amalthea 19:54, 14 April 2012 (UTC)

I don't understand what that means. RolandR (talk) 22:09, 14 April 2012 (UTC)

It means that there are too many open cases on the mainpage (cases that are transcluded there). Tiptoety ^talk 06:05, 15 April 2012 (UTC)

Editor interaction tool

Thought you might be interested in a new tool I'm working on. It's similar to (and was inspired by) the popular stalker tool, except that it sorts common pages by time between edits. So, if two users edited the same page within a short time, that page will show up higher on the list than other pages. It also gives you a view of both users' edits to one page in chronological order. Take a look if you're interested: http://toolserver.org/~snottywong/editorinteract.html ‑Scottywong| soliloquize _ 20:30, 17 April 2012 (UTC)

I can see how this would be useful when investigating some types of sockpuppetry. Can you explain why some lines are coloured differenty, as in this example of two completely unrelated users chosen at random? Delicious carbuncle (talk) 20:58, 17 April 2012 (UTC)

That is probably just the "visited link" color. Some other editors have been confused by that coloring as well, so I think I will probably change it soon. ‑Scottywong| converse _ 21:25, 17 April 2012 (UTC)

That does appear to be it. Thanks. Delicious carbuncle (talk) 21:30, 17 April 2012 (UTC)

Could we possibly make it for more than just two users? Because I like the interaction time feature. -- DQ (ʞlɐʇ) 15:14, 18 April 2012 (UTC)

I've thought about that. It would increase the complexity of the analysis by quite a bit (which, in turn, would make the tool take a lot longer to return results, especially in cases where all the editors have a lot of edits). I'll think about making a copy of the tool which works on multiple users, but only on (for instance) their last 5000 or 10000 edits. ‑Scottywong| yak _ 16:58, 18 April 2012 (UTC)

Experimental version for up to 10 editors: http://toolserver.org/~snottywong/editorinteractmulti.html ‑Scottywong| spill the beans _ 20:36, 20 April 2012 (UTC)

Heh I just got back to checking back to this page, this is awesome, though 5k edits should be more than enough. Thanks! :) -- DQ (ʞlɐʇ) 21:38, 20 April 2012 (UTC)

I like it, too. One request: Strip any trailing whitespace from the usernames. I sometimes end up with an extra space when copying. Thanks for the nice tools! ​—DoRD (talk)​ 21:42, 20 April 2012 (UTC)

Notice of an SPI restriction

This is a notice that I have officially restricted User:Darkness Shines on SPI investigations to the following:

In my SPI clerk hat, you are being restricted from:

1. Filing SPIs against well established users (guide is 500 edits, not including major sockpuppeters, except as the next item)
2. Filing against Nangparbat
3. From using presenting evidence against established users
4. From filling huge SPIs with multiple editors involved (5 is a general max)

This is an indefinite restriction till you can show otherwise that you will not waste SPI clerk time with baseless cases. Your normal cases (which you have been pretty good with recently) are still allowed and encouraged. Appeal is to the SPI clerk/CU team as a whole, and I will be giving them notice of this restriction.
— User:DeltaQuad 22:55, 23 April 2012

Feel free to contact me with any questions. -- DQ (ʞlɐʇ) 22:45, 23 April 2012 (UTC)

I wonder under what kind of authority this ban was enacted. Since when do "clerks" have the power to unilaterally impose block-enforced editing restrictions on individual users? And since when is the "SPI clerk/CU team as a whole", rather than the community as a whole, responsible for hearing appeals about anything? WP:SPI/C clearly states that "SPI clerks do not [...] Have any special authority over the general community; their actions can be overturned by the community or by any CheckUser; [...] Have any special status or any immunity with regard to consensus or other policies". Fut.Perf. ☼ 13:08, 1 May 2012 (UTC)

I trust the clerks to make a call like this, but this is still a fair question which deserves a good answer (preferably from DeltaQuad). --(ʞɿɐʇ) ɐuɐʞsǝp 13:27, 1 May 2012 (UTC)

• I must insist the sanction imposed on me from filing SPI's on Nangparbat be removed immediately. DQ had not the authority to enact it, and I will not be prevented from filing an SPI against a prolific sockpuppeter who continually stalks and harrases me. Darkness Shines (talk) 14:26, 1 May 2012 (UTC)

This doesn't seem outside of typical admin scope. I certainly wind up in the position of telling an editor "I have determined your behaviour to be disruptive, and if you do it again, I will block you". This doesn't seem to be any different. The target editor can bring it up in advance at ANI or afterwards in an unblock request, but issuing the warning/restriction isn't really all that unusual.—Kww(talk) 15:16, 1 May 2012 (UTC)

I'll keep that in mind the next time I meet a user making bad image uploads – I'll simply topic-ban them from uploading any others. But no, seriously, last time a possibility like this was discussed among admins, the consensus was very clearly that individual admins should not have such an authority, and that general restrictions of this sort should remain the prerogative of the community as a whole. There is an objective difference between a normal, legitimate admin block warning, and a restriction of this sort. A block warning says: "you've been doing disruptive things X; if you do X in a disruptive way again, I'll block you". However, a formal restriction (as in this case, or as in the case of a topic ban) says: "you have been doing a mixture of good and bad things in area X. From now on, if you do anything at all in area X again, be it objectively good or bad, I'll block you". That's a far stronger measure, and in this case it was handed out with the air of a special authority (somebody "wearing his SPI clerk hat"), and I am just questioning whether this type of hat comes with this type of authority. Last time I looked, it didn't. Fut.Perf. ☼ 15:27, 1 May 2012 (UTC)

I would consider that checkusers have the authority to warn users for misuse of the SPI process, and block users if they do not heed the warnings. Out of curiosity, Fut.Perf, would you? --(ʞɿɐʇ) ɐuɐʞsǝp 15:29, 1 May 2012 (UTC)

That's just the difference between a "warning" and a "restriction" I described above. General warnings may of course be legitimate (block if user does something disruptive again). A generalized formal restriction (block user irrespective of objective merit of any future action) is something different. BTW, I'm not sure what "would you" refers to – would I consider? would I block? would I heed? – Fut.Perf. ☼ 15:33, 1 May 2012 (UTC)

I meant "Would you consider". It seems your answer is yes, because as you pointed out I failed to spot the distinction you made in your post. Thanks for your feedback. FYI, I've left a message on DeltaQuad's talk page inviting him to comment on your question. --(ʞɿɐʇ) ɐuɐʞsǝp 15:37, 1 May 2012 (UTC)

I can accept the distinction, but it seems to me that DQ has erred primarily in attempting to be excessively formal.—Kww(talk) 15:52, 1 May 2012 (UTC)

When someone is so disruptive that it's causing harm to a process, there are three options. 1) Block them (which causes collateral damage if they're useful elsewhere), 2) ignore them (which is rude, and often ineffective because the disruptive person won't take the hint), or 3) interaction or topic ban them. This is an application of option 3, and admins do have the ability to unilaterally impose topic bans or interaction bans. Sven Manguard Wha? 20:27, 1 May 2012 (UTC)

(without particular prejudice to this circumstance) I don't think so. Wikipedia:Editing restrictions clarifies that this is either done by Arbcom or the community via a noticeboard like WP:AN. I've never seen a single admin impose such restrictions.
⋙–Berean–Hunter—► 20:43, 1 May 2012 (UTC)

(edit conflict) (without seeing Sven's or Berean's comments) Future Perfect, I actually was not trying to stop the wider community from having input on this, I actually was only adding another step into the process hopefully to eliminate the drama by taking it to a lower body first who could point where they feel I have erred in the wrong, or where the user has improved. My intention with the appeal note was to have the SPI team on the appeal first, then the general community, then further up the community chain, at last leading to ArbCom. As for where I felt the "jurisdiction" to issue such a restriction Wikipedia:Sockpuppet investigations/SPI/Clerk and checkuser procedures states "Full clerks may ask users to cease patrolling or posting to SPI pages (other than to open a case or present evidence) if there are problems." Obviously I did not note the "other than to open a case or present evidence" when I last read the procedures several months ago. Though it doesn't seem to be "in jurisdiction" I would like to ask the team, and if needed, the further community to consider that this restriction may be better. As to the spirit of the restriction, I hate and never want to tell a user to stop filling SPIs. But when it becomes a burden or over burden to the clerk and checkuser teams, we have an issue. I have had three checkusers comment whether in public or in private (and maybe the private part is part of the issue here) that Darkness Shines SPI filings are an issue. One had even noted that DS needed to stop filing against regulars and that a restriction was definitely should be considered if not administered. I also did not consider myself out of scope issuing a 'restriction' in what ever term you want it as per Wikipedia:Editing restrictions#Final_warnings and the restrictions given there. Also the problem I would be dealing with if I gave a pure warning in your terms is all I could say is that "If you file another bad SPI or a disruptive one, I will block you." So i'm stopping a good editor from editing within the community, where the contributions might actually be useful, over issues with an administrative process? That's why I tried to err on the side of not making it a warning, but at the same time, it needed to be stopped. If I gave the warning stated above, it would be open to great interpretation of any administrator caring to review an unblock requested by DS. If I had 1 out of 1,487 current administrators disagree with me, then the editor would be unblocked, leaving the same issue resulting and a broken process for administrative enforcement. I hope I have answered all the questions, I will look back here and try to answer any other questions, but I hope this explains the nature, the process and my thoughts. -- DQ (ʞlɐʇ) 21:07, 1 May 2012 (UTC)

Are you going to remove the restriction on my filing against Nangparbat or not? Given he today again posted on my talk page which shows he is still stalking me. Darkness Shines (talk) 21:14, 1 May 2012 (UTC)

Personally I'd just scrap the complicated restrictions in favor of just topic banning you from SPI entirely, but it's not my call. I'm not an active clerk at the moment. Sven Manguard Wha? 07:44, 2 May 2012 (UTC)

Darkness shines, there is no point in filing IP addresses for Nangparbat. They rotate every 24 hours, they are not on a blockable range, and he is only doing it to annoy you at the moment. You are obsessed with socks. Just leave it for a while - you are disruptive at the moment when you file at SPI, and if you don't take the hint for a few months, you probably will end up topic banned by the community, who (like the clerks and checkusers) get fed up with you reporting everyone who takes the opposite view to you as a sock. Elen of the Roads (talk) 08:05, 2 May 2012 (UTC)

Move discussion

See Wikipedia talk:Sockpuppet investigations/Hershebar#Move. Not really sure what's up with this, I don't think I've ever seen an SPI come through RM. In any case, I think it's being requested that the two SPI files be histmerged, which I guess makes sense if it's all the same guy (wouldn't have a clue if they are, though). Hoping someone with a bit of experience with SPIs can take a look at it, because it's languishing in the RM backlog. Cheers, Jenks24 (talk) 04:57, 2 May 2012 (UTC)

New members

Is SPI still accepting new members? The project page is flagged as having "a backlog that requires... administrators," so I don't know if more non-administrators would help. Lack of any information about how to join makes me lean towards no, but I am interested in helping out if so. --BDD (talk) 16:49, 3 May 2012 (UTC)

You may want to apply to become a trainee SPI clerk. Δρ.Κ. ^{λόγοςπράξις} 18:10, 3 May 2012 (UTC)

"User compare report" link

Clicking the "user compare report" link for Lui1721 at Wikipedia:Sockpuppet investigations/Lui2021, I get an HTTP403 Forbidden error. Has Betacommand forbidden us to use his tools in retailation for banning him? Or is this tool only available to certain users? Nyttend (talk) 00:11, 12 May 2012 (UTC)

Doubtful. It was probably just temporarily down. It worked for me when I clicked on it just now. --92.6.200.56 (talk) 21:24, 14 May 2012 (UTC)

SP Allegations

Just would like to confirm Wikipedia policy, what do you do if you have been accused of being a sockpuppeteer? On Talk:Phil Mason I have been accused of being one (which, I am not) on circumstancial grounds from another user. They've tagged the other account but not started an spi. The C of E. God Save The Queen! (talk) 14:09, 8 May 2012 (UTC)

If they have not taken any further action, I would say you could ignore it. Without looking at the specifics, I would guess they are trying to intimidate you. TNXMan 20:56, 14 May 2012 (UTC)

I'm fairly sure that's not allowed under WP:NPA judging from guidance at WP:INTIM. The C of E. God Save The Queen! (talk) 18:44, 16 May 2012 (UTC)

Note that the page in question was deleted on May 8 per WP:G10. ​—DoRD (talk)​ 00:29, 17 May 2012 (UTC)

Cannot open case - assistance needed

Hi. I'm unable to open a case as the submission form at WP:SPI requires an account (I'm an IP editor). Once I put in the username it takes me to Wikipedia:Sockpuppet investigations/$USERNAME, however I can't create the page--probably because it's in Projectspace.

I did try asking about it at #wikipedia-en-spi but I don't think anybody was around to respond. I've written the case submission ready to add. What should I do? Do I give the username here requesting a blank page be created in that name so I can paste in the details, or should I place the name+evidence information here, or is a different way preferred?

Thank you for any help. Regards, --92.6.200.56 (talk) 20:11, 14 May 2012 (UTC)

Yes, either add the information here or place the information at the WT page and request a move by placing a {{editsemiprotected}}. Regards, mabdul 21:28, 14 May 2012 (UTC)

Thank you, mabdul! I created the page and added {{editsemiprotected}} requesting it be moved to project space. Kind regards, --92.6.200.56 (talk) 21:54, 14 May 2012 (UTC)

A lovely and fast person took care of it. Thanks! --92.6.200.56 (talk) 21:57, 14 May 2012 (UTC)

That'd be me. No problem, thanks for helping to root out sockpuppets. Furries (Talk) 21:59, 14 May 2012 (UTC)

I went ahead and create a new button for IP users which creates the WT page automatically and placing automatically an {{edit semi-protected}} on it. Regards, mabdul 11:01, 16 May 2012 (UTC)

Aww, that's very thoughtful of you mabdul. Thank you for doing it, it makes it much clearer. 92.6.200.56 (talk) 13:33, 16 May 2012 (UTC)

Likely IP sock evading Indef Ban

I very strongly suspect that 110.174.4.210 (talk · contribs) is actually indef blocked editor Bowei Huang 2 (talk · contribs) (block for socking).
This is based on:

• use of similar IPs such as 110.174.63.234 (talk · contribs),
• IPs are through same internet provider,
• editing patterns (type of article and type of edits; esp re-directing against consensus and edit warring to maintain same),
• non-use of edit summaries, blanking of talkpage when warned.

See Wikipedia:Sockpuppet investigations/Bowei Huang 2. Several editors reverted almost 100% of their last slew of edits. What should my next move, if any be? Just add the IP to the list of suspected sockpuppets ie. {{IPsock|Bowei Huang 2}}? - 220 of ^Borg 08:46, 19 May 2012 (UTC)

I've started a new investigation page and requested a rangeblock, if one is possible. Dori ☾Talk ⁘ Contribs☽ 01:50, 20 May 2012 (UTC)

Wikipedia:Sockpuppet investigations/Yasht101

Wikipedia:Sockpuppet investigations/Yasht101, which is requested by me includes quiet a lot of evidences. However, the user is not using his old account claiming that he has retired and won't be in Wikipedia anymore. Hence, should I go ahead with the SPI, tough the user is not contributing from his another account? -- ♪Karthik♫ ♪Nadar♫ 06:43, 22 May 2012 (UTC)

The situation sounds quite complicated, but speaking generally you should never be afraid of filing an SPI as the worst that will happen is that it gets declined. There are no negative consequences for filing declined SPIs. --(ʞɿɐʇ) ɐuɐʞsǝp 15:04, 24 May 2012 (UTC)

Proposal to modify the clerk team

Please see the proposal to modify the clerk team. -- DQ (ʞlɐʇ) 12:14, 28 May 2012 (UTC)

User:SuperblySpiffingPerson actually sock of User:DavidYork71

I was wondering if we could get User:SuperblySpiffingPerson labeled as a sock of User:DavidYork71 rather than a sock master. Checkuser confirmed that one of Superblys' socks, User:Janoskian was actually a sock of David. David has a long history of abuse and consolidating all of his socks under the single sockmaster will, in my opinion, make fighting his abuse easier.Coffeepusher (talk) 01:58, 29 May 2012 (UTC)

Inappropriate category

For some reason, the project page has been placed in the category Category:Wikipedia sockpuppets of AndresHerutJaim. This is obviously a mistake; but I can't see where this has been added. Could someone please remove this. RolandR (talk) 15:55, 13 June 2012 (UTC)

[2] -- DQ (ʞlɐʇ) 16:04, 13 June 2012 (UTC)

Mistyping and mistaken archiving

I mistyped an SPI. In place of AndresHerutJaim, I typed AndrfesHerutJaim, and the cas has now been mistakenly archived at Wikipedia:Sockpuppet investigations/AndrfesHerutJaim/Archive instead of Wikipedia:Sockpuppet investigations/AndresHerutJaim/Archive. Could someone please correct this? RolandR (talk) 20:31, 18 June 2012 (UTC)

 Done Thanks for bringing this to our attention. ​—DoRD (talk)​ 21:16, 18 June 2012 (UTC)

I done messed up

Wikipedia:Sockpuppet investigations/User:KO.2 needs to be moved to Wikipedia:Sockpuppet investigations/KO.2. Thanks! -- Uzma Gamal (talk) 13:06, 22 June 2012 (UTC)

 Done I moved the case shortly after it was submitted, but just now noticed this request. ​—DoRD (talk)​ 03:54, 23 June 2012 (UTC)

Please read, vandalizing

Someone is vandalizing all Rare LTD. (a videogame company) with fake news about them and their games:

• The first, by 151.41.29.141, was about an announced new Conker game at E3. 108.93.254.189 wrote in the same page that Rare are making a new Conker game for Wii, Playstation 3 and Xbox 360.
• On Rare LTD. page, Jeff G. wrote that Rare left Microsoft and came back to Nintendo.
• 68.36.116.12 wrote on Banjo-Kazooie (series) page that Rare are working on Banjo-Kazooie 3DS.
• The page about the non-existing videogame Grabbed by the Ghoulies II was created by BlueMario1016. — Preceding unsigned comment added by Walecs (talk • contribs) 07:58, 24 June 2012 (UTC)

When does policy permit summarily reverting a suspected sock?

Suppose user "XYZ" is suspected of being a sock of a banned user, and has been reported as such at WP:SPI. Is it acceptable to start reverting XYZ's edits on sight (using an edit summary such as "rv sock") right away, on the assumption that XYZ is "obviously" a sock (and, as such, reverting of his work is exempt from 3RR/EW concerns)? Or does this sort of treatment of XYZ need to wait until such time as the SPI process has conclusively tagged him as a sock?

I see risks either way ­— giving short shrift to due process on the one hand (especially if XYZ might not be a sock after all), or unduly empowering abusive editors on the other hand (letting them take advantage of the slowness of the system by churning out sock after sock). I don't think we should play stupid, but the SPI procedure has presumably been established to put a damper on haste and prevent abusive sock allegations. What do others think? — Richwales 05:10, 23 June 2012 (UTC)

A few questions: Is the new account created a few days after the master got blocked? Are the edits identical? Do the edit-summaries look similar? Is there a propensity for both accounts to flood the talkpage with walls of information? Do they edit-war incessantly? When invited to participate in the SPI, does the new sock-to-be respond? When given a 3RR warning does the new account comply? Δρ.Κ. ^{λόγοςπράξις} 05:34, 23 June 2012 (UTC)

This suggests that there might be (or should be) three possibilities instead of only two — the third being that if a sock case is "sufficiently obvious", perhaps the case can/should be treated from the start as if it were already confirmed, even before the SPI process has run its course. I can see risks either in doing this (lots of potential for abuse and miscommunication), or in not doing it under certain circumstances (letting the "obviously guilty" play around while we're trying to prove that they really are guilty). My purpose in bringing the question here is to find out what people, in general, understand the policy to be, and perhaps also to see if any consensus exists to fine-tune the policy. — Richwales 06:11, 23 June 2012 (UTC)

In some cases, such as the case that prompted this policy question, the editor is so obviously a sock (same edits, same wording, same edit summaries, etc.) that he/she is reverted immediately without waiting for the investigation to proceed. Indeed, in this case, the sockmaster has been at work socking for years and his habits are very well known. In other cases, the sock isn't so obvious and there is some content discussion permitted before the sock is ejected. But once the sock is known and ejected, then all editing done by the sock is reverted. But in each case, the page in question was well-monitored and tended by experienced editors so that the sock's activities were reverted. I think that we need to let some things be in the hands of experienced editors who are familiar with the page in question and the socks (and anon IPs) who typically make disruptive comments. If we regulate Wikipedia too much, then it simply empowers the socks to find the loopholes which they can exploit while tying the hands of the conscientious editors who know what they are doing on any given page. --Taivo (talk) 08:40, 23 June 2012 (UTC)

Actually, the fact that "Justice Forever" has been able to continue harassing Wikipedia for ~5 years — forcing Dr. K. and others to play a never-ending game of Whac-A-Mole against one sock after another — suggests to me either that the existing anti-sock tools may not be adequate to the task, or else that other tools need to be brought into play. The Cyprus topic area, for example, seems to me to be an obvious candidate for discretionary sanctions, as an adjunct to the existing sock-fighting activity. Is it possible to ask ArbCom to authorize discretionary sanctions by motion? Or will they do this only in connection with a full-fledged case? Are there other anti-disruption tools that might be worth considering in cases like this as well? I'm not suggesting WP:AC/DS is a magic wand, but it seems to me that it would make the overall task easier (for example, by providing a recognized justification for an admin to block a suspected sock for a longer period of time while an SPI process proceeds). — Richwales 17:37, 23 June 2012 (UTC)

If an administrator is convinced that a user is a sockpuppet and has the evidence to back up such an assertion, then they can do so immediately without need for filing an SPI case. SPI mainly exists as a courtesy to users who are not administrators so that they have a forum where they can present their evidence and have an administrator act appropriately. Given this, I'm not sure what you're asking for. Can you please explain a bit more? --(ʞɿɐʇ) ɐuɐʞsǝp 17:48, 23 June 2012 (UTC)

Thank you. I was not aware that an admin had the authority to do that while an SPI case was still pending. Per what you've said, I have extended Axisperpendicular's block to be indefinite. As for my question about additional tools for fighting sockpuppetry in general, or disruptive editing on Cyprus-related topics in general, this isn't as urgent anymore (after your clarification) — though WP:AC/DS might still be appropriate for that topic, especially if a more in-depth examination of recent edits reveals disruptive editing not clearly attributable to known socks. I'll take a look at this later today, if someone else doesn't beat me to it. — Richwales 18:13, 23 June 2012 (UTC)

There are a bunch of admin discretionary tools available to admins who work in the Balkans articles. From what I've seen "Balkans" is not really tightly defined. Can Cyprus be included in the "Balkans" since it involves Greece and Greeks? If we can, then there are already tools in place for an admin to use to keep a tighter control. --Taivo (talk) 20:39, 23 June 2012 (UTC)

Including Cyprus under the existing "Balkans" sanctions umbrella seems like a stretch to me. However, I've brought up the question at Talk:Balkans#Cyprus? to see what people working there think of the idea. — Richwales 01:31, 24 June 2012 (UTC)

Additionally / alternatively, are there any tools that haven't already been tried to curb seemingly endless sock activity of this sort, other than by reporting and indef-blocking each sock, one at a time? I'm not familiar with all the ins and outs of SPI, so apologies in advance if this is a futile FAQ. — Richwales 03:58, 24 June 2012 (UTC)

Checkusers may be able to do more, but whether we can or not is based on technical factors outside our control. --(ʞɿɐʇ) ɐuɐʞsǝp 09:54, 24 June 2012 (UTC)

Good faith belief that the target is a sock is all that is required. If someone's good faith belief proves to be frequently faulty, either through sloppiness or bad faith, it becomes a case for community intervention.—Kww(talk) 22:44, 23 June 2012 (UTC)

I asked one current arbitrator for his thoughts on sanctions for the Cyprus topic, and his opinion was that: "I'm not aware of any discretionary sanctions enacted by either the Arbitration Committee or the community that would apply to Cyprus-related articles. I think trying to categorize Cyprus geographically or politically as part of the Balkans would be a bit of a stretch." So if we would want to supplement the tools already available with a declaration of sanctions on this subject area, I guess it would have to be a new request, rather than an application of something already in existence. I'm mulling over whether and how to try to accomplish this. — Richwales 16:29, 26 June 2012 (UTC)

Request for comment on unblocking policy

A request has been opened at Wikipedia talk:Blocking policy#Proposal: third party request for unblock

Should the proposed change, "A third party may request the review of a block at the Administrators' noticeboard," or some variation of that change, be added to the unblocking policy. Penyulap ☏ 01:20, 28 Jun 2012 (UTC)

Creating Wikipedia:Sockpuppet investigations/Shawnee Smith

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

I can somebody help? http://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Shawnee_Smith&action=edit&redlink=1 --Ultimate Anna (talk) 12:15, 29 June 2012 (UTC)

Perhaps, but you'll need to explain what you need. ​—DoRD (talk)​ 12:17, 29 June 2012 (UTC)

I put the same link!

http://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/Shawnee_Smith&action=edit&redlink=1 --Ultimate Anna (talk) 12:22, 29 June 2012 (UTC)

You just need to following the instructions in the "To open a case" section on the Wikipedia:Sockpuppet investigations page. There doesn't appear to have been a previous case for Special:Contributions/Shawnee_Smith. Sean.hoyland - talk 12:34, 29 June 2012 (UTC)

ah..I now see that in fact you have been accused of being a sockpuppet of Shawnee Smith by Mdann52 here. Mdann52 doesn't appear to have filed a report yet, hence the red link. So, if you are a sockpuppet of Shawnee Smith please file the report against yourself. This will be a first and may set a trend. Sean.hoyland - talk 15:15, 29 June 2012 (UTC)

Obvious sock of User:Shawnee Smith, I blocked indef, see User talk:Mdann52 and deleted contribs. No report needed thanks to sock being a bit clueless here. Dennis Brown - 2¢ © 16:54, 29 June 2012 (UTC)

The discussion above is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

REQUESTING INVESTIGATION for posibble ScottyBerg SOCK

I would like to request a sockpuppet investigation for IP address 173.63.176.93 and 74.88.160.244 which I believe may be socks for banner user ScottyBerg. I've been keeping an eye on both IPs, and the language is eeerily similar. Without good reason, both keep undoing my corrective edits in the "Chinatown, Manhattan" article citing the same old original research as their source. I've been keeping an eye on both IPs, and I feel that my suspicions are enough to warrant this request. When I suggested to SysAdmin Alison that she investigate 173.63.176.93 for a possible sock, 74.88.160.244 jumps into the argument and ask that such an investigation be called off, and then accusing me of pro-San Francisco propaganda which is ludicrous. If I were to state that Tokyo is a cleaner city than New York(which is a fact), he'd probably accuse me of pro-Tokyo proaganda as well. As a matter of fact, 74.88.160.244 was in a rush to make his concerns noticed by posting it in the "edit summary" box for undoing my edits, instead of adderssing the issue properly on Alison's talk page. If 173.63.176.93 is NOT ScottyBerg, then he shouldn't be concerned about the pending outcome of any investigations. In addition to the similar language of both users to ScottyBerg, as well as 74.88.160.244 making it clear he doesn't want another sock investigation on ScottyBerg, here are my other suspicions: 1. Why is 74.88.160.244 suddenly worried about a possible ScottyBerg sock investigation? Neither 173.63.176.93 or 74.88.160.244 should be concerned if they are who they are, and not ScottyBerg. 2. The history log of both IPs didn't even exist until shortly after ScottyBerg was blocked in Jannuary of this year. His last unblocked edit occured around January 6, 2012. 74.88.160.244's history log began on exactly this same date. WHAT A COINCIDENCE! The history log of 173.63.176.93 commenced a little later on May 30, 2012. 3. I did an nslookup, and found that 74.88.160.244 and 173.63.176.93 are located in Fair Lawn, NJ and Westwood, NJ respectively- small towns both within 5 miles of each other! There's no doubt about it. There is obvious sockpuppetting going on, and the likelyhood that it's ScottyBerg makes the matter even more urgent. MBaxter1 (talk) —Preceding undated comment added 20:58, 8 July 2012 (UTC)

I haven't read the above very closely, but no one is going to act on your request here. You need to open a proper case. The instructions for doing so are on the main Wikipedia:Sockpuppet investigations page. Sven Manguard Wha? 21:04, 8 July 2012 (UTC)

Reporting a sock with no obvious puppetmaster, and logging suspicion with a lower threshold

I am coming here to discuss how to improve the SPI guidance at this page for situations when there is a proliferation of obvious socks, but no obvious puppetmaster. This is further to a long discussion at WP:Administrators'_noticeboard/IncidentArchive756#SPI_harassment in which I was a protagonist.

The heart of the problem is twofold:

(1) There appears to be no way for an editor to report sock activity unless that editor can identify an active editor as puppetmaster. If there is a way to do it, it certainly isn't set out clearly on this project page.

(2) It is a very high barrier for your average editor to be able to build a detailed and robust report prior to filing suspicion of a sock, particularly when there is no obvious puppetmaster. When this is not done, the case gets shut down, since (quoting the lead to this page) "an administrator with experience in dealing with sock puppetry can make a determination as to whether your suspicions are correct". But sometimes a long period of time is required before enough evidence is built up to truly determine whether "suspicions are correct". This high barrier means a lot of obvious sock activity goes unreported. A lower-intensity "open" method to file initial suspicion of socks would allow a case to be built up over time by a multitude of experienced editors with ever-growing evidence, just like a wikipedia article.

Grateful for thoughts on both these topics. Oncenawhile (talk) 13:37, 24 June 2012 (UTC)

• As for your first concern, the norm is to simply list the earliest suspected sock as the master. As long as you are able to reasonably demonstrate that the group of socks is working in concert, the actual identity of the master can be deferred until a checkuser looks over the case. That leaves the issue where you are certain that an editor is a sock of somebody, but there's only one and you aren't certain as to who the master might be. I'm not aware of any good way to handle that.—Kww(talk) 13:44, 24 June 2012 (UTC)
• If you don't know who the master is, what criteria are you using to determine that someone is a sockpuppet? By definition, a sockpuppet is when Editor B looks very much like Editor A, but when there is no Editor A, what do you have left? And you are correct that often a sock "goes free", because we have to operate under the principle that it is better for 10 socks to get away with socking than to indef block one innocent editor. Eventually, the sock will get caught, but if you lose an otherwise good editor, you risk never getting them back. When you are accusing someone of socking, it is a serious offense, so the burden of proof has to be on the accuser, not the accused, to insure that frivolous claims aren't filed. Lowering the bar, so to speak, and requiring that SPI clerks do all the footwork would mean more socks went without sanction, as that make the case load go up 10x. We have enough trouble keeping up as it is. The burden on the accuser is high because the "punishment" is as well. Dennis Brown - 2¢ © 13:54, 24 June 2012 (UTC)

Hi Dennis. To your two points: (point 1) if you look at the history of 1929 Palestine riots you'll see a perfect example of a situation where it is clear that socks are involved but without an obvious puppermaster. There have been more than 10 WP:SPAs supporting an edit war over an esoteric debate on a single sentence in a previously rarely-visited article; and (point 2) I absolutely don't think (nor did I suggest) that any more burden should be shifted to the SPI clerks - I agree that the onus needs to sit firmly with the accuser(s). I also don't think we should lower the bar for clerk involvement. I am simply suggesting that there should be a lower bar for filing of initial suspicions, to allow accuser(s) to build up a case over time. Oncenawhile (talk) 14:59, 24 June 2012 (UTC)

• First, for reference, this thread can also be thought of as a continuation of Unsure of how to handle suspected day-use socks that we all puzzled over on Tnxman307's talk, recently. Sean Hoyland, myself, Oncenawhile, and several others have been struggling with this for some time, and it's really come to a crisis point. The difficulty is that in the past six months or so in the Israel/Palestine topic area, the extremely active sockmasters editing on behalf of Israel's current policies have embraced the strategy of using throwaway accounts, and the effectiveness of that strategy has been extraordinary.

I think Dennis is looking at this from a perspective similar to that of an employee standing behind a counter trying to deal with a throng of would-be customers, all of them demanding, all of them frustrated, knowing there's no way he can keep up. To extend the analogy, what he doesn't seem to get (sorry, Dennis) is that a lot of them have been standing in the hot sun for hours, thirsty as anything, and his counter is the only place that has anything to drink. ( Disclosure: On June 5th I submitted a very detailed sock report that each of the three admins who privately reviewed it said looked like it identified an obvious quacker, to the checkusers mailing list to avoid spilling the beans. When I didn't hear anything for the next 12 days I sent a query. Three days later, on the 20th, I got a one sentence e-mail saying I should probably file an SPI ... which would make detecting the prolific sockmaster, a person who has created dozens of socks, at least, that much harder next time. I'd spent at least three hours investigating that, and writing it up, and the experience was every bit as frustrating as it sounds. )

I'm pretty sure Dennis would look at the problem differently if he were on the other side of the counter, i.e. if he'd tried to edit under such conditions. I don't think I'm exaggerating to say that around 1 of 5 accounts active in the Israel/Palestine topic area at any given time is a sock. How do I know, he asks, when I can't name a puppetmaster with any certainty, because these accounts purposely limit the duration of their editing to a few days? I could try to answer that, but it'd take a short course, or at least a lot more paragraphs than anyone would want to read. And I'm only an amateur, anyway, compared to some. But if editors or admins familiar with the topic area will look carefully at e.g. the contributions for "new" user "Eat memory", to provide just one good example, or at Kipa Aduma, Esq. (talk · contribs), or at the profusion of socks at 1929 Palestine riots recently, it's staringly obvious. Our old friend Breein1007 has been active there as well, btw, in his customary and extremely active IP-hopping, scrutiny-evading, open-proxy-using incarnations.

Besides, I'm not aware of a single genuinely new editor in the I/P topic area who's been "bitten" by an experienced contributor there, and left in dismay. Not one, ever. Is anyone else? And as far as losing editors goes, what about losing committed, good-faith, longstanding editors who want to view this as an encyclopaedia project, instead of some massive video game where any progress made is overwhelmed because you refuse to cheat, overwhelmed by the evidently many people who are only too happy to cheat?

Btw, Dennis, in the thread I linked to at the top of this post, on Tnxman's talk, I could only make a guess at the sockmaster. The actual sockmaster was never discovered definitively, but Sean's and my guess that the account was the sock of some prolific sockmaster was nevertheless correct: Tnxman's check revealed two other related accounts, based on technical evidence. The "punishment" against an individual who socks is high. But the "punishment" the project receives for disallowing such checks is high, too: A contentious topic area that's well on its way to being wholly owned by the group that, so far, has the most editors who are willing to cheat. --OhioStandard (talk) 16:08, 24 June 2012 (UTC)

We are all volunteers here. Most of us are not familiar with I/P intricacies, and are simply doing the best we can with the manpower we have. Things are not as black and white when you are the one trying to investigate topics you aren't familiar with, and decide who gets blocked and who doesn't, knowing you are fully accountable for every action, and that someone is going to be pissed no matter what you do. I already edit articles far less than I prefer, and three of us working the cases are trainees, so the manpower situation is worse than you might think. Lowering the bar isn't going to get better results. You could always volunteer to help out with other cases, but working SPI is not as glamorous as it looks. With this in mind, it shouldn't be surprising that the idea of lowering the bar isn't instantly appealing. We want to get the socks as bad as you do, it is why we are here. It just isn't quite as simple when you are "on this side of the counter". Dennis Brown - 2¢ © 18:35, 24 June 2012 (UTC)

Hmm, I'm very sorry, Dennis; the last thing I intended to do was to give you the idea that I was blaming you in any way. The anti-socking system is broken, but you didn't break it. I suppose I must have given you a contrary impression, though, by addressing my comments to you, in part, directly, and by expressing some of my own frustration. ( I've been thinking very seriously for several months now of just abandoning the topic area, because of that frustration. )

And in retrospect, now, it occurs to me that I can scan through an I/P article's edit history very quickly, distinguish the new user IDs from the established users without having to even think about it, really, and look for certain "tells" that seem pretty clear to me after so long, as to other regulars in the topic area, I believe, which signal a need for a closer look. It's certainly not at all reasonable to imagine that I or anyone who hadn't already had a few months of exposure, at least, to the labyrinthine history of socking in the topic area could do that from the starting line.

I personally think checkusers should be paid, that there's a high-enough need and a correspondingly low-enough turnout that it would be justified. I have thought of volunteering, btw, but my good friends with whom I typically differ re my political views in the topic area would raise the roof with their cries of dismay and disapproval, I have no doubt. I do want you to have fun though; and I recognise that it's the Foundation that needs to address the problem of socking, systemically. I know both your resources as volunteers and the tools you've all been given to try to address the problem are not sufficient to solve it. --OhioStandard (talk) 19:15, 24 June 2012 (UTC)

What would be good for you and us: Volunteer to help an hour or two a week, but stay away from P/I cases. It would still reduce our load a little, and it would help you to see what kind of info helps us quickly determine a case. I will be honest, when I see a case that is formatted perfectly, I jump on it quickly because that is one I can get out of the way. Person1 ()()() Person2 ()()(), very simple, little verbage, just facts. If you hung out and helped on non P/I cases, you would quickly pick that up, and it would make your SPI reports more effective for us as well. Something to think about. Dennis Brown - 2¢ © 19:26, 24 June 2012 (UTC)

Spot on. A smaller report which is clear, concise and formatted correctly will likely advance through the process much quicker. Giant walls of text are self-defeating. If folks would like to improve their report writing, I'd suggest that they read through cases and see which ones are successful and what traits they possess. Providing comparison diffs is critical.
⋙–Berean–Hunter—► 20:00, 24 June 2012 (UTC)

And providing the diffs side by side, like I showed above, where they line up. Honestly, a well formatted report that is concise with more fact and less opinion increases the perceived reliability of the information as well, making it fast to make comparisons and easier to take the few comments at face value. I should work up an example or two to use as a guide, maybe as an essay. Dennis Brown - 2¢ © 21:10, 24 June 2012 (UTC)

• I share sympathies on both sides that we don't catch all the socks, but the workload is high. I have personally dealt with SPIs without a master, and only one account. What we do need to see when it comes to those types of reports is a clear indication that abuse of multiple accounts is going on. As a rule of thumb, give me three reasons why it's likely to be a sock, and I will probably endorse for a checkuser. Take it out of a highly contentious editing area, and you might even get a block out of me without a CU. But I have to echo the above comments that reports do not need to be a mile long. Your English teacher might say different, but we are not grading your paper here. Give us bullet points, that connect the dots on how multiple accounts are being abused and we can handle it pretty easily. If you can't get a response from the functionaries list, it's because of a shortage in the CU taskforce, and the length of your report. They are just like us, create a concise report, and they will do it a lot faster. It's all about time. There is one SPI where I spent an hour and a half finding diffs for people against 15-20 socks. I can't do that everyday, and neither can a CU. So it's just a matter of finding a balance between us adding more members to the clerk team, and people filling reports we can handle. -- DQ (ʞlɐʇ) 00:52, 25 June 2012 (UTC)
• The problem is that some of the users are jumping the gun if its so evident that user a sock and will be blocked anyhow why not wait day or two before starting reverting him and striking his comment such behavior is clear violation of WP:NPA and WP:BITE.--Shrike (talk) 06:37, 25 June 2012 (UTC)
• I have been trying to find previous discussions along a similar line to this - the best i could find was Wikipedia:Village_pump_(policy)/Archive_70#Checkuser_discussion_.28was:_Any_checkusers_handy.3F.29 from 2009 and Wikipedia:Village_pump_(proposals)/Archive_75#Raise_the_rangeblock_limit_.28especially_for_IPv6.29 from 2011. Not sure they help much, other than it seems to suggest that the community accepts the limitations of the system. Oncenawhile (talk) 07:23, 26 June 2012 (UTC)
  • To answer previous questions here and on my talk page, an editor should NOT call another a "sock" unless they are willing to file an SPI. That is just a civility thing for me, putting your money where your mouth is and all that. If someone is wrong often enough, we will know, and we will discuss it with them. If that doesn't work, we can take it ANI. And if they are almost always right, all the better, since that means we catch the socks. But calling someone a sock without risking your neck on the block shouldn't be done, and yes, is incivil. Once in a while, I can overlook, but a habit of it is actually considered disruption and can get a person blocked. Dennis Brown - 2¢ © 23:30, 29 June 2012 (UTC)

Unfortunately I don't have the time to read the the entire discussion. I did see a suggestion that checkusers should be paid though, and I'd be all for that as it'd give me money! ;-) But anyway, having read the first comment left by Oncenawhile, I can offer this response.

1. We certainly can and do check accounts that are blatantly sockpuppets, but where the suspected sockmaster is not clearly known. I can't say whether or not there's a way to file such as case via the SPI system as I've never filed an SPI report in my life, but if there is no way to make such a case then we should make one.
2. The bare minimum of evidence that's required to run a checkuser is as many diffs as there are accounts (one for the sockmaster, then one for each suspected sockpuppet) and a short sentence explaining the connection that the diff shows. That's all. Any claims of there being a "high threshold" is not the case; more evidence is certainly welcome and may expedite your request, but it's not necessary.

--(ʞɿɐʇ) ɐuɐʞsǝp 20:51, 30 June 2012 (UTC)

May sound a bit daft - but why is evidence needed?

There are very good reasons for restricting law enforcement fishing expeditions. But I can't think of any that really apply to checkuser - truely, if one has nothing to hide then one has nothing to fear from a respected member of Wikipedia knowing your IP (and if that doesn't apply to you, perhaps because you are a dissident who worries they are a government spy or something, then you really shouldn't be editing). Being checkusered is completely invisible to the checked and doesn't hurt one bit.

Perhaps there would be so many checkuser requests that there needs to be a strong threshold for practicality reasons. However, I suggest at least trying out for a little bit allowing checkusering on nothing more than any user's hunch. Egg Centric 01:39, 15 July 2012 (UTC) Just to be clear, I would expect such requests to be made off-wiki to avoid obvious dangers of "no smoke without fire"-type assumptions being made about an editor. Egg Centric 01:41, 15 July 2012 (UTC)

Your suggestion that dissidents who worry about hostile governments discovering their editing activity, should just "not edit", rather gives away that this proposal doesn't really understand the problem.

Even "respected" people are occasionally unreliable. If you have a few dozen respected people and you rotate them every few months and they also share data privately via unsecure means, then you are pretty much guaranteed that slip-ups will happen. So yes, lots of restrictions are needed. --Demiurge1000 (talk) 01:53, 15 July 2012 (UTC)

But what are the consequences of a slip up? Just that someone's IP is known. Hardly a big deal! Egg Centric 12:23, 15 July 2012 (UTC)

Might be a big deal, might not be. --Demiurge1000 (talk) 14:36, 15 July 2012 (UTC)

Checkuser isn't magic pixie dust Egg, and restricting it to only when there are good reasons is the only way to instill trust from the community. If you use speculation as the basis for checkuser, it opens up a Pandora's box of trust issues for the entire community. This is why they require that Checkusers privately reveal their own true identity as well, to insure they can be trusted to have that kind of access. Checkuser can't prove innocents and only imply guilt and must be backed up with other evidence to take action. Even though they don't generally disclose IPs, linking accounts can have serious consequences for someone writing on en.wiki, but who happens to live in Syria, Iran, China or other countries who's view on freedom is not as enlightened as the rest of the world. In those places, the government knowing the IP can be big deal, with prison time or death. We never know the consequences on this end, but we know they can be dire, which is why CU usually replies without IP info and sounding as cryptic as a Magic 8 ball. Dennis Brown - 2¢ © 15:00, 15 July 2012 (UTC)

Everyone who has done networking or networking security knows that it may be trivial to intercept IP communications once the number is known. It is illegal for private citizens to do this but that doesn't stop many. Also, you potentially open yourself up to attacks and having your ports exploited. Per beans, I don't want to layout a roadmap but suffice it to say that having your IP known potentially sacrifices a layer of your own security.
 — Berean Hunter (talk) 15:12, 15 July 2012 (UTC)

Very strange

User:BenB4 is blocked as a sock. User talk:BenB4 is a redirect to the user page. An IP made a strange request here: User talk:BenB4/edit request. I am going to run far and fast from it now.--Canoe1967 (talk) 02:20, 22 July 2012 (UTC)

I don't know why the anon editor couldn't edit the page, but indefinitely blocked users' talk pages are sometimes redirected like that, and because of the redirect, notices can end up at the wrong place. I removed them and deleted the subpage as requested by the anon editor. ​—DoRD (talk)​ 14:30, 22 July 2012 (UTC)

Resolved

--Canoe1967 (talk) 21:02, 22 July 2012 (UTC)

Defending against SPI by identifying oneself to WMF?

Speaking hypothetically, would it make sense for a user suspected of being a sockpuppet to clear their name by identifying themselves to the Wikimedia Foundation?

Various thoughts:

• My initial impression is that self-identification to the WMF is more likely to be useful as a defence against SPI than a CheckUser check (which we know can easily be circumvented if one really wants to hide their origin or pretend to be more than one person).

• A nefarious sock would "probably" be reluctant to make their true identity known (even within the bounds of the WMF's privacy policies). Hence, if someone were to identify themselves to the WMF, I would be less inclined to suspect them of engaging in sockpuppetry (either as a master or a puppet).

• There are, pretty clearly, valid reasons why someone might legitimately not want to self-identify (even to the WMF — or perhaps especially not to the WMF). I don't think we would want to get into a situation where users could be effectively forced to identify themselves to the WMF by threatening to ban them as socks — or else be presumed guilty because they decline to self-identify. On the other hand, if I were accused of sockpuppetry, I would be more than happy to identify myself to the WMF if doing so would remove suspicion from me.

• WMF identification presumably can't prove two accounts belong to two different people unless both account holders agree to identify themselves. We presumably don't want to get into a situation where we're demanding that someone self-identify in order to prove they're not engaging in sockpuppetry (see my previous point). And asking an already-banned user to self-identify, in order to prove that someone else (who has willingly self-identified) is not their sock, is obviously ludicrous.

What do people think? — Richwales 04:30, 27 July 2012 (UTC)

The WMF is only interested in the identity of people performing tasks where identity is required, I really doubt they are interested in sockpuppets, which I believe they would term a matter for the community. Also, which identification do you wish me to submit? Do you like blondes, Estonians, pipefitters? If I'm a sockmaster, hopefully I've attained sufficient skill that I can pull off each one. Franamax (talk) 05:13, 27 July 2012 (UTC)

Generally speaking, the Foundation is also not staffed or adequately placed to do this type of identification. We identify certain holders of advanced permissions, but it's rare, and there's a positive assumption (that they are who they say they are), and a check for age of majority. We're not doing things like actively attempting to prove or disprove that they are who they say they are. Speaking as the Director for the team that handles identification, this is not a role that I would like to see us take on without a very deliberate process to determine whether it's legal or appropriate to us. Philippe Beaudette, Wikimedia Foundation (talk) 19:53, 27 July 2012 (UTC)

If I remember rightly (would appreciate confirmation or denial), the identification that's supplied for CUs, arbs, etc. is destroyed as soon as it's confirmed, since they just need to ensure that these people are adults. However, we'd need to store identifying information to enable its use in SPIs, so your proposal would involve a massively larger task. Nyttend (talk) 21:13, 27 July 2012 (UTC)

That is what I have heard, that documents are destroyed upon verification. This is on the Arbitration Noticeboard somewhere, some long time ago, but I can't remember where. -- DQ (ʞlɐʇ) 21:33, 27 July 2012 (UTC)

This is correct. We do not retain the identification. Once identified, the documents are destroyed (actually electronically destroyed, since they're never printed physically on our end.) Philippe Beaudette, Wikimedia Foundation (talk) 22:17, 27 July 2012 (UTC)

The proposed system could be gamed as easily as the current checkuser process, so given the workload it'd add at the WMF office and the minimal benefit of doing it, it's not really not worth it. --(ʞɿɐʇ) ɐuɐʞsǝp 21:30, 27 July 2012 (UTC)

And in fact this system would actually be easier to game than checkuser to your average person who does not have much technical expertise. --(ʞɿɐʇ) ɐuɐʞsǝp 21:30, 27 July 2012 (UTC)

Current complaints about SPI

Self-defeating purpose, high standard of evidence, and difficulty of use

The Village Pump has received a complaint about the end-user experience and general purpose of the SPI process. Please see Wikipedia:Village pump (policy)#SPI process may defeat its own purpose. The perspective of administrators, checkusers, and clerks would be exceptionally enlightening. AGK [•] 15:10, 29 July 2012 (UTC)

Discussion is archived and pretty dead, the editor who brought it up and is the main contributor has been blocked (not for this discussion of course). Dougweller (talk) 13:05, 12 August 2012 (UTC)

That discussion was a bit puzzling. It was hard to tell what the original poster wanted, exactly. I found the instructions reasonably reasonably clear. The one thing I would ask for is communication. It's understandable if some SPI reports are given a lower priority, or are too involved to handle right away, or are just not acted upon because the disruption is not very severe (regardless of whether the suspected sockpuppet abuse is correct). From the point of view of someone filing an SPI report that may fall into one of those categories, it would be very helpful if each case could get some kind of response -- even if only to say "this may not be acted on for some time" or "unfortunately, we don't have the manpower to look into this given the large number of more disruptive cases." --Amble (talk) 17:30, 12 August 2012 (UTC)

It was often hard to tell what the original poster was saying. Pretty annoying at times. I sympathise with what you say, but that would take time away from actual action on SPIs. We don't have the manpower, you're right. Dougweller (talk) 18:40, 12 August 2012 (UTC)

You need some apprentices, who can look into the details of a case properly to check for obvious signs of socking. If they find such then they could give the case the go ahead. If they find none then they could close the case out. Filers would have the option of agreeing with that or asking an admin who deals in SPI to review the case. Darkness Shines (talk) 18:43, 12 August 2012 (UTC)

It looks to me like the SP investigators are doing a great job of moving most of the cases through. I wonder if part of the overload comes from the wider scope of investigations after the old Requests for Checkuser changed to Sockpuppet investigations. I believe there is a clerk system somewhat like what Darkness Shines suggests, but focused again on checkuser requests. --Amble (talk) 01:20, 13 August 2012 (UTC)

merge Luciano di Martino into the Velebit case

Over at Wikipedia:Sockpuppet investigations/Velebit several of us have come to the conclusion that Wikipedia:Sockpuppet investigations/Luciano di Martino is actually the same abuser. What is the procedure to merge LdM into the Velebit case? (They don't overlap chronologically, so it seems technically easy enough.) --Joy [shallot] (talk) 16:23, 15 August 2012 (UTC)

I'll take care of it today if nobody gets to it before I have the chance. ​—DoRD (talk)​ 16:36, 15 August 2012 (UTC)

Now  Done. ​—DoRD (talk)​ 17:15, 15 August 2012 (UTC)

Thanks. Yet, now I found that there are actually several earlier usernames of this abuser, and the earliest known is actually "Oesterling". I added a full description of that 'back trace' now. Can someone take a look? --Joy [shallot] (talk) 10:57, 16 August 2012 (UTC)

Nice detective work, Joy. It seems to me, with the details you've added to the Velebit case, and since the earlier accounts are very old and already blocked, that it is unnecessary to merge or move the case any further. Thanks ​—DoRD (talk)​ 13:28, 16 August 2012 (UTC)

(copied from case page) Regarding Joy's suggestion that this case be moved to User:Oesterling, I would argue for keeping it at Velebit. Any well-known name that is sufficiently old ought to suffice, even if it is not the oldest one used by this editor. Ed Johnston 15:33, 16 August 2012 (UTC)

That would actually argue that it's not a well-known name, since he's managed to evade SPI correlation with that name between the last report in January 2011 and August 2012, even though he was processed through SPI. Granted, it doesn't matter much. Also, I'm unhappy with the use of generic nouns such as Velebit (mountain in Croatia) and "Purger" (citizen of Zagreb) to refer to a person with such a bizarre anti-Croatian sentiment. --Joy [shallot] (talk) 07:26, 17 August 2012 (UTC)

Changed redirects

I boldly redirected WP:RFCU to point to WP:RFC/U instead of here. I think enough time has gone by so that people who type in the shortcut will be mostly looking for Wikipedia:Requests for comment/User conduct and not Wikipedia:Requests for checkuser (an old page that did the same job as SPI). This may have an effect on old pages that include the RFCU shortcut, but I think this will be mostly archived talkpages and dormant user talkpages. I intend to go through "what links here" and amend important redirects if there are any, but I don't think it is worth doing that until I know no-one objects to the change.

So, if you do object, please give it to me with both barrels below. Formerip (talk) 22:28, 16 August 2012 (UTC)

There's well over 500 links, so I don't think an outright change is a good idea, it'll confuse people clicking those old links, which is contrary to WP:R#PLA. I've turned it into a disambiguation page instead. --Joy [shallot] (talk) 07:50, 17 August 2012 (UTC)

In fact, several of those RfCU-related shortcuts were 'updated' to point to SPI earlier, which has the same potential. It would require some database analysis to find which is best at this point... --Joy [shallot] (talk) 07:54, 17 August 2012 (UTC)

Did I do this one right?

Wikipedia:Sockpuppet investigations/JOEWM2004 isn't transcluded yet. Perhaps there's a big backlog?— alf laylah wa laylah (talk) 00:46, 17 August 2012 (UTC)

Ah, all's well now.— alf laylah wa laylah (talk) 08:20, 17 August 2012 (UTC)

Nomination for deletion of Template:SSP-CU

Template:SSP-CU has been nominated for deletion. You are invited to comment on the discussion at the template's entry on the Templates for discussion page. DH85868993 (talk) 12:26, 19 August 2012 (UTC)

Concern

Wikipedia:Sockpuppet investigations/Universal Hero/Archive - Hi In regard to this, my name has been wrongly accredited and mentioned and in turns up in Google Searches. Could it please get deleted. Thanks. 82.31.132.44 (talk) 17:04, 22 August 2012 (UTC)

I've removed the name, I assume this will be sufficient? I note that we already ask search engines to not index these pages, but there are often mirrors out there that don't respect this. Amalthea 17:27, 22 August 2012 (UTC)

Thanks! 82.31.132.44 (talk) 17:41, 22 August 2012 (UTC)

hasty close of an SPI

I filed an SPI yesterday.  RL took me away from the computer, and I have returned to find the SPI case closed with less than ten hours allowed for me to respond to a question.  The one respondent to the evidence doesn't dispute that the record shows that both accounts are controlled by the same editor.  The respondent doesn't dispute that the editor has been disruptive and uncivil.  The respondent doesn't dispute that the IP editor has been deceptive about the use of alternate IP addresses.  The respondent argues that the IP address is part of a dynamic IP range.  However, the pattern of usage is not explained by dial-up service.  And the argument of a dynamic IP address misses the point that the IP editor is not self-identifying as having a dynamic IP range, choosing instead to hide such IP addresses.  If no further evidence is needed, can we get these IP addresses warned or blocked?  Otherwise, must I now open a new case?  Thank you, Unscintillating (talk) 22:44, 28 August 2012 (UTC)

I undid my close of the case, so feel free to make further comments there. My apologies for being too hasty. ​—DoRD (talk)​ 22:58, 28 August 2012 (UTC)

Thank you, and thank you for a prompt response.  Unscintillating (talk) 23:51, 28 August 2012 (UTC)

Me not allowed

I came here to report a suspected SP, but only got red preview pages. See [3], ANI. -DePiep (talk) 00:44, 29 August 2012 (UTC)

It looks like Dennis answered there, but yes, you simply have to ignore the warning about not leaving an edit summary. If you have evidence, please don't let the cranky interface deter you from submitting it, and if you use it, Twinkle can submit a report from its "ARV" menu. ​—DoRD (talk)​ 02:34, 29 August 2012 (UTC)

Why the subpages?

Why are CU cases now in subpages, so you can't see them without going to a new page? Dougweller (talk) 18:05, 29 August 2012 (UTC)

Are you asking why some of the cases aren't appearing on WP:SPI? That's sometimes due to a formatting issue on one of the case pages, but in this case, it's because the page has too many cases which has caused it to hit the template transclusion limit. ​—DoRD (talk)​ 19:15, 29 August 2012 (UTC)

Also, this page, which is updated as often as every 15 minutes by a bot, lists all active cases in one place. ​—DoRD (talk)​ 19:30, 29 August 2012 (UTC)

Thanks. I'd found the update page and had forgotten about the transclusion limit so I shall go trout myself. Dougweller (talk) 05:36, 30 August 2012 (UTC)

User compare reports not working

Invoking the 'User compare report' in the currently open SPI for JHerbertMunster generates a call to http://toolserver.org/~betacommand/UserCompare/JHerbertMunster.html. This tells you 'Page Not Found'. Now Betacommand suffers the misfortune of being blocked, so it is not a surprise that his tools no longer work. Does anyone know if there are any alternatives for the Betacommand user compare tool? I remember that the results were very useful. Thanks, EdJohnston (talk) 00:37, 1 September 2012 (UTC)

It's possible this is the result of one of the recurring Toolserver problems; the tool worked fine for me just yesterday, but I have had problems with other Toolserver-based tools today. Risker (talk) 01:17, 1 September 2012 (UTC)

It is most certainly needed. It's a very useful tool.

On a related note, Betacommand reached out to me over IRC and asked me to relay the message that it is a Unicode error and that it will be fixed shortly. Sven Manguard Wha? 01:27, 1 September 2012 (UTC)

open case of Camoka4

The case of Camoka4 (Wikipedia:Sockpuppet investigations/Camoka4) has been open since August 11, but is still in its initial stage. As the case is active the last 2 days, I'd appreciate if a Clerk started the process... Tnx! L.tak (talk) 20:38, 1 September 2012 (UTC)

Identifying Possible Suspected Sockpuppets

Hello everyone. I would like to know that what are the different methods and techniques of routinely finding, checking and identifying possible suspected sockpuppet user accounts ? I usually have to review random articles and check from their history, user's contributions and editor behavior before reporting them for the actual Sockpuppet Investigations for technical evidence. Also i have indeed initiated some Sockpuppet investigations which has led to confirming and blocking of many sockpuppets of different sock masters. Therefore i would be happy and grateful if other users can give any advice and useful information about this, and can also provide any other additional tips and suggestions that can help me in finding possible sockpuppet accounts in the future. Thank you. TheGeneralUser (talk) 20:08, 27 August 2012 (UTC)

• We talk about this on IRC but I personally don't like to discuss methods and such onwiki as it gives the socks information that will help them become better socks. That is just my take, others may disagree. Dennis Brown - 2¢ © Join WER 15:08, 3 September 2012 (UTC)
  • I agree, strongly. Socking is a major problem and we have to make sure we don't make life easier for puppet masters. Dougweller (talk) 18:24, 3 September 2012 (UTC)
    • Thanks for your comments Dennis Brown and Dougweller. I also completely agree that the methods and techniques which are used to identify sockpuppets cannot be openly discussed on Wikipedia. As private correspondence can help me in this case, my e-mail is always open (Special:EmailUser/TheGeneralUser) for any private issues and talks which in this case can truly help me to more easily find out future socks as i frequently patrol this administration area and report suspected sockpuppet accounts to CheckUser. Any tips and suggestions received will be of great help and use for me to work easily in the Sockpuppet Investigations Regards. TheGeneralUser (talk) 19:13, 3 September 2012 (UTC)
      • IRC is a good choice for learning more. Every SPI clerk and CU has their own methods and ideas, no two do it alike. #wikipedia-en-spi is the channel on freenode servers. Evenings EST seem to be busiest there. Dennis Brown - 2¢ © Join WER 19:27, 3 September 2012 (UTC)
        • But Dennis, I dont use IRC or any other website like that which is not a part of Wikimedia Foundation to use and talk about things related to Wikipedia and other Wikimedia Foundation wiki's. I have never used it. I believe the same type of private correspondence can be done via e-mail and it is far completely safe also as it is a core part of the Media Wiki software that powers Wikipedia. Sorry but i won't be using the IRC, I just cannot trust it 100%. I trust only Wikimedia's E-mail system to be secure and completely private. It's just my thought. If you or anyone can actually e-mail me that will be really helpful. Thank you. TheGeneralUser (talk) 19:43, 3 September 2012 (UTC)
          • All the SPI clerks and most checkusers use IRC, there is even a bot that pings the page every time any spi page is updated. We don't make backroom deals or anything, it is just a place to learn, compare notes, ask questions, quickly get assistance, in real time. It is almost required to be a clerk. Almost. Dennis Brown - 2¢ © Join WER 19:48, 3 September 2012 (UTC)

The only information that can be revealed by connecting to IRC are 1. your hostname and ip, 2. the name of your IRC client. IRWolfie- (talk) 00:01, 4 September 2012 (UTC)