Wikipedia:Sockpuppet investigations/SPI/Guidance

What qualifies as abusive sock puppetry?

Main page: Wikipedia:Sock puppetry

Whilst merely owning multiple accounts is permitted on the English Wikipedia, misuse of two or more accounts by the one individual—"abusive sock puppetry"—is in violation of the project's communal norms. Editors who are filing an SPI request ought to be fully familiar with Wikipedia's sock puppetry policy since complex sock puppetry cases occur regularly.

A sockpuppet inquiry case may only be opened if there is evidence or good cause to suspect that there has been abuse of multiple accounts, or IPs. The English Wikipedia's policy on sock puppetry holds that, whilst merely owning multiple accounts or IPs is acceptable, utilising them in a disruptive, misleading, or unhelpful manner is not. As a rule of thumb, if you suspect the use of multiple accounts or IPs in a manner that is affecting the encyclopedia, an investigation ought to be filed.

Abusive meat-puppetry

Sometimes users who appear to work with a common agenda are not sockpuppets (one user, multiple accounts), but multiple users editing with the sole purpose of backing each other up, often called "meatpuppets". Meatpuppets are not regular Wikipedians who happen to agree with each other; they are accounts set up by separate individuals for the sole purpose of supporting one another. For the purposes of upholding policy, Wikipedia does not distinguish between meatpuppets and sockpuppets.

Advertising Wikipedia articles to your friends, family members, or communities of people who agree with you, so that they come to Wikipedia and support your side of a debate and give the appearance of consensus is strongly discouraged. Discussions in which violations of this nature are found will have the violations stricken from the discussions and sanctions may be applied to protect the project's integrity.

Examples of forbidden uses of multiple accounts or meat-puppetry

• Voting more than once in a poll.
• Circumventing Wikipedia policies such as multiple article reversions, edit-warring, collusion, evasion, disruption, or other misuse.
• Using an alternate account to avoid scrutiny of edits.
• Using an alternate account to mislead others or otherwise artificially stir up controversy by making disruptive edits with one account and normal ones with another account (known as "good hand, bad hand" or GHBH).

Presenting a case

Claims of sock puppetry

Identifying sock puppetry is not always a simple matter. There is often an element of judgement and assessment of evidence. You need to provide evidence showing the accounts or IPs are acting in a disruptive or forbidden manner, which other users will then assess. If there is a good case that checkuser data from the server logs may be needed to resolve the case, you may request that a checkuser add this evidence to the case. They will only do so if they feel it is appropriate. (See § Checkuser for more information.)

How to open an investigation

In general, cases are opened for current active issues, not closed ones. Exceptions are infrequent, usually when there is a serious issue such as accusations of admin puppetry or a likelihood of serious future issues.

• If the evidence is sensitive or the case delicate or likely to be very controversial, seek advice by email from a member of the Arbitration Committee first, in order to minimize the risk of unhelpful disruption and "fall-out", whether you are right or wrong.

I.	Write up your evidence statement: If you have a good case, then take time to write it up, making sure you follow the guidance notes, especially: Remember to assume good faith Do not post private information, emails, logs, etc. on the wiki that are not already on the wiki (if this is a problem, ask before posting your case). Remember to stick to verifiable evidence (usually diffs), and reasonable deductions and impressions drawn from evidence. Do not debate the issue, or respond to others' attempts to do so. Check that the matter is current (right now), and that the user is not already blocked, or reported. Decide if the case needs CheckUser evidence to help prove the matter. (See below for more.) You can add more later, if needed. Do not use any section headers ("===") as this will break the template.
II.	Identify the name for the case: New case? - If it is a new case, and the user has not had a sock puppet case under this or any other (known) identity, then the case name will be the name of the oldest-created account. 2nd or further case? - If a previous case already exists for this user, under the same name, IP, or a different one, use that name, and add the case as a new report on the same page. Not sure? - If you aren't sure, create it as a new page, and add a comment to the effect that that you aren't sure - a clerk will check for you.
III.	Create the report page (or section): Using the box on the main SPI page, create the case by replacing "CASENAME" with the name of the puppet master, or previous case name. The name given to the case should be the original case name (if any), or the main name the user is known by (do not add the word "user"). Then click the button to create a request page (or new section) and follow the instructions there.
IV.	Watch the case while open (and update if needed): Remember to watch the page in case there are questions or comments about your evidence, and remember to stay cool and not get distracted from the case. As the case progresses you may update your evidence or statement as needed, to add new evidence or relevant information.
V.	Consider notifying all the users you are accusing using the template {{subst:uw-socksuspect|Case name}}.

Defending yourself against claims

If you are accused of puppetry, stay calm and don't take the accusations too personally. If you have not abused multiple accounts or IPs and have not breached the policy on meat-puppetry, then that will almost always be the finding. If there is a good reason for the evidence provided, point it out in your own section. Sockpuppet inquiry pages are only about account and IP misuse—nothing else. If the evidence is not there, then the case will be closed without any adverse finding of any kind.

If you are operating a legitimate alternate account and do not want to make this public, then please see alternate account notification, and email any checkuser, any Clerk, or any Arbitrator to ask for help.

If an accusation on this page is "bad faith" (an editor making a fake case for an "attack" or to prevent their own editing being examined) then you may wish to say so briefly, but cases on this page will be decided based upon evidence of misuse of accounts only. You do not have to defend yourself against other claims, however bad, or engage in discussion about them. You may wish to note that the claim is not relevant to sock puppetry. Claims and issues that are not relevant to account and IP abuse will almost always be ignored by the clerks and checkusers, and will often be removed.

CheckUser

CheckUser is a tool used to obtain technical evidence related to a sock-puppetry allegation. It will not be used without good cause, which you must clearly demonstrate. If your request is agreed by a clerk or administrator, then they will tag the request for CheckUser attention. ALT TEXT: Checkuser is a tool that allows authorized users to look at technical information from the server logs themselves, which can provide evidence whether two users, or a user and an IP, are likely to have any connection, and can be used to investigate disruption, "sleepers", returned banned users, and the like. Because Checkuser is both powerful and involves access to privacy-restricted information, its use is strictly limited by policy to cases where it is necessary, appropriate, and there is good cause. Checkuser is restricted by both privacy policy and Checkuser policy, as well as English Wikipedia's own individual Checkuser policy that supplements these. Checkuser will not be used unless there is good cause, and the final decision belongs to those users trusted with the tool. If you feel that Checkuser is needed and appropriate, please read below before making your request.

To request CheckUser evidence:

1. Change {{SPI case status}} to {{SPI case status|curequest}}

   You (or anyone) can do this at any time on an open case if it is necessary. (This is done automatically if you use the "Request CheckUser" box to create your new request.)

2. If you need to say why CheckUser is appropriate and needed, do so below this tag. If you are an SPI clerk you may endorse the request yourself.
3. Notification of a checkuser request may be courteous but is not currently seen as essential; the user knows an SPI case has been set up, the evidence within that case, including the need for further technical evidence, is assessed within that, on its merits.

Your request will be reviewed by a clerk who will update it with any notes they make. Do not do this yourself unless you are an SPI clerk. This is an anti-abuse measure to prevent wasted time and discourage spurious requests:

The investigating user/s may use Checkuser anyway, if it is likely to help.

If the request is agreed, a checkuser may look at the server logs, and add comments and evidence as they see fit. Checkuser findings are required by Foundation policy to take privacy very seriously, so the answer will often be one word, such as "likely", "confirmed", or "unrelated". The privacy policy allows for considerable disclosure but in most cases this is used judiciously. If the checkuser feels more information is needed, especially in serious cases of abuse, repeat cases, or complex cases, they will use their discretion to say more.

When to consider requesting CheckUser

Situation How to proceed In these cases, file a case and request a check Evasion of ArbCom or Wikimedia Foundation bans or remedies Link to the closed case. Supply evidence to show the active user is the banned party. Ongoing, serious pattern of vandalism involving dozens of incidents Supply diffs of the vandalism. Possible vote fraud Link to the vote(s). 3RR violation using sockpuppets Link to four or more diffs showing the 3RR violation. Evasion of community-based bans or blocks Link to block log of the original account. Supply evidence to show the user is the banned or blocked party. Likely undetected or "sleeper" socks, getting an IP block (of a repeat sock-user) Link to or point to a possible reason, or if enough socks exist, the archive. 'Messy' and complex cases where behavior alone cannot determine which accounts are socks. Link to diffs that show the likelihood that each account listed could be a possible sockpuppet. You believe a check is warranted anyway Give a brief summary of the situation, link to further discussions, and supply supporting diffs. In these cases, do not request CheckUser Obvious, disruptive sock puppet Block. No checkuser is necessary. Disruptive "throwaway" account used only for a few edits Block. No checkuser is necessary. Checkuser to confirm a user has been using a specific IP address File an SPI request without checkuser. For privacy reasons, checkusers will not publicly connect IP addresses to accounts. Checkuser on yourself to "prove your innocence" Such requests are not accepted. Please do not ask. Question about a possible sock puppet related to an open arbitration case Request on the arbitration case pages that a checkuser be run. Suspected "good hand bad hand" use to avoid scrutiny Initially file an investigation with no check requested, except in severe cases. Suspected administrator sockpuppetry or multiple account abuse Report to the Arbitration Committee. They may have to desysop the administrator. Other disruption of articles Report to AN/I, or file a case without CU and ask if checkuser should be requested. Open proxy where you already know the IP address List on Wikipedia:WikiProject on open proxies. You want access to the checkuser tool yourself Access is rarely granted, and not requested here. Please see Wikipedia:CheckUser.

After the decision

Close

When a case has been decided (whether by patrolling administrator, clerk or checkuser):

• A clerk, CU, or admin will add the close parameter to the {{SPI case status}} template at the top of the case.
• A second clerk will review the case and (unless there is a concern) archive it to "Wikipedia:Sockpuppet investigations/Case name/Archive". Only a clerk should do this.