Jump to content

Wikipedia:Sockpuppet investigations/GoRight/Archive

Add links
From Wikipedia, the free encyclopedia


GoRight

GoRight (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
13 June 2010[edit]
Suspected sockpuppets [edit]
Evidence submitted by Stephan Schulz [edit]

All three users listed as socks simulate or repeat edits and edit comments made by User: William M. Connolley (if in different contexts). The first two one also contain references to this user in the user name (VLB->WMC, Stoat is WMC's off-wiki blog). The edits are certainly made by a user with significant Wikipedia-experience. User:GoRight is currently banned and blocked. However, he comments off-wiki about User:VLB Pocketspup here. I find the story presented there implausible - it's much more likely that he actually created the sock, or at least has independent knowledge about it. Please check any connections between the three listed accounts. I suspect User: GoRight is stale - if not, please consider my hypothesis. --Stephan Schulz (talk) 23:22, 13 June 2010 (UTC)[reply]

Added User:SafelyAnonymous, who now tries to pass off the fake socks as real socks via Wikipedia:Sockpuppet investigations/William M. Connolley. --Stephan Schulz (talk) 00:56, 14 June 2010 (UTC)[reply]
User:GoRight has commented on the case in a new blog post, here, claiming that he is not behind the socks. I won't go into detail, but I find it interesting that he points out User:William_M._Connolley/For_me/The_curse_of_gnome as the origin of the name of the third sock - something I was not aware of. To me this again suggests involvement, but it may, of course, also be simply a sign of a certain obsession with WMC. --Stephan Schulz (talk) 11:52, 16 June 2010 (UTC)[reply]
Comments by accused parties [edit]

See Defending yourself against claims.


Comments by other users [edit]

I'm going to have to agree with Stephan. These socks, making edits that are seemingly identical to William Connolley, must be the work of GoRight! The crypto-sock sock theory! Shall I safely assume that all socks in this area are skeptics now? Oh wait Ratel doesn't fit into that pattern....unless he is was a victim of a crypto-sock attack as well. We should look into this. Luckily this new bogeyman behavior has conveniently come to light just in time to show Arbcom what you have to deal with. Congratulations on once again discovering socks with lightning speed Stephan. TheGoodLocust (talk) 03:30, 14 June 2010 (UTC)[reply]

Not a helpful comment. ++Lar: t/c 21:25, 14 June 2010 (UTC)[reply]
  • GoRight is technically highly proficient so checkuser will be of limited use in confirming lack of association. There are some possibilities of less obvious connections but more likely any socks of GoRight would be undetectable by technical means, unless he wants them to be detected. Short Brigade Harvester Boris (talk) 14:34, 14 June 2010 (UTC)[reply]
  • And your point in raising this is... ? ATren (talk) 16:45, 14 June 2010 (UTC)[reply]
  • Out of curiosity, how do you know this about GoRight? Cool Hand Luke 03:38, 16 June 2010 (UTC)[reply]
He's posted some fairly complex scripts for parsing user contributions and the like. Admittedly there's a slight bit of extrapolation involved, but I think it's likely he knows what's in an httpd log file, and I also assume that checkuser basically works by parsing httpd logs or something similar. In any event the technical measures required to defeat checkuser are a poorly kept secret. Addendum: It takes about 30 seconds with google to find the source code for the checkuser extension to MediaWiki. And once you have the source code... Short Brigade Harvester Boris (talk) 03:56, 16 June 2010 (UTC)[reply]

Can a CU please just run this and get it over with? This is turning into another witch hunt, with this section now filled with ridiculously vague insinuations. Now we have Stephan presenting "evidence" in loaded language that GoRight's knowledge of a user's subpage is somehow incriminating. These users are abusing SPI and it needs to be stopped. ATren (talk) 12:09, 16 June 2010 (UTC)[reply]

That subpage/attack page is also easily accessible from WMC's userpage - it "hidden" in plain sight. TheGoodLocust (talk) 17:43, 16 June 2010 (UTC)[reply]
Clerk, patrolling admin and checkuser comments [edit]
Checkuser request – code letter: E  + B (Community ban/sanction evasion and ongoing serious pattern vandalism)
Current status – Completed: Reviewed by a Checkuser, results and comments are below.    Requested by Stephan Schulz (talk) 23:20, 13 June 2010 (UTC) [reply]
  •  Clerk endorsed - I'm not sure who those are, but a check is definitely warranted, if only for sleepers and IP blocks. BTW, GoRight is not stale yet. T. Canens (talk) 04:27, 14 June 2010 (UTC)[reply]

SafelyAnonymous (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) and Cursing Gnome (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) have edited only with open proxies.

STOATblog (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) used one open proxy, and no other IPs. VLB Pocketspup (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) has most recently used the same proxy as STOAT did. (This proxy was globally blocked independently by a steward who does not typically edit the English Wikipedia.) VLB also edited using a few IPs registered to a hosting company, and a residential IP that geolocates far from GoRight.

Incidentally, AlfredGeorgeWoolsie (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) also used the same proxy as VLB and STOAT, so I looked at him as well. I am not sure if he is related to VLB or not, but he has exclusively edited via open proxies, which is not a good sign in my opinion.


In the end, I have basically no data at all to go on. In addition to the heavy proxy use, most of these accounts are editing with user agents and operating systems that are extremely rare and/or old, which suggests spoofing. Someone (or multiple people) is/are definitely trying to hide, but I cannot tell who. J.delanoygabsadds 18:23, 16 June 2010 (UTC)[reply]

You'll probably want to block AnonymousByChoice (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki) as well. He was on one of the proxies used by Cursing Gnome, and is almost certainly the same user. J.delanoygabsadds 18:27, 16 June 2010 (UTC)[reply]
  • All blocked, including AGW (what a coincidence!). T. Canens (talk) 18:33, 16 June 2010 (UTC)[reply]
This case has been marked as closed. It has been archived automatically.
30 June 2010[edit]
Suspected sockpuppets [edit]


Evidence submitted by Viriditas [edit]

User:Rush's Algore recently changed its user name to User:TheNeutralityDoctor. The editing pattern of this user, including the peculiar choice of vocabulary, use of punctuation, edit summaries, and method of argumentation are virtually identical to User:GoRight. If this isn't GoRight, then it is somebody pretending to be him, which would be very odd. Viriditas (talk) 05:16, 30 June 2010 (UTC)[reply]

Wikistalk returns six hits, an unusual number of matches considering Rush's Algore (now TheNeutralityDoctor) only created his account on 11 June 2010. Similarities in edit summaries are numerous, including the use of identical punctuation, and unique use of words in the same context as GoRight, such as "irony", "clarify", "Connolley", "vs.", "Reply to X", "Restore", "Fix", "Typo", "These are", "I believe", and dozens more. It isn't necessarily just these words that show a match, but how they are used. Keep in mind that GoRight had 6,406 edits before he was banned, whereas TheNeutralityDoctor has only 107. For there to be this many matches in such a small set of contributions is highly unlikely, and points to a direct match. Rush's Algore's style of endless argumentation on Talk:Climatic_Research_Unit_email_controversy#Hipocrite_should_self-revert. is what tipped me off. Viriditas (talk) 06:00, 30 June 2010 (UTC)[reply]

Reply to TheNeutralityDoctor: The reason you changed your name has nothing to do with this report. Viriditas (talk) 06:04, 30 June 2010 (UTC)[reply]

Reply to Fut.Perf.: It isn't the similarities in the words, but how they are used in the edit summaries and on the talk pages. Both users have the same set of words in their vocabulary that they use more than other users ("item", "confusion", "provided", "no longer"). Same English style, and same obsession with Al Gore in the contribution history (Aside from Fred Singer, GoRight's second highest number of contributions was to Al Gore's film An Inconvenient Truth) I would invite you to look at their edit summaries closer and their style of communication on random talk pages. They appear to be the same user. Viriditas (talk) 06:14, 30 June 2010 (UTC)[reply]

Evidence submitted by B [edit]

Upon examining their talk page comments following a request by Viriditas, I have come to agree that GoRight and TheNeutralityDoctor (TND hereafter) are one in the same.

  • Both users separate quotes and links into separate paragraphs. GoRight ([1], [2], [3]). TND ([4], [5], [6], [7], [8]).
  • Both users capitalize words they want to stress. GoRight ([9], [10], [11], [12]). TND ([13], [14]).
  • Small sample size, but both users have numbered lists in talk page edits. GoRight ([15]). TND ([16])

These taken together with periods in edit summaries and section headers discussed below? It's conclusive enough for me. --B (talk) 01:52, 2 July 2010 (UTC)[reply]

Comments by accused parties [edit]

Sigh. I changed my name because of this conversation. The rest of this is ridiculous on it's face and isn't worthy of a response. --TheNeutralityDoctor (talk) 05:44, 30 June 2010 (UTC)[reply]

Comments by other users [edit]

I find it difficult to assess the claim of "similarities in edit summaries", based on the list of expressions above, which all appear extremely common and straightforward expressions most people are likely to use. Fut.Perf. ☼ 06:10, 30 June 2010 (UTC)[reply]

I spend the last 15 minutes comparing, and the similarities are... quite uncanny. Not just the phrases, but their usage in specific instances... Still not sure though. NativeForeigner Talk/Contribs 06:12, 30 June 2010 (UTC)[reply]
Also requested him change username per req at WP:UAA because Algore is a fairly negative republican term for Al Gore. It's not a huge deal, but I could see it causing problems, so I requested the change and he went along with it. NativeForeigner Talk/Contribs 06:15, 30 June 2010 (UTC)[reply]
User Compare report. Many similar pages, unfortunately I'm not familiar enough with the case, but I do hope this helps those who are.— Dædαlus Contribs 07:33, 30 June 2010 (UTC)[reply]
The account is clearly not that of a new editor. It turned up on an article going through AfD and has shown familiarity from the start with Wikipedia's policies. The pattern of behaviour is very much like that of GoRight, including the tendentious argumentation. Viriditas' analysis of the use of language is compelling - I think he is definitely onto something. Note that CU by itself is not necessarily going to confirm this; GoRight is technically highly proficient and is likely to be aware of the way CU works, so it will be of limited use in confirming association. However, from the behavioural and linguistic evidence I think there is a clear case for blocking this account as a sockpuppet. -- ChrisO (talk) 07:51, 30 June 2010 (UTC)[reply]

Ending a section title with a dot is fairly unusual:

Sole Soul (talk) 13:30, 30 June 2010 (UTC)[reply]

  • GoRight is the new Scibaby. Anyone who opposes the house POV in this topic area is thought to be GoRight. I'm not saying they definitely aren't GoRight, but I'm highly suspect of evidence that cites similarities without rigorous analysis behind it. For example, how many other editors use dots at the end of sections, does anyone know? Or are we going to decide solely on the basis of "it seems unusual"? The real problem is the years-long effort to suppress opposing views in this topic area. ATren (talk) 14:29, 30 June 2010 (UTC)[reply]
Without presenting an opinion on this case, I searched talk pages for "Archive index," which resulted in [27]. Lookingonly at the first result, I found two section titles that ended with a single period (as opposed to an elipsis), out of 447 total headers.[28], [29]
On the other hand Talk:Global warming/Archive index has [30], [31], [32], [33], [34](possibly non-similar usage), [35], [36], [37] (possibly non-similar usage), [38], [39], [40], [41], [42], [43], [44] (possibly non similar usage), [45], [46], [47], [48], [49], [50], [51], [52], [53], [54], [55], [56], [57], [58], [59], [60] (possibly non-similar use), [61], [62], [63], 34 total sections out of 1744.
The Hezbola sections were by Tarc and a long term Australian vandal. The Global warming sections were by: Short Brigade Harvester Boris, Cortonin, Silverback, Arker, Raymond Arritt (probably non-similar usage), unsigned from 2004, Stephan Schulz, Ling.Nut (probably non-similar usage), Poodleboy, Theo Pardilla, 114.77.203.166, Animebop, Ramsquire, mbeychok, J. Langton (PNSU), Stephan Schulz, Grundle2600, UBeR, 209.144.55.6, Ramsquire, Martin Hogbin, Kim D. Petersen, User:Mugwumpjism, Count Iblis, Africangenesis, Jdcaust, 71.164.195.26, Unsigned from 2007, Unsigned from 2005, mbeychok, Poodleboy, 70.152.25.58, Poodleboy, grundle2600.
The only names on that list that are remotely suspicious are Poodleboy and grundle2600. I would be beyond shocked if grundle2600 could go as long as a week without being blatently obvious, and Poodleboy is in good standing.
I also reviewed all of GoRight's use of "." in section headers - looking at all of his article-talk contributions for the past year, I searched for "new section" at the end and merely counted "with" or "without" or "other," counting bulk user-talk posts once
  • with: 13
  • without: 12
  • other punctuation: 8
I did the same with RAG
  • with: 3
  • without: 3
  • other punctuation: 1

While the observation count is not high enough for statements about RAG to pass peer review, the difference between RAG and GoRight is not statistically significant (the t-test is .8693), while the difference between RAG/GoRight and the population is statistically significant (RAG vs Population .0000, GoRight vs Population .0000) Hipocrite (talk) 15:48, 30 June 2010 (UTC)[reply]

  • Is goright to be constantly accused of sockpuppetry then? until one of the charges stick? sad really, he`s not socking btw, i have asked him mark nutley (talk) 16:59, 30 June 2010 (UTC)[reply]
  • "he`s not socking btw, i have asked him " now THAT is solid evidence! Active Banana (talk) 20:19, 30 June 2010 (UTC)[reply]

Well, AlGore's wikilawyering in Talk:Climatic_Research_Unit_email_controversy#Hipocrite_should_self-revert. reminds me strongly of GoRight's wikilawyering in my talk page here in this looong discussion. In particular, I noted that these two comments use the same format: [64][65]. And this is the typical completely-missing-the-point-so-much-that-he-has-to-be-wikilawyering-me behaviour that GoRight always displayed: you would point something apparently obvious to him, and he would say that he didn't see anything wrong on it, then you would explain the problem, and he would keep explaining why there is really no problem (he also does this in the first link in my comment). --Enric Naval (talk) 23:01, 30 June 2010 (UTC)[reply]

Thanks for that comparison. It's clearly the same individual behind both accounts. -- ChrisO (talk) 08:42, 1 July 2010 (UTC)[reply]
... and the above breakdown is as good as WP:BEANS as one can get :-) (talk→ BWilkins ←track) 10:04, 1 July 2010 (UTC)[reply]


I performed my proprietary propitiatory linguistics analysis rooted in genetic etiologies, and the results say false match to GoRight. Zulu Papa 5 * (talk) 15:49, 1 July 2010 (UTC)[reply]

Without compromising your intellectual property rights, perhaps you could elaborate on your use of genetic data to address the question of sockpuppetry? Otherwise, a skeptical observer might conclude that you've simply strung together several seemingly random sciencey-sounding buzzwords. MastCell Talk 20:37, 1 July 2010 (UTC)[reply]
I have a thesis on expressed words and genetics with a tractable model that must and maybe verified and validated under controlled conditions. The "random sciencey-sounding buzzwords" approach would be the norm in duck testing.Zulu Papa 5 * (talk) 05:20, 2 July 2010 (UTC)[reply]
If this is a joke, it's not coming across well. Could you please clarify - do you have a linguistics tool, and if so, can you detail its operations, and the results it gave, and what data you fed into it? If you don't, can you come clean that it was just a joke, and stop making jokes like that? Thanks. Hipocrite (talk) 09:20, 2 July 2010 (UTC)[reply]
FYI, see [66]. I don't think this is meaningful/reliable evidence of anything. Whether he's joking or serious, I'm not sure, but it's not meaningful evidence of sockpuppetry or a lack thereof. --B (talk) 16:00, 2 July 2010 (UTC)[reply]
I have 20 years experience roughly in looking at such - and there is no apparnet connection - and use of common words is meaningless at best. We have a "John Doe tossed a coin and got 50% heads or so, and so did Mary Roe, and so they must be the same person" <g>. One needs specific unusual words or misspellings to make any comment at all. Collect (talk) 22:24, 1 July 2010 (UTC)[reply]
I think Hipocrite's point was that using a period to end a section header is unusual. MastCell Talk 23:18, 1 July 2010 (UTC)[reply]
That is correct. It's not just "unusual," it's statistically significant. Hipocrite (talk) 00:01, 2 July 2010 (UTC)[reply]
I agree that it's unusual. But help me out with the statistics here - it's been a while, but I don't think the methodology is right. It's one thing when you have some large vat of edits and you choose some number out of each and find that they have the same proportion and then you extrapolate the odds of both samples having the same proportion. But that's not what you have here - there are only six edits total. When I look at it, I don't see any particular reason to believe that TheNeutralityDoctor is GoRight more than he is any other right-wing sockpuppet. It's obviously not his first account, but I don't see any particular reason to believe that GoRight is the sockmaster. He doesn't really sound anything like him. --B (talk) 00:15, 2 July 2010 (UTC)[reply]
I'm reversing my opinion here. I've looked more closely at some of the editing and I think they're clearly the same person. I initially thought that TND sounded like he was just trying to be obnoxious whereas GoRight sounded more serious. But upon more closely examining their edits, I agree they are the same. I will give my reasons in an evidence section above. --B (talk) 01:33, 2 July 2010 (UTC)[reply]
I agree and stated many times that there's not a large enough sample set for RAG. While the math shows that he uses . at the end of section headers more than the average bear, and not-more than GoRight used to, there are not enough observations yet to state so with real certainty. Hipocrite (talk) 09:20, 2 July 2010 (UTC)[reply]
I think there's a certainty, just one demonstrated with your gut, not with math. Heck, even if you were to assume that given 1000 section headers created, they both would use a period exactly 500 times, that doesn't prove that they're the same person. I eat Mexican one day a week. My coworker eats Mexican one day a week. By the end of the year, we will have eaten Mexican 52 times. We're not the same person. --B (talk) 12:18, 2 July 2010 (UTC)[reply]
[citation needed]. --Stephan Schulz (talk) 12:47, 2 July 2010 (UTC)[reply]
I need a citation to prove which part? That I eat Mexican food or that I don't have multiple personality disorder? --B (talk) 12:56, 2 July 2010 (UTC)[reply]
Yes! --Stephan Schulz (talk) 13:06, 2 July 2010 (UTC)[reply]
  • The evidence was, has been, and is convincing that there is a clear case of puppetry here - admins should have no need to hesitate in enforcing policy in this case. Ncmvocalist (talk) 10:26, 2 July 2010 (UTC)[reply]
  • Actually the evidence is nicely inconclusive. The real problem is one of people seeking to label any who fall into an "opposition group" as socks, and too many have been blocked on such evidence. Collect (talk) 11:35, 5 July 2010 (UTC)[reply]
That is plain wrong. The evidence of socking is as conclusive as it will ever get. You have a clearly experienced user editing via an open proxy. What is inconclusive, at least from a technical point of view, is who the sockmaster is. --Stephan Schulz (talk) 12:05, 5 July 2010 (UTC)[reply]
I'm confused about what exactly has been established here. Is this person editing from an open proxy or not? -- ChrisO (talk) 13:11, 5 July 2010 (UTC)[reply]
You have an experienced user - who has not used open proxies in the past. You have a similar new? user who uses open proxies? which means they are the same user?? I am lost at that train of logic. Perhaps you can give me a book on logic which makes that conclusion obvious? Collect (talk) 14:43, 5 July 2010 (UTC)[reply]
You confuse users and accounts. The user behind TND is not new. He edits via open proxies, which certainly is not an accident. This is strong evidence of socking. The connection to GoRight is less firmly established. I find the evidence convincing, but there is little technical material to go on. --Stephan Schulz (talk) 15:29, 5 July 2010 (UTC)[reply]
I think you're also confused about GoRight. The checkuser's comments below indicate that GoRight has used open proxies in the past, which is interesting in the current context. The best logic text in the world is no use until you've got the basic facts squared away. MastCell Talk 16:36, 5 July 2010 (UTC)[reply]
One i history != common usage of open proxies. Or do we have "open proxy equals sock of a specific person" as evidence? Or "open proxy equals illegal use of WP"? Seems that SPI has the word "investigation" in it, not "assumption" else everyone who ever edited as an IP should be blocked as well <g>. Collect (talk) 16:48, 5 July 2010 (UTC)[reply]
There are multiple questions here. Is it proven to a mathematical certainty that GoRight = TND? No, of course not. Is it demonstrated beyond a reasonable doubt (ie, enough to convince a jury)? Probably not. But certainly we've at least shown that it is more likely than not that GoRight = TND and, in any event, editing through open proxies is explicitly forbidden. If TND were editing through a real ISP, I'd certainly be more open to the possibility that they were not the same person, but there's enough here for me. Two accounts use the same style of edit summaries, the same formatting, have the same POV on the same articles, and are both editing from open proxies (which itself is against the rules)? I think we can call it a duck. --B (talk) 17:56, 5 July 2010 (UTC)[reply]
Yes, well put. There is simply too much evidence pointing in GoRight's direction. The next question is whether all those previous proxying socks - the ones that targeted WMC - are also GoRight. I have to say that it looks more than likely, given this incident. -- ChrisO (talk) 18:04, 5 July 2010 (UTC)[reply]
Clerk, patrolling admin and checkuser comments [edit]
  •  Clerk endorsed - NW (Talk) 15:01, 30 June 2010 (UTC)[reply]
  • My Magic 8 ball says "open proxies", but let's see what checkuser turns up. MastCell Talk 20:07, 30 June 2010 (UTC)[reply]
  • Goright only has an open proxy in asia left in history, so technically  Inconclusive, but no counterindications. Go by behavior as needed. — Coren (talk) 04:45, 5 July 2010 (UTC)[reply]
    • Is TheNeutralityDoctor using open proxies or a real ISP? If he is using proxies, then that may be the nail in the coffin. --B (talk) 13:28, 5 July 2010 (UTC)[reply]
      • I talked to User:Brandon, and he clarified that TND is indeed using open proxies. That's good enough for me; I'm blocking. NW (Talk) 14:46, 5 July 2010 (UTC)[reply]

 Clerk note: I suppose if we cannot definitely show that the two now-blocked accounts are GoRight (as with the previous SPI case), then I don't think there is much else to do here. –MuZemike 17:11, 5 July 2010 (UTC)[reply]

Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia:Sockpuppet_investigations/GoRight/Archive&oldid=1138671488"