Wikipedia talk:Sockpuppet investigations/Archive 15

Page contents not supported in other languages.
From Wikipedia, the free encyclopedia

Wikipedia:Sockpuppet investigations/Dragonron

This has gone unchecked for two weeks. Could a CU please look into it? Thanks, King of ♥ ♦ ♣ ♠ 16:41, 11 June 2014 (UTC)

Merge Imaginationcolors to Noormohammed satya

I'd like to suggest that Wikipedia:Sockpuppet investigations/Imaginationcolors be merged into Wikipedia:Sockpuppet investigations/Noormohammed satya.

When the Imaginationcolors report was first filed, the identity of the sockmaster wasn't clear. There were some vague behavioural similarities to several known sockpuppeteers, but the technical evidence didn't support a link to any one of them. However, it was clear that someone was operating a big farm of socks, most of the names of which were variations on "Huzaifakhanda".

A couple months later, I reported a sockpuppet named "Huzaifakhanwla" at Wikipedia:Sockpuppet investigations/Noormohammed satya/Archive#02 June 2013, and I think it was pretty conclusively proven to belong to Noormohammed satya, because (among other reasons) it seemed to be recreating Noormohammed satya's deleted articles.

I'd appreciate it if an SPI clerk could make an independent assessment and, if they agree with my conclusions, merge the two reports and their archives. On the other hand, if they don't agree, then please move today's two SPI reports for Noormohammed satya to Imaginationcolors, because they're both "Huzaifakhanda" socks. —Psychonaut (talk) 16:29, 1 July 2014 (UTC)

Request

I made a request yesterday that has not been moved to the main space. Please may this be done? 159.92.1.1 (talk) 19:50, 25 July 2014 (UTC)

SPI table

Am I the only one who cannot get the SPI table to update? As an example, I changed the status of this case over three hours ago, yet it still shows as a current request. No matter how often I purge, or which browser I use, it stubbornly remains the same.--Jezebel'sPonyobons mots 21:40, 4 September 2014 (UTC)

Yeah, I noticed that earlier. Something has borked Amalthea's bot again, but I was hoping that it would correct itself somehow. ;) ​—DoRD (talk)​ 22:26, 4 September 2014 (UTC)
Thanks for confirming DoRD. Am I a bad person for being relieved that it's not just me? --Jezebel'sPonyobons mots 22:34, 4 September 2014 (UTC)
I reported the problem about an hour ago at Amalthea's talk page (see here). — Richwales (no relation to Jimbo) 05:14, 5 September 2014 (UTC)
@Ponyo: Yes? :P Unfortunately, the bot sometimes chokes on something in one of the cases. I think that we would all appreciate it if the bot's owner would let us know what causes the the stoppage so that we could deal with it sooner. (No offense, Amalthea. But since we rely on the bot, we would like to know if there is something we could do to correct the problem without involving you. Cheers) ​—DoRD (talk)​ 05:41, 5 September 2014 (UTC)
  • I put a notice up on the mainpage for the time being. My concern though is that Amalthea hasn't edited in 4 weeks. How long do you guys want to wait till we start reprogramming another one? -- DQ (ʞlɐʇ) 11:53, 5 September 2014 (UTC)
"We"? ​—DoRD (talk)​ 13:47, 5 September 2014 (UTC)
I'd be willing to help out if only DoRD hadn't confirmed my base evil nature. I suppose it's back to maniacal cackling and dastardly plotting for me. Just in time for the weekend too!--Jezebel'sPonyobons mots 16:39, 5 September 2014 (UTC)
Just to let people know, I have come accross this replacement, which should do for the time being. --Mdann52talk to me! 17:38, 5 September 2014 (UTC)
That's super-helpful, thanks Mdann52! I don't suppose it can somehow be transcluded to the main SPI page until Amalthea's prettier version is back up?--Jezebel'sPonyobons mots 17:48, 5 September 2014 (UTC)
@Ponyo: Don't think so unfortuantely, no. Feel free to link to it from whereever it's needed though. --Mdann52talk to me! 18:25, 5 September 2014 (UTC)
Sorry guys, was on vacation and only checked my mails every couple of days. :(
Should be running again: Some overly cautions tests met a trivial api change. I've fixed a similar mistake before and reviewed the remaining code to make sure it won't happen again.
Again, my apologies. Amalthea 13:25, 8 September 2014 (UTC)

Outstanding SPI second opinion from clerk request

The reviewing clerk at Wikipedia:Sockpuppet investigations/Dolovis, King of Hearts, would like a second opinion from another clerk. It has been 10 days and the accused is getting antsy. Can another clerk please talk a look? Cheers, Hwy43 (talk) 01:41, 12 September 2014 (UTC)

Ambiguous language

At WP:Sockpuppet_investigations#Archived_cases, it says: "A record of old SPI cases in 2009 and early 2010, separated by month, had been created and maintained by a bot. This archival system was deprecated in February 2010." followed by a textbox and a button that says "Search All Archives". Does this mean there are searchable archives only through early 2010 (doubtful)? Or only after early 2010? Or ...? —[AlanM1(talk)]— 08:20, 14 September 2014 (UTC)

Backlog on ACC

Calling all of our friendly neighborhood CheckUsers who have an ACC Account - there are currently 22 outstanding ACC requests that require a CheckUsers' attention. Should you find your account suspended for inactivity, please ping me. Thank you in advance. Dusti*Let's talk!* 21:58, 20 September 2014 (UTC)

Inquiry

I recently communicated about possible sock with elockid but he seems to be busy with real life as he don't answer emails. He said its probably a duck but he wants second opinion he probably sent it to some of the CUs Did someone received the evidence?--Shrike (talk) 10:19, 29 September 2014 (UTC)

 In progress I'll take care of this as I was already starting to look into the issue. -- DQ (ʞlɐʇ) 16:41, 30 September 2014 (UTC)

Procedural question

Is it worth filing a report if socks have already been blocked on other grounds (e.g. WP:CORPNAME)? I've never been entirely sure if I should be reporting blocked accounts as socks or not. --Drm310 (talk) 17:01, 2 October 2014 (UTC)

Good question. It comes down to whether or not you think that they may continue their behavior. If so, then recording the details can be useful and those who read the reports can be on the lookout in case they sock again.
 — Berean Hunter (talk) 22:11, 2 October 2014 (UTC)
Even if the editor(s) is/are already blocked, if say it may be in Wikipedia's best interest to file the SPI in order to create a connection between the socks, in case more socking happens in the future. Having that information can help administrators in future cases. Steel1943 (talk) 23:36, 2 October 2014 (UTC)
Note that a user who is blocked for having a group username and subsequently creates another account may not be in violation of policy; creating a new account is one of the recommended ways to address the problem of an inappropriate username. It is only a problem if: 1) they had abused policy under the old name; or 2) they make multiple new accounts that violate WP:SOCK. -- King of ♥ ♦ ♣ ♠ 03:14, 3 October 2014 (UTC)
But if it looks like a spambot, we lock dozens a day, and there's not much sense in keeping track of them. --Rschen7754 05:10, 3 October 2014 (UTC)

67 in one blow

This has got to be some sort of record, no?--Jezebel'sPonyobons mots 23:08, 3 October 2014 (UTC)

-Whoa! Holy sockpuppets Batman! That is INSANE. Wgolf (talk) 23:10, 3 October 2014 (UTC)
And with that complete, I'm off to enjoy a Friday afternoon beverage.--Jezebel'sPonyobons mots 23:17, 3 October 2014 (UTC)
Ponyo, he's not known only as "Icehound2". You may as well designate who really is behind the socks. DARTHBOTTO talk•cont 07:33, 4 October 2014 (UTC)

SPI bot

It appears the SPI bot is down again. I've left a note for Amalthea.--Jezebel'sPonyobons mots 22:10, 25 September 2014 (UTC)

Mine is always up in my userspace. Feel free to just change it until Amalthea's is back. -- DQ (ʞlɐʇ) 22:27, 25 September 2014 (UTC)
Can you update it? Yours appears to be from the 17th where Amalthea's was only out by a few hours.--Jezebel'sPonyobons mots 22:31, 25 September 2014 (UTC)
Darn WMF labs job queue froze up on it's run. I restarted it, waiting to see the edit... -- DQ (ʞlɐʇ) 00:08, 26 September 2014 (UTC)

It's down again. The overview page was last updated on Sept. 29 (4-1/2 days ago). — Richwales (no relation to Jimbo) 04:03, 4 October 2014 (UTC)

Johngalea24

Wouldn't Wikipedia:Sockpuppet investigations/Johngalea24/Archive go under long term also? We keep on having these pages appear still and I have NO clue how many there are (I believe I've seen more not even connected to this) Wgolf (talk) 02:22, 5 October 2014 (UTC)

We don't move SPI's to long term abuse. However, it may be advisable to create a new LTA page for him. -- King of ♥ ♦ ♣ ♠ 03:10, 5 October 2014 (UTC)

Sju hav

Why hasn't my CU request at Wikipedia:Sockpuppet investigations/Sju hav from 28 September been handled when all other requests from before 4 October has been handled? Regards, Iselilja (talk) 18:04, 4 October 2014 (UTC)

There is no requirement that cases be handled in order. As a clerk I can speak from personal experience: we prefer to handle short and simple cases, and everything else is TL;DR. Now your case is not particularly verbose, so I'd just pin it down to bad luck. But I'll handle your case now. -- King of ♥ ♦ ♣ ♠ 02:14, 5 October 2014 (UTC)
Thanks for checking the request. Honestly though, I don't think this SPI board is working as good as I think it should. I reported Sju hav 28 September and 11 days after he is still happily editing; messing up articles, in particular the Peter Handke to which he now has made about 40 edits. (Handke's odds for winning Friday's Nobel Prize in literature is set to 12 to 1; so it's not a totally unimportant article). I understand many SPIs can be complicated and will naturally often take time. But with repeat offenders like Sju hav I don't think it's satisfactory to have to wait for weeks to see him blocked. With reasonably clear Ducks like Sju hav, I think the standard should be to have him blocked within a day, and preferably within an hour after he is reported. Is there a better way of handling this going forward, as I doubt the little scoundrel editor Sju hav has said his last words at Wikipeda? Iselilja (talk) 19:45, 8 October 2014 (UTC)

ANI

Hello. An incident relating to this project is currently being discussed at ANI. Thank you. Iselilja (talk) 17:13, 9 October 2014 (UTC)

Tagging IPs with {{IPsock}}

ElNiñoMonstruo (talk · contribs) has been tagging IP addresses as suspected socks although there have been no SPIs. See for instance User talk:49.144.56.197 which the editor has tagged as a possible sock of Kapamilyaliker (talk · contribs). Have I missed something or is this inappropriate? Thanks. Dougweller (talk) 15:22, 20 October 2014 (UTC)

If your tagging a completely static IP address, I could see it, but otherwise it confuses new users that get those IPs. Honestly, I've always felt that tagging IPs is a waste of time and counter productive. -- DQ (ʞlɐʇ) 17:30, 20 October 2014 (UTC)
Thanks. That's my opinion also, but wanted to check (sorry it took me so long to respond!). Dougweller (talk) 15:45, 22 October 2014 (UTC)

Question

If an IP address engaged in edit warring, and after the page has been semi-protected, used his own account to revert the edits to his side, is this considered sockpuppetry? --Carlojoseph14 (talk) 17:13, 21 October 2014 (UTC)

Yes, that would fall under circumventing policies or sanctions. Mike V • Talk 18:35, 21 October 2014 (UTC)
Thanks @Mike V:. To make sure that it is, could you please help me? Here are the diffs of the user IP: 1 2. Here is the edit of the user account: 1. --Carlojoseph14 (talk) 18:46, 21 October 2014 (UTC)
If it were edit warring, the events have occurred far enough in the past that a block is punitive, rather than preventive. The article has been semi-protected to prevent future occurrences. If it happens again, you are welcome to make a report at the edit warring noticeboard. Mike V • Talk 18:53, 21 October 2014 (UTC)
Thanks, but a Sockpuppet investigation is still valid? --Carlojoseph14 (talk) 02:52, 22 October 2014 (UTC)
Generally, we don't open SPIs after the situation has been resolved already; this is not a moot court. (With a few exceptions, e.g. when a CheckUser discovers a bunch of socks, blocks them, and reports them on the master's SPI.) -- King of ♥ ♦ ♣ ♠ 01:31, 23 October 2014 (UTC)

IP block exemption

I have some concerns and questions on the IP block exemption usergroup, specifically its abuse potential and possible split. I would appreciate some input here. Cenarium (talk) 22:54, 12 November 2014 (UTC)

User:OliviaPGirl is a sock of Fairyspit

Carried on where User:Porsche Mom left off with The Imitation Game poster edits. Just another one for this category. Film Fan 04:07, 5 November 2014 (UTC)

Found another sock of Fairyspit. Film Fan 04:17, 14 November 2014 (UTC)
And another. Film Fan 03:56, 16 November 2014 (UTC)

User:The Lucky Ones is a sock of Fairyspit

See above. Film Fan 03:45, 12 November 2014 (UTC)

Please file a case the proper way, rather than posting a note here that people may not see, and without evidence. --Rschen7754 04:10, 12 November 2014 (UTC)

Evidence threshold (for making sock accusations / opening SPIs)?

This is getting out of hand. No more.--Bbb23 (talk) 05:46, 16 November 2014 (UTC)

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

I suspect sock puppetry and found that https://tools.wmflabs.org/intersect-contribs shows an over 800-article overlap. An admin's opinion is requested: Is that enough to open an SPI? Seems high enough that it's unlikely to be a coincidence. I can't find any guidance on use of the tool, and the Editor Interaction Analyzer doesn't seem to be working at the moment.--Elvey(t•c) 11:01, 14 November 2014 (UTC)

A couple of usernames would be great to go on :) Dusti*Let's talk!* 13:04, 14 November 2014 (UTC)
No! Editors get blocked for making sock accusations and opening SPIs on what is judged to be a lack of evidence, so I'm asking before doing so. (Why else would I be asking?) Again, my request is for an admin's opinion on whether an over 800-article overlap enough to open an SPI? (Obviously, the thresholds that determine the results of the investigation are different.) --Elvey(t•c) 17:16, 14 November 2014 (UTC)
No, editors get blocked for making baseless accusations. If you're noting a concern in good faith - you cannot be blocked. Generally speaking, two editors editing the same articles can be deemed as behavioral evidence, and if you're saying there's over 800 articles that overlap that's certainly more than enough. I wouldn't post all 800, I'd post five or six with a link to the search on labs. In addition, what brought you to take a look at these two and any other evidence you have will be considered by a clerk and thus a CheckUser. If you'd like for me to take a look in private, you're more than welcome to email me and I'll give you my thoughts in private. Dusti*Let's talk!* 17:37, 14 November 2014 (UTC)
No, editors do get blocked for making accusations with a foundation in good faith, if the accused has powerful support. It shouldn't be that way, but it is. Again, my request is for an admin's opinion on whether an over 800-article overlap enough to open an SPI. You have an admin account?--Elvey(t•c) 20:55, 14 November 2014 (UTC)
No, but I've been around for awhile and been around SPI enough to be comfortable enough to tell you that it'd be okay to open an SPI. If a clerk disagrees or a checkuser refuses, they'll simply do so. I'm not sure what blocks you're mentioning, but that doesn't sound like the foundation behind AGF. Dusti*Let's talk!* 21:13, 14 November 2014 (UTC)
Well, my last RFCU did go well, so that's something. There's a lot of tag-team behavior. I wonder if the users are meat puppets. I see the users talking to themselves extensively on their own talk pages, and not always agreeing, so if it's sock puppetry, it's a severe case. Still holding off, pending a comment from an admin.--Elvey(t•c) 22:31, 15 November 2014 (UTC)
Aha! The Editor Interaction Analyzer is working again, and the evidence is damning. No wonder the user went wild when I mentioned tag-teaming. --Elvey(t•c) 22:42, 15 November 2014 (UTC)
Wikipedia:Sockpuppet investigations/AcidSnow was declined for other reasons, but I'd still be wary unless you have more evidence than just article intersection.--Bbb23 (talk) 22:57, 15 November 2014 (UTC)
Also, take a look again at the Analyzer and notice how short some of the gaps are between the two editors' contributions, sometimes just seconds. That's very hard to do if the users are the same person.--Bbb23 (talk) 23:02, 15 November 2014 (UTC)
I dispute that it's very hard to do. Bbb23: Do you have any evidence to back that claim? I think it's preposterous trivial to do or explain how to do such edits. But thanks for the pointer to the extant SPI. Also, may I ask how you found this conversation? I see your, "I am declining this report as retaliatory, agenda-driven, and without prima facie evidence of sock puppetry." Given the evidence I've noted, I'm not sure how to proceed. Do you dispute User:Dusti's judgement that it'd be okay to open an SPI? If so, can you explain why? --Elvey(t•c) 01:57, 16 November 2014 (UTC)
Evidence? It's not the kind of statement that is supported by evidence. Preposterous isn't the best tone to take. I'm done. You should do what you think best, but I don't think continuing this discussion is serving any useful purpose.--Bbb23 (talk) 02:38, 16 November 2014 (UTC)
Editors do not get blocked for opening SPIs in good faith. Conclusive evidence is not required, often that requires checkuser which editors cannot perform themselves. Editors can be blocked however for making accusations on article or user talk pages. An 800 article overlap is sufficient to raise suspicion.
Also, since sockpuppetry is disruptive behavior, generally you should show disruptive behavior by both editors.
TFD (talk) 03:43, 16 November 2014 (UTC)
What a joke. "A couple of usernames would be great to go on", I was already aware of whom Elvey was referring to from the start. This isn't surprising considering that most of their recent edits have been exclusively about us. If you really belive that I am a sockpuppet of Middayexpress or vis versa, then I ask any of the admins here to do a User Check on us. "I see the users talking to themselves extensively on their own talk pages", nobody should be surprised about this considering that Middayexpress and I are amongst the three main contributors to the Somalia Project. I am not a Wikipedia:Meat puppetry either since a don't have any connections with the "Man Behind The Mirror" and that I have had this account much longer than this discussion has been going on. Nor did none of us go "wild" when you accused us of tag teaming. It's odd to claim otherwise considering that none of us have give any response to your accusation. I did, however, respond to your baseless accusation of violating WP:CIVIL, WP:NPOV and WP:EDITWAR. Ironically, once again your accusations don't match up with my edits. That said, I am encouraging you to follow Bbb23s advice and drop this. But you don't have to listen to either of us. You may not get blocked for this but it is humiliating. AcidSnow (talk)
The discussion above is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

Wikipedia:Sockpuppet investigations/Pearljambandaid

This case has been waiting for a checkuser for over a week now. Hell in a Bucket (talk) 05:26, 17 November 2014 (UTC)

Question - sockpuppets banned on other Wikis, what would their status be here.

A gaggle of users has been banned on eswiki. Many of the users have been active on enwiki, such as Daniel a Tescione, FiSeOfSu, Mickey9992, Artbunker, and MrChri9s2. It appears they copies from sources and writes articles with bad refs. Do I go thru the normal SPI process? Any suggestions? Bgwhite (talk) 18:38, 4 December 2014 (UTC)

@Ponyo and DeltaQuad: Help. Bgwhite (talk) 23:23, 5 December 2014 (UTC)
My advice would be to open an SPI under the oldest account name and list all of the socks blocked on eswiki. If there are copyright issues we should really ensure the same thing isn't happening here.--Jezebel's Ponyobons mots 23:34, 5 December 2014 (UTC)
Commons should probably be notified too, some accounts edited there. I'd also ask the CU to forward stuff to checkuser-l. --Rschen7754 02:03, 6 December 2014 (UTC)
I've filed the report. Bgwhite (talk) 08:40, 6 December 2014 (UTC)

About technical capabilities, and sock activities that aren't edits

Hi,
Please correct me if I'm wrong, but - I believe Checkuser queries data which is gathered at the time of each edit. However, over time en.wiki (or mediawiki) has expanded functionality so there are an increasing number of actions which editors can perform but which don't actually appear in the edit log, though they are generally captured in some other log. For example, Thanks, or various things in the Education Program, and so on. Would it be fair to assume that none of this is visible to Checkuser? If so, is it a gap in our radar, and could/should we consider trying to close the gap? bobrayner (talk) 18:57, 10 December 2014 (UTC)

There are several logs that are put into checkuser, the thank log being one of them. We also get the abuse filter, user rights, deletions, blocks, and more. I forget if we get the EP or not, it would be nice to have login attempts too even though those are not currently logged. -- DQ mobile (ʞlɐʇ) 22:44, 10 December 2014 (UTC)
OK; thanks. I must have misunderstood what is currently checkuserable. For what it's worth, off-wiki, large organisations usually find that reviewing failed logon attempts in their own right is not worthwhile, but looking at any failed logon attempts that can be correlated with other events in a specific investigation is definitely worth doing, and the latter is analogous to how we use checkuser. Do you get successful logon attempts? bobrayner (talk) 23:57, 10 December 2014 (UTC)
I thought I'd heard (I can't remember where, and I'm sure DQ or somebody else will correct me if I'm wrong) that the data was gathered for any action that creates an entry on recent changes, plus possibly some other things. HJ Mitchell | Penny for your thoughts? 00:03, 11 December 2014 (UTC)
Bobrayner, no we don't get successful enwiki logins, which I agree would generally be extremely useful. HJ, correct, recent changes and some log events (if it creates an entry in your watchlist we'll see it in CU - from what I've seen so far). Callanecc (talk • contribs • logs) 01:41, 11 December 2014 (UTC)
Bob, in reply to your comment, it actually would help us a lot. All activity on accounts goes stale after a certain period. So if that person is logging back in to a sleeper account, it would be nice to have that appear in CheckUser. Also it helps with diagnosing accounts that are being compromised or if someone is lying about a compromised account to avoid scrutiny. -- DQ (ʞlɐʇ) 20:47, 11 December 2014 (UTC)

Changes to status

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

Within the last few days there has been a change to the status displays on the main SPI template (based on a cursory look at the transclusions they were perhaps made by NE Ent)? The yellow "Awaiting CU" isn't entirely correct. It should read "CU requested" which (should) prompt clerks to review the evidence and move it to "Endorsed" if CU is actually required. --Jezebel's Ponyobons mots 00:56, 19 November 2014 (UTC)

How's it now? NE Ent 10:48, 19 November 2014 (UTC)
Much better, thank you!--Jezebel's Ponyobons mots 18:50, 19 November 2014 (UTC)

@NE Ent: Can we also change "Completed" to "CU completed" indicating that further action is still needed (as opposed to the case being done). Thanks, Callanecc (talk • contribs • logs) 08:59, 20 November 2014 (UTC)

I second that request. NE Ent, could you update that status as well?--Jezebel's Ponyobons mots 17:20, 20 November 2014 (UTC)
Completed. NE Ent 01:11, 21 November 2014 (UTC)
Thank you! --Jezebel's Ponyobons mots 19:27, 21 November 2014 (UTC)
The discussion above is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

Wording on cover page

For an archived investigation, we have a cover page (like this one) that lists the user and then states "This page is archived at Wikipedia:Sockpuppet investigations/Burhanhakim99/Archive". I suggest changing the wording on this page for more clarity: "This user is not currently under investigation. For earlier investigations, see Wikipedia:Sockpuppet investigations/Burhanhakim99/Archive". Oiyarbepsy (talk) 07:08, 11 December 2014 (UTC)

Sounds like a good idea to me, but the same notice is displayed whether there are open investigations or not (here for example). Perhaps just "For previous investigations, see Wikipedia:Sockpuppet investigations/Example/Archive." so it will work in all contexts. There are many words we could use instead of "previous" (eg "archived", "passed", "closed") what are people's preference? Callanecc (talk • contribs • logs) 07:34, 11 December 2014 (UTC)
I think your wording is fine. I would not use the first sentence by the OP for your reason and for others. It sounds like we're trying to defend the named master.--Bbb23 (talk) 12:02, 11 December 2014 (UTC)
I would not used 'previous investigations' as it leads on that it is all investigations that have been done. Some of course (not specifically indicating for that user) are not public. I feel that saying 'For archived investigations, see ...' is a better set of wording. -- DQ (ʞlɐʇ) 20:38, 11 December 2014 (UTC)
 Done Callanecc (talk • contribs • logs) 08:04, 13 December 2014 (UTC)

SPI evidence subpages

There have been a few examples in recent days of editors creating "secret evidence" subpages attached to current or archived SPI cases. The checkuser team has discussed these subpages, and believes that the information contained in the subpages is more appropriately posted within the SPI request itself. Under no circumstances should a subpage be created for an archived SPI. There are limited situations where the sockpuppetry evidence involves private or non-public personal information, and in those circumstances direct communication with an active checkuser or email to the Functionaries mailing list would be appropriate. Otherwise, all evidence should be posted on an open SPI request. Risker (talk) 06:53, 29 December 2014 (UTC)

HRW in the 1900

Anyone recognise any similarity between this name [1] and that of any known socks? — Preceding unsigned comment added by Dougweller (talk • contribs) 11:54, 1 January 2015 (UTC)

@Dougweller: why do you want to know that about User:HRW in the 1900? Grewia (talk) 22:21, 1 January 2015 (UTC)

Notifying the accused

The discussion above seems to reveal that the wording at Wikipedia:Sockpuppet investigations/SPI/Guide to filing cases#Important notes doesn't appear to match the consensus on best practice. I think it's worthwhile to discuss if and how the wording should be changed. Oiyarbepsy (talk) 03:14, 2 January 2015 (UTC)

I don't see the mismatch. It says "Notification is courteous but isn’t mandatory, and in some cases it may be sub-optimal. Use your best judgement.". How does that conflict with anything that's been said? You may want to note that it's the guideline for filing SPI cases, not the guideline for commenting on them.—Kww(talk) 03:33, 2 January 2015 (UTC)

Warned off for notifying suspects

Does the panel here think that this warning (and this followup) I received from Bbb23 was reasonable and policy compliant? My main interest is rationales here. Grewia (talk) 22:27, 1 January 2015 (UTC)

your only purpose here appears to be to tell possible sock puppets that they are being investigated. You do realise, I hope, that such behaviour makes one wonder if you are a sock? Are you under the impression that sock puppetry is not a problem? The warning was deserved. Dougweller (talk) 22:37, 1 January 2015 (UTC)
@Dougweller: do you have the ability to explain why you think suspects should not be given the opportunity to see what they are being accused of and putting their side? Grewia (talk) 22:42, 1 January 2015 (UTC)
I just read the warning. So people accused of sockpuppetry are not allowed to be notified and defend themselves? I am confused by this policy, Bbb23. - erisrenee (talk) 23:04, 1 January 2015 (UTC)
  • You absolutely are; the issue is that the Grewia account has only been used to alert editors to SPIs, and if I'm correct, LGBT-related SPIs at that. Grewia has made no attempt to actually contribute to Wikipedia as of right now. The other issue is that undeclared alternate accounts are not allowed to edit Wikipedia namespace (as per WP:ILLEGIT), which means that they shouldn't be editing SPIs directly when they have no relevance to them. Lukeno94 (tell Luke off here) 23:09, 1 January 2015 (UTC)
@Lukeno94: do you have anything constructive and on topic to say about the instruction not to notify suspected socks? If you want to discuss my interests and intentions wrt the articles I plan to work on here, than perhaps we can take that discussion somewhere more appropriate, even offline perhaps? Grewia (talk) 23:15, 1 January 2015 (UTC)
  • Nice cherry-picking of my comment there Einstein. If you read my comment, you'll see I was explaining to Erisrenee exactly what had happened... *palm to face* Lukeno94 (tell Luke off here) 23:16, 1 January 2015 (UTC)
  • I've blocked Grewia indefinitely per NOTHERE and because they're very likely a sockpuppet. A lurking CU might be kind enough to appease our curiosity, but it's academic really. HJ Mitchell | Penny for your thoughts? 23:21, 1 January 2015 (UTC)
I believe that's an inappropriate block and an inappropriate cause to block. Notifying someone of an SPI against them is not against the rules nor is the unsubstantiated claim that a user is a sockpuppet appreciated. Tutelary (talk) 23:59, 1 January 2015 (UTC)
  • However, trolling in an SPI that has nothing to do with them is a pretty clear sign of NOTHERE. If they're not a sock, then they're violating ILLEGIT as an undisclosed alt account. Lukeno94 (tell Luke off here) 00:32, 2 January 2015 (UTC)
  • Since the instructions on filing a report explicitly suggest that notifying the user is an option, this is a ridiculous grounds for blocking an editor. The bad faith warnings were also uncalled for. Always start out polite. There is no investigation and zero evidence at this point that Grewia was a sockpuppet. {{Trout}}s all around. Oiyarbepsy (talk) 00:42, 2 January 2015 (UTC)
Tutelary, the first time we met you were accusing me of making an inappropriate block. Since then, you have accused me on multiple occasions of making inappropriate or abusive blocks. And here you are again, accusing me of making and inappropriate block. It's becoming an irritating habit. Perhaps you'd like to tell the good folks following along at home just how many times one of those blocks has been reversed as out of process by another admin? Or just how many times I've been censured by the community or ArbCom for inappropriate blocks? HJ Mitchell | Penny for your thoughts? 00:40, 2 January 2015 (UTC)
Or you could just unblock him because notifying someone of an SPI is not against the rules neither is participating in SPIs that don't involve them. Note that there is a spot for 'other user's comments' and that is a section that they are allowed to participate in. There's a reason for that, because other users could have reasonable comments, concerns, doubts, or even raise new evidence in an SPI. And just because no one's called you out or officially censured you for something doesn't mean it isn't inappropriate. People get away with all sorts of stuff on Wikipedia, and it's only when people raise a certain light on issues does it ever get investigated. Tutelary (talk) 00:57, 2 January 2015 (UTC)
Maybe, just maybe, you have a habit of issuing inappropriate blocks. I don't know your history, but don't always assume the other guy is wrong. Oiyarbepsy (talk) 00:42, 2 January 2015 (UTC)
It's not an inappropriate block as they are clearly trolling so not here to build an encyclopedia. They're getting involved in sockpuppet investigations that are clearly nothing to do with them. It's down to the editor raising the SPI to notify the affected editors--5 albert square (talk) 00:44, 2 January 2015 (UTC)
Name me a diff of 'clear trolling'. Last time I checked that they are allowed to get involved in SPIs that don't involve them. And cite policy for that. Tutelary (talk) 00:57, 2 January 2015 (UTC)

I fully endorse HJ Mitchell's block. I almost blocked the user myself without a warning as it was obvious they were a troll. It's not just the notification that was wrong; they were also trolling in SPI cases themselves. As for Oiyarbepsy's statement that the instructions "explicitly suggest that notifying the user is an option", please find that in the instructions on the SPI page and quote it.--Bbb23 (talk) 00:50, 2 January 2015 (UTC)

  •  Checkuser note: There's nothing conclusive in CU which indicates what their other account could be. But I agree that they are very likely a sock or meat puppet here with the intention to disrupt. Callanecc (talk • contribs • logs) 00:59, 2 January 2015 (UTC)
Notifying users that there's an SPI against them is disruption nowadays? Tutelary (talk) 01:00, 2 January 2015 (UTC)

From Wikipedia:Sockpuppet investigations/SPI/Guide to filing cases: "You can notify the suspected accounts by adding {{subst:socksuspectnotice|PUPPETMASTER|sig=yes}} to the bottom of their talk pages. (Notification is courteous but isn’t mandatory, and in some cases it may be sub-optimal. Use your best judgement.)" As you can see, there's even a template. Oiyarbepsy (talk) 01:02, 2 January 2015 (UTC)

The language in the guide is precisely the language that used to be in the instructions. Usually notification requirements are in the instructions themselves (see other administrative noticeboards). It's already odd that the notification here was at one time "optional". I appreciate the quote, though, because I didn't realize it was in the guide. I only tracked the history of the instructions themselves. In my view, leaving it in the guide is inconsistent with removing it from the instructions, and I may remove it or at least discuss the removal with the CUs as SPI is really their show.--Bbb23 (talk) 01:34, 2 January 2015 (UTC)
If that's the sole purpose of their account, it would class as trolling--5 albert square (talk) 01:03, 2 January 2015 (UTC)
Are you discriminating against him solely because he wishes to inform individuals against a SPI claim against them? Or because he's new? Most of you are seeming to implicitly be claiming that the behavior is allowed, but not allowed because he's doing it as the sole purpose of his account? Last time I checked we weren't supposed to make such double standards. Tutelary (talk) 01:05, 2 January 2015 (UTC)
How would that be classed as trolling? If anything they're being helpful by notifying users of charges brought against them. - erisrenee (talk) 01:06, 2 January 2015 (UTC)
Because that is the sole purpose of the account. It indicates that they're not here to build the encyclopedia--5 albert square (talk) 01:18, 2 January 2015 (UTC)
I probably would have blocked as well. It is not a first account (no first account starts off knowing where WP:SPI is), and as such its actions (focused on non-article activity) violate WP:SOCK. We don't have to play along with this sort of nonsense. It's an encyclopedia, this account wasn't even pretending to be interested in it. Risker (talk) 01:21, 2 January 2015 (UTC)
Hey, Risker and I agree on something. That doesn't happen by coincidence: it tends to mean the answer is pretty obvious even to people that tend to disagree.—Kww(talk) 01:22, 2 January 2015 (UTC)
So explicitly--Is it allowed to notify users of an SPI against them and to participate in SPIs? Again, everybody seems to be saying that it is--so long as you aren't a new account. Tutelary (talk) 01:23, 2 January 2015 (UTC)
There's not a good answer to your question. Let's just say that if you open an SPI yourself and notify the parties, you're not going to get warned or blocked. However, I wouldn't take it upon youself to notify parties of an SPI that you didn't open.--Bbb23 (talk) 01:37, 2 January 2015 (UTC)
But that doesn't answer my question. You say that you wouldn't take it upon myself to notify parties that I didn't open, but you didn't rule on that either. But I don't think that admins should be making policy, so where is that explicitly disallowed? Tutelary (talk) 01:44, 2 January 2015 (UTC)
You know as well as anyone that policy is established by examining history, not written in advance. If any admin determined that the reason for your notifications was to interfere with the process, you'd get blocked for disruption, and other admins would be unlikely to reverse the block. There should be no expectation on your part that every form of disruption that you could be blocked for would be written out in advance.—Kww(talk) 01:48, 2 January 2015 (UTC)
Of course but policy is primarily based on consensus, which can change. I'll be apt to propose an addition in policy in some RfC at some point in the future to expressly allow this behavior. I find this highly disturbing that he was blocked for merely notifying participants of an SPI charge against them and other users have as well. Plus admins are supposed to enforce community consensus, not deter it. Tutelary (talk) 01:54, 2 January 2015 (UTC)
At this point, consensus is that notifying SPI subjects is frequently a bad idea, and, as a result of that consensus, the person opening the investigation has the option of not doing so. Why should we permit others to take that option away? Why should others override that choice?—Kww(talk) 02:02, 2 January 2015 (UTC)
Tutelary, as you're so fond of saying, "drop the freakin' stick". I can't remember the last time Risker, Kww, and I all agreed on something (much as I respect both of them). That should tell you all you need to know. New accounts that show no interest in the encyclopaedia and instead engage in policy wonkery in obscure corners of the projectspace should be summarily blocked, and I don't think you'll find an admin on the project who would disagree with that. HJ Mitchell | Penny for your thoughts? 02:08, 2 January 2015 (UTC)
SPI may not always prove conclusive but its decisions to block are rarely wrong. However, there are plenty of other grounds for blocking some accounts. The block by HJ Mitchell is perfectly reasonable and more than comfortably within our policies and guidelines. If he hadn't done it and I had come across this case earlier I would have done it myself. That said, I question the usefulness of some comments by users who are not connected with the current case. Opinions are usually welcome but those who early on in their Wiki careers question legitimate admin actions or who fervently try to initiate unnecessary changes to policies and procedures all around the site might also not quite be on Wikipedia 100% for the right reasons; or at least they should be revisiting this pillar and perhaps also looking to their own block logs and/or participation in meta areas before using borderline PA and possibly harassing other editors. --Kudpung กุดผึ้ง (talk) 04:05, 2 January 2015 (UTC)
Are you referring to me for the last bit? Tutelary (talk) 05:09, 2 January 2015 (UTC)

Misclassification of status of a SPI?

Wikipedia:Sockpuppet_investigations/Absolution_provider_1999#01_February_2015 says its open, but on WP:SPI it is down as declined since the declining of a further checkuser on Absolution_provider_1999 on 29 January 2015. John Smith the Gamer (talk) 11:40, 7 February 2015 (UTC)

The bot that maintains the list of cases on WP:SPI can only classify a case with one status at a time. Since there are multiple cases in that particular SPI, each with a different status, the bot (apparently) chooses the most relevant for the list. Another bot-maintained list includes the SPI in multiple sections. ​—DoRD (talk)​ 15:49, 8 February 2015 (UTC)

How to relist?

This case has been closed[2] and archived,[3] but I'd like to know if there is a way to re-open it and get a second opinion.

I provided a lot of evidence, but the closing remarks were very brief and a little confusing. How do I re-open the case?

Thanks. Lightbreather (talk) 16:36, 9 February 2015 (UTC)

Please discuss your concerns with the closing clerk - I'm sure that he would be willing to discuss his findings, and may be open to un-archiving the case for further review. ​—DoRD (talk)​ 17:08, 9 February 2015 (UTC)

Evasion of block possible

--Donaldouglas (talk) 07:50, 14 February 2015 (UTC)

Is there any point in opening a SPI against someone who knows a lot about computer software?

My neighbor recently showed be how he can hack into a computer on the other side of the earth and make his Wikipedia edits appear to come from it. Is there any point in opening an SPI against a user who is knowledgeable about hacking, or are SPIs really just to catch average sockpuppetry? Gouncbeatduke (talk) 17:30, 22 February 2015 (UTC)

Feel free to open up a case. We look at more than just the technical information available. Also, if a checkuser were to look at their user logs there's a good chance they'll see that someone is using some sort of trick to fake their IP address. Mike V • Talk 05:03, 23 February 2015 (UTC)
What Mike said. From a CU perspective sometimes trying to avoid detection is as obvious as if they hadn't avoided protection, and it only takes one mistake to be caught. Plus if I post a result stating that the accounts in question where using open proxies then admins/clerks looking into account will take the attempt to avoid detection into account. Callanecc (talk • contribs • logs) 11:28, 23 February 2015 (UTC)
@Callanecc: I don't believe User:Gouncbeatduke was talking about the use of Open proxy, but then I might be mistaken. Ottawahitech (talk) 15:48, 23 February 2015 (UTC)

Is the linking of off-wiki accounts considered Outing?

Per WP:OTHERSITES I would like to link a Twitter feed to a Wikipedia user account mentioned in an SPI. Would that be considered WP:OUTING? In the case I'm speaking about (go on and look through my edit history you nosy parkers) the username and the Twitter name are the same. -Thibbs (talk) 17:11, 16 February 2015 (UTC)

Unless the user has posted their twitter feed on-wiki, it would be a violation of WP:OUTING for you to post it. ​—DoRD (talk)​ 20:11, 18 February 2015 (UTC)
Thank you. This is in agreement with the comments of User:Kyohyi at the other board I posted to (here). It looks like email is the best option for private evidence like this. -Thibbs (talk) 21:20, 18 February 2015 (UTC)
The RfC on "should the policy extend harassment to include posting ANY other accounts on ANY other websites?" has been closed and states that posting of other accounts is sometimes allowed. Doc James (talk · contribs · email) 02:04, 25 February 2015 (UTC)

Launching an investigation into a sock if the puppetmaster's case has already been archived

I have a third user who I believe is a sock of a puppetmaster whose case is already archived following the investigation into the previous two socks. How do I proceed? Do I launch an investigation into the original puppetmaster again? Thanks, Dismas|(talk) 17:46, 28 February 2015 (UTC)

Jut file a new report under the master's name. This happens a lot, especially with prolific sockpuppeteers. HJ Mitchell | Penny for your thoughts? 17:50, 28 February 2015 (UTC)
Great! Thanks! Dismas|(talk) 00:38, 1 March 2015 (UTC)

How to find out why someone was blocked years ago?

I frequently see editors who were blocked a very long time ago by an admin who is also no longer active. Is there an easy way to see what evidence was presented at the time without making it into a PhD thesis? Ottawahitech (talk) 15:36, 8 February 2015 (UTC)

You can look at the block log and see what comments the administrator provided, which may contain links to the discussion, or discussion posted on the editor's talk page at the time. You could also search the archives of SPI, AN or ANI. In some cases administrators blocked without discussion, so you have to look at what the editor posted shortly before the block. Often years ago there was less documentation when editors were blocked. Why do you want to know? TFD (talk) 15:42, 8 February 2015 (UTC)
Thanks for the speedy reply, TFD. To answer your question: the reason I wanted to know today is user:Straightpress. Other times I am interested in looking up the history of other editors. For example when I was blocked back in 2012 other editors who tried to help me, ended up being blocked themselves. Ottawahitech (talk) 15:52, 8 February 2015 (UTC)
Generally, blocks placed years ago aren't terribly relevant to anything anymore. I suggest completely ignoring them. Martijn Hoekstra (talk) 15:46, 8 February 2015 (UTC)
Straightpress was blocked 9 November 2007 as a sockpuppet of Amorrow, based on checkuser, according to the user page revision history.[4] A search for Amorrow on the SPI page leads to Wikipedia:Sockpuppet investigations/NatchitochesLA/Archive (2010), where Amorrow is mentioned as a "serial sockpuppeteer." (However that is not very helpful.)
Amorrow was blocked 10 August 2005, and blocked from editing his own talk page 29 December 2009, according to his block page.[5] He was then banned by the Wikimedia Foundation and his page protected 17 January 2015. There are a lot of mentions of Amorrow at ANI.[6]
All the postings about Amorrow appear to be from 2005-2007, so it is not really relevant to today. I don't know why he would be banned this year, but you could ask the administrator.
TFD (talk) 16:56, 8 February 2015 (UTC)
That's a valid ban. You can contact me privately about it per email, or google can help you. Martijn Hoekstra (talk) 17:06, 8 February 2015 (UTC)

@Martijn Hoekstra: You said blocks placed years ago aren't terribly relevant to anything anymore but with all due respect, I disagree. There are reasons people want to dig into history, and everyone expects wikipedia to be transparent. I may want to find out what evidence was presented to block ,say, User:Telanian183. Others may be interested in researching User:Wik, and still others may want access to information so that statistics can be compiled.

In any case why is there no standard way to denote information about “sock puppets”. Why is it necessary to ask here and take up valuable time of admins? Ottawahitech (talk) 16:39, 22 February 2015 (UTC)

@Ottawahitech: That is because we don't want to give sockpuppeteers more recognition than they deserve. Read this: Wikipedia:Revert, block, ignore. Vanjagenije (talk) 17:49, 1 March 2015 (UTC)

Replacing dead links with spam

This company is recommending a spam technique http://www.wikilinkpro.com/ that involves replacing dead links with spam links.

There is a user on Elance that is working for this company. They appear to be using hundreds of socks and claim to have made thousands of edits.

This user is editing in that fashion User:Bobkarlz. These are other accounts that have been picked up Wikipedia:WikiProject_Spam/Dead_link_spamming

Would a check user on these accounts potential help us find the sock master? Doc James (talk · contribs · email) 08:57, 25 February 2015 (UTC)

Special:Contributions/Bobkarlz seems to have been searching for dead links then replacing them with spam links. That website says that it has a business model doing this. It is sad that someone would make a business model by attacking Wikipedia with spam. Blue Rasberry (talk) 20:08, 25 February 2015 (UTC)
Yes there are a few businesses that are doing this. Doc James (talk · contribs · email) 00:49, 26 February 2015 (UTC)
Another new one has appeared. Reported to SPI [7] Doc James (talk · contribs · email) 02:13, 26 February 2015 (UTC)
@Doc James: CU is unlikely to be much use with these accounts, as you've discovered in that case. It's possible that they're socks and whoever it is very adept at evading detection by technical means (which is not as simple as merely changing your IP address with each edit, and is very difficult to do consistently over multiple accounts without an overlap between them); Occum's razor suggests it's more likely that they're meatpuppets or completely unrelated people who took a work-from-home job. Probably best not to put too much thought into it and just block, revert, ignore. And it's worth blacklisting the domains/URIs being used, especially if more than one account links to the same domain. HJ Mitchell | Penny for your thoughts? 18:07, 28 February 2015 (UTC)
Yes we likely need better detection methods for specifically this type of edit if these are meatpuppets rather than sockpuppets. Doc James (talk · contribs · email) 18:48, 28 February 2015 (UTC)
Blacklisting is a good idea, I found an account doing this a few days ago, must go back through my contributions and see about doing that. Sorry for the accidental revert, I was on my iPad trying to look at the talk page, not sure how that happened. Dougweller (talk) 19:21, 28 February 2015 (UTC)
James, there was some talk of an edit filter at WT:EF. I don't know if it went anywhere. I've blacklisted the two domains used by your latest two. HJ Mitchell | Penny for your thoughts? 20:15, 28 February 2015 (UTC)
Thanks Doc James (talk · contribs · email) 01:41, 1 March 2015 (UTC)

Tagging question 1

If a checkuser spontaneously blocks a named account as a sock, with no SPI and no other discussion at all, should the blocked account be tagged as "confirmed" or as "suspected"? 94.196.213.139 (talk) 21:21, 1 March 2015 (UTC)

Tagging question 2

If a non-checkuser administrator spontaneously blocks a named account and tags it as "confirmed" when there has been no SPI and no checkuser involvement, what can be done to get the tag corrected to "suspected"? 94.196.213.139 (talk) 21:38, 1 March 2015 (UTC)

Question

There are a couple accounts at the Shaygan Kheradpir page that I suspect are paid socks, however, when I got to the "evidence" parameter, I realized I would have to spend hours providing diffs to explain the full context of tenuous editing and tag-teaming that led me to that conclusion and after spending all those hours I would just look paranoid, especially since it's unlikely a checkuser will verify one way or another. All an astroturfing service has to do is use multiple IPs to avoid a checkuser.

I don't have much experience with SPIs and was hoping for some guidance on what the threshold of evidence is, etc. I have a potential COI on the page, basically just with this section, which the alleged socks have avoided anyway, but it's very frustrating that I'm trying to bring it up to GA and they keep adding unsourced content, removing outsourcing and layoffs, and insisting sources support article-text that they don't actually, etc. CorporateM (Talk) 13:46, 20 March 2015 (UTC)

There is no hard-and-fast rule. The idea is that you have to convince a clerk/CU/admin that it's probable that the accounts are socks. You use comparison diffs to do that showing similarities between the accounts side by side. The better organized it is, the easier it is for a clerk to evaluate. I don't think you should presume that a CU will not be successful. If you think there is sufficient evidence to warrant a CU and a CU would be possible and useful, you should request it. I don't think you should worry about your supposed COI, although you are welcome to disclose it if you open an SPI. As for the time you have to spend, that's going to vary by the complexity of the evidence and the editor presenting the evidence. If you don't believe you are up to the task, there's not much I can do about that. I'm sometimes a little sharp with editors who present little or no evidence, but generally I can tell the difference between a good faith effort and someone just saying "duck" with almost nothing.--Bbb23 (talk) 15:14, 20 March 2015 (UTC)

Not sure if I messed something up

I tried to create a new SPI case for User:EPANews through Twinkle, but when I submitted it I got an error message. I created it again, using the form reached through adding the sockmaster's username in the neat little box at Wikipedia:Sockpuppet investigations. That caused Wikipedia:Sockpuppet investigations/EPANews to be created, but did not list the SPI among the other cases, and the link to Wikipedia:Sockpuppet investigations/EPANews/Archive seems to have been overwritten. It's very late where I am and I don't want to risk messing anything else up, so I'll just post a note here and hope that whatever error I made can be fixed so that the case doesn't disappear. Cheers, --bonadea contributions talk 22:30, 24 March 2015 (UTC)

@Bonadea: Had a look at them and everything appears ok. Archive page hasnt been edited in years. New SPI is showing at the link you gave and its showing in the case list. — Preceding unsigned comment added by Amortias (talk • contribs) 22:36, 24 March 2015‎ (UTC)
I added the archive link back in to the case page. --David Biddulph (talk) 22:50, 24 March 2015 (UTC)

Sockpuppet clear-up

We not going to reenact the closed ANI here.--Bbb23 (talk) 13:46, 29 March 2015 (UTC)

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

I have been alleged by User:OccultZone to be a sockpuppet of User:Zhanzhao. Since it seems constructive dialogue cannot proceed until I have proven that I am distinct from either of the two, I would like to request all three of us to share Skype IDs so we can confirm that we are really three distinct people and no two of us are the same person. My Skype ID is --hidden-- and I do understand that I am putting it out here with the risk of abuse from random people on the Internet, so please be sensitive about using it. I would like to request User:OccultZone and User:Zhanzhao separately to tell me their Skype IDs so I can add them into a group call. 49.244.254.201 (talk) 12:53, 29 March 2015 (UTC)

Please don't mention or drag me into this. That page is freaking cursed as far as I am concerned. I am trying to stay hands off from any article editing or discussions, and just directing admins to problem pages without getting involved, but even that is being used against me. I am not intereste in being involved in that article or any article both of you are involved in. Sorry, this is between you and Occult Zone, I don't want any involvement at all. Zhanzhao (talk) 13:00, 29 March 2015 (UTC)
Hmm, okay well that was pointless then. How do we proceed from here?Bargolus (talk) 13:03, 29 March 2015 (UTC)
You don't. You drop the whole thing.--Bbb23 (talk) 13:07, 29 March 2015 (UTC)
@Bbb23: It's correct. Removing this whole thread would be the right thing to do. Check User talk:Ponyo#49.244.239.31 for more information. 49.244 is a heavily abused IP extension. OccultZone (Talk • Contributions • Log) 13:14, 29 March 2015 (UTC)
The discussion above is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

Not sure if this would constitute sockpuppetry

There's a user with a username and pattern of behaviour very similar to a retired user. This retired user had a long history of conflict regarding certain articles, including some (since lapsed) bans, and had rather publicly announced their retirement from Wikipedia. As a note, I do not believe this user to be using both accounts at the same time. However I am concerned that the user has created a new account so that their history of conflict on this topic will not be considered in light of their current edits. As this user's edits are becoming more problematic this historical context may be relevant, and soon, but after reading the WP:SOCK page I honestly don't know if they've actually contravened Wikipedia policy on sockpuppetry. Before casting aspersions or requesting investigations (you'll note I am NOT identifying either account at this time) I thought it'd be best to ask. Simonm223 (talk) 14:32, 31 March 2015 (UTC)

If you believe the purpose of the alternate account is to make it more difficult to relate current edits to earlier problematic ones, yes, that's socking.—Kww(talk) 14:35, 31 March 2015 (UTC)
Thank you. I will proceed accordingly then. Simonm223 (talk) 15:06, 31 March 2015 (UTC)

When is checkuser justified?

Other than as part of an overt SPI (i.e. listed at WP:SPI), when is CU justified? As is frequently stated, CU won't be carried out on IPs (lest it reveal the anonymity of a socking user account). Yet it is hardly rare for anon IPs to instead be blocked as "socks" - in the absence of any publicly visible evidence for this, or even an indication of who the claimed sockmaster is.

If it's unacceptable to use CU on an anon IP as part of some overt process, subject to appropriate community scrutiny, why do we instead permit it undercover, out of sight? Andy Dingley (talk) 01:11, 8 April 2015 (UTC)

Just a quick comment, the reason we don't say we run a check on IPs is because anything we say afterwards about the results can be interpreted as a comment on whether an account and IP are related (which would be very likely a privacy policy violation). So we make no comment on it. The other point is even though the CU said no comment or declined a request to check it doesn't necessarily mean that they didn't check and deal with it separately. Can you give me an example of what you mean with the last sentence in the second paragraph, I might be able to shed some light. Callanecc (talk • contribs • logs) 01:26, 8 April 2015 (UTC)
It's not that policy prohibits CheckUser from running checks on IPs, it is that (except in extreme circumstances), it prohibits publicly revealing user's IP address(es). If we couldn't run checks on IPs, the CheckUser extension would be almost useless. Tiptoety talk 02:24, 8 April 2015 (UTC)
What I'm concerned about is when an admin or admin/CU sees comments by an IP that they, or a friend, take exception to (often something borderline uncivil on a talk: page) - and these are then blanked and the IP blocked. Yet the comment for this is "Block sock of banned user" with no visible evidence to support this. Quite rightly we have strong measures against banned users and their socking. Yet the obvious suspicion is that this insta-block was actually being given for a content-related reason (a block that would never stick against an established editor), hiding behind this inarguable reason of "banned user". Andy Dingley (talk) 02:27, 8 April 2015 (UTC)
That sounds like an issue mostly unrelated to CheckUser, unless someone is asking for a check to be ran on the IP to verify whether or not it is in fact a sock of a banned user. Such requests are dealt with on a case by case basis. If it is a CheckUser that is doing the blocking, they should probably use {{Checkuserblock}} and not a block summary of "banned user" if the block is based solely on private CheckUser evidence. I am not saying this is required but it is highly recommend and is essentially standard practice. Tiptoety talk 02:36, 8 April 2015 (UTC)
If this is "block evasion" (banned or not) and it is confirmed by checkuser, then shouldn't the sockmaster at least be visibly named?
The situation at present is that a politically sensitive page can have all manner of argument across its talk: page, perhaps alleging "A cabal of admins are in league with the subject of this BLP to whitewash unfavourable content." An IP then appears and posts the contentious content, or else a link to RS making the same claim – and that IP is then reverted and blocked, with the comment "rv block evading sock". As an uninvolved editor I can see no evidence that this is a block evasion, or a banned editor, yet that's such a convenient excuse to stonewall any questioning of that action. If I was to question it, then I can be accused of supporting this blocked / banned editor (whose identity is still a secret) and blocked myself. Worst of all, this hypothetical "cabal of biased admins" now seems to have carried out precisely the sort of blocking of any dissent that one would expect from such a cabal!
We not only have to issue such blocks correctly, we have to do so in a manner that is open to scrutiny and can be seen to be acting in a correct manner. Andy Dingley (talk) 02:58, 8 April 2015 (UTC)
Once again: that depends. while I'm in agreement that visibly naming the sockmaster is preferable, it is simply a violation of the privacy policy and CheckUser policy. Specifically, the section titled "Release: Policy on Release of Data". Essentially, we cannot publicly link an IP (as it is sensitive private information) to a named account except under the exceptions listed at the CheckUser policy. The example you provided about does not fit any of the release exceptions. As for the other issues you speak of, it seems best to address your concerns with the AUSC or email the functionaries mailing list. Tiptoety talk 03:16, 8 April 2015 (UTC)
Obviously Checkusers have access to private information of GF users and should not distribute this. However I see a strong distinction here between the innocent being excluded and the then-confirmed sockmaster. The information that is already very visibly connected, even before confirmation, when an overt SPI is filed.
If a sock is confirmed, then I see no reason why we cannot then publicly connect the socks – just as we would have done at SPI. This is permissible by policy at meta:CheckUser policy#Release: Policy on Release of Data
3. When necessary for investigation of abuse complaints,
6. Where it is reasonably necessary to protect the rights, property or safety of the Wikimedia Foundation, its users or the public
If we don't do this, the problem is that it gives admins an invisible and unquestionable blockhammer to squish any content they disagree with. This is much worse than preserving the absolute secrecy of confirmed sockmasters. It would be naive to think that, "honest admins wouldn't do that". Andy Dingley (talk) 09:57, 8 April 2015 (UTC)
I've always interpreted "investigation of abuse complaints" as being more of an investigation into an actual abuse complaint with an internet service provider. As for the second bullet, I guess we could argue that we are attempting to protect the user's rights by releasing private data about them in an effort to protect them from false accusations. I've never really seen that exception used that way, but it might fly. Lastly, CheckUser's rarely publicly link an IP to a named account in an SPI. We often publicly connect the socks, just not the IPs. With that said, I think a check under the circumstances you have provided would likely be approved, it just might not be done publicly. For example, after discussion on the functionaries thread about this I would see no reason that a CheckUser couldn't release the CheckUser data to the entire functionaries team. This would allow enough eyes to be on the matter to ensure that no abuse is taking place on the part of the blocking administrator while still ensuring that a limited, presumably trusted, audience sees the private data. Tiptoety talk 02:52, 9 April 2015 (UTC)
I'd always seen "protection" in this sense as extending to the general GF community of editors and readers, protecting them from the disruption of socking.
In this case though, the clear group needing protection would those conveniently accused, but innocent, of socking. At present, any biased admin can use the claim of "OMG Communists Sock!" to blank anything they don't like and this is effectively unchallengeable. If sock claims had to be backed up with, at the very least, the claimed identity of the sockmaster, it would be harder to make false claims stick. Andy Dingley (talk) 09:00, 9 April 2015 (UTC)
Two things: First, if you're referring to some of my recent blocks, and judging by what I read above, I think you are, the sock master is DavidPatrick70/SkepticAnonymous. I'm not revealing anything here that they haven't already made clear themselves. Second, just because a CU makes a socking-related block, it doesn't necessarily mean that they used private data to make the connection. In this case, the behavior, ISP, and location makes it obvious to those of us who have dealt with this person in the past. ​—DoRD (talk)​ 11:43, 9 April 2015 (UTC)
Thanks for replying. So why not annotate as to who the sockmaster is? Andy Dingley (talk) 12:00, 9 April 2015 (UTC)
In many cases, my reasoning is WP:DENY, but that's not completely applicable here, and it's rarely a good idea to tag IP user pages, so in this case, it really comes down to the fact that nobody asked me with a little bit of DENY thrown in the mix. ​—DoRD (talk)​ 12:43, 9 April 2015 (UTC)

SPI Guidelines

Hi, all. I was looking at an old SPI where the filing editor was asked for a "code" which I guess were used at some point. It led me to Wikipedia:Sockpuppet investigations/SPI/CheckUser criteria which seemed quite useful but I noticed it hasn't been edited in a few years. I was wondering if these are still the guidelines for whether a CU was run and the advice was still valid. I know that policies and practices evolve over time so I am not sure if it is still accurate. Thanks for any response you can provide. Liz Read! Talk! 16:23, 12 April 2015 (UTC)

Case opened using Twinkle does not show up on main SPI page

I opened Wikipedia:Sockpuppet investigations/\\'arrior 786 using Twinkle instead of manually and it did not show up on the main page. Is this normal? If not would a clerk please correct whatever mistake I made? Thank you for the help. Jbh (talk) 16:48, 13 April 2015 (UTC)

Jbh, no mistakes on your part. I purged the main page and it appeared. --NeilN talk to me 16:53, 13 April 2015 (UTC)
Ahh... thank you for checking it out. Jbh (talk) 16:56, 13 April 2015 (UTC)
@Jbhunley: Main SPI page is updated by a bot every 10 minutes. You have to wait for (at most) 10 minutes before newly opened case appears. Vanjagenije (talk) 18:01, 13 April 2015 (UTC)

CU needs spelling-out

In the chart, the abbreviation "CU" should be spelled out. It is defined nowhere on the page and is very confusing. BeenAroundAWhile (talk) 03:02, 22 April 2015 (UTC)

MEAT

i reviewed the archives of this board, and my understanding is that if one has concerns about a set of editors who may be socks but are likely meat (admission of shared IP) - SPI is still the place to bring that, right? just confirming. thx Jytdog (talk) 16:17, 24 April 2015 (UTC)

Possibly, though SPI is really for confirming that two accounts are the same person literally, not just a bunch of people coordinating their actions. It should be noted that the very existence of WP:MEAT as a concept is controversial; there's no rule that says that friends cannot both edit the same areas of interest. Think of WP:MEAT as more of a subset of WP:GAME violations than outright sockpuppet violations. The only relevant information from WP:MEAT to SPI is that two accounts which pass WP:DUCK or otherwise are indistinguishable from each other (that is, if a reasonable person would conclude that two accounts were run by the same person), then we treat them as such, even if reality were otherwise. Where we know that two accounts are run by two different people, there may be other sanctions available for coordinated disruption, but it isn't an SPI issue. Just remember, the only part of WP:MEAT that applies here is that accounts which are indistinguishable from each other behaviorally are treated as the same, without regards to whether or not they are really run by one person or two. To wit, "for the purpose of dispute resolution when there is uncertainty whether a party is one user with sockpuppets or several users with similar editing habits they may be treated as one user with sockpuppets." (bold mine). If we're certain it is two different people, or reasonably sure, we needn't bring it up here. --Jayron32 16:33, 24 April 2015 (UTC)
that is super helpful, thanks. i have participated in a case that is just sitting stale, where the sockmaster says that (at least some of) the accounts are a bunch of people sharing an IP... but their behavior is indistinguishable ... and i had a different thing like that earlier this week with just two accounts (that i think is resolved so i am not bringing it here). The case that is puzzling me is Wikipedia:Sockpuppet_investigations/BriceStratford, fwiw, where i presented a ton of behavior, including timing, sharing of fake (!) sources, etc. Thanks again! Jytdog (talk) 16:43, 24 April 2015 (UTC)
How about the shared account, is it a possibility? Can a bunch of different users share a sockpuppet account; I mean, has there been any incidence in the past? What do the checkusers do, when they come accross an account whose IP history is quite interesting? Can there be other arguments other than IP history, which normal users do not have access to? Logos (talk) 13:58, 25 April 2015 (UTC)

Question for CUs, admins and clerks

Hi, all,
There is a question at Wikipedia:Administrators' noticeboard/Incidents#Other IP User that I hope folks from SPI can address because I saw the same question come up recently on another talk page. The question is whether it is okay for nonadmin editors to tag user pages of folks believed to have socked or to be socks. The last time I saw this discussed, the answer was "No" because admins have different opinions about blanking and tagging sock user pages (some do it, some don't). It also might be done prematurely by well-intentioned editors and have to later be undone. But I come to this talk page to ask those of you most involved in investigations to go to ANI and give the editor a more authoritative answer than the shot-in-the-dark opinion I offered. Thanks! Liz Read! Talk! 19:29, 26 April 2015 (UTC)

Unable to archive

I'm unable to archive Wikipedia:Sockpuppet investigations/Sardanaphalus with the SPI script. The error message states that it looks to have already been archived. Anyone else have this problem? If not, please archive it. Cheers,
 — Berean Hunter (talk) 16:04, 27 April 2015 (UTC)

@Berean Hunter: I fixed it and archived it. The problems were created with the first archive, which for some reason corrupted the archive after it was done. Then, another administrator tried to fix it but introduced invisible errors at the same time. I've fixed those errors on both the archive page and the case page, and the archive then worked.--Bbb23 (talk) 16:26, 27 April 2015 (UTC)
Thank you Bbb23. That was a new one on me.
 — Berean Hunter (talk) 16:42, 27 April 2015 (UTC)
Can you do it manually? (Cut and paste the report from that page to the archive) Zeke Essiestudy (talk) 16:05, 27 April 2015 (UTC)
I was trying to understand if I had a problem or if something had broken. Looks like it's fixed now.
 — Berean Hunter (talk) 16:42, 27 April 2015 (UTC)

User compare report not created

Is there some reason why http://tools.wmflabs.org/betacommand-dev/UserCompare/BiH.html is 404, when the report was filed 20+ hours ago? — Brianhe (talk) 01:45, 10 May 2015 (UTC)

Please see the above thread for using the interaction tool.
 — Berean Hunter (talk) 01:59, 10 May 2015 (UTC)
That's a huge bummer. A two-way comparison, manually invoked tool doesn't really fill in for the awesome user compare report. — Brianhe (talk) 02:33, 10 May 2015 (UTC)

Admin help

I unfortunately opened up a SPI when one already existed and made a mess of the title. Could one of the admins/ clerks redirect this Wikipedia:Sockpuppet investigations/ DMRRT to Wikipedia:Sockpuppet investigations/DMRRT. Thanks. Cowlibob (talk) 16:04, 14 May 2015 (UTC)

@Cowlibob:  Done. Vanjagenije (talk) 16:23, 14 May 2015 (UTC)

Bot broken?

Wikipedia:Sockpuppet investigations/Allenroyboy needs adding to the main page. Dougweller (talk) 20:54, 14 May 2015 (UTC)

Nothing wrong with the bot - the case was missing some important bits that the bot needs to see. Binksternet apparently had some difficulties with filing the case, but it should show up in the list shortly. ​—DoRD (talk)​ 21:05, 14 May 2015 (UTC)
The automatic system did not create the proper format. This has happened to me before, but not every time, so I cannot identify what's wrong. Binksternet (talk) 21:20, 14 May 2015 (UTC)
Yes, the template it uses is complex, and if you get one essential character or parameter out of place, the whole thing fails miserably. I typically suggest to set up the basics (sockmaster, suspected sockpuppets) at first and then go back and add evidence, diffs, etc. later. ​—DoRD (talk)​ 21:36, 14 May 2015 (UTC)
Good idea! Binksternet (talk) 21:49, 14 May 2015 (UTC)
Thanks. Dougweller (talk) 09:50, 15 May 2015 (UTC)

Editor interaction tool

The editor interaction tool listed on the case pages here fails to return interaction in many cases. There used to be other editor overlap tools, but they are down. Is there another tool? Or am I using the tool incorrectly? If someone could email me about this, I'd be grateful to avoid discussing the misses publicly. SandyGeorgia (Talk) 13:29, 6 May 2015 (UTC)

How about this tool? Does it also miss interactions?
 — Berean Hunter (talk) 15:32, 6 May 2015 (UTC)
Berean Hunter, yes that one does seem to work. Curious that the other one doesn't. Anyway, I just saw this, and already submitted a (way too messy) SPI, that could have been much simpler if I had simply linked to a tool :) Sorry about the needless verbosity there. Bst, SandyGeorgia (Talk) 21:46, 9 May 2015 (UTC)
@SandyGeorgia: As a backup there is also this Editor Interaction Analyzer. The maintainer has just retired so I don't know how long it may be around. It would be interesting to see if it misses some of the interactions or not; reliability is important for this kind of tool. I'm currently looking through our tools and assessing some of them.
 — Berean Hunter (talk) 15:28, 23 May 2015 (UTC)

WP:SUL issues

Don't know if this has come up before or how widespread of an issue it is, but yesterday I was reviewing CSD noms and came across JaxPack12. For whatever unknowable reason they tagged themselves as a sock. The page was nominated for deletion as they user they tagged themselves a sock of didn't appear to exist. However, there was a category for their socks and it turned out the puppeteer had been renamed UnknownMan~enwiki as part of SUL finalization.

So, I left a note at the relevant cat pages, but I stopped short of moving them as this was a relatively minor puppeteer and (other than the weird tagging yesterday, which may also be worth looking into) didn't appear to have been active lately. I thought I'd bring this here for those more heavily involved in SPI to discuss if need be. Beeblebrox (talk) 19:13, 25 May 2015 (UTC)

I just saw this, Beeblebrox, and I'll look into it when I get a chance (next few days?). ​—DoRD (talk)​ 16:09, 30 May 2015 (UTC)
@Beeblebrox: Alright, after looking at the cats and accounts, I decided to go ahead and move and update the cats and fix the tags where appropriate. I didn't try to figure out whether JaxPack12 is them or not, though. I'd hate to try to do this for a prolific sockpuppeteer, so hopefully this is a rare occurrence. ​—DoRD (talk)​ 17:25, 2 June 2015 (UTC)

AnnalesSchool is back

Please see the edits of user 38.86.48.38 and 90.0.27.159. — Preceding unsigned comment added by 2600:1015:B12D:9EB2:503B:56BA:FB8E:B906 (talk) 15:43, 30 May 2015 (UTC)

Backlog

It's some years since I edited Wikipedia regularly, and I remember that on the few occasions that I filed sockpuppet reports there would be some kind of response, and often action such as blocking, within hours, but in looking at the backlog here I see that it could well be weeks or even months before the report that I filed today is even looked at, by which time the sockpuppets will have subverted the result of the AfD discussion where I spotted them and possibly have spread far more spam. I know that, pretty well by definition, this isn't the fault of anyone reading this but, if of anyone, of those who are not reading this, but could anyone suggest a way of speeding up this process or a location where it would be helpful to start a discussion about the backlog? 82.9.185.151 (talk) 21:42, 1 June 2015 (UTC)

@82.9.185.151: Well, it depends on the case. Clear-cut cases of obvious sockpuppetry are usually dealt within 24 hours of filling the report. I think the only way to speed up the process is to have more people participating. Vanjagenije (talk) 08:55, 2 June 2015 (UTC)
My fears were not realised, as User:Bbb23 dealt with the case in question, Wikipedia:Sockpuppet investigations/7yPDx4, very promptly. I was rather scared by the fact that there were other cases listed up to five weeks old that didn't seem to have made any progress, but will now stop worrying about them and let those who have the requisite knowledge and permissions deal with them. I understand fully that more participation is the most important thing to address, but that seems to be a problem across the board now. I have my thoughts about what is getting in the way of more participation, whether by checkusers, administrators or "mere" editors, but those thoughts don't belong here. 82.9.185.151 (talk) 21:00, 3 June 2015 (UTC)
I think most of us would agree that it's people who can investigate (sometimes needing to see deleted revisions) and those who can take action (needing a block, protect and/or delete button). Callanecc (talk • contribs • logs) 06:49, 4 June 2015 (UTC)

Bot problem

@DoRD and DeltaQuad: I see the list was switched to DeltaQuad's one because of the bot malfunction, but this one also has some problems. For example, it shows the case Wikipedia:Sockpuppet investigations/Nopirosyadi (permalink) as closed, although it is actually open. The problem, I think is that the page contains old cases that are closed, but not yet archived. The bot need to be fixed so that it detects the latest status of the case.

DQ's bot lists a case according to each status tag it finds. In this instance, there are two closed tags and one open, so it can be found in both sections. ​—DoRD (talk)​ 12:15, 3 June 2015 (UTC)
Yes, I see now. Still, I think it's wrong. Vanjagenije (talk) 12:28, 3 June 2015 (UTC)
Retrieved from "https://en.wikipedia.org/w/index.php?title=Wikipedia_talk:Sockpuppet_investigations/Archive_15&oldid=1185030170"