Knowledge talk:Sockpuppet investigations/Archive 13

3747:- As one of the founders of SPI, this goes against everything SPI stands for. The idea was to create a streamlined process that both new and established users could navigate. The reason that the old RFCU had fewer cases lacking evidence was because there was separation between SSP (suspected sock puppets) and RFCU (requests for checkuser). This created a more clear distinction between those cases that require behavioral investigation and cases that have enough evidence to warrant a CheckUser. That said, it also created a lot more work for clerks moving cases from SSP to RFCU, and vice-versa (I was a clerk at both RFCU and SPI). I can say with certainty that the code letters were not the reason there were fewer cases lacking evidence at RFCU. Adding code letters just creates another layer of pointless bureaucracy and just another reason for people to stay clear of SPI. While I share Deskana's frustration with cases lacking evidence, I would also challenge clerks and CheckUsers to remember that not everyone is intimately involved in SPI like they are. I really don't see how it is that hard for a clerk or CheckUser to add 1801:

to use more than one account? It would probably be better to use the original anyway. Opening an SPI is not difficult, after learning how to link diffs there is no mystery. Reporting something on AN was also the only logical step for what I wanted to report. I'm new to wikipedia, but not to internet in general. I read the wiki guiding material on my own, really. If I was an old user, I wouldn't have opened the AN3 because my request was invalid after all. I thought as a new user I had the same rights as other users, the guidelines for new users sounded welcoming. But in no way do I have intention to disrupt, only to contribute. Sorry if I did something wrong. Like you, I also have interest on chess and classical music and if you need some work to be done in that area, I would be happy to help.

2658:: Well, well, well, my introduction to wikipedia editing has been quite the short and nasty ride. I realize I am one of the people named in the above notice. I would like to add that I have strong reason to believe that at least two of these aliases, fishface gurl and Bulgarian Chess Dude are the same person, and that they correspond to the person on chess.com who has gone by at least two aliases on chess.com, namely 'Indyfilmguy' and Umberto_Unity. Of course I have no way of verifying any of this 9well, I can verify that Umberto_Unity and Indyfilmguy are the same person, but I can't do the same verification on the wiki site), but let's just say I have strong reason to believe this, and if there's any way of verifying these people by their Ip addresses or whatever, do it. Thanks. 444:

the links to the investigation archive the evidence appeared to be non existent (other than a lame observation that the infamous sock puppeteer - like the accused editor - had a fondness for "clever" names). I might have assumed that the suspected editors shared IP's and that this would serve as the damning evidence, but in the same investigation archive someone claimed that the sock puppeteer "makes extensive use of proxies, therefore his IPs geolocate to dozens of countries" so it would appear that the investigation simply looks at the accused's edits and if it reminds them too closely of the sock puppeteer they are summarily banned. Surely the indefinite blocking decisions have more credibility than that?

2507:, but not sure where to begin (as there are possibly more than one sockpuppeteer). A lot of new accounts are involved in this AFD that have no or extremely few edits not related to the dispute (including the nominator). It's probable that some are people that have been canvassed to participate on online forums, but at least some the accounts seems to be used by the same person (or possibly two, with sockpuppeting on both sides of the dispute). I get the feeling that in some edits there is a "good hand"/"bad hand" tactic (which mean that it is difficult to see which sock belongs to whom). Some of the new accounts are: 3703:- You have to describe the abusive behavior anyway, or you won't even get a block. The case will be summarily closed if no evidence of abuse is presented. Checkuser is just a tool used when there's evidence of abuse of multiple accounts, but not enough evidence to block the accounts outright. It is also used to find the sockpuppets that either haven't yet edited or have only edited innocuously to build up a history, and it is useful for placing IP blocks when major disruption is occurring. Re-adding the code letters will just increase the bureaucracy of this already overly-bureaucratic process. 1727:

researches. But just now I am learning how it works on the inside. As Knowledge guidelines tell, bad or biased editing attracts new editors, and this is part of why I have signed up. Do I not have the right to be a user and denounce issues I can clearly see? If others have denounced the same issue in the past, I think it only proves that the issue is the same and bothering people in the same way. If 2 people complain about something, maybe it proves that some issue is real, rather than the 2 persons complaining are the same, don't you agree?

118:

like a maths test: show your working. It became clear what was happening - cases were being filed without the evidence being spelled out, and people's working was being done off-stage. Not ideal. Many changes were made around the SPI area which put the emphasis on the person filing the case to show their working, and use diffs to support it; not least on the basis that it is unacceptable that the person most familiar with a situation leaves it up to a) those least familiar with a situation b) to retrieve their argument for them.

1275:

know if there is something which could be improved with that kind of report. While the investigation awaits, it's impossible to edit the article or the talk page, as the user forcefully reverts anything by any other editor and behaves on the talk page as the omnipotent authority of the article. It seems this user has been doing the same thing for 7 years and is likely to keep returning. I wish there was a way to report his socks which wouldn't leave the article in his control for so many days at each of his returns. Thank you.

3814:- I have been putting off commenting here, but since it is still open... I think that the code letters were needlessly bureaucratic, and as a much less experienced editor back when I went to file a CU request under that system, I found it somewhat confusing. That being said, I completely agree with Deskana in that we currently end up with far too many cases with entirely inadequate evidence. Rather than a return of the code letters, though, I would prefer a technical solution in the form of a case-filing wizard such as 1752:

their decision and move on. Our perception is biased by 'off-wiki' information. It's true that if they knew all that stuff the decision would have been different. But both of us need to build up more credibility within Knowledge by editing more broadly - I think it's a very fair-minded and kind community, but they get lots of SPA 'insurgencies' they have to protect Knowledge from, and in many ways that is just what we look like. Anyways, this is my view, hopefully no offense taken...Regards

31: 1430: 3219:

see how it was broken in the first place. We are trying to solve a problem by changing something unrelated to the problem. We have clerks for a reason, and it should cover this. If you really wanted, instead of an error you could put a colored notice on the end labeling it as a master, but I think the error is really counter-productive especially since checkusers have been using that template for a long time now. I would like to get others opinions. --

3818:. The wizard should explicitly ask the filing party to categorize the type of abuse they are reporting and insist on complete evidence before the case can be filed. I'm not a Javascript programmer, but I can't imagine that it would be too difficult to implement something like this. Then we could do away with the current error-prone template system, or at least relegate it to the few instances where users don't have or don't want to use Javascript. — 1313:

completely made by the sockmaster) is a mess, full of unsupported claims presented as fact, which seems to be based on religious hate by the sockmaster. They tried to place tags of "conflict of interest" to inform readers, but as I said, I never heard of an edit which wasn't reverted by Januarythe18th. Why would I feel any interest in taking my time to make any edit knowing that it will be reverted even though

625: 5464:

get into the issue of publicly revealing the IP. That's not a path that the average editor is going to know how to use. There's nothing at all wrong with having a clerk approve a case that has strong evidence supporting it, having a CU look into it, and then not publicly commenting on the result. Please don't represent that as somehow being a violation of policy, because it isn't. What it

4987: 281: 4169:. A CU declined it, no big deal, happens all the time, however, once again, Reaper removed the report saying that it amounted to an attack on two editors, and was baseless. While I won't go into specifics, I will state I'm not the only person that questioned if that editor was actually a different editor that is currently indef banned from creating anything to do with NHRP items. 5229: 3625:, but a rather mild oppose, and I'm open to discussion. Filing an SPI can be rather complicated, especially for inexperienced users, and I'm disinclined to make it any more complicated. (I have also gotten a feeling when I have initiated requests myself that there is a bit of a culture here of being a little too by-the-book, in the sense of needing to have 764:. If he has evidence, he should present it in a neat orderly manner that shows the alleged sockpuppetry. If he does not have evidence, he should refrain from baseless accusations of deceitful behavior. If he continues despite a request to present the evidence or stop the accusations, you should probably take him to ANI for unsubstantiated insinuations. 1829:. Now that the user has been confirmed by CheckUser to be using multiple accounts in violation of policy, I see evidence that at least one additional account and an IP is also involved. The SPI investigation is checked and accounts have been blocked, but the case is not closed. Should I add the additional accounts to the open case or start a new one? 3686:(but open to more discussion). I realise that filing an SPI is already a complex process (I've done plenty of them myself), and understand the arguments for such a system of short cuts. However, having filers continue to provide their own reasons for a CU request would help ensure that the cases have been well researched and thought out. 2874:, where we have probably more than 100 socks, with SPIs going back three years, and a new one every two weeks. If, in such cases, the CUs would perform a check every week or so, until no new socks appear for e.g. three months running, then it would probably save some time at our side and be a small deterrent for the socker. Thoughts? 901:; it's an impenetrable wall of text, isn't it? Personally, I have never came across a Knowledge process page that contains so many words in its instructions section. It's not even laid out especially nicely, or phrased very elegantly (the latter probably due to the fact it's been "written by committee" over the years). 2704:

Indyfilmguy. \I cannot guarantee that they coorespond to three aliases of a sockpuppet on wikipedia, but I can certainly confirm that they are three aliases of one person on chess.com, all with the same axe to grind, and with the same linguistic idiosyncracies. Alright, enough sleuthing for one day. Over and out.

4731:, indicating in his edit summary that he and JHobson2 were one and the same and citing the Eagleton review for the addition, claiming that he "found" a source for his previous comment. Since it had been months, I double-checked that review, and again, it contains nothing of what JHobson3 indicates it did. 4393:

has produced a mixture of obvious socks and more subtle sneaky socks which take time to build up experience &c. I've noticed another sleeper sock being developed, but at this early stage the evidence is quite subtle (the account hasn't yet joined in the usual controversies) and I'm sure many folk

3793:

The views I have mirror those of Tryptofish and Tiptoety. There's no critical issue that needs to be resolved right away. The system that is there right now, works. While the intentions of Shirik are good, I think if one wanted to simplify the process here (as Tim's spihelper script does for regulars

3218:

As I have come to just notice (from being inactive and things), I note that the checkuser template has changed. Now instead of providing the results that are needed, it blocks the name of the master unless it has a certain parameter. I personally don't see how this is going to benefit us, and I don't

1800:

Thank you for your concern about me being a sock, TC. I was following the process on the BKWSU article for some weeks before making my account. I read the history and realized the similarity between previous accounts and Jan18. If I had a previous account, why would I make a new one? Why would I want

1680:

I was also surprised that the evidence presented was considered insufficient. I would really like more eyes on this as I thought it was WP:DUCK. The behavior of Januarythe18th is literally identical to Lucyintheskywithdada, and I presented a long list of diffs so that there couldn't be any doubt that

443:

Is there a way for non admin editors to have some assurance of the strength of the evidence used to block a suspected sockpuppet? I've been relatively blissfully unaware of the process until I happened to notice an editors comments deleted as a sockpuppet in a controversial article. When I followed

5518:

Again, as I have said, the problem isn't running the CU; the problem is holding up the SPI microphone to the CU and asking "Does X user use this IP?" The CU is forced to either lie about running the check (which would not stand up to the Ombudsman Commission) or say yes or no. Saying "I took care of

1676:

The person behind all these accounts is well known off-Wiki and I can provide off-Wiki evidence proving that Januarythe18th is the same person as Lucy and the defunct 195...244 account. I realise I can't just post this stuff on Wiki so I would be grateful to know how to proceed with this. Do I email

1646:

The conversation took place between individual CheckUsers in passing while discussing the case (as is standard practice with many cases). That said, I would not consider these conversations binding or treat them as consensus amongst the entire SPI/CU team. As for by whom, I can't speak to that other

1614:

We don't know that all those accounts are even paid by the Morning277 group. For all we know, all these slow reposts by random unrelated apparent meatpuppets are actually the clients who paid for the text. For all we know, they are now just writing up wikitext and emailing it to their clients to put

1533:

Hi Rybec. Here is the problem, SPI does not have the staffing, or the ability to adequately deal with a case of this size and nature. The majority of the CheckUsers, administrators and clerks who frequent SPI are not familiar enough with the specifics of the case to feel comfortable taking action on

1312:

Thank you for your advice, Rybec. I fully agree, but in this specific case, for some weeks I observed that Januarythe18th has a very aggressive editwarring behavior, insistently reverting edits that came from consensus on the talk page. All editors agree on the talk page, that the article (which was

1120:

If a user has different accounts on Commons and en.Knowledge, and is using these accounts for dishonest reasons such as changing filenames and data to make photos on Knowledge articles xhe edits to appear as if xhe is the creator of the image, what is the CheckUser (or other) process, if

142:

I've gone and provided the diffs to justify the CU on several occasions myself when it is simple and obvious only because that is the fastest and easiest way to achieve the desired end result. In those cases, it doesn't bother me to help them. Part of the problem is that many people filing the the

117:

In Winter 2012, CheckUsers became concerned at the number of courses where checks had been run, but justifications for checks, i.e., arguments supported with diffs and log entries hadn't really been spelled out. That's not to say they weren't necessarily justified, but SPI is perhaps best thought of

5463:

of those checks. Putting the filter at the clerk level is not mandated by policy, and only serves to make it difficult for the typical user to get a check run when it may actually be a good idea. When I need a checkuser run on an IP, I build my evidence and e-mail a checkuser directly, so as to not

3647:

There is so much procedure involved in filing a formal request, that I have never done so, but work with other aspects of the problem. Increasing it is the worst possible direction. We need to encourage people to file requests, not the opposite. Filling out forms is a RW procedure, designed to cope

3494:

develop into a problem) took six weeks to resolve, which is already halfway to stale. Part of the reason for this is the tendency for a mishmash of "oldest first"/"most serious first"/"complexity sorting" wrt to prioritizing. Therefore, by being able to code a case (as Robert mentions above), the

2814:

Response: NativeForeigner, I received a message via the wiki messaging service from 'fishface gurl' confirming his identity as the sockpuppet I identified above. That message was also consistent with disruptive behaviour that he used on chess.com. I do not wish to engage in bickering on here, but I

2144:

I'm a relatively new trainee clerk at SPI. As for my tackling open cases, all I can say is it's a ton of work. Although I was often involved as an administrator in SPI cases, clerking is much tougher and I'm still learning. I just "took on" one of the open cases, and I've spent over an hour working

1298:

and edit (the history shows no edit from your account). You needn't wait for the SPI to finish. If you can provide "verifiable information based on reliable third party sources" as requested, your changes will have a better chance of remaining. I see seven comments from you on the talk page; you're

1274:

Hi, the investigation case on Lucyintheskywithdada has been waiting for about 10 days. I wonder if maybe it's very long, I just wanted to add all the evidence possible not to leave any doubt that the behavior is almost identical and we are dealing with the same person, as per WP:Duck. Please let me

111:

I have been seeing clerks/patrolling admins write that CheckUsers cannot connect, as in, perform actions which compare/associate an account with its IP address(es) due to the privacy policy. This is incorrect. Of course CheckUsers can retrieve the IPs used by an account, or the accounts on an IP or

4761:

Doesn't look like a legit alternate account to me. No declaration of an alternate account seems to be there. However, since the second account has not edited concurrently with the previous account, the question of socking is much less clear. Sure, it's the same user. But one can abandon an account

4172:

Reaper is clearly going beyond the bounds of what a clerk should do. In example 1, he's sheltering a suspected sock-puppeteer based on no evidence whatsoever, when a request to CU had a fairly in-depth case. In example 2, he's deleting a case where the indivduals identity was questioned by more

3773:

The more I think about this, the more it doesn't sit well with me. If people have to categorize socking especially on the old system, it sometimes misses some of the stuff that is covered in SPI. Futhermore, as better said by RHaworth, they should be able to spill it out consistently. I also agree

3325:

There is a consensus against restoring the requirement of codeletters for checkuser requests. Both supporters and opposers were concerned about the increase in bureaucracy and further work required to submit SPI request, especially since the abuse of accounts needs to be explained and shown in the

1684:

The admin who closed the case said Januarythe18th could be a follower/fan of the subject of the article, when it's completely opposite. He is a person with inflammatory religious hate AGAINST the Brahma Kumaris movement, and well known off-wiki. He is a person daily dedicated on heavy criticism of

1578:

About the statement that there isn't enough staffing to keep up with this: recently about three short reports had been made daily. Most of them were being closed by Rschen7754, at the same pace. When Dennis Brown and WilliamH were available, a much larger volume of reports was being handled. There

1344:

Let's say I start socking disruptively, and someone notices. Why should my admin rights exempt me from a normal SPI? Shouldn't I be treated like anyone else? The sockmaster's user rights don't have any effect on the need, or lack thereof, for private information that may not be posted on-wiki.

935:

so aptly described me, the "grumpy old grandfather of SPI"), I very much approve of this. The new instructions are concise, and contain all necessary information for filing the case, so it's a fantastic improvement over the old header. People that like to have comprehensive documentation available

5577:

Accounts that engage in problematic conduct to the point that requests for administrative action or blocking are raised and considered valid for CheckUser usage, and where CheckUser then determines the user probably has engaged in such conduct, must expect the protection of the project is given a

5347:

As I repeat over and over, the issue of declining a checkuser for an IP is not simply "ooh, it's an IP". It's a case for a checkuser to decide based on whether the actions of the IP editor justify running a checkuser. The checkuser may then choose not to reveal much about his actions, but it is a

3629:

behavioral evidence spelled out in detail beyond what sensible editors would need – just saying.) I'm not really persuaded that there is a problem here that needs to be fixed. Is it really too burdensome for SPI clerks to ask users who post a request to provide more information, and to decline to

3392:

Several years ago, to file a request for checkuser, the filing editor had to select a "codeletter" which indicated what category of abuse (vote fraud, ongoing serious vandalism, ban evasion, etc.) was occurring along with the request. This was later abolished on the basis that it was confusing to

2703:

Thomas Hauser 41 is the same person too. I have just confirmed this on chess.com. Three peopole that I busted within 45 minutes on chess.com responded by...closing their accounts. It is one person. One of them was called Thomas_Hauser on chess.com, and the other two aliases were Umberto_Unity and

1572:

This seems like the most promising place to find "those with the proper knowledge, time, and interest" in investigating allegations of sock-puppetry. This is the official place for that. Someone's user page is not. Moreover, moving this investigation elsewhere would make it less visible. It would

1462:

I want to ask if two editors are from Iran and they are editing same Iran related Articles would they considered as sockpuppets.the checkuser would consider him as likely and blocking admin would easily find behavioural evidences as they are editing related articles.In short if two users are from

806:

As I have tried to explain to Mishae, I doubt a checkuser will take this case and I doubt they need to. What we have here is two accounts with relatively similar names, but I'm pretty sure that's down to nothing more than coincidence; Aspielman is meaningless, and is probably a name (A. Spielman)

276:

I've copy/attributed the archive and move/histmerged the current case page. I still need to go through and change all the sock tags, which will take a while to complete as there are a lot of them. I will also change the block on IranitGreenberg from 3 months as master to indef as sock. For all

1751:

GreyWinterOwl, if you have time to collaborate with improving page content, I will try and resurrect what was happening before the sock was launched. When I think about it, I would probably have made the same decision the admins have made here if I was in their shoes. I think it's best we accept

152:

which can be put in mainspace if the CUs and Clerks find it useful. I tend to think that helping them once or twice while pointing them to the essay to instruct them in the future is the best option, however, I am happy to comply with whatever the CUs clearly state the procedure should be.

3194:

are still open in the UTRS CU queue. I've been handling nearly all of the requests there and it would be helpful to have some fresh eyes to review and respond to them. I've always declined requests for IPBE to allow for proxy editing unless they meet the "exceptional circumstances" clause, but

911:

My proposal is to simply replace the current contents our lead section with everything in the sandbox. On the current SPI front page, everything before the table of open investigations would go, though most of it will still be present in the extended guide page linked to in the sandbox mockup.

5503:

If approving requests that have substantial evidence justifying a check would result in someone losing clerkship, there's something seriously wrong. Our processes shouldn't render an editor that uses IPs to sock with substantially more difficult to deal with than an editor that uses alternate

790:

Can someone be so kind and check users User:Aspielman (account creation June 10, 2013‎) and User:AspieWiki (account creation from February 26, 2013 to July 12, 2013)? Just a heads up, I don't accuse anyone of sockpuppetry but the account creation which is roughly couple of months a part looks

1672:

I was shocked and disappointed that the above SPI case was closed without a positive result. I don't just suspect that Januarythe18th is a sock of Lucy. I actually KNOW that he is a sock of Lucy, as do other editors that have to endure his aggressive anti-Brahma Kumaris taunts, intimidation,

1518:

Very few requests for check-user had been made, so the first concern seems superfluous. As for the second, the activity has involved the posting and re-posting of several hundred articles, from several hundred throwaway accounts, on behalf of banned editors. I feel that it qualifies as major

123:

It is entirely reasonable to expect Clerks and CheckUsers to have some measure of familiarity with well-known sockpuppeteers. However, I am seeing clerks increasingly substantiating the argument that the filer should have provided so that they can endorse a case for CU attention. While it is

3509:

Sounds good to me. I check SPI cases frequently and find them completely lacking any evidence for a check. I've tried telling people about this, but it's never changed anything. We've tried adding information on how to file a case, but it never changed anything. We then tried simplified the

1726:

Someguy1221, if you think I am using sockpuppets, please DO investigate that rigorously, but as rigorously as the Lucy case. I am really a new user to Knowledge, GreyWinterOwl is my first and only account ever made here. I do like Knowledge very much and it has helped many of my studies and

634:

Following the consultation phase, the committee will take into account the answers provided by the candidates to the questions and the comments offered by the community (both publicly and privately) along with all other relevant factors before making a final decision regarding appointments.

3794:

at the desk), then one could add multiple sequential input boxes for editors filing SPI reports rather than hand them over to an edit box with considerable instructions. But then again, that's veering off the point here. Let's not introduce stuff that's not solving any critical issue here.

3490:- As a longtime utilizer of SPI, I felt that, in the past, socks who were tagged as evading were dealt with much faster when it was immediately apparent to the case reader that that was what they were doing. Conversely, the last SPI I filed (while admittedly minor because this time it 5235:

To attempt to demystify when clerks should endorse or decline something, I've made a flowchart. This is a first draft, so any feedback would be helpful. Please note that this is not a substitute for thinking the request through carefully and evaluating it based on policies!

2345: 2309: 5602:

And, again, as I have said, you declining them deprives most editors of any method of having the check run. Your flowchart indicates that they should be declined without thought and without examination of the evidence. That's not justifiable by any interpretation of our

3432:

As proposer. I recognize that I could be noosed for proposing to bring back something that was once considered awful, but I think that we should evaluate how we could have improved the old system, rather than continuing to abolish it. Especially with the expanded use of

2273: 2237: 1360:

Because, if you were to be caught sockpuppeting, your admin rights would need to be revoked before you knew you were caught. Given that loss of the admin buttons would be almost guaranteed, along with a block, you might decide to cause mass disruption (block everybody,

2900:

All true but hardly relevant. In a case like Sju Hav, where new, active socks are discovered every two weeks or so, there is a clear "current problem", the last edit clearly is not more than 90 days ago, and SPIs will be filed anyway and a check needs to be done then.

618:

containing the nomination statements supplied by the candidates and their answers to a few standard questions. Community members may also pose additional questions and submit comments about the candidates on the individual nomination subpages or privately via email to

319:

Technoquat is vandalizing each of his sock account talk pages which did not have the talk page access yanked when they were blocked. I'll need some help cleaning this up, and please make sure that their talk and email are disabled when the socks are blocked. Thanks,

4800:

I would ask them to state it for clarity. They do not appear to be trying anything deceptive on the face of it and I would guess that they may have forgotten their password and created the new account. If they own up to the previous account then no harm done / no

3036:

I was thinking about this. We need a sort of "SSPI" or Special SPI for that. I don't think the standard format works well. Something a little more open ended might be necessary but I wasn't able to come up with a satisfactory conclusion for how it should be done.

2381: 4703:, he dismissed this, arguing that he didn't really do any "research" in order to make the edits. He refused repeatedly to even acknowledge any statements on my part regarding our policies, and their application, while simultaneously demanding that I respond to 494:

Hi all, could someone checkuser these two accounts for me? I suspect they are the same, as they post at ITN/WT:Main Page, and both seem pretty outraged regarding the Trayvon Martin verdict. The accounts are: User:Mission Twelve and User:Boomer Patrol. Thanks,

2003:, I've moved it from 108.82.148.123. I don't think I'm able to correct the actual case on here or if I'm even going about this correctly, so I thought I'd mention it. The two IP's I meant to report are on the current page which I've moved it to. Thanks! { 4717:(which was already cited elsewhere in the article for other material), in which JHobson2 says Eagleton voiced the same criticism, thereby "agreeing" with him. In fact, Eagleton never mentions The Courtier's Reply, reserving the criticism in question for 4177:. A clerk should never remove a case prior to CU because the suspected sock gives some excuse like "it's my brother"...etc.... yet this is exactly what he's done. Nor should he delete a case where the identity of a suspected sock is an indef editor 5348:

misreading of policy to claim that checkuser may not be run upon IP addresses based on valid suspicions. While the clerk may reasonably require a fairly high standard of evidence, it isn't a knee-jerk "decline all requests against IP addresses" issue.—

2869:

Perhaps this already happens, perhaps this is policy-forbidden somehow, but wouldn't it be in some cases easier (faster) if for some long-term and prolific sockmasters, a CU was done every week, without waiting for a SPI? I'm thinking about cases like

1561:

Thank you for commenting. I'm aware of the table that shows open SPI cases. Besides its presence in that table, forcing uninterested readers to scroll down, is there some way that the existence of this case was interfering with the resolution of other

5540:

This flowchart is purely about the handling of checkuser requests, not SPI reports in general, is that right? A report about a named account and one or more IP addresses seems like it could proceed on just the publicly visible evidence, without CU.

4311:); you should also be seeing these truths, and without groveling, lay amends before the aggrieved. Then, go forth in earnest, endeavoring to do better. My advice is to next time, simply ask your question, and—in asking; be open to the answer given!— 2815:

wish help in filing the SPI, as I don't know how to do so. I am willing to open up the message that 'fishface gurl' sent me to confirm his identity, and to confirm that his identity is one with some others. Please contact me via message. Thank you.

4154:

part of that report, third, the IP's in question showed as being in different parts of the county, even though they edited the same way and the same articles, so his reason was without merit at all !!. I did speak with him on his talk page

2209:

One of the reasons is that it's one of the few Knowledge tasks I find actually painful, and I suspect I'm far from alone in the admin corps in feeling that way. Good faith and reasonable cases are buried in a pile of caterwauling and unfounded

3437:, coordination with twinkle developers could result in the old codeletter system being as simple as using a dropdown, making it easier on users that need to report. The biggest benefit of this system in the past was that it required people to 5485:

That's great and all, but the point of the clerks is to weed out such frivolous requests that cannot be fulfilled such as what you describe. If any clerk did what you described on a regular basis, they would not remain a clerk for very long.

3058:

I am a fairly new user on Knowledge requesting assistance. I am trying to determine if I properly initiated a sockpuppet investigation. This involves a user with at least two IPs, 71.167.98.43 and 108.170.85.234. The page can be found here:

2941:

Exactly. A lot of the LTA guys use proxies, change IPs, work on ranges that are impossible to thoroughly check, etc. Some people we can just hard rangeblock, and that's that. Most of the recurring ones we need a duck to take good action on.

2915:

Specifically to the sju hav case he's moving around in terms of IPs. so although we're finding regular sockfarms a regular check would not be effective especially because I handed out a comprehensive and long term rangeblock on that case.

2339: 2303: 2028:

Don't worry about it. I've deleted the redirect that was left behind by the page move. Provided the current SPI report contains the correct information (which you've indicated it does), then there's nothing else to do other than that.

2889:

This isn't the NSA. As a practical matter, our Checkusers have historically been in high demand. I'd rather have them focus on current problems than scanning for stale issues. Moreover, checkuser won't work when the last edit was :

5137:

I'm here (WP:SPI) for the first time in over seven years / 3K+ edits, not cause I never suspect sockery (far from it), but 'cause I anticipated the process being onerous, where sockery is veiled with, of semi-, fanery ... and it is!

3720:. We not automatons. Although I spend a lot of time working on CSDs, I still get annoyed and have to think when someone talks about a "G10" - what on earth is a G10? Likewise with SPI requests. People should describe the reason in 147:

threshold, to be honest) and it is often easier and less bureaucratic to simply help them along. If the linkage isn't simple and obvious, I will ask for more info. I will note this is part of the of the reason I started this essay

2267: 3060: 1545:), that said paid editing is not a block-able offense on its own. I would suggest creating a user subpage where those with the proper knowledge, time, and interest can investigate allegations of socking without bogging down SPI. 667: 2434: 896:

On IRC, we were discussing the problem of SPIs being submitted with little or no evidence, particularly when checkuser data is requested at the SPI subpage. I speculated that the problem lies with the SPI front page. Please

588: 2186:

Well, you're wrong, so there. In fact, that's why I'm rapidly losing weight - can't afford to eat. Any moment now, just like the wicked witch of the west, I will have melted to nothing but a black, administrator cape and

5172: 5141:

Reporting suspected sockery in a FaoPFC subject will have many false-positives / indeterminates and may have a vindictive risk. However, this heightens such as an area where confidential reporting is unusually fruitful.

5019: 2375: 1056:

has been awaiting a CheckUser confirmation of sockpuppetry since 14 August (11 days ago). It took 14 days for an Admin to endorse the sockpuppetry request and to request a check user. Can someone please have a look.

2050:

I'll add that SPI isn't really the best venue for something like this case, as we aren't really set up to deal with simple vandalism and often have a backlog. Ongoing vandalism needs the more immediate attention of

1478:

I am not a CheckUser, but I think that's a little more precise than "they live in the same country". Also, neither editor should be editing "in favour of their country"; that would be a violation of our policy on a

1161:

To be honest, the best way would be to file requests at both here and the Commons page. In theory, you can ask at SPI to have the information forwarded to Commons, but in practice that has rarely worked out for me.

1396:

Okay, makes complete sense. It sounded to me as if admins somehow were officially immune from normal SPIs, i.e. some weird "admins are more equal than non-admins" thing, rather than a method of protecting against

4138: 3389:" (emphasis mine). For this reason, checkuser requests which suggest the presence of multiple accounts but do not indicate any pattern of abuse are generally denied until such abusive behavior can be identified. 2738:@Fishface gurl: nope. the above three, which includes you, Bulgarian Chess guy and Thomas Hauser, are anti-Lilov people. I am sure you, Bulgarian Chess guy, and thomas Hauser are one and the same. talkingfacts 3859:

I don't think it would work, because a description is required along with the evidence section, so it would either repetitive or vague. I'd imagine a lot of "see evidence" or "vandal" statements in that case.

3397:. A "support" consensus on this RFC would imply a need to re-evaluate the old codeletters, adjust them if necessary, and support clerk denial of checkuser requests that are not using established codeletters. -- 1688:

Please advise on how to proceed with this. I need a fair result. It can't be right that a banned user is free to hijack a topic to bait and taunt members of an organisation he is campaigning against like this.

660: 4946:

Okay, so it's pretty much a non-issue, as long as they don't try to pass off the accounts as belonging to different people, right? Okay, I just wanted to make sure. Thanks for your time, and Happy Holidays.

614: 598: 124:

commendable they don't wish to leave things to the imagination, my concern is that this behaviour of filling in the blanks will allow the previously mentioned bad habbits to creep back in. Thoughts welcome.

905: 180:

Perhaps a template is needed that precisely explains the issues with publicly connecting accounts to IP addresses? Maybe that would help to address the issue - I think a lot of it is the choice of words.

3522:

In general, yes. I'm not sure code letters are the most friendly thing though, maybe we could just use the categories themselves? "This request is for checking a banned user" instead of "Code letter A".

1776:

GreyWinterOwl made his first edit on 18 August this year, and less than a week later, without having been particularly active on Knowledge, he opened an SPI case. Likewise, he has already been active at

3256:

except in the error case, and is used only when filing a case. However, restricting improvements because "what we have is good enough" is pointless. I would prefer not to do things that a robot can do.

5397:

I understand that and have told other editors that, but I think the point is more "Is it ever appropriate to run a CU check that includes an IP editor" - or the other way around, is that prohibited.

1365:

users with large numbers of created articles, vandalize high-use templates and push the job queue into the millions, etc.) with the admin toolkit before you could be emergency-desysopped. Cheers!

5428:

Not at all true. Checkusers are free to lie about the results of running checkusers. I remember the questionnaire for getting the results specifically asking whether I was comfortable with that.—

1567:

I imagine that the SPI workers are not familiar with the specifics of most of the cases that are presented here. For this one, I wrote a long-term abuse page. Is the information there inadequate?

5584:

where I had to squabble with an SPI clerk over this very topic because of a case where the behaviour was too ambiguous to act. Your flowchart doesn't conform to policy, and should be corrected.—

5122: 3664:"We need to encourage people to file requests"... again, we should not be encouraging people to file CU requests that cannot be fulfilled under policy, in the hopes that they will be granted. -- 4956: 4755: 4476: 4004:

since its filing on 14th November. On the other hand, one of the suspected sock is quite active again since then. Is something missing in the case? Am i suppose to add anything more to it? §§

1956:

course. They have few edits so far, but I don't see any indication they're anything other than what they say they are. Unless you have evidence beyond their contributions, they aren't socks.

5032: 4662: 4865:

they claim the accounts are unrelated and/or edit the accounts concurrently. They could abandon Hobson3 and create Hobson4, and there's still no issue unless they go back to using Hobson3.

2767:

Learn some wiki markup and how to sign "~~~~" your contributions. I can tell that you are a chess.com sockpuppet, based on your paranoia and your fascist "citizen patrol" type attitude.

2379:, which you might have created, has been nominated for possible deletion, merging, or renaming. If you would like to participate in the discussion, you are invited to add your comments at 2343:, which you might have created, has been nominated for possible deletion, merging, or renaming. If you would like to participate in the discussion, you are invited to add your comments at 2307:, which you might have created, has been nominated for possible deletion, merging, or renaming. If you would like to participate in the discussion, you are invited to add your comments at 2271:, which you might have created, has been nominated for possible deletion, merging, or renaming. If you would like to participate in the discussion, you are invited to add your comments at 2235:, which you might have created, has been nominated for possible deletion, merging, or renaming. If you would like to participate in the discussion, you are invited to add your comments at 807:

rather than anything to do with aspies. The accounts were created 4-5 months apart, when we have 3,000 edits a day, and show absolutely no similarities in user behaviour or writing style.

5571:

Which means that a case that could have been conclusively made against an editor by checkuser may be rejected as ambiguous on behavioural grounds, giving an unreasonable protection. From

4695:

that Knowledge policy precludes this. The discussion went nowhere, as he did not respond to the issue of policy, but instead insisted that I removed his argument from the article because

3843:

Would it work to require the filer to simply describe the abuse instead of having to pick a code letter? A place in the template or prototype that says "Describe briefly the specifically

1794: 993:, was created by these users, but it has been deleted on both occasions. An admin could look at the diffs, though. Hence I'm leaving this note on the talk page. The person is running for 4504: 1698: 1685:

the subject of the article since many years and the edits he makes to the article are exactly the same Lucy's socks used to do. I think the evidence presented was not fairly considered.

1514:

We do not have the power given by the community to 1) CU meatpuppets 2) massively block them without some sort of major disruption. Therefore SPI is not equipped to deal with such cases.

2333: 2297: 2364: 2328: 1838: 5442:

Look, if you want to go and try to change the CU policy, you are free to do so at the appropriate venues, but your views are quite out of step with the community and the CU team. --

2292: 2256: 4631: 4470: 4369: 4218: 4120: 2627: 2261: 2225: 1340:

If you suspect sock puppetry by an administrator or you need to submit off-wiki evidence, you must e-mail the CheckUser team or the Arbitration Committee to open an investigation.

3063:

Please advise if I correctly published this complaint. I apologize if this inquiry has been placed here inappropriately. But thanks for verifying if I followed correct protocol.

553: 5068:

Therefore, I spend a high proportion of my edits herding cats (taming fanboy/fangirl-ishness), which is tiresome but worth it – so long as they're not (semi-)representatives of

3393:

editors. This RFC is regarding a possible return of those codeletters, potentially with improvements to avoid the confusion from before. The old set of codeletters can be found

483: 4128:

be removed as a CU clerk. His actions amount to interfering with the CU reports. He has deleted two CU reports outright, without even allowing the actual CU's to weigh in.

908:. It's complete minimalist, especially compared to what we have now, but I think this is the only way we will be able to get everybody to read and understand our instructions. 4253:- I'm pretty sure that ArbCom was aware of the report. All ArbCom members are CUs. In any case, at least a few CUs were aware of the case before it was deleted and suppressed. 2721:

Yep, like I said before, these Chess.com sockpuppets are really crawling out of the woodwork to support their "boy" Lilov, the Generalissimo of the Chess.com sockpuppet army.

2400: 5471:

Somehow our policy of discouraging the linking of IPs to editors has turned into a prohibition against asking about IPs. That is neither the letter of policy nor its intent.—

2808: 1810: 779: 2850: 2776: 2730: 1441: 5013: 4840: 4814: 4656: 1889: 1736: 1717: 1681:

the duck is the same, feather by feather. I appreciate that the clerks have a heavy workload but if any of the clerks have any other suggestions I would be most grateful.

1624: 1391: 4241: 869: 5304: 2623: 2595: 1667: 1228: 4033: 3979: 3887: 1374: 560:. Shayan7 and other socks were engaged in the promotion of this journalist. How can I report this case? Do I submit a case under his/her name and add those socks to it? 133: 5423: 5406: 5392: 4932: 4603: 4579: 4407: 4320: 3068: 3043: 2883: 2369: 1761: 1584:

DeltaQuad said that the closure of the Morning277 reports was done after discussion with other SPI clerks. Where did that discussion take place? I'd like to read it. —

173: 5284: 2962: 2948: 2936: 2922: 2797: 2697: 1641: 833: 389: 304: 271: 260: 5321: 5217: 4880: 4795: 4777: 4562: 3906: 3126: 2743: 2579: 1816: 1468: 1326: 1307: 1185: 925: 732: 714: 211: 193: 5198: 5119:

Thus, esp' Asian pop (subjects) – However, I'm sure there are many other more and less FaoPFC subject areas where action should be taken, supported and encouraged!

4050: 3941: 3920: 3569:

I dislike codes. A simple explanation for why they violate policy is more than enough for me. That being said it would significantly help in the handling of cases.

3177: 3145: 2831: 2755: 2713: 2667: 1629:

The evidence I presented in the reports indicates otherwise. I would like to know where this sudden closure was discussed, and by whom. I don't see it discussed at

1492: 1410: 1174: 1066: 968: 428: 410: 355: 4684: 4430: 2984: 2231: 1965: 1875: 1853: 851: 537: 453: 5566: 5549: 5334: 5265: 3961: 3869: 3281: 3031: 3018: 2486: 1609: 1213: 1199: 1156: 1142: 816: 582: 5459:

I'm not asking for any change whatsoever to CU policy. Checkusers are permitted to run checkuser on IPs for numerous reasons. They are strongly discouraged from

4277: 4061: 2036: 1263: 602: 5612: 5593: 5535: 5513: 5498: 5480: 5454: 5437: 5375: 5357: 4462: 4448: 3676: 2910: 2895: 1653: 1551: 5366:

prohibits running a CU on an IP address. Flow charts are great and this one looks useful but sometimes they oversimplify a situation that isn't cut and dried.

5270:

The flowchart's first draft looks good, but it seems a little bit muddled up. I think a simpler pattern, preferably in a more systematic way will look better.

3510:

information that's available so that people could find it more accessible, and it never changed anything. I'm all for a more radical approach at this point. --

3296: 3292: 3117:

The reason I'm asking right away is I presume this might be somebody's idea of how to not get blocked for vandalism--perhaps there are other one off accounts?

2591: 2154: 2139: 1354: 1109: 2092: 2068: 1472: 5149:

user page, blank not redlinked) and heaps of stat's (e.g. from :contributions where vague IP-reverts/external-link edits predominate and, excepting heaps of

3072: 2649: 2219: 2200: 2180: 1592: 951: 375: 3345: 3312: 2460: 3394: 3169: 3118: 2575: 1010: 5248: 4390: 3874:

It would be nice if there were a list of editors who were willing to help SPI filers, in cases where requests are (initially) denied. (See, for example,

3421: 2871: 1630: 1251: 1130: 990: 986: 549: 229: 225: 94: 86: 81: 69: 64: 59: 3878:.) If there were, then the (initial) denial could be accompanied by a suggestion to contact one of the editors, preferably by email, for assistance. -- 1527: 4613: 4159:

he remained insistent that somehow, someway, a real name would magically be revealed and therefore he refused to allow a CU to even see that report.

4026: 3208: 3133: 2563: 2423: 2022: 2000: 754: 4537: 3230: 2864: 2543: 1398: 1042: 1021: 394:

I've already nuked the archive (around 28 of them that weren't already no tp/em), now will work on the hidden blocks via my block log. Easy peasy.

4978: 4001: 1977: 1284: 881: 3546: 1508: 238: 5299: 3760: 1859: 1648: 1546: 1258: 1180: 1137: 982: 4019: 3575: 3482: 904:

Taking the Meta process as a template, and working under the assumption that we need to say as little as possible in the SPI lead section, I've

525: 463:

their IP was found to be an open proxy. If they really weren't a sock, well tough luck, they shouldn't have been editing on proxies anyways. --

459:

I agree, what you described is not sufficient for a block. However, what most likely happened is that their edits resembled those of the master

4866: 4763: 2446: 1999:

I attempted to report two IP's for repeated vandalism which seemed to be connected, and accidentally reported the incorrect IP. The page is at

1863: 695: 102: 5309:

If anyone is interested in making it look more pretty, I will not be offended if they redo it. My artistic skills have always been lacking. --

4721:. The Courtier's reply is never mentioned in that review. However, I said nothing at the time, having given up trying to get through to him. 3712: 3441:

before they filed the request, resulting in fewer reports filed just because of a similarity between two accounts with no pattern of abuse. --

1989: 638:

The consultation phase is scheduled to end 23:59, 16 August 2013 (UTC), and the appointments are scheduled to be announced by 24 August 2013.

518: 3000: 2559: 2411: 2116: 1942: 1826: 937: 333: 3853: 888:

Cross-posted from functionaries-en mailing list. Comments are welcome here, as well as at the functionaries' list (if you are a subscriber).

800: 4382: 4156: 3593: 1822: 745:

Could someone here tell me the appropriate action to take when a user has baselessly accused me of socking as an IP. Thank you in advance.

3639: 3563: 569: 4707:

demands for specificity and clarification. So I gave up on the discussion. His last message on my tp was the claim that he had just read

3785: 2504: 1053: 679: 149: 3765: 3739: 3610: 3532: 3517: 3504: 2983:

The company Wiki-PR has been linked to the activities reported in the Morning277 investigation, and has just been given a community ban

1597:

SPI is just not designed for such a heavy load; there were at times towards 70-80 sections on that page, and it was painful to clerk. --

1091: 362:

I think I got all of the 12 or so that popped up at RFU. It will still be helpful to go back and plug the talk page editing loophole. --

5115:

objectives (again heightened in Asian pop where 1st-lang-English editor proportion is low and little-English editor proportion is high)

3806: 3695: 3473:- Some way that an editor reporting a possible sockpuppet can summarize the nature of the issue would help prioritize investigations. 3465: 2633: 1047: 3929:

to make the case for the request; repeatedly, clerks have been told to not make the case for the filer, as that encourages fishing. --

3191: 2927:

Thanks. So you specifically need a DUCK each time before you can effectively conduct a further check in this case? That makes sense.

2838: 2437:

with an edit semiprotected request to move it to Knowledge space. LOL. Could someone who understands such things please handle it? --

1291: 5504:

accounts to sock with. Any interpretation of checkuser policies or guidelines that makes that true is a perversion of their intent.—

4038:

We do tend to be chronically backlogged, and the holiday in the US also didn't help matters. Hopefully we will get to these soon. --

3827: 3659: 3006:

If we were to do this, I don't think we could use the traditional SPI format - the templates made it difficult to edit anything. --

2160: 47: 17: 4622:

going on here along with the edit warring via IPs, but I cannot be arsed to sort out who is who there, anyone up for a challenge?

3774:

with Tiptoety, though more to the latter part of his comments. (I think I'll improve on my answer here a little more tomorrow) --

3925:

SPI clerks may choose to help people out of their own volition, but they are not required to do so. The responsibility is on the

3077: 2802:

Stop the bickering here and file an SPI. If there is further argument on this talk page I will hand out blocks for disruption.

2466: 1334: 994: 405: 350: 299: 255: 168: 4398:" as that will just make future socks harder to identify. What's the best approach? Wait until there is more obvious socking? 3648:

with marginal literacy and let machines handle the information. Here we have people who can read a request, however informal.

5145:

Currently, for the suspected editor that broke that impetus, I have a handful of trivial diff's, a couple of circumstantial (

4762:

and pick up a new one provided they don't go back to using the first account without declaring the second one as being them.

3287: 2601: 2987: 5007: 4083: