Jump to content

Wikipedia talk:Sockpuppet investigations/Archive 21

Page contents not supported in other languages.
From Wikipedia, the free encyclopedia
Archive 15←Archive 19Archive 20Archive 21Archive 22Archive 23→Archive 25

Block settings for IP ranges

In response to a particular long-term sockpuppet I'm considering setting a hardblock on an IPv4 /19 range (~8,190 addresses) to block edits from registered accounts. I know about collateral damage and know to ask a Checkuser before doing such a thing, but my question is more generally: what are our norms on this, and/or what's everyone's opinion as to weighing the potential for collateral damage? As far as I can tell from anon edits the range hasn't been used at all except for this one sockmaster since at least 2011. This is a user who creates multiple sleepers at a time to go around restoring their old (sometimes very old) versions of pages, disregarding any progress or discussion. They quickly create a new account or cycle to a new IP if they are blocked and don't really make much of an effort to evade detection at all, strongly suggesting they don't care if they're blocked and 7 years of data indicate they intend to continue. The topic they frequent is popular among other unregistered editors, meaning semiprotection also leads to collateral damage, and the list of articles they frequent is quite long. Two of their IP ranges I've tracked for a while are currently anonblocked for terms measured in years, and it has stemmed their IP disruption but doesn't stop them from creating new accounts. My thought is that the possible collateral damage of hardblocking the range (unknown) should be weighed against the damage from possible mass-semiprotection of their frequently disrupted pages (somewhat high to extreme), versus myself and several other users playing a long and tedious game of whack-a-mole over many years. Before I do anything further I'd like to know what other clerks and CUs think. Ivanvector (Talk/Edits) 17:49, 2 April 2018 (UTC)

I haven't mentioned which case it is because I'm interested in general opinions, but I can get into specifics if it benefits the discussion. Ivanvector (Talk/Edits) 17:50, 2 April 2018 (UTC)
I'd strongly encourage you get a CU to take a peek, as collateral isn't always obvious, any IPBE can be dealt with, and the accounts might not all be coming from where you think they're coming from. This is the norm. Quite simply, you can't properly assess the collateral if you don't know who's editing on the range. You can take a guess, but you'll probably be missing something. This is especially true when a range is already anonblocked and you won't have any idea about the activity, because only registered users are using it. -- zzuuzz (talk) 20:01, 2 April 2018 (UTC)
Sure, I'd ask a checkuser first, I thought I said that originally. I'm really asking for opinions on whether this sort of thing is justified, like, if there are x1 registered (unrelated) accounts editing on the anonblocked range, versus x2 articles that are frequently disrupted and would need protection to prevent disruption (multiplied by y2 unrelated IPs interested in those articles), is preventing disruption worth the inconvenience to those x1 users of seeking IP block exemption? I know there's not going to be a bright line rule here, just a judgement call. Ivanvector (Talk/Edits) 13:43, 6 April 2018 (UTC)
I've never seen any policy or guideline give advice on range blocks. It seems to be one of those things that's left entirely to admin discretion. NinjaRobotPirate (talk) 02:18, 7 April 2018 (UTC)
Ivanvector, over the period since 2011, how many named sock accounts do you think have been created from the range that you are proposing to hardblock? (I'm not a clerk or CU). EdJohnston (talk) 02:43, 7 April 2018 (UTC)
Looking at about 50 checkuser-confirmed accounts in the case archive, plus another 25 in my block log that link to the SPI although there could be overlap in those two sets, and only since about this time last year. The user only edited from IPs up to that point, but after I investigated an ANI report and figured out an effective range to block, they switched to mass account creation. Of course there is no CU confirmation that the user and the IPs match, but the behavioural evidence is very strong, one of the most obvious cases I've seen. Ivanvector (Talk/Edits) 14:30, 9 April 2018 (UTC)

Lua error in Module:Navbar at line 66: Tried to write global div.

This is in big red letters on the main page, can someone fix it? Thanks. Doug Weller talk 12:59, 9 April 2018 (UTC)

I don't see what you're referring to, Doug Weller. ​—DoRD (talk)​ 14:45, 9 April 2018 (UTC)
According to WP:VPT there was a site-wide typo thing earlier, which has apparently now been fixed. -- zzuuzz (talk) 14:48, 9 April 2018 (UTC)
Thanks. When I saw it had gone, I presumed that it must have been something like that, particularly as I hadn't been able to find where it had been introduced. Doug Weller talk 14:50, 9 April 2018 (UTC)

White space vandalism?

Anyone know if this is related to anything? Ivanvector (Talk/Edits) 21:04, 11 April 2018 (UTC)

FYI Ivanvector, see the current WP:AN and the last two archives of it (probably more, but that's as far back as I went) for headings with "white space" in them. Some of the rangeblocks being asked for are out of the question, iirc. ​—DoRD (talk)​ 21:31, 11 April 2018 (UTC)
Oh yeah, I did see that. Yeah, let's block all of China over someone inserting and removing single newlines, that seems like a reasonable response. :) I was more just wondering if anyone's bothered to create a container case for these reports. Ivanvector (Talk/Edits) 21:45, 11 April 2018 (UTC)
There's one in Brazil that I've range blocked a few times. That's the one that GoodDay is usually on about at WP:AN. I don't think any other white space vandals are related, but some people apparently do. I think it's just a "thing" recently. NinjaRobotPirate (talk) 01:57, 12 April 2018 (UTC)

Involved sock block question

I have another conceptual question for the group, and thanks again for bearing with my over-cautiousness. Say there's a case I've been actively clerking for a good long time (I've been patrolling and blocking socks and such) and at the same time there's an article I edit regularly on which there are frequent disputes. It turns out, coincidentally, that the sockmaster also edits that article from time to time, and their edits are incredibly obvious. Normally if I spot them editing a page on my watchlist I just block, but now that they're editing a page I also edit there's an issue of WP:INVOLVED. What's my best practice here?

  1. Block anyway, per WP:EVADE and the INVOLVED exception for "any reasonable admin would do the same";
  2. File a case and wait for someone else to action it (I've tried this - with only three other active admin clerks it's quite a long wait for action);
  3. Something else, like reporting here or at AN for another admin to review.

-- Ivanvector (Talk/Edits) 14:31, 13 April 2018 (UTC)

My (outside) opinion is that if it's obvious, block away. It's probably always good to log the action at the case page anyway, unless if it's a obvious trolling account. If it's a relatively long term abuse case, reporting at AN is probably unhelpful as it can take a while for uninvolved admin to familiarise themselves with the sockmaster. Alex Shih (talk) 14:54, 13 April 2018 (UTC)
I rarely consider myself INVOLVED in sock-blocking. It would have to be a very unusual circumstance, and your example isn't particularly unusual. Of course, I'm a CU, and usually when I block outside of an SPI, I have behavioral and technical evidence to rely on. If I'm at all unsure of my ground, I consult with another CU.--Bbb23 (talk) 15:09, 13 April 2018 (UTC)
I agree with both Alex and Bbb on this, i.e. if it's an obvious sock, one that any reasonable admin (is that a thing?) would agree is a sock, go ahead and block it. ​—DoRD (talk)​ 15:19, 13 April 2018 (UTC)
There's almost zero chance anyone would call you to task for blocking someone in that situation, and it's quite fine to block them. You're not "involved" in any meaningful way; feel free to block away. The purpose of WP:INVOLVED is to avoid using your admin status to advantage yourself in a dispute with another user. Noticing that a known, banned user is editing a page you edit is not a "dispute" in any meaningful sense of the word, and you should feel no qualms about blocking someone in that situation. --Jayron32 16:37, 13 April 2018 (UTC)
This is all pretty much what I thought, especially Jayron's comment about not using tools to give oneself an advantage in an editing dispute. Thanks everyone! Ivanvector (Talk/Edits) 17:12, 13 April 2018 (UTC)

Incorrect archiving for this talk page

February 5 is the last time that Cluebot III correctly archived the posts from this talk page to Archive 20. Starting February 9, it began incorrectly appending posts to Archive 1 which ended in 2009. I don't see why this happened and hoping someone else will and fix, please. :)
 — Berean Hunter (talk) 17:25, 17 April 2018 (UTC)

This edit by Vanjagenije seems to have set it in motion but that is undesirable behavior in an archiving bot. It shouldn't retroactively begin to layer in newer posts in older archives. I hope it hasn't done this in other places where archive size has been changed. This certainly isn't Vanja's fault as anyone could have done the same thing.
 — Berean Hunter (talk) 17:44, 17 April 2018 (UTC)
Fixed.
 — Berean Hunter (talk) 17:54, 17 April 2018 (UTC)

Why is there some kind of witch hunt going on after a bunch (nearly 100s) of supposed swiss sockpuppets:

Hi everyone. I came to this article after I saw that Number 57 was pushing the speedy deletion of the Swiss Monetary Referendum because it was created by a sockpuppet. I left Wikipedia long ago when I couldn't keep track of all the WP:x terminology, feeling it became a haven for petty bureaucrats but at the same time recognising the need to moderate the content in a way I simply wasn't interested in. Anyhow in this case (and I don't know if you have such a WP:X term) it seems to be a clear case of shooting the messenger. Either way, not here to discuss that article per se but it is related. So I come here, following the trail and I see that hundreds of accounts have been removed because they edit in a similar way, not because of the actions that they take. Can you guys explain to me how it can ever be considered right to ban people because they "add templates and portals and edit in a way similar to a well informed Wikipedia user who we have previously banned"!?

Further more, whether or not this group of people really all belong to one person or one organisation it seems that most of what they have added to Wikipedia in the end gets accepted. Like some university hospital, university professors, swiss referendums, swiss places of interest...Even if they are promoting the country, are they really doing such a bad job with it and why are you so concerned as long as they dont use multiple accounts in talk pages to push their agenda? The later which would be the reason why sockpuppetry is frowned upon and not the using multiple accounts to edit different articles.The little ferry (talk) 14:00, 18 April 2018 (UTC)

Instead of "supposed sockpuppets", I think you meant to say "confirmed sockpuppets". Number 57 14:06, 18 April 2018 (UTC)
Well, often "confirmed" simply because they follow a pattern of informed editing in a certain way. Not confirmed by you or any other accuser through actually sourcing attempts to manipulate discussions or adding things that shouldn't be added, which is the reason why ...as I said, sockpuppeting is frowned upon. The "confirmations" also seem to be done by very few people and very rapidly. Though I must add that although most of these "confirmations" are at the best on very thin ice, a few are not and seem to indicate malicious behaviour. Still, point stands, most editors seem to be banned not out of malicious editing but your and a few other users "gut feel" concerning their "editing style". The little ferry (talk) 14:10, 18 April 2018 (UTC)
The little ferry, before you start lecturing other editors perhaps keep track of all the WP:x terminology related to sockpuppetry? "Confirmed" means a checkuser has confirmed the accounts are technically linked through IP addresses and other private data. --NeilN talk to me 14:24, 18 April 2018 (UTC)
Well, this one of the issues I mentioned. I forget the correct terminology so please excuse me but in laymans terms you've created a closed language which is difficult for outsiders to deal with and thus get involved in. The reasons specified on the talk page do not mention many IPs...instead for example the latest ones simply mention editing style. And once again, even if they are sockpuppets they do not seem to be malicious such... and again. Perhaps I am not familiar with your definition of a sockpuppet but I assume a user is allowed to have several accounts but not to use those accounts in the same discussions or the same articles so as to create a false atmosphere of support for their position, correct? If it is not allowed to have several accounts then that's fine, I guess. And if indeed all of these users have been confirmed through IP analysis and other methods then that's fine too. But it doesn't seem to be the case, again...if one reads the talk page of the supposed puppetmaster. For example and I quote
"January 2018 (UTC)
@Ajraddatz: All the socks I've looked at in this sizable group have edited multiple other projects, many of which are the same, e.g., fr.wiki, Commons, Wikidata, and pt.wiki. I'm still at a loss to understand the motive behind the accounts. Although many edits are disruptive, a significant portion of the edits here are either constructive or at least harmless. Unfortunately, I don't think we've seen the end of these accounts. Up to you whether global locks are needed.--Bbb23 (talk) 21:02, 28 January 2018 (UTC) "
It seems to me that the likely theory here is that these people are employed by say the ministry of tourism or something, they work in the same place and so have similar IPs but generally provide good content and they should not be harassed unless edits are malicious. The little ferry (talk) 14:28, 18 April 2018 (UTC)
@The little ferry: Reporters are required to give evidence (i.e., editing style) linking accounts before a checkuser like Bbb23 will run their checks (which includes more than IP addresses). If a sockmaster is blocked, they are not allowed to create or use any other accounts period. And if the socks were "likely" instead of "confirmed" we still have WP:MEAT to consider. --NeilN talk to me 14:41, 18 April 2018 (UTC)
So, can you do me a small favour if you're one of these people.Two things: 1. Do a little investigating and confirm to me and other observers that these people are sure to be the same person and not different people working/living in the same space. 2. That it is disallowed for people to do the later or to be the former even if they are not intending to commit any malicious editing? If something is not clear to you with these two requests then please tell me and I'll explain it further. Again, what I am concerned with is that users like Number57 are harassing and punishing some workers at the Ministry of Information or some non governmental Swiss organisation intent on promoting Swiss culture. The folks or person doing the editing don't even seem to think that they are in the wrong and don't seem to try or know how to hide it or challenge it but keep coming back to do what they care about or are payed to do every now and then. The little ferry (talk) 14:44, 18 April 2018 (UTC)

Dealing with comments of socks

See Wikipedia talk:Dealing with sock puppets#Involvement in SOCKSTRIKE. Capitals00 (talk) 12:12, 19 May 2018 (UTC)

SPI when socks are not known? (resolved)

I came across an account that looks like (1) not a new user; (2) possibly engaged in UPE. Is it worth starting an SPI when socks / other accounts are not known? I.e. would SPI help determine sleepers / prior accounts? That may be helpful in deleting their promotional contributions, if it were to be determined that they were a sock. But I'm not sure if that's an appropriate use of an SPI report. I would appreciate a clarification. --K.e.coffman (talk) 16:35, 15 May 2018 (UTC)

In general, one-account SPI's are really frowned upon. The fact that account "looks like not a new user" isn't good enough, you need to have a prior master in mind. Instead I would recommend emailing a CU about your suspicions. Sro23 (talk) 16:40, 15 May 2018 (UTC)
Agreed - we can't do much in a one-account SPI unless a clerk happens to come upon it who recognizes the behaviour, but do email a CU. We established support a while back for CU action on suspicious new accounts suspected of UPE, and they may be able to help. Or at least they can give you a better response, privately, one way or the other. Ivanvector (Talk/Edits) 17:02, 15 May 2018 (UTC)
Thank you both; I'll follow the suggestion. --K.e.coffman (talk) 17:08, 15 May 2018 (UTC)
@Ivanvector: Does the support for "CU action on suspicious new accounts" apply only to accounts suspected of UPE, or is it a more general measure? Regards, Vanamonde (talk) 11:05, 20 May 2018 (UTC)
@Vanamonde93: the discussion I'm referring to (archived) was specifically in the context of UPE, and it's possible I'm misremembering the outcome of that discussion. In general I avoid asking CUs to investigate cases of "obviously somebody's sock" when I have no reasonable suspicion of who the sockmaster is, but it's also possible that "obviously somebody's sock" is a blocked editor who's newly resorted to sockpuppetry in which case there isn't a case yet, and (I think) CheckUser can detect that without knowing who the master is. But this is probably turning into a question for the CUs. I personally think "obviously somebody's sock" blocks need to be very conservative: most obvious socks are also obvious to a particular user (they make exactly 10 one-byte edits to their own talk page and then revert a semiprotected page to a blocked editor's revision, for example) but we should have very good reasons not to assume good faith. Ivanvector (Talk/Edits) 13:45, 20 May 2018 (UTC)
Understood: that makes sense, and I agree we should be conservative with that sort of thing; it just gets damn frustrating on occasion. Vanamonde (talk) 13:51, 20 May 2018 (UTC)

New script announcement

Thanks to the wonderful Writ Keeper, who should be hired full-time as a technical guru for SPIs (with a tripling of his current salary), there is a new script for determining staleness of socks listed in categories. Please see WK's Talk page for more, including amusing side notes of my script cluelessness.--Bbb23 (talk) 17:05, 20 May 2018 (UTC)

Also, there's a new feature that I added to both this script and my User:Writ Keeper/Scripts/cuStaleness.js: a switch that lets you disable lazy mode. Currently, the default is that the script will lazily check account creation date, last undeleted edit date, and last deleted edit date (if visible) in that order; if the creation date makes the account not stale, then the script won't keep going and check the edit date, and so on; this means that the date of the last edit (or deleted edit) might not display even if there is an edit. Now, there's a switch to disable that behavior, which will cause the script to always check and display the last edit dates. (It will still only display the last undeleted edit or the last deleted edit, whichever is more recent; it still won't display both). To enable on SPI pages: put lazyCheckCUStaleness = false; on the same .js page you installed the CU staleness script on, on a new line above the cuStaleness.js line. To enable on sock categories, do the same thing with lazyCheckCatStaleness = false; above the sockStaleness.js line. Hope this helps! Writ Keeper ⚇♔ 16:25, 21 May 2018 (UTC)

Second opinion

I'd like to request a second opinion on a recently-closed SPI. What is the best forum to handle this? — JFG talk 18:03, 26 May 2018 (UTC)

Seems to me this would be as good a place as any. A link would be helpful.--Bbb23 (talk) 18:12, 26 May 2018 (UTC)
Thanks. This is about the case Wikipedia:Sockpuppet investigations/Hidden Tempo/Archive#26 May 2018, which was opened and closed today in the same edit.[1] Granted, there were reasons to suspect socking due to similar interests and apparent political views between those two accounts, however I also see exculpatory evidence:
  • Shortly after becoming active (April 2018, while the account had been created in November 2017 but had only 3 edits then), the suspected sock went through the Wikipedia Adventure, and asked for advice at the Teahouse, indicating some newbieness.
  • Personal user pages of both accounts are markedly different in tone and style: User:Hidden Tempo vs User:Mr. Daniel Plainview
  • Login times and editing habits of the suspected master[2] and puppet[3] are markedly different.
  • In the conversations I have witnessed, Mr. Daniel Plainview sounded much more civil and constructive than Hidden Tempo ever was. Of course, it may also be that the same person learned to fool people better than ever…
Also, is it correct process-wise to have the same investigator open and close the SPI with just one edit, without providing any particular rationale besides "he was clearly a sock, and CU confirmed it"? Perhaps in case of egregiously obvious vandals, but this looks like a more elaborate case. — JFG talk 18:36, 26 May 2018 (UTC)
First, I endorse the block. Indeed, the only difference between what DoRD did and I would have done is I would have CU-blocked MDP. Second, administrators are not required to open or reopen an SPI when blocking socks. Third, it is common for an admin to open and close a report at the same time. The intent of such a filing is to note it "for the record". Finally, your "exculpatory evidence" would not have changed the result. Socks, by their nature, are deceptive, and what you've presented has all the earmarks of deception.--Bbb23 (talk) 18:45, 26 May 2018 (UTC)
OK, thanks for checking. — JFG talk 19:10, 26 May 2018 (UTC)
You may have already seen it, JFG, but they've admitted to socking now. ​—DoRD (talk)​ 20:12, 26 May 2018 (UTC)
Thanks for the pointer, I had not seen this yet. In hindsight, he probably thought it was clever to be "hidden in plainview"! Now I also noticed that activity on Plainview started a few days after Tempo's unblock appeals were rejected; this happened both in November 2017 and early April 2018. Given this level of sneakiness, have you guys looked for sleepers? — JFG talk 20:19, 26 May 2018 (UTC)

Allowing non-clerk admins to move/merge cases

I noticed that there is a backlog of SPI cases that are waiting for someone to move the case to a different name. Currently, it seems this action may only be performed by SPI clerks, but sometimes, doing this requires some kind of administrator action, such as a histmerge, and not all SPI clerks are admins. I was wondering whether it would be okay for any administrator to move/merge cases, especially if it is at the request of a non-admin clerk or if the case is absolutely clear (e.g. the oldest account is not the listed sockmaster). (Admittedly, I didn't realize there was a rule against this a while back.) The action of archiving the case will still need to be done by clerks, so clerks will still ultimately have oversight of the process. The goal of this is just to make the process more efficient. What do you think? Mz7 (talk) 17:39, 28 May 2018 (UTC)

The main problem is there are certain procedures for these sorts of merges, and although some admins may follow those procedures, others may not. Also some of the merges are complex, and even I don't attempt those. I usually ask Vanjagenije because he's really good at it, although other clerks may also know how.--Bbb23 (talk) 17:48, 28 May 2018 (UTC)
Ah gotcha. I suppose that makes sense. Mz7 (talk) 20:30, 28 May 2018 (UTC)

Mobabansos and Grace Saunders

Moved from Wikipedia talk:Sockpuppet investigations/Grace Saunders

I think this needs to be split into two cases. As NinjaRobotPirate says in the most recent archived instance of this case, the association between Mobabansos and Saunders appears to be erroneous and these are separate sock masters. They have both been engaged in recurrent socking but the former is focused on the Kurdishness of sports figures and the latter on action movie stars and wrestlers. The language use and English competence seems to differ, as well. Is it useful to split or is that just make-work for admins? Thanks. Eggishorn (talk) (contrib) 14:07, 30 May 2018 (UTC)

We should probably raise this at WT:SPI, where it's more likely someone will see it. I can copy it over there. NinjaRobotPirate (talk) 14:13, 30 May 2018 (UTC)
Based on the technical data, agreed. ~ Rob13Talk 15:43, 30 May 2018 (UTC)
One problem this issue has caused is that Mobabansos lost his talk page access because he refused to admit to being a Grace Saunders sock. I think he was telling the truth – this time, at least. I've tried to push him toward making unblock requests instead of creating more sock puppets, but if reviewing admins won't even consider his requests, he's got no incentive to stop socking. So, I think there's some utility in separating the cases. NinjaRobotPirate (talk) 00:43, 2 June 2018 (UTC)

Nickag989

I came across an edit request via WP:SPERTABLE posted by an IP in Special:PermaLink/846269449 and currently located at Wikipedia talk:Sockpuppet investigations/Nickag989 asking for it to be moved to the project page. Out of experience I prefer to post about it here and have qualified crew take care of it. Thanks, Sam Sailor 17:49, 17 June 2018 (UTC)

I took care of it.--Bbb23 (talk) 18:28, 17 June 2018 (UTC)

Edit request found at Wikipedia talk:Sockpuppet investigations/Kylericardolaifatt

FYI. Sam Sailor 18:57, 23 June 2018 (UTC)

Fossorial vandals

There has been some bizarre new user activity at the Fossorial article. The page's popularity seems unchanged but an unusually large number of accounts are making their first edits at the article, some minor edits, some vandalism. One appears to be an alt account of an undeclared paid editor (Switchadon). It's quite an obscure article (<100 views per day) so was very surprised by the level of activity. Many new users appear to have very brief edit histories, starting with Fossorial and moving on to a national topic of some kind, then stopping. I can't tell if this is just weird mindless stuff or maybe the start of a sockfarm. Is this kind of thing worthy of a sockpuppet investigation? SFB 00:25, 26 June 2018 (UTC)

SFB, checks reveal that there are many different users from different parts of the globe. This looks to be related to something on youtube maybe. I've semi-protected the article and handed out several NOTHERE blocks. UPE Switchadon (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki) and Garcigeza (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki) are  Confirmed to each other with Harsimran.Minhas (talk+ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser(log) · investigate · cuwiki) as a  Possible.
 — Berean Hunter (talk) 12:17, 26 June 2018 (UTC)
I forgot to add that there are many accounts that have gotten their start like the vandals on the Fossorial article but since they didn't go that far, they remain unblocked. if they wake up later and start vandalizing then we may need to revisit this.
 — Berean Hunter (talk) 12:26, 26 June 2018 (UTC)
@Berean Hunter: Thanks for looking in to this odd case! SFB 02:13, 1 July 2018 (UTC)

Bot down?

Bot has not edited Wikipedia:Sockpuppet investigations/Cases/Overview about 7 hours Hhkohh (talk) 15:13, 9 July 2018 (UTC)

@Amalthea: courtesy ping. Amaltheabot has not edited in about 7 hours. Ivanvector (Talk/Edits) 15:44, 9 July 2018 (UTC)
It seems run now Hhkohh (talk) 09:35, 10 July 2018 (UTC)

Blanking instead of archiving some SPIs

We sometimes get SPI reports in which the disruption is so clear that the accounts could have easily been taken care of at WP:AIV. These reports are sometimes frustrating because SPI archives seem to go against the spirit of WP:DENY by essentially creating a monument that lists all of the accounts that each LTA has used. In response to these inappropriate SPIs, the only available clerk action seems to be to archive to the /Archive subpage. I was wondering whether it might be reasonable to introduce a new form of archiving: for cases where WP:DENY is an issue, it may be better to simply blank out handled SPI cases, rather than archive them. The details of the investigation will still be viewable in the page history, just not the /Archive subpage. Mz7 (talk) 20:31, 17 July 2018 (UTC)

In rare cases I've courtesy-blanked or even deleted a case report, but not usually for it being obvious. Record-keeping is good for SPI: what seems obvious now might not be so obvious if the same sockmaster goes away for eight months, or whatever. Ivanvector (Talk/Edits) 21:25, 17 July 2018 (UTC)
I think what Mz7 is getting at are cases where it's so obvious that the case page might as well not exist. Think WP:LTA/BMX for example. That being said I don't think it's worthwhile. The kind of troll who is aware of and responsive to their SPI case page is going to be so firmly entrenched that blanking a case page instead of archiving it is unlikely to make a difference. This type of troll is also likely to be aware of standard SPI procedures, so special treatment may just as well provide them with recognition as visibility. Sir Sputnik (talk) 21:44, 17 July 2018 (UTC)
Fair enough, I suppose. I didn’t have specific criteria for when blanking would be preferred over archiving, but I was thinking it might be useful to add to the toolbox for you SPI clerks. Mz7 (talk) 01:01, 18 July 2018 (UTC)

CU on blocked users?

Is it okay to request quick CU on blocked users? The ones blocked for not being here or similar reason? —usernamekiran(talk) 14:34, 25 July 2018 (UTC)

Quick CU is for requests unrelated to sock puppetry. So, most of the time, you'd want to open an SPI case. NinjaRobotPirate (talk) 18:47, 25 July 2018 (UTC)
@NinjaRobotPirate: erm... What are they used for then? I mean, I cant think of any other use for CU right now. —usernamekiran(talk) 19:02, 25 July 2018 (UTC)
As an admin, the most frequent use is to use {{Checkuser needed}} for review of a block when requesting the standard offer or for a user requesting IPBE because of an underlying block. Other reasons would be for assessing if an account has been compromised or confirming two accounts are the same person when requesting return of advanced permissions (usually with the consent of the user.) TonyBallioni (talk) 19:14, 25 July 2018 (UTC)
checkuser needed and quick CU are different and not used for the same things.--Bbb23 (talk) 21:50, 25 July 2018 (UTC)
yeah, i had the same doubt. (I deleted my previous comment.) So is it possible to request a quick CU on blocked users? —usernamekiran(talk) 03:05, 26 July 2018 (UTC)
Bbb, yeah, I get the distinction, but I thought they appeared in the bot maintained table as a Quick CU request, which is why I mentioned it. Sorry if I stepped on toes TonyBallioni (talk) 04:14, 26 July 2018 (UTC)
You never step on toes - at least not mine. I just wanted to clarify.--Bbb23 (talk) 12:32, 26 July 2018 (UTC)

erm... So can we request CU on blocked sockmasters or not? —usernamekiran(talk) 13:11, 29 July 2018 (UTC)

I don't find this thread useful. You're asking an abstract question without giving any context. You're changing your question from blocked users to blocked sockmasters. First it was a quick CU, and now it's just asking for CU without specifying the venue. Quick CU is rarely appropriately used. So forget about it. If you think someone is socking, file a report at SPI.--Bbb23 (talk) 13:17, 29 July 2018 (UTC)

Archive

Why Cluebot archive discussions to Archive 1 [4]? Hhkohh (talk) 12:40, 26 July 2018 (UTC)

Does Vanjagenije this edit [5] cause this? Hhkohh (talk) 12:43, 26 July 2018 (UTC)
@Hhkohh and Vanjagenije: yes, increasing the archive limit would cause ClueBot to add to older archives, if I understand how the code works. ClueBot doesn't keep track of how many archives there are, it just starts from the beginning and adds to the first archive which is under the limit. However I do think there's a switch you can give it that tells it which archive to start counting from. I'll check. Ivanvector (Talk/Edits) 13:46, 26 July 2018 (UTC)
Yeah, this change seems to have done the job. Ivanvector (Talk/Edits) 16:41, 26 July 2018 (UTC)
too late here, but yes, the archive bots have parameter numberstart or counter for that purpose. —usernamekiran(talk) 13:13, 29 July 2018 (UTC)

Dealing with LTAs

Is it useful to file an SPI on the likes of Bob Kennedy (talk · contribs · count), Jim Stemmons (talk · contribs · count) and James Vaney (talk · contribs · count) just to have it in the record who they were? ☆ Bri (talk) 23:24, 8 August 2018 (UTC)

No. Sro23 (talk) 00:04, 9 August 2018 (UTC)
I'm a little befuddled. Fine if we don't want to go through the gestures of an SPI, but shouldn't they at least have sockpuppet tags? Is it a problem if I do this myself? ☆ Bri (talk) 19:50, 9 August 2018 (UTC)
I usually tag accounts, as they will still come up in the category. --Emir of Wikipedia (talk) 19:57, 9 August 2018 (UTC)
There are many reasons why a checkuser, clerk or admin may choose not to tag an account they have blocked. If you believe it may be an oversight you can ask for clarification, but please don't tag the accounts yourself.--Jezebel's Ponyobons mots 21:06, 9 August 2018 (UTC)
I will ask in future cases then. Emir of Wikipedia (talk) 14:17, 11 August 2018 (UTC)

Request for closure

The latest incarnation at Wikipedia:Sockpuppet investigations/Willschmut is continuing to cause trouble throughout the project. The user is unquestionably a sock given the Swedish connection and the same intense focus on an RFC opened by a previous incarnation. I am posting here because the SPI page has gone quiet. Onceinawhile (talk) 23:07, 14 August 2018 (UTC)

I have no idea what "gone quiet" means.--Bbb23 (talk) 00:00, 15 August 2018 (UTC)
Hi Bbb23, I mean that since your involvement four days ago, noone has come along to close it. And in those four days the sock is causing as much havoc as possible (even being blocked for exit warring). Onceinawhile (talk) 08:23, 15 August 2018 (UTC)
Well, there is one thing that we can all agree on: the investigation needs closure, so that people like you guys will stop reverting my edits. Mithrandir the Grey (talk) 11:00, 15 August 2018 (UTC)

Thoughts on rangeblocks

I've been looking at Wikipedia:Sockpuppet investigations/Aggiefan47, and would like a second opinion on whether or not a range block is potentially appropriate here. The range in question is 98.200.12.0/22 (talk · contribs · WHOIS). There is a very prolific editor on this range, interested only in baseball, and who may very well be Aggiefan47. Best I can tell there have been two other editors on the same range in the past three weeks, who have engaged in unrelated, but also problematic editing: Unexplained removal of content at Mile 22 and POV editing at Did Six Million Really Die? and Sudetenland. On one hand, there is clear risk of collateral damage; on the other, preventing the unrelated edits might actually be beneficial. I'm leaning towards saying no, simply because the behaviour of these other editors has not reached blockworthy levels of disruption, but I'm unsure enough that I'd like a second opinion. Sir Sputnik (talk) 04:44, 19 August 2018 (UTC)

I've taken action at the SPI.—Bagumba (talk) 09:59, 22 August 2018 (UTC)

3x ban template

I've made a change to {{sockpuppeteer}} to support a status of banned, which provides a different message regarding WP:3X and adds the page to the banned users category. See User:UnsungKing123 for an example. Still kind of a work in progress, feedback appreciated. Ivanvector (Talk/Edits) 13:05, 23 August 2018 (UTC)

Templates for the clerks

I created a userbox and top icon for the SPI clerks. Just wanted them to know. funplussmart (talk) 03:57, 2 September 2018 (UTC)

Thank you, could have sworn it existed but apparently not so. Alex Shih (talk) 04:14, 2 September 2018 (UTC)
@Funplussmart: See also an old version:User:Yunshui/Userbox SPIclerk (userbox) Hhkohh (talk) 10:51, 2 September 2018 (UTC)

ISP Rangefinder

I know WT:OPP is a little 'backwoods'. I figured I'd introduce toollabs:isprangefinder here as well after Oshwah exclaimed that he'd never heard of that tool. Hope it helps. SQLQuery me! 10:24, 2 September 2018 (UTC)

Move a case, please

I screwed up and opened a case at the wrong place - sorry for being so careless. Could an SPI clerk please move Wikipedia:Sockpuppet investigations/Heena3600 to be a new report at the already existing Wikipedia:Sockpuppet investigations/Shamsuddin Patel? A virtual beer will be yours. --bonadea contributions talk 13:04, 4 September 2018 (UTC)

Thank you, and thanks for that piece of information - that's very useful to know. --bonadea contributions talk 13:25, 4 September 2018 (UTC)

Bogus SPIs to harass an editor?

Can I use an SPI to harass another editor? Can I do this by attaching an editor's name to a plausibly valid SPI, as a harassment technique?

If not, why not? Can anyone please point me to the specific piece of SPI policy (i.e. not just civility) which is against that. There's a claim ongoing at ANI that fatuous SPIs are not harassment, and I'd like to refute that more solidly. Thanks. Andy Dingley (talk) 11:05, 9 September 2018 (UTC)

Andy Dingley, you need to include the context; Wikipedia:Sockpuppet investigations/Andy Dingley/Archive is what you are referring to. Filing an SPI against longtime editors without good reason should be harassment, but I don't think this is a good example of SPI being filed out of bad faith, and I don't think that's what is being "claimed" at ANI. I am going to write another post at your talk page. Alex Shih (talk) 11:20, 9 September 2018 (UTC)
No, I'm trying to find the (context independent) policy which states "Fatuous SPIs are harassment", especially when filed on an editor you have an ongoing dispute with. Andy Dingley (talk) 11:26, 9 September 2018 (UTC)
You won't find that direct quote. Independent of context then, this can fall under NPA: "Serious accusations require serious evidence". "Fatuous" does not sound serious, and "plausibly valid" does not particularly sound like an attack. See also Wikipedia:Casting aspersions. -- zzuuzz (talk) 13:05, 9 September 2018 (UTC)
I'm sure I've seen it somewhere, as the specific form "SPIs may be considered harassment". I'm also distinguishing here between a purely fatuous SPI, and an SPI which might involve real sockpuppets, but is unsupportably (and arguably, harassinglu) linked to a non-socking editor. Andy Dingley (talk) 13:18, 9 September 2018 (UTC)
Someone will probably correct me if I'm wrong, but I'm sure it's mentioned in a few essays as a logical interpretation of the aforementioned policy. Again, "unsupported" does not sounds like serious evidence. -- zzuuzz (talk) 13:25, 9 September 2018 (UTC)
This is why I'm looking for the policy behind this, not looking for comments in a single specific case. Andy Dingley (talk) 14:14, 9 September 2018 (UTC)
In my opinion, filing a bogus SPI per se does not necessarily constitute harassment. Personally, I'd probably classify filing an SPI in bad faith as a form of disruptive editing. That said, filing a bogus SPI can be used as evidence of harassment, if the filing happens within the context of repeated annoying and unwanted contact or attention. Salvio Let's talk about it! 14:40, 9 September 2018 (UTC)
I agree with Salvio, just filing a clearly bogus SPI on its own is not likely to constitute harassment, but as a pattern of hounding it's a different story. I'm not familiar with the mentioned case. I would recommend if you're feeling like some user is abusing administrative processes to try to get you in trouble, contact one of these admins privately, or follow the instructions on that page. Ivanvector (Talk/Edits) 16:51, 10 September 2018 (UTC)

This page is a mess

I started looking at a range of IPs that are supporting each others arguments on talk pages, looked at histories and saw them reverting legit users back to the same preferred versions using the same language in the edit summary, and then saw a user mention that one IP is a sockpuppet of a specific user.

I came to SPI, it's been several years since I've been active enough on WP to care to report abuse, and there is NOTHING directing me how to report this nest of sockpuppet IPs. There's no obvious report template, no direct link from a years worth of archives, no linking of the IPs to the username. There is however, a huge ass warning that if I make my report wrong it'll get ignored and I'm the bad guy.

(I found the above template ^^ while writing this. It's not obvious enough, so I'm leaving this paragraph because this process is hostile to users.)

Gee, it's almost like Wikipedia is losing admins and users because of a hostile environment. No, really? Cuz that's exactly what this page presents as: one big hostile impediment to getting things done and shutting down trolls that cause nice people to go away. If the sock puppets can get a new IP address faster than a reporting user can gather diffs, then this process is broken.

Suggestions:

  • Fix the user hostile language about what not to do! I get it, the admins who work this page are overworked. Don't make it worse by scaring away contributors.
  • On every cases "umbrella" page, and every archived page, have a big giant button that says "report new instances here" that accepts usernames and IP addresses as input.
    • Do not force contributors to enter endless diffs and evidence against whack-a-mole IP addresses.
  • On the main SPI page, make "How to open an investigation" even bigger and bolder, and put it in the table of contents.
  • REPEAT THIS LINK "How to open an investigation" on the page "Guide to filing a case".

Sorry for the cranky rant, but... SchmuckyTheCat (talk) 09:42, 10 September 2018 (UTC)

The easiest way to file a report is to use WP:Twinkle, which is an easy-to-use extension that will introduce a button on any user page that allows you to report them automatically at a variety of venues. SPI is included. Due to technical limitations, this is really the only way to introduce the type of button you're describing, since it involves executing a script. For security reasons, that's not so easy to do, since otherwise anyone could execute potentially malicious code from a page on-wiki. I appreciate the difficulty in filing a report. It wasn't all that long ago that I was trying to figure out how to file my first report at SPI, and it took me about 30 minutes to figure it out, which is too long. Having said that, there's not really an easy way to make it better. The reason the header is worded a little strongly (though I don't think as strongly as it came across to you) is because we need to prevent editors from casting aspersions. Making clear that hard evidence is needed to launch an investigation is the best way to do this. I'll look into mentioning Twinkle on the header to hopefully same some people some headaches, but the manual way of reporting is likely to remain a bit annoying. ~ Rob13Talk 16:23, 10 September 2018 (UTC)
I've now added Twinkle instructions to the page. ~ Rob13Talk 16:30, 10 September 2018 (UTC)
Generally speaking, if a person unfamiliar with the process writes up a genuine report in whatever format they're comfortable with, and posts a note to it on this page, a clerk will come along and fix it. The problem is that there is a particular template that must be used in the report or it won't show up in the list at all, so if someone writes a report even in the correct location but omits the template, none of us ever see it. Twinkle is a good tool to navigate a lot of technically-difficult processes on Wikipedia, it's worth getting used to it. Ivanvector (Talk/Edits) 16:46, 10 September 2018 (UTC)

Checkuser LTA is active recently

A note to the clerks and functionaries: there have been reports on ANI that the checkuser troll is back around again. One of their hallmark behaviours is posing as an administrator and closing SPIs inappropriately. Please be on the lookout for cases closed by unfamiliar new accounts. Ivanvector (Talk/Edits) 01:02, 26 September 2018 (UTC)

I don't know who this is, but it sounds like at minimum it could at least be tagged in an edit filter? -- Amanda (aka DQ) 02:13, 26 September 2018 (UTC)
@Ivanvector and DeltaQuad: see LetsPlayChekUzer and Helper916, who are probably the same. GABgab 18:29, 8 October 2018 (UTC)
Fair enough, but CU would not say they are the same person, but only a small possibility. -- Amanda (aka DQ) 20:11, 8 October 2018 (UTC)

Does anyone know a sock operating from the Republic of Korea

They've been busy at Talk:Scientific racism as well as calling an editor a communist and when blocked going to ANI just now from 2 IP ranges to call me one. Doug Weller talk 10:38, 12 October 2018 (UTC)

The last several edits have been from open proxies located in South Korea. The style doesn't ring any bells for me, but pick any usual suspect in any part of the world and you'd probably be right. -- zzuuzz (talk) 10:57, 12 October 2018 (UTC)
Lol. Probably. Could be Mikemikev but I didn't think he often used proxies. Doug Weller talk 11:01, 12 October 2018 (UTC)

Email list and/or private IRC channel for SPI clerks

SPI clerks, would you be interested in having a.) an SPI clerks' email list to coordinate your work and training and b.) a private IRC channel in addition to the already existing public channel? Your feedback is appreciated as is the hard work that all of you do.
 — Berean Hunter (talk) 15:16, 20 October 2018 (UTC)

@Berean Hunter: Capital idea - I'm a troglodyte, so email would be best. GABgab 15:18, 20 October 2018 (UTC)
I support creating both :-) ~Oshwah~(talk) (contribs) 15:36, 20 October 2018 (UTC)
Never really active on IRC, mailing lists work best for me, what better to sift through emails between unending college semesters. --QEDK (後 ☕ 桜) 07:17, 1 December 2018 (UTC)

Problem with appeals

I've noticed lately a rash of unblock requests from socks that include the template {{checkuser needed}}. This creates bogus table entries at WP:SPI, and on many occasions I've had to remove the templates from the unblock requests or the reviews of them. One of the issues has to do with the template {{checkuserblock-account}}. It is not a block notice that many CUs use, but it includes the checkuser-needed template in the instructions for the user. It doesn't look like it was changed anytime recently; it needs to be fixed. It doesn't look hard to remove, but I would prefer someone with at least a modicum of template-writing knowledge to do it (it's fully protected, so it must be an admin). I don't know why this is also happening when "normal" block notices are used, but maybe someone can figure that out?--Bbb23 (talk) 15:07, 27 November 2018 (UTC)

Callanecc added it on 8 October with this edit to the template. Also, the template displays in the block message users get when they try to edit, which is what would explain it when the SPI scripts’ block notice is used on a talk page. TonyBallioni (talk) 15:11, 27 November 2018 (UTC)
It was supposed to default to an appeal to ARBCOM rather than publicly on the talk page. I'll fix that. Any appeal of a CU blocked account would need a CU to review. So if the CU wants to allow that option the CU needed template is needed. Not sure why it's happening when the CU block template isn't being used though. Callanecc (alt) (talk) 21:30, 27 November 2018 (UTC)
User:Callanecc, its because any block rationale with the template will cause its default version to transclude in the message the user sees if blocked (ex. edit from a blocked webhost on your alt after you remove ipbe and you'll see {{colocationwebhost}}. TonyBallioni (talk) 23:51, 27 November 2018 (UTC)
@Bbb23 and TonyBallioni: Just saw that it was AGK who change the default to a public appeal (I originally had to set to an ArbCom appeal). So I'll ping him before making any changes. Callanecc (talk • contribs • logs) 05:55, 1 December 2018 (UTC)
I have no opinions either way. My general view is that it’s better for a non-CU admin to request CU review so as to avoid frivolous use of the flag template, but I’m fine with either. Bbb is obviously the most active CU both in general and at SPI, and I’d defer to his judgement here. TonyBallioni (talk) 06:02, 1 December 2018 (UTC)
I'm a bit lost how the checkuser needed template and whether appeals are "public" or to Arbcom got entangled, so I'll just make like I understand it and comment on both. A blocked sock should not be using the checkuser needed template. It's generally used when a user was blocked as a sock but not by a CheckUser and they convince an administrator or SPI clerk on their Talk page that a check would be helpful. In my view, appeals of CU-blocked socks should not generally go immediately to ArbCom. The first step for a blocked sock is to appeal in the usual manner with an unblock request on their Talk page. Administrators should not deny unblock requests just because they are not permitted to unblock, e.g., "this is a CU block and I cannot unblock you". That kind of response, albeit true, is unhelpful. They can do any of a number of other things: (1) comment on the nature of the unblock request (e.g., you don't address the socking), (2) not only is there technical evidence but the behavioral evidence (which any admin can evaluate) is compelling, (3) you've admitted to socking, what are you going to do if you're unblocked, (4) your best chance of being unblocked is waiting the standard six months and requesting to be unblocked, and the list goes on. That doesn't mean that at some point an appeal shouldn't go to ArbCom; just as with everything else, ArbCom should ususally be the last resort. There are exceptions of course, but they are rare. I've thought about this for a long time, but this is the first time I believe I've written my thoughts in such detail. There's more but it will become too long if I continue. I also don't even know if I'm on topic.--Bbb23 (talk) 14:26, 1 December 2018 (UTC)
Thank you for your thoughts. Even if they may not be on topic, they're certainly something that's useful to have documented on-wiki to point to if people need an explanation . TonyBallioni (talk) 17:22, 1 December 2018 (UTC)

Sandbox for Google code-in

Is this legitimate use of an account/sandbox? Is Google Code-in (GCI) 2018 part of WEP?
 — Berean Hunter (talk) 12:21, 3 December 2018 (UTC)

This looks like GCI tasks that RexxS is mentoring. — JJMC89 (T·C) 05:17, 8 December 2018 (UTC)
Google Code-In is an annual event hosted by Google where a number of open software organisations, including Wikimedia, set programming tasks for pre-university students aged 13-17 throughout the world. Most of the Wikimedia tasks address phabricator tickets and make small patches to MediaWiki software. However for the last couple of years I have been encouraging students to become interested in Wikipedia, to learn Lua and eventually create module code that could be useful for the project. The aim is "grow" the next generation of coders and developers. This isn't part of WEP, but I feel is useful outreach, nonetheless. I do try to mark the student pages as "patrolled" to save NPP from reviewing them, but I almost certainly miss some, and for that I apologise. Naturally, I'd be happy to answer further questions if I'm able. Cheers --RexxS (talk) 10:47, 8 December 2018 (UTC)

Tagging sock accounts

Hey, SPI crew,

I've run into an editor who is placing sockpuppet or suspected sockpuppet notices on user pages for accounts where I can not find any claim that the accounts (in this case IP accounts) were accused of being socks (see here). I've actually suspected this might be going on for a while now (since before my WikiBreak) when I saw some new editors, trying to be helpful, who would enthusiastically put sock or blocked templates on user pages when the SPI admins chose not to. And in this case, there seems to be no actual accusations, just a template plastered on to an innocent account.

So, I post this question here: If I have checked block logs of accounts and SPI cases and can't find a record of an account being a confirmed or suspected sockpuppet, is there anywhere else this information would be noted? I also check to see who put the tag on the accounts and if is is a CUer or an SPI clerk, the conclusion is warranted. I think this is serious because I don't think most editors or admins check to question the validity of sock tag on a user page and I don't think it should be held against these accounts. I just want to make sure that I'm not missing any place where a confirmed sock would be noted. Thanks for any suggestions you might have. Liz Read! Talk! 00:38, 7 December 2018 (UTC)

@Liz: I'm familiar with the bizarre history of this person. I've blocked the user. I'd rather not explain what's going on. Thanks for the report.--Bbb23 (talk) 02:06, 7 December 2018 (UTC)
I can't decide who works in more secrecy, ArbCom or CUers. I thought I asked a straight-forward question but over the years, I've had little success in getting CUers and SPI clerks to let me know how they come to decisions that aren't documented in a SPI case. What that means to those of us on the outside is that SPIs, especially informal ones, basically run on trust. And while I do trust CUers and SPI clerks and the conclusions they come to, it is hard to verify that certain accounts are or aren't socks when there isn't information in a SPI case or a block log.
I'm not trying to get anyone to disclose information that could be used to damage the Project. But I will say that I'm going to periodically check accounts that are labeled socks to see who put the suspected or confirmed sock tag on their user page. I think it is worse to incorrectly label innocent editors as sockpuppets than to not place a tag on a suspected sock's user page because incorrect labeling influences other editors and admins' judgment of the account. But enough, I'll get off my soapbox and let you get back to the important work you do. Cheers. Liz Read! Talk! 23:24, 8 December 2018 (UTC)
CheckUsers frequently don't tag socks. Tagging is not required. And when someone asks, sometimes it's better not to identify the master. Sometimes it's clear that the user is a sock but because we may get in late in the game, we can only say what the oldest account we saw was but are reasonably sure that because some of the data is stale, there is an earlier account who is the master. There are other sometimes, but I'm not going to list all of them. All of this happens most often when the blocks occur outside of SPIs. In this particular instance, none of the examples I've given applies. It's mainly too complicated to explain and, in a strange sense, unfair to the user. BTW, if you want to revert any of the tagging by Destiny Max Leo, feel free. Finally, if you it makes you feel any better, there are times when I get frustrated because another CU blocked an account without tagging, and I too want to know who the master is. If it's important enough, I'll ask, either publicly or privately, depending on which I think is appropriate. Most often, I just let it go and move on.--Bbb23 (talk) 23:39, 8 December 2018 (UTC)
From a slightly different perspective, my position as a CU is always to make a connection between an account I'm blocking and the sockpuppeteer (whether on the user page or in the block summary) except if I can't due to privacy concerns. If there's no previous master recorded, I'll file a (closed) SPI report so that there is a record that people can refer to and make future reports under. Making the connection makes it easier for reviewing editors and admins to understand why the block was made and it makes the blocks more easily reviewable. This aspect has been made much clearer to me since serving on ArbCom. There are a reasonable large proportion of CU blocked editors who don't understand why they've been blocked and it can significantly increase the workload of the Committee in reviewing the block. Particularly if a non-descriptive summary in the CU log has been used, or if it's more than 3 months later. Callanecc (talk • contribs • logs) 08:23, 9 December 2018 (UTC)

Deletion of SPI, and LTA, subpages

This has become a messy discussion and is going downhill in a hurry. If someone wants to notify the SPI team of something, they're welcome to post it here. However, no "rule" is going to be established requiring any set procedure.--Bbb23 (talk) 01:57, 14 December 2018 (UTC)

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

Hi,

<moved from Wikipedia_talk:Sockpuppet_investigations/SPI/Clerks>

At MfD, we occasionally get nominations to delete an SPI subpage. Consistently, I have always !voted against such nominations, quietly noting that the nominator is not an SPI clerk, and arguing that deletion of SPI pages, if and when required, should be the puhrview of SPI clerks, and their checkusers. No one else is qualified. Do you agree that SPI page deletions should be under the purview of SPI clerks?

This week, MfD has an LTA page nominated for deletion. I think such nominations are undesirable. I note that WP:LTA is not nearly as organised as SPI, and think that LTA has fair overlap with SPI in the sort of work it is, and I think that LTA pages needing deletion should similarly be referred to SPI clerks. Do you agree?

This comes from Wikipedia:Miscellany for deletion/Wikipedia:Long-term abuse/Leicester College vandal

—SmokeyJoe (talk) 09:20, 12 December 2018 (UTC)

You might find WT:SPI a more useful venue. My own opinion is that it is often appropriate to run SPI/LTA pages past the wider community rather than unilateral deletions (which can sometimes also be appropriate), however at the same time I think it should be a requirement that admins/CUs/clerks who have been previously involved with the case should be somehow notified. Maybe just dropping a note at WT:SPI, along with a few pings would suffice. -- zzuuzz (talk) 09:29, 12 December 2018 (UTC)
WP:DENY sure, but information is information. We don't delete case subpages, but keep archiving them for that reason. I cannot say LTA can come under our purview but a well-made LTA page is a good start for profiling some prolific sockers. --QEDK (後 ☕ 桜) 14:00, 12 December 2018 (UTC)
In the past when this has come up I've suggested that a note should be left at WT:SPI if a page related to LTA is nominated for deletion because there are often intersections, but no, ultimately they are community pages and not the exclusive domain of SPI operators. SPI subpages on the other hand should not ever be deleted unless active SPI clerks agree. Ivanvector (Talk/Edits) 14:06, 12 December 2018 (UTC)
  • There are several LTA pages that should be deleted for Deny reasons. I can name a few cases where such LTA created usernames and/or left spam messages and summaries of the form "create an lta for me/user:<x> or I'll keep vandalizing", etc. It is clear that such pages are shrines/trophies to some of these people. The ones in question are never ambiguous either, so an LTA page serves no purpose. CrowCaw 14:33, 12 December 2018 (UTC)
  • I am hearing that SPI admin clerks don't want the responsibility of discretionary deletion of SPI pages, but instead that any MfD nomination of an SPI page should be notified here at WT:SPI.
LTA pages are connected to SPI. Are people hear happy for MfD to instruct notification here of LTA page deletions? My assumption here is that the deletion nominations are being made by someone not associated wit SPI. If so, I'll add this instruction to the MfD instructions.
At the MfD, User:Ivanvector argues that the page is not, and never was, a proper LTA page. Does this mean Ivan, that you do not generally support deletions of proper LTA pages, only exceptions? Also, you write "per WP:RBI". Nothing at RBI says nominate the page at MfD, where for this example 12 editors have made 27 edits, doesn't supporting MfD deletion discussions of troll pages contradict RBI? Similarly User:Zzuuzz, aren't you supporting an self-contradiction by Ivan? Similarly User:Bradv, isn't your "per Praxidicae and Ivanvector" inconsistent with WP:RBI in support an MfD discussion for every vandal reported at WP:LTA? Or maybe you mean that Lojbanist (talk · contribs) deserves a TROUT for creating the page in the first place? --SmokeyJoe (talk) 01:27, 13 December 2018 (UTC)
Just to confirm: SPI admin clerks do not want a speedy deletion criterion of "delete per WP:RBI" for SPI and LTA pages? --SmokeyJoe (talk) 01:17, 13 December 2018 (UTC)
@SmokeyJoe: You're taking this as an all-or-nothing approach, which isn't terribly helpful. I meant exactly what I said in my !vote — when an LTA page becomes a problem, we should delete it with a minimum of fuss. Bradv🍁 01:38, 13 December 2018 (UTC)
User:Bradv, I didn't mean to be aggressive, but am probing to sort out what I find to be a contradiction, "RBI means MFD"? Occasionally at MfD we get nominations, like this one, where it is really unclear to me that it should be deleted as a special case from the set of similar pages, and especially because the nominator does not appear to have any particular role in managing these pages. I'm asking because this feels outside the expertise of me and other typical MfD reviewers. Delete the LTA page because the named vandal edits the page?!? Is this a mechanism for any vandal to get their LTA page deleted? Surely the answer is blocking, or semiprotection, or both? --SmokeyJoe (talk) 01:48, 13 December 2018 (UTC)
One-size-fits-all is often good but it never handles all cases. Fortunately there are plenty of clueful people at Wikipedia who can work out which LTA pages are useful and should be kept and which cause too much fuss with no commensurate benefit. If anyone wants to make a batch MfD nomination of a few pages, please post a notification here. Johnuniq (talk) 02:49, 13 December 2018 (UTC)
SmokeyJoe, I really can't follow your thinking here, and I don't know what you're trying to get an answer for. My mention of RBI was referring to that case in particular, not to any general case. RBI and MFD have nothing to do with each other. I never said "RBI means MFD", I did not argue that creation of the LTA page was anything other than good-faith, I never said anything about generally supporting deletion of LTA pages, I don't know what "self-contradiction" you're referring to, I said nothing at all about speedy deletions, and I did not suggest anywhere that the creator of that LTA page did anything wrong. I don't know what you're trying to accomplish here but if you're going to twist my words and invent arguments on my behalf, then I'm done with this discussion. Ivanvector (Talk/Edits) 03:48, 13 December 2018 (UTC)
Ivanvector, I not trying to twist your words, but sort out an apparent contradiction in my mind. Instead of trying to explain my confusion, let my try this attempt at a simplified question of what is going on here:
A troll is trolling his LTA page. What should be done?
RBI says to me: Revert the edits, block the IP, semiprotect the page if blocking the IP is not so simple.
What am I trying to do? I am trying to clarify what should be done when people bring SPI and LTA pages to MfD. At MfD I am not happy to support deletion unless I know the story behind the page and what possible future uses it has. My penciled in conclusion, consistent with your post of 14:06, 12 December 2018, is: When someone nominates an SPI or LTA page, notify WT:SPI of the MfD.
Maybe in asking the questions I have already found the answer? --SmokeyJoe (talk) 04:00, 13 December 2018 (UTC)
  • Looking for past cases, it seems there are less of them than I think I remember, but the following four are examples of MfDs that I think needed notification here.
The notion that SPI pages are speediable has been around for a long time, for example:
Quiet speedy deletion is in keeping with WP:RBI. I've had it confirmed to me that G6 deletions are often used for deletion of BLP violating, or personal details containing, or broadly inappropriate pages. --SmokeyJoe (talk) 04:21, 13 December 2018 (UTC)
Okay, I think I see what you're getting at. The short answer is that there's no one-size-fits-all answer to these. For the last example, yes we do often delete SPI pages when they're obviously created in bad faith, and there are likely numerous examples of this. We also regularly delete SPI talk pages because they're a maintenance headache. It's pretty rare for an SPI page to be deleted otherwise. As for other pages that might be of use to SPI clerks but aren't under the SPI hierarchy (LTA pages, user subpages) it is a good idea to get input from SPI, in the same way you would seek input from a subject matter expert or a WikiProject for article content. I'll have to look at the others in the morning, it's 1am here. Ivanvector (Talk/Edits) 05:04, 13 December 2018 (UTC)
I think it is a good idea to put a Template:Mfd notice on WT:SPI whenever an SPI or LTA page is nominated. --SmokeyJoe (talk) 06:51, 13 December 2018 (UTC)
This is a terrible idea as it gives them far more attention than we should. Praxidicae (talk) 20:18, 13 December 2018 (UTC)
Praxidicae, can you explain you logic? You are good to nominate a troll page at MfD, 142 page views per day, few participants accustomed to dealing with trolls, but oppose notifying WT:SPI, 12 views per day, all accustomed to troll issues? --SmokeyJoe (talk) 22:44, 13 December 2018 (UTC)
How is my logic unclear? I've literally said it repeatedly. Stop making LTA's/trolls more popular by talking about them more. This is a garbage troll who thrives on us talking about his idiocy more. This is clearly not my first rodeo here. Praxidicae (talk) 01:26, 14 December 2018 (UTC)
The discussion above is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

Retain the N-day data for known sockpuppets for use in subsequent investigations

I realise there are practical limitations to retaining vast quantities of data about the activities of all contributors which results to the N-day limit for CheckUser. However, many sockpuppets re-emerge and the current system can't easily detect this (e.g. this recent case) and I imagine our regular socks know about the N-day limit. However, is there any reason we should not separately retain the N-day data indefinitely for accounts that have been determined to be sockpuppets and stored separately? This PastSock data could be checked by the CheckUser tool in addition to the N-day all-contributor data and make it much easier to reveal the returning sockpuppets (or assist in any other enquiries about problematic user behaviour). Naturally there would be the same access restrictions to this data (CheckUser clerks, etc). And of course if this data got unmanageably large (although I think it unlikely since only a tiny proportion of our users are sockmasters/puppets), it could be pruned but its "S-day limit" would still be much longer than the "N-day limit" so it would continue to be effective in practice against socks (unless they are incredibly patient ones). The idea could be extended to sockpuppet investigations more generally (which are currently closed without a determination of sock puppetry) in case those accounts crop up again later in another investigation. Kerry (talk) 00:07, 20 December 2018 (UTC)

The retention period is set by the foundation. It cannot be changed by individual wikis. This is not the right venue to suggest such a change.--Bbb23 (talk) 00:25, 20 December 2018 (UTC)
Where should I suggest it then? Kerry (talk) 03:10, 20 December 2018 (UTC)
We have access to a private wiki where data in LTA cases and xwiki cases can be stored and compared if needed. I suspect the foundation would point to that if this was brought up as one of the reasons extending the data retention period wasn’t needed. TonyBallioni (talk) 00:56, 20 December 2018 (UTC)
If this data is already retained, why did User:Courcelles say "what I'm saying is that CU data is only retained by the server for 90 days, and all the known socks are older than that, so I literally have nothing to compare this account against" in recent case? Or are you saying it can be stored but isn't being stored? Kerry (talk) 03:10, 20 December 2018 (UTC)
Because we don't use cuwiki for every case or even most cases. TonyBallioni (talk) 03:20, 20 December 2018 (UTC)
(edit conflict) The raw data is not maintained past 90 days. We can make notes on the private wiki (and these notes can include copies of relevant data logs in some cases) and those notes are stored indefinitely, but the data that we have access to loses its usefulness over time. Even if the raw data logs were maintained for a very long time, comparing the technical data on an account active now to one active a long time in the past is less likely to give useful information and more likely to return false positives or simply nonsensical results. 90 days is a fairly reasonable limit, all things considered. Ivanvector (Talk/Edits) 03:52, 20 December 2018 (UTC)

Seeking comment on WMF funding request for blocking research

Hello, I am Lane Rasberry user:bluerasberry. I am employed as Wikimedian in Residence at the Data Science Institute at the University of Virginia. I coordinate projects at English Wikipedia and other Wikimedia projects.

I am writing to request comments and feedback on a request I have for US$5000 Wikimedia Foundation funding to coordinate machine learning research on Wikimedia blocks on English Wikipedia and elsewhere in Wikimedia projects. Please comment on meta at

I expect in the future that other researchers will do similar analysis and prediction to rank Wikimedia blocks, just as the WMF has their experiments with the mw:ORES. I appreciate anything anyone has to say about my funding request in itself or as a model and precedent for similar research in this space.

I am posting at this board because socking / proxy editing is currently the most common reason in English Wikipedia for blocks being administered.

Thanks. Blue Rasberry (talk) 17:19, 28 December 2018 (UTC)

Do you want us to endorse/join/contribute, how? Or is this just informational. --QEDK (後 ☕ 桜) 14:21, 2 January 2019 (UTC)
@QEDK: Yes, I am seeking endorsement for funding. Aside from that, any sort of comment, including criticism, is helpful. Excuse me for not being direct. Blue Rasberry (talk) 22:26, 3 January 2019 (UTC)

IP editors cannot request investigations

As an IP editor I cannot request an investigation, because I lack the permission to create SPI report pages. I suspect that User:KillerGho$t and User:2607:FCC8:D44C:900:11C5:6BA2:26CF:7250 are the same, and both have been used for the same kind of vandalism. First via the former, now via the latter. The former has been blocked for modifying music genres, both removing sourced material and inserting unsourced claims, for articles whose subjects relate to trap/hip hop music, with the misleading edit summary "‎Fixed typo". The latter is now doing the exact same thing, I just undid this edit by the IP editor. --77.173.90.33 (talk) 14:10, 6 January 2019 (UTC)

I'll make an SPI report page for you.  Doing... --DannyS712 (talk) 15:31, 6 January 2019 (UTC)
@DannyS712: be aware that checkusers won't make a public connection between registered accounts and IP addresses though. ——SerialNumber54129 15:42, 6 January 2019 (UTC)
@Serial Number 54129: I am aware of this, but the can still make a determination and block the IP.  Done at Wikipedia:Sockpuppet investigations/KillerGho$t --DannyS712 (talk) 15:44, 6 January 2019 (UTC)
So why ask for a CU...? No worries, we'll see what happens. ——SerialNumber54129 15:47, 6 January 2019 (UTC)
@Serial Number 54129: It was already declined. I requested it because I though the could do a CU but not make the connection public if it exists, but I guess not --DannyS712 (talk) 15:48, 6 January 2019 (UTC)
You guess...correctly :D  ;) just joshing you bro. Keep up the good work! ——SerialNumber54129 15:49, 6 January 2019 (UTC)
Thanks Danny. I see an administrator has temp-blocked an IP range, and blocked the account. --77.173.90.33 (talk) 16:29, 6 January 2019 (UTC)
No problem. Glad I could help --DannyS712 (talk) 17:03, 6 January 2019 (UTC)

New template for dynamic IP ranges

{{Notsockdyn}}: {{Notsockdyn}}

After having typed out various versions of this message recently (and many more times over the past few years) I decided to just go ahead and make a little template. CUs and clerks, please feel free to edit the wording or make other useful modifications to the template. —DoRD (talk)​ 14:51, 23 January 2019 (UTC)

Sock template change

Please see the discussion at Template talk:Sockpuppet#Sockpuppet categories. I am particularly looking for comments from members of the SPI team. Thanks.--Bbb23 (talk) 19:35, 23 February 2019 (UTC)

who dis?

I just ran into Ericspant (talk · contribs), who was a-holing around and also matches Sirusumps (talk · contribs). NinjaRobotPirate, Materialscientist, DoRD, DeltaQuad, Zzuuzz, MusikAnimal, all of you ran CU on this one IPv6 range they used (that I won't name since I'm not sure if I'm allowed to...), a range CU-blocked by NinjaRobotPirate five times, most recently on 25 February. Ericspant started his account on another range, a regular one, where an editor was most recently active screaming around in Anchor Bay Entertainment, and I believe some of you may know who this is. Sorry for speaking in code; I'd love to include the IP ranges of course--and I don't have access to my arbmail from here. Anyway, I hope this makes sense to some of you, and I will leave it for you to decide whether any tagging, rangeblocking, etc. should take place. Thanks, Drmies (talk) 17:04, 4 March 2019 (UTC)

Drmies, please see the CU log for Ericspant for their identity. —DoRD (talk)​ 17:53, 4 March 2019 (UTC)
Gotcha. I saw that name in the other log. Thanks. That person has issues. Drmies (talk) 17:56, 4 March 2019 (UTC)
Yes, yes they do. —DoRD (talk)​ 18:09, 4 March 2019 (UTC)
@Drmies: The reason I likely didn't catch on was there appeared to be nothing new at the time, plus I was there for a different unrelated reason and when I found what I needed I walked away. That's also a pretty large range so multiple people could be editing off it and why we had so many CUs on that range. -- Amanda (aka DQ) 19:27, 4 March 2019 (UTC)

Could someone review this edit request?

This page Wikipedia talk:Sockpuppet investigations/MishMoshKeel121 has appeared on User:AnomieBOT/SPERTable and I'm not sure what to do in these cases as both users being reported in the request is already blocked and tagged for sockpuppetry. I have a feeling the new user that opened the request might be a sockpuppet themselves. I would love some guidance on how to deal with these kinds of edit requests if possible. Thanks! Alucard 16❯❯❯ chat? 14:06, 7 March 2019 (UTC)

Pinging me and DoRD as you did was fine. If you had done what the sock asked you to do, that would have been okay as well. The ping caused faster action, but it would have been dealt with in reasonably quick order either way. This kind of trolling usually attracts attention.--Bbb23 (talk) 15:09, 7 March 2019 (UTC)

Cross-wiki socking

白骨青灰 (talk · contribs · deleted contribs · logs · filter log · block user · block log) has been temporarily blocked on zh-wiki for vandalizing zh:李学勤 (Li Xueqin on en-wiki) and making legal threats. I reverted several of their unsourced defamatory edits there and was accused by the user of libel, who went on to threaten legal action. Soon after they were blocked there, a new account, NormandyD-Day1944 (talk · contribs · deleted contribs · logs · filter log · block user · block log), was created and placed multiple tags on Li Xueqin (which I wrote) without explanation. The two accounts are very likely the same person. My question is, is using multiple accounts across wikis considered sockpuppetry, and if it is, can I request CU for cross-wiki edits? -Zanhe (talk) 22:52, 11 March 2019 (UTC)

Erm...

What sort of evidence is required for an SPI to be instigated against accounts? Does the evidence have to be overwhelming, or could an editor request someone take a look at something that just looks suspicious? PaleCloudedWhite (talk) 22:11, 13 March 2019 (UTC)

The required evidence to open a case is somewhere below "overwhelming" and somewhere above "both of these accounts reverted me". If unsure you can contact the functionaries via email, or ask for a clerk on IRC. Someguy1221 (talk) 22:40, 13 March 2019 (UTC)
The standard is generally that you present sufficient evidence (in the form of diffs) that two accounts are more likely than not operated by the same person. As Someguy implies, it can be a mushy standard, but, in my view, it should be more than mere suspicion.--Bbb23 (talk) 02:36, 14 March 2019 (UTC)
Thanks. My understanding of the IRC page is that it is frowned upon to use a discussion there as a basis for on-wiki activity. If I contact the functionaries, would not the same apply? And would I have to use my offline identity? Maybe I should just open a case and see if it gets dismissed.... PaleCloudedWhite (talk) 08:37, 14 March 2019 (UTC)
I wouldn't contact the functionary list. That would be something you might do if you had evidence that you did not want to share publicly. I can't speak for IRC as I don't use it. If you have evidence of the kind I described above, I would simply file a report at SPI.--Bbb23 (talk) 11:54, 14 March 2019 (UTC)
Yes, that. I was never suggesting to hold the investigation via email or IRC. Just to ask someone in private, "should I open a case?" That said, you're not going to get pilloried for making a mistake. Someguy1221 (talk) 21:38, 14 March 2019 (UTC)
I think for now I'll monitor the situation and see if anything more demonstrable emerges. Thankyou for your replies. PaleCloudedWhite (talk) 01:25, 15 March 2019 (UTC)

Whois errors

Tracked in Phabricator
Task T219051

I'm getting "Error 500, Internal server error" when trying to do whois lookups and it is unusable. Should an alternate be placed in the template? Example.
 — Berean Hunter (talk) 12:16, 24 March 2019 (UTC)

According to the tool's page, it is maintained by Whym. If they don't see/respond to this, I'll contact them directly. —DoRD (talk)​ 13:08, 24 March 2019 (UTC)
I also left them a message on Commons, where they're an admin and where they've edited most recently. In the meantime, I guess we're stuck with something like Robtex. —DoRD (talk)​ 13:39, 24 March 2019 (UTC)
My guess would be an update to Labs infrastructure broke it. I'll see if I can find anything. --QEDK (後 ☕ 桜) 15:06, 24 March 2019 (UTC)
Amanda prefers Domain tools IIRC. TonyBallioni (talk) 15:09, 24 March 2019 (UTC)
Appears to be fixed now. SQLQuery me! 21:43, 24 March 2019 (UTC)

SPI for editor that lacks competence

This might be a silly question, but should I create an SPI if an editor is incompetent (both old and new accounts have the same editing pattern) and most likely is not aware of certain policies? I am sure it is the same person just looking that their nicknames are almost the same, their user pages have the exactly same information, and their editing habits (horrible grammar, which does not make any sense, not using edit summaries, among other things) are the same. – Sabbatino (talk) 10:16, 26 March 2019 (UTC)

Socking and SPI aren't just about behavior (ie. objectionable behavior) it's about WP:ILLEGIT, so I'd say file it. Praxidicae (talk) 12:29, 26 March 2019 (UTC)
Sabbatino is talking about RuthSmith95 (talk · contribs · count) and Ruth Smith 101 (talk · contribs · count). See report at WP:ANEW.--Bbb23 (talk) 12:34, 26 March 2019 (UTC)
I'm not sure ILLEGIT applies; the accounts don't overlap, and they certainly can't be accused of pretending to be different people. Having said that, CIR applies in every circumstance and to every editor. ——SerialNumber54129 13:01, 26 March 2019 (UTC)
This user is not just incompetent; she is disruptive and uncollaborative (she doesn't talk).--Bbb23 (talk) 13:05, 26 March 2019 (UTC)
Yes, bizarrely so. And who knows, maybe CheckUser will reveal their previous accounts... ——SerialNumber54129 13:10, 26 March 2019 (UTC)
I dunno, pretending to be other people isn't really the only illegitimate use of an alt account but I guess without reading too much of the history but what you guys have said, ANI is probably better? (Also ignore me, lots of cold medicine = delusional Prax.) Praxidicae (talk) 13:06, 26 March 2019 (UTC)
@Praxidicae: The doctor recommends a hot toddy :) ——SerialNumber54129 13:10, 26 March 2019 (UTC)
Maybe the editor in question also had a journey with a hot toddy + cold meds, that'd explain it! ;) Praxidicae (talk) 13:16, 26 March 2019 (UTC)
Well I am aware of WP:ILLEGIT and since I was not sure about it, I decided to ask here. I also wanted to take a look at "Editor Interaction Analyzer" but it does not work at the moment. However, the "Intersect Contribs" tool from Wikipedia:Tools/User interaction investigations shows that, while both users edits do not overlap, but their edited pages do overlap (20 same pages) – here is a link to it. So I believe that it might be a good case to start an SPI. I will wait for the result at WP:ANEW and then will probably start an investigation here. – Sabbatino (talk) 14:33, 26 March 2019 (UTC)
Update: While I was writing this reply, RuthSmith95 started moving its old user to a new namespace by itself (not sure if that is permitted)... – Sabbatino (talk) 14:34, 26 March 2019 (UTC)

Templates not showing in archive

I see a good number of "Template:checkuser" and other templates that aren't transcluding. The breaking point seems to be here. Is the archive simply too large to handle the transclusions?
 — Berean Hunter (talk) 22:38, 25 March 2019 (UTC)

@Berean Hunter: That page is in Category:Pages where template include size is exceeded - so that is probably why: it's just too big of an SPI archive. --DannyS712 (talk) 22:43, 25 March 2019 (UTC)
I started to make a bot years ago to help with this issue, but never got around to actually doing it. But I did add some sort of system where the archives were archived. I'll do that when I'm home. -- Amanda (aka DQ) 22:55, 25 March 2019 (UTC)
Thank you both.
 — Berean Hunter (talk) 23:09, 25 March 2019 (UTC)
Force subst-ing them as a temporary measure would work but would break a lot of the tools that we use, a bot which splits off archives is probably a better approach (probably what Amanda is going for). --QEDK (後 ☕ 桜) 14:48, 27 March 2019 (UTC)
All that is needed, really, is to cut/paste a large chunk of the /Archive to /Archive/1 and the header templates should take care of the rest. —DoRD (talk)​ 16:16, 27 March 2019 (UTC)
Berean Hunter, your example has been taken care of: Wikipedia:Sockpuppet investigations/Anatha Gulati/Archive/1 and special:diff/890012229 —DoRD (talk)​ 12:56, 29 March 2019 (UTC)

Is this sock puppetry?

I have never raised a SP investigation, and the situation I have come across is really not clear-cut. I suspect it is a case of an inexperienced user not understanding the rules, and I would prefer not to bring out big guns - I would appreciate your guidance. The situation is this:

  • A school's article has basically been written by one editor, who is possessive.
  • Other editors made changes to the article, and that original editor went to the Help Desk looking for ways to stop them. The Help Desk explained the situation, and it may have backfired from his viewpoint because several editors edited that article and removed some promotional material. I was one of them, in a minor way.
  • He contacted me on my User Talk page, saying he is the schools's archivist, including his real name and asking me to email him. I declined, requesting that we communicate on Wikipedia instead.
  • Suddenly a new editor appeared, named for the above editor's real-life name. This "new" editor has only made 8 edits, all on that school's article - mainly adding more unsourced material that is becoming trivial in nature. He has not used the old account since starting to use the new one.

So it looks like he stopped using the old account and created a new one instead, without leaving any trail for continuity. I doubt he had any bad intent, so I don't want to escalate unnecessarily. Is this a problem; does anything need to happen, or should we just let it slide? --Gronk Oz (talk) 10:56, 3 April 2019 (UTC)

  • No. Here's an unofficial opinion. You're looking at two different people (google it), who communicate in real life and either pass on messages, or perhaps briefly type something while logged into the other's account. Other issues aside, there appears to be no serious foul - a newbie mistake at worst. Now that there's a new account I would expect both might edit, but you're unlikely to see a repeat of the previous situation. -- zzuuzz (talk) 11:31, 3 April 2019 (UTC)
  • Aye, one person taking instruction/sugggestion from someone else I'd imagine; and cf User:Johnson.coop, who is probably not unconnected either. ——SerialNumber54129 11:55, 3 April 2019 (UTC)
Okay, thanks for confirming that ... sounds like it might be best just to let it go. --Gronk Oz (talk) 13:31, 3 April 2019 (UTC)

Is there a non-annoying way to get attention to (easy) cases?

I've posted a (very straightforward) case of IP sockpuppetry here, 9 days ago. The last time I posted a similar case, I was told that the IP edits were "too old" to take any action. Is there an accepted mechanism to draw attention to this newer case so that it can be logged as confirmed, rather than being ignored and then labelled stale? --JBL (talk) 15:26, 6 April 2019 (UTC)

Generally, reports only about IPs attract little attention from clerks and virtually zero attention frm CheckUsers. The only thing I ever do is close them when the IPs go stale, as they often do. Many editors - not just you - don't like the way this works, but it's unlikely to change, and reposting at the SPI or posting here (you've done both) is unlikely to help.--Bbb23 (talk) 15:40, 6 April 2019 (UTC)
Ok, thanks, this is helpful for expectation-setting. If you don't mind, a follow-up: the reason I bothered to file an SPI like this is on the belief that a record of IP abuse is potentially useful in detecting future sockpuppetry from named accounts; is this mistaken? (If it's not ever going to be useful to have the record, I can just go to RPP etc. directly in the future.) --JBL (talk) 16:16, 6 April 2019 (UTC)
Apparently the article at issue has been semi-protected and the report closed. I think a record of IP abuse at SPI is useful. A clerk's finding that the IPs are operated by the master would make it more so, but at least you've done your part. One idea is to say you're filing it for the record and report the problem at RFPP simultaneously.--Bbb23 (talk) 16:38, 6 April 2019 (UTC)
Thank you, sounds good! --JBL (talk) 18:26, 7 April 2019 (UTC)

Blocks and stale accounts

I'm honestly a little baffled by a recent trend that I am seeing at SPI where some people are skipping blocking not just socks, but potential sockmasters solely because they haven't edited. This presents two issues in my view. CSD G5 specifically requires a block for someone to be able to delete the materials, and when I go dumpster diving for potential other socks on other investigations, I won't see that they could still be a sock/sockmaster. So I wanted to initiate a discussion on this so we can figure out standard practice. -- Amanda (aka DQ) 23:31, 17 April 2019 (UTC)

Unless it's a stale dynamic IP I tend to block everything that pops up. I haven't been as active at SPI recently, so I haven't stumbled upon the issue you bring up as of yet. Is it a typically a clerk decision, or are CUs not blocking as well?-- Jezebel's Ponyobons mots 15:42, 18 April 2019 (UTC)
To clarify, by "everything that pops up" I mean "everything likely or confirmed that pops up". -- Jezebel's Ponyobons mots 16:04, 18 April 2019 (UTC)
It'd help if you gave us a real example.--Bbb23 (talk) 15:44, 18 April 2019 (UTC)
I think I may sometimes skip stale accounts when it's on behaviour and I'm unsure, but generally, I'd agree with you that we should be blocking everything. TonyBallioni (talk) 16:00, 18 April 2019 (UTC)
This comment by Sir Sputnik to Cabayi is one example. I believe that Cabayi may know of a few others where they are trying to figure this out. :)
 — Berean Hunter (talk) 16:19, 18 April 2019 (UTC)
See also this archived report and I didn't block the 2012 master account.
 — Berean Hunter (talk) 16:28, 18 April 2019 (UTC)
I don't think there is one-size-fits-all for this sort of thing, and I don't see how we can come up with a "standard practice", or if that's even advisable.--Bbb23 (talk) 16:55, 18 April 2019 (UTC)
Wikipedia:Sockpuppet investigations/Marketing5/Archive is one such case.
In general my view is still that I formed while preparing cases rather than handling them.
If master (blocked & tagged) focused on article ONE, and unblocked, untagged, stale sock focussed on articles ONE and TWO, then a fresh new sock editing article TWO would be undetectable.
Especially in cases where evidence has been deleted I favour blocking and tagging so that non-admins can still exercise vigilance. Without a full set of blocks & tags here, a non-admin is stuck with digging around for corroborating evidence on commons or wikidata which might not have been obscured. Cabayi (talk) 17:41, 18 April 2019 (UTC)
I always leave tags and get accounts blocked before closing a case, as I've assumed that has always been the procedure. I might leave the tags if a CU blocks and states they don't want to tag, otherwise it pretty much applies. --qedk (t 桜 c) 14:35, 30 April 2019 (UTC)
Sorry I left this so open. I'm going to take the general consensus here to be that we still do look at the rest of an SPI regardless and i'll start pointing others to it. Does the Clerks procedures need to be updated somewhere? -- Amanda (aka DQ) 05:12, 4 May 2019 (UTC)
I don't understand what you think the consensus is. I'm not sure there is a consensus, but that's a different issue.--Bbb23 (talk) 13:10, 4 May 2019 (UTC)

"you must email the CheckUser team"

 Done --qedk (t 桜 c) 18:13, 9 May 2019 (UTC)

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

No e-mail address is provided, either at WP:SPI, or at WP:FUNCTIONARIES, which is where "the CheckUser team" links to.  — SMcCandlish ☏ ¢ 😼  13:03, 6 May 2019 (UTC)

I found "the English Wikipedia CheckUser OTRS queue at checkuser-en-wp@wikipedia.org" at WP:CHECKUSER, which is presumably the address to use, but WP:SPI should probably say so.  — SMcCandlish ☏ ¢ 😼  13:05, 6 May 2019 (UTC)
@SMcCandlish: Wikipedia:CheckUser#Contacting a CheckUser - checkuser-en-wp@wikipedia.org --DannyS712 (talk) 13:06, 6 May 2019 (UTC)
Yeah. That should probably either appear in this page, or that note in this page should link there instead of to WP:FUNCTIONARIES.  — SMcCandlish ☏ ¢ 😼  13:12, 6 May 2019 (UTC)
The discussion above is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

SPI archive notice

 Done --qedk (t 桜 c) 16:00, 14 May 2019 (UTC)

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

FYI - Wording change is being contemplated at Template talk:SPI archive notice. Draft is in the sandbox, visible on the testcases. Cabayi (talk) 13:14, 30 April 2019 (UTC)

Another planned change for {{sockpuppeteer}} template to make it more compatible with {{sockpuppet}} parameters. --qedk (t 桜 c) 13:19, 30 April 2019 (UTC)
Proposed changes to {{Sockpuppeteer}}, brings it in line with the puppet template. Testcases show the change. No breaking changes. ¯\_(ツ)_/¯ --qedk (t 桜 c) 13:43, 30 April 2019 (UTC)
The only ones I can follow in the testcases are the two about LTA page existing and not existing. The rest of the tests are meaningless to me, although I don't recall anything about "operators" before.--Bbb23 (talk) 17:38, 30 April 2019 (UTC)
Mostly just added a |1=confirmed parameter which behaves the same way as a |checked=yes without a corresponsing blocked parameter set as well. The {{sockpuppet}} template uses a variety of "confirmed" parameters to mark up the same thing, so I wanted to make it uniform among all sock templates. --qedk (t 桜 c) 19:59, 30 April 2019 (UTC)
@Bbb23: In the {{SPI archive notice}} template, there is a subtle wording change from Checkusers: This SPI case may involve cross-wiki abuse. Please consider reporting the results on meta or the checkuser mailing list, as appropriate. to This SPI case may involve cross-wiki abuse. Please consider reporting the results on meta or Checkusers can send an email to the interwiki checkuser mailing list if required. In the other template, I just added two more aliases of parameters, namely confirmed and suspected, which act exactly the same way as a checked=yes and the default, respectively. --qedk (t 桜 c) 20:08, 1 May 2019 (UTC)
Thanks, QEDK, could you simplify the last part of cross-wiki abuse to "Checkusers can send an email to the Checkuser mailing list."?--Bbb23 (talk) 20:15, 1 May 2019 (UTC)
That was my idea too since CUs would know where to go, @Cabayi: simplifying should work I guess? --qedk (t 桜 c) 21:03, 1 May 2019 (UTC)
Bbb23, QEDK, I agree up to a point. When everything works as it should, and the message to the en CU list is passed to the interwiki CU list and acted on - no problem. What happens when the message is not passed on (the en CU decides it's not worth acting on for some reason) and the reporting user heads over to meta to complain that their message (which never got as far as anyone on meta) has been ignored?
The creative ambiguity of glossing over the existence of multiple mailing lists works only so far. Cabayi (talk) 19:44, 4 May 2019 (UTC)
I'll summon @TonyBallioni, Ponyo, and DeltaQuad: from the thread above to see if they have anything to add. Cabayi is really exercising their creative freedom with that summary. --qedk (t 桜 c) 15:24, 5 May 2019 (UTC)
Bbb23 performs more of the grunt work here than anyone else, so I'm giving them my proxy vote.-- Jezebel's Ponyobons mots 22:34, 5 May 2019 (UTC)
All this template talk is beyond me. If everyone else is happy, I’m good. I just flag down a steward on IRC when I need a lock most of the time. TonyBallioni (talk) 15:29, 5 May 2019 (UTC)
@TonyBallioni: I'm with you on the template stuff. Because I hate IRC, I just ping a steward at the SPI. Most of the time that works great. We're lucky, in my view, to have such responsive stewards. Back to the template, I'm still not sure why any changes were needed, but it sounded like it wasn't going to hurt anything, and if it makes clerks happier (always a good thing), fine.--Bbb23 (talk) 22:41, 5 May 2019 (UTC)
I'm fine with the archive template, but I'd like to see us change the sockpuppet/master template to take a CU parameter instead of seperate confirmed and checked=yes. That always seemed counter intuitive. I know we'd have to change a lot of templates for that, but I could easily write a bot and do a botreq for that. -- Amanda (aka DQ) 18:51, 5 May 2019 (UTC)
@DeltaQuad: (talk page stalker) If you want to file a botreq, I'd be happy to help code up a bot and run it for you --DannyS712 (talk) 18:58, 5 May 2019 (UTC)
We could alias it to cuconfirmed, confirmed, cu, like the sockpuppet template. --qedk (t 桜 c) 13:10, 6 May 2019 (UTC)
@DeltaQuad: See Template:Sockpuppeteer/sandbox for current proposal. See mockups at Template:Sockpuppeteer/testcases. I've made it so it preserves current behaviour. --qedk (t 桜 c) 13:53, 6 May 2019 (UTC)
  • I've posted respective edit requests to the template. Feel free to raise any objections here or at the talk pages. --qedk (t 桜 c) 18:13, 9 May 2019 (UTC)
The discussion above is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

Move protect all investigation pages?

I'm not sure how it works exactly (cascading is broken as I understand it) but why don't we move-protect all SPI case and archive pages at EC level? It's a common, ongoing form of vandalism here. Once they're created nobody needs to move these except clerks, excepting I guess when someone realizes they created a case under the wrong name but clerks can handle that. All our active clerks are EC, and all but one also have pagemover. Ivanvector (Talk/Edits) 12:15, 10 May 2019 (UTC)

That sounds like a reasonable idea, but since cascading protection is only available for full protection, I'm not sure how it can be accomplished short of using a bot. —DoRD (talk)​ 12:28, 10 May 2019 (UTC)
Could use MediaWiki:Titleblacklist, though it wouldn't allow extended-confirmed protection, only protection so that page movers, template editors, and admins can move the page. Galobtter (pingó mió) 12:56, 10 May 2019 (UTC)
Wouldn't that only prevent the move_to title? The edit filter seems an obvious solution. It shouldn't take a minute to implement if there's a demand for it. -- zzuuzz (talk) 13:15, 10 May 2019 (UTC)
With the moveonly flag, a page can be created, but not moved; certainly an edit filter would be easy enough to create. Galobtter (pingó mió) 13:19, 10 May 2019 (UTC)
I'm not so sure about that. Anyway, filter 990. -- zzuuzz (talk) 13:24, 10 May 2019 (UTC)
You're right, not sure how that made sense in my mind. Galobtter (pingó mió) 13:28, 10 May 2019 (UTC)
It just needs a couple of eyeballs and turning on properly. We can probably make it public, and if we want to, we can specify only sysops and a list of named users. -- zzuuzz (talk) 13:31, 10 May 2019 (UTC)
Zzuuzz, I would advise against the last and feel the current EF is sane enough. Preemptive protections are disallowed by policy (Have there really been EC-vandalism? )Also, I have (mistakenly) created pages for sock-farms under editor(s) other than the oldest one, only to realize it soon and move it to the correct page. ∯WBGconverse 13:44, 10 May 2019 (UTC)
(edit conflict) Unless there are many EC vandal socks running around, that seems enough protection, and would allow the vast majority of SPI filers to fix any typos they make when filing etc without having to ask an admin. Public seems fine since knowing the filter details does not seem like it'll help people circumvent it. Galobtter (pingó mió) 13:46, 10 May 2019 (UTC)
Well, we do get some EC socks, but if they make it to 500 edits without being caught then we might get a few typos fixed. I'm happy to leave it as is, but I'll just mention that we could also limit it to, say, 1,000 edits, if required. -- zzuuzz (talk) 13:48, 10 May 2019 (UTC)

Noting

this edit. Regards, ∯WBGconverse 11:52, 22 May 2019 (UTC)

There are some fixes that need to be made, I made a TPE request at the template talk page. --qedk (t 桜 c) 13:33, 22 May 2019 (UTC)
 Done ∯WBGconverse 15:31, 22 May 2019 (UTC)

Should suspected IP socks be reported here?

According to WP:LOUTSOCK "Editing under multiple IP addresses may be treated as the same level of disruption as editing under multiple accounts when it is done deceptively or otherwise violates the principles of this policy", which suggests we should report any suspected behaviour here. However, the lede statement here that "This page is for requesting that we investigate whether two or more Wikipedia accounts are being abusively operated by the same person" and the repeated use of the word "account[s]" throughout the page suggests that only registered users should be reported. I apologize in advance for the strong probability that this subject is clarified somewhere, but ask forgiveness for not being able to find where. Fred Gandt · talk · contribs 21:36, 27 May 2019 (UTC)

You can file a report consisting only of IPs. Please be sure that that at least one of the IPs has edited very recently (preferably no earlier than the day before you file) and that the IPs have edited more than a little. That said, you should not necessarily expect any action to result from your filing. Often, by the time a clerk reviews an IP report, the IP edits are too old, and it's closed. Quicker action is usually obtained by reporting the IPs in other administrative forums.--Bbb23 (talk) 22:55, 27 May 2019 (UTC)
Hi Bbb23 and thanks for replying. I noticed on WP:AIV, recommended as an option to me by Ad Orientem when discussing this issue on their talk page, it states that "Reports of sockpuppetry should be made at Wikipedia:Sockpuppet investigations unless the connection between the accounts is obvious and disruption is recent and ongoing", which is certainly informed by your own comments. I didn't see (until I was double checking details while writing this reply) the "... enter the user name (or if there isn't one, IP address) ..." bit in the collapsed-on-page-load "How to open an investigation:" box originally, since I wasn't informed enough to know if I should be making a report here and therefore didn't open it, and didn't think to report sockpuppetry at a noticeboard for vandalism. Do you think it would be appropriate to clarify the reasoning on AIV and more clearly display and define the IP situation here? Fred Gandt · talk · contribs 03:33, 28 May 2019 (UTC)
I'll admit this is an area we don't handle the best. Logged out editing is much more likely to be noticed and taken into account by a CU when performing a check on a named account for another reason. At SPI, reports with IPs routinely go stale. If it is a new user, the usual answer is they forgot to log in and are just editing as an IP like they used to. If it is an experienced user and the violations are pretty severe (logged out vandalism, logging out and participating in project space, violating ArbCom restrictions, etc.) then WP:LOGOUT says you should contact a CheckUser privately and present the evidence to them.
If you contact a CU, don't be surprised if you don't get a direct response to your concerns because of the privacy policy, but if you present evidence and there are grounds for investigating, we will take the claims seriously. TonyBallioni (talk) 16:30, 28 May 2019 (UTC)
Thank you Tony. My hopeful mind is now beginning to accept that IP editing is too much like searching for fingerprints in a supermarket; any of the thousands of prints could belong to anyone, and trying to nail it all down would be a monumental task and probable waste of time. So, my understanding is that we should (where IPs are involved):
  • Report very recently (effectively "currently") active IPs, suspected of sockpuppetry with another IP, to WP:AIV
  • Report registered users, suspected of "logged out" sockpuppetry, privately to a CheckUser
  • Report suspect IPs, which have not been recently active, and suspect registered accounts, here
The result of this being that no registered account is publicly connected with an IP per WP:OUTING, and solely IP socks are only chased down with urgency if continued activity is likely to remain the responsibility of the recent user (in the case of the IP being dynamic). Is that a reasonable understanding? Fred Gandt · talk · contribs 20:17, 28 May 2019 (UTC)

Merge request

Could an admin clerk please merge Wikipedia:Sockpuppet investigations/Cecemaso into Wikipedia:Sockpuppet investigations/1608Washington? The two accounts reported in the Cecemaso SPI have been blocked, but I am certain that they are connected to the older accounts in the 1608Washington SPI. --bonadea contributions talk 16:41, 7 June 2019 (UTC)

Expected time for case

Since the user under investigation continues to disrupt on Wikipedia, I was wondering when it could be expected that the sock puppetry investigation would begin. I filled the case June 2th. Thanks in advance. --Ahmedo Semsurî (talk) 12:15, 8 June 2019 (UTC)

The oldest case is from April 7th, and in my opinion, that's decent given that it is well under the limit of WMF's data retention period. And to be frank, when a case is picked up is way too variable to give a suitable answer to your question. If it's urgent, or let's say an account is about to be stale, you can always email a clerk, post here, or post at the clerk's noticeboard. --qedk (t 桜 c) 14:34, 8 June 2019 (UTC)
Got it. Thanks for the reply. --Ahmedo Semsurî (talk) 16:16, 8 June 2019 (UTC)

'New' user

I've come across an apparently new user who is clearly familiar with Wikipedia and is showing some slightly aggressive traits (lots of undos, somewhat snarky edit summaries). However, I have no idea where to start in terms of who they might previously have been. Is it possible to run a checkuser on them to see whether there are linked accounts? Cheers Number 57 20:08, 11 June 2019 (UTC)

@Number 57: There is no requirement that there be a specific suspected sockmaster in order to run a check on an account. That said, practically speaking, you might have a harder time convincing a checkuser to run a check if you don't have specific evidence. The best thing to do would be to file a case with a few relevant diffs, and be as specific as possible. --Deskana (talk) 20:13, 11 June 2019 (UTC)
  • (former CU comment) (edit conflict) Sometimes. We don't normally (and were specifically warned a few months back not to) check accounts just because they seem "too experienced to be new", and not having a known account to compare with makes CU kind of a kludge. If you see something suspicious and aren't quite sure what to do about it, you can email one of the clerks to have a look. (Or take Deskana's advice) Ivanvector (Talk/Edits) 20:14, 11 June 2019 (UTC)
@Number 57: if you suspect sock puppetry but don't know the master, you can try this tool. Input a couple obscure pages that the suspected sock puppet has edited, and it will tell you who else has edited them. NinjaRobotPirate (talk) 03:23, 12 June 2019 (UTC)

Categorization

You categorize the user pages of many (but not all) sockpuppets and sockpuppeteers but you do not categorize the investigation pages. Is that intentional for some reason? Or was it just too much extra work to take on with all of the many demands on your time? it might speed things up and make archived SPIs easier to find. Just wondering. Liz Read! Talk! 23:33, 1 July 2019 (UTC)

I'm not sure exactly what you mean, but when a sockmaster or sock is tagged and there's a case, the tag has a link to the case.--Bbb23 (talk) 23:44, 1 July 2019 (UTC)
The category also has a link to the case, normally, if it's created properly with the {{sockpuppet category}} template. I suppose that template could be modified to automatically include the SPI page as a main article for the category, but then (for example) we'd have Wikipedia:Sockpuppet investigations/Fangusu categorized as a Wikipedia sockpuppet of Fangusu, and I don't see how that would be helpful (the investigation itself is not a sockpuppet). Ivanvector (Talk/Edits) 00:40, 2 July 2019 (UTC)
As Ivanvector said, the tags point to the page, the cat points to the page, sometimes the block log does too. Worst case, you'll have to type in the username at the SPI homepage (or /Closed) to search the archives. --qedk (t 桜 c) 12:40, 2 July 2019 (UTC)
Well, you all would know better than I, but I didn't think the archived investigation pages were categorized, it's the user pages that are categorized. I just was looking for a project to take on but it seems like the system you have works fine for you. Nevermind! Liz Read! Talk! 02:33, 7 July 2019 (UTC)

Advice please, vexatious editing

If I buy time with a gentle VPN which provides me with a static IP address acceptable to WP and I log in as a casual editor but with a login name. Then from these accounts I attack but not quite mindlessly the WP work of people whose edits irritate me. I employ some cunning in making many small edits that each require a good deal of new citations to refute. In other words I create a real nuisance without improving the article. The common characteristic of the edits is little depth of knowledge of the subject, just what is already in the article and perhaps some info from Google.

Would I be breaking any rules by doing this?

That’s what I think these editors are doing. Should I do anything about it?

ZCARSTVNZ https://xtools.wmflabs.org/ec/en.wikipedia.org/Zcarstvnz WENTOUNG https://xtools.wmflabs.org/ec/en.wikipedia.org/Wentoung KORKECONV https://xtools.wmflabs.org/ec/en.wikipedia.org/Korkeconv (seems to have disappeared) KENSOPAL 6/2/2019 to 18/2/2019 https://xtools.wmflabs.org/ec/en.wikipedia.org/Kensopal GRENPRID https://xtools.wmflabs.org/ec/en.wikipedia.org/Grenprid BARLALAIN https://xtools.wmflabs.org/ec/en.wikipedia.org/Barlalain MPW008 https://xtools.wmflabs.org/ec/en.wikipedia.org/Mpw008 PLAWRENCE99CX https://xtools.wmflabs.org/ec/en.wikipedia.org/PLawrence99cx (seems to come and go)

Must I provide sockmasters' names? Please advise me.

Eddaido (talk) 11:02, 3 July 2019 (UTC)

A more useful list
Andy Dingley (talk) 14:03, 3 July 2019 (UTC)
  • If you think they're socking, file it at SPI and give some evidence as diffs. Because otherwise this is going to be seen as unfounded harassment on your part. Andy Dingley (talk) 11:29, 3 July 2019 (UTC)
  • The best evidences I think I can give is
1. they seem intended to harrass me and why bother to do it like that except as some kind of game-playing and
2. most recently I responded to this with this (take it to arbitration) and from that moment (more than a month) there has been no peep from any one of them. Neither "bit of evidence?" seems to me to be completely compelling but did you look at the range of edits for each editor? Eddaido (talk) 12:14, 3 July 2019 (UTC)
  • Don't confuse content, socking and harassment.
If it's wrong, source it and it'll stick. If they're socking, you need some evidence of socking, not just harassment. If it's only harassment, then we both know that that's a popularity contest on WP. Whoever has the most friends wins. If you have admin friends, you win bigger. If you have friends above admins, even admins get a ban. Andy Dingley (talk) 12:31, 3 July 2019 (UTC)
  • @Eddaido: Andy is giving you bad advice here, and needs to knock it the hell off.
For your concerns, the behaviour you describe is tendentious editing, or just disruptive editing in general. It might also be sockpuppetry. If you know who the sockmaster is (or have a good suspicion) then you can file a new report under that sockmaster's investigation. Otherwise, choose whichever account was created first and create a new investigation under that name. Instructions are on the SPI main page, and it's preferred that you use the form to submit a report. For evidence, you will need to provide diffs showing the editors making the same edits (or edits reasonably close to the same), editing the same pages in the same way, or anything else you think is evidence that one person is using more than one account. If you make a convincing case we can ask a checkuser to read private technical information about the accounts and see if they are the same, or if they are using open proxies or VPNs as you suggest. If you don't think this is one person with many accounts, you could report instead to WP:ANI. Remember that you should focus on what the accounts are doing, not on your guesses about what they might be doing. Thanks. Ivanvector (Talk/Edits) 12:58, 3 July 2019 (UTC)
So Ivanvector reckons you need to file an SPI and that I'm giving you bad advice that it isn't socking? Well, you're welcome to try.
You are going to get two responses at SPI. Firstly that these edits are stale (3 months), so CU is mostly technically unable to run. The only two which have enough evident overlap (you've still given us no more illuminating diffs) is at Barford & Perkins between Grenprid (talk · contribs) and Korkeconv (talk · contribs), but they're also stale. Nor have you discussed this with any of them, so you'll just get a flea in your ear for that. You could make a behavioural claim for the socking, but the overlaps aren't there and unless you've spotted some obscure tell which we haven't, there's not enough similarity either. Andy Dingley (talk) 14:19, 3 July 2019 (UTC)
Thank you both Ivanvector and Andy. I did not know about edits going stale. I just filed away what I thought was potential evidence and let it accumulate. Maybe the two sockmasters might notice this correspondence. If it does re-start I won't let things grow stale. Thank you, both. Eddaido (talk) 06:11, 7 July 2019 (UTC)
@Eddaido: Ivanvector's and Andy's advice about evidence is sound. Andy's comments about "friends", etc., is silly and certainly irrelevant to SPI. I have no opinion on whether you have sufficient evidence to connect the eight accounts, but Andy's last comment about staleness is misleading. Five of the eight accounts you listed are not stale.--Bbb23 (talk) 13:13, 7 July 2019 (UTC)
Many thanks Bbb23. After much thought I've decided to continue to hold off in the hope that there won't be any more. Eddaido (talk) 23:48, 8 July 2019 (UTC)
Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=Wikipedia_talk:Sockpuppet_investigations/Archive_21&oldid=1159114617"