Jump to content

Wikipedia:Sockpuppet investigations/SPI/header: Difference between revisions

From Wikipedia, the free encyclopedia
Content deleted Content added
softened new instruction
potential refactor of the SPI page
Line 1: Line 1:
<includeonly>{{Floatinglink|SPI/Administrators instructions|Administrator instructions}}</includeonly>
<includeonly>{{Floatinglink|SPI/Administrators instructions|Administrator instructions}}</includeonly>
{{editabuselinks}}
:''[[WP:RFCU]] redirects here. You may be looking for [[Wikipedia:Requests for comment/User conduct]] ([[WP:RFC/U]]), CheckUser policy ([[Wikipedia:CheckUser]]), or [[Wikipedia:Changing username]] ([[WP:CHU]]).''
:''[[WP:RFCU]] redirects here. You may be looking for [[Wikipedia:Requests for comment/User conduct]] ([[WP:RFC/U]]), CheckUser policy ([[Wikipedia:CheckUser]]), or [[Wikipedia:Changing username]] ([[WP:CHU]]).''
{| style="background:transparent; width:100%; margin: 2px 0; border:2px ridge #dcffe0;"
{| style="background:transparent; width:100%; margin: 2px 0; border:2px ridge #dcffe0;"
Line 18: Line 17:
|
|
{{shortcut|WP:SPI|WP:RFCU|WP:SSP}}
{{shortcut|WP:SPI|WP:RFCU|WP:SSP}}
Welcome to '''Sockpuppet investigations (SPI)'''. Here, users can request discussion about possible breaches of the '''[[Wikipedia:Sock puppetry|sock puppetry policy]]'''. Wikipedia has a strict [[WP:SOCK|policy]] on uses of multiple accounts. This page is used to discuss whether a user is likely to have violated that policy, or breached other restrictions (eg [[WP:BLOCK|blocks]] or [[WP:BAN|bans]]) using multiple accounts.
Welcome to '''Sockpuppet investigations (SPI)'''. Here, users can request discussion about possible breaches of the '''[[Wikipedia:Sock puppetry|sock puppetry policy]]'''. Please see the [[WP:SOCK|sockpuppet policy]] for detailed definitions and descriptions of what sockpuppetry is and is not. This page is used to discuss whether a user is likely to have violated that policy, or breached other restrictions (eg [[WP:BLOCK|blocks]] or [[WP:BAN|bans]]) using multiple accounts.


''<font color="red">For '''exceptionally sensitive matters (e.g. harassment, privacy)''', please contact any <u>[[Wikipedia:CheckUser#Users with CheckUser permissions|CheckUser]]</u> or any Arbitration Committee <u>[[Wikipedia:Arbitration Committee#Current_members|member]]</u>, by {{nowrap|e-mail&nbsp; (<u>[[WP:FUNCTIONARIES|how to]]</u>).}}</font>''
''<font color="red">For '''exceptionally sensitive matters (e.g. harassment, privacy)''', please contact any <u>[[Wikipedia:CheckUser#Users with CheckUser permissions|CheckUser]]</u> or any Arbitration Committee <u>[[Wikipedia:Arbitration Committee#Current_members|member]]</u>, by {{nowrap|e-mail&nbsp; (<u>[[WP:FUNCTIONARIES|how to]]</u>).}}</font>''
Line 32: Line 31:


{{TOClimit|limit=4}}
{{TOClimit|limit=4}}

==Sock puppetry==

As described in the sock puppetry policy, a ''[[Sockpuppet (Internet)|sock puppet]]'' is an [[WP:MULTIPLE|alternative account]] used for fraudulent, disruptive, or otherwise deceptive purposes that violate or circumvent the enforcement of Wikipedia policies. When two users, accounts, or IPs are said to be "sock puppets", it means that, for Wikipedia editing policy purposes, editors may treat their edits as being effectively written or controlled by the same person. Examples of sock puppetry include the usage of alternative accounts to [[WP:EVADE|evade]] a [[WP:BLOCK|block]] or a [[WP:BAN|ban]], [[#Voting and other shows of support|votestack or distort consensus]], or circumvent the [[WP:3RR|three-revert rule]].

The misuse of an alternative account will result in a [[Wikipedia:Blocking policy|block from editing]]. Keep in mind, however, what not ''all'' uses of alternative accounts are considered sock puppetry; there are [[WP:SOCK#LEGIT|legitimate reasons]] to use alternate accounts, such as for [[Wikipedia:Sock puppetry#Segregation and security|segregation of tasks and for security]], doppelgänger accounts to prevent impersonation by vandals, and for [[WP:CLEANSTART|clean starts]].

Sometimes users who appear to work with a common agenda are not sockpuppets (one user, multiple accounts), but multiple users editing with the sole purpose of backing each other up, often called '''[[WP:MEAT|meatpuppets]]'''.


==CheckUser==
==CheckUser==
'''[[WP:Checkuser|CheckUser]]''' is a tool that allows a select few authorized users to look at technical information from the server logs themselves, which can provide evidence whether two users, or a user and an IP, are likely to have any connection, and can be used to investigate disruption, "sleepers", returned banned users, and the like. Because CheckUser is both powerful and involves access to privacy-restricted information, very few users (known as "CheckUsers") have access to this tool. Its use is strictly limited by the Wikimedia Foundation's [[m:privacy policy|privacy policy]] and [[m:CheckUser policy|CheckUser policy]] to cases where it is necessary, appropriate, and in good cause. CheckUser does not solve cases. It provides additional evidence of a technical nature that can be considered ''along with'' behavioral evidence and may help clarify whether sock puppetry has taken place.
'''[[WP:Checkuser|CheckUser]]''' is a tool that allows authorized users to look at technical information left when a user/IP makes an edit. This technical information can help determine if a single person is using more than one account. Use of the checkuser tool is governed by policies on the English Wikipedia and Wikimedia Foundation levels. For more information, see the [[:m:checkuser|Foundation policy]], the [[wp:checkuser|local policy]] and the [[:m:privacy|Foundation privacy policy]].


===When not to request CheckUser===
===When not to request CheckUser===
There must be credible evidence that sock puppetry is suspected. Usage of the CheckUser tool in an SPI case without evidence of sock puppetry is called [[File:Crystal 128 babelfish.svg|20px]]&nbsp;'''fishing''' and is not allowed per CheckUser policy. CheckUser requests are also not [[File:8 ball icon.jpg|20px]]&nbsp;'''[[magic 8-ball]]s''' or [[File:Pixie dust.png|20px]] '''magic pixie dust''', and such requests will likewise be rejected. CheckUser should also not be requested if canvassing or [[WP:MEAT|meatpuppetry]] is suspected, as opposed to multiple account abuse, or if the account(s) reported have not edited for many months (i.e. is or are [[File:Time2wait.svg|20px]]&nbsp;"'''stale'''"). In addition, in cases where behavioral evidence alone clearly indicates sock puppetry (see the [[WP:DUCK|duck test]]), then such CheckUser requests will likely be rejected.
There must be credible evidence supporting the suspicion of sockpuppetry. Requests for checkuser without supporting evidence will be declined, because [[File:Crystal 128 babelfish.svg|20px]]'''CheckUser is not for fishing.''' CheckUser requests are also not [[File:8 ball icon.jpg|20px]]&nbsp;'''[[magic 8-ball]]s''' or [[File:Pixie dust.png|20px]] '''magic pixie dust''', and such requests will likewise be rejected. CheckUser should not be requested to investigate canvassing or [[WP:MEAT|meatpuppetry]], or if the account(s) suspected have not edited for many months (i.e. are {{StaleIP}}). In addition, if behavioral evidence alone clearly indicates sock puppetry (see the [[WP:DUCK|duck test]]) then any CheckUser requests will likely be rejected.

===How to request CheckUser===
Anyone can request CheckUser '''at any time''' on an open case if it is necessary. (This is done automatically if you use the "Request CheckUser" box to create your new request.) If you wish to request CheckUser to any existing open case, then do the following:
# Add '''{{tlx|RFCU|CASE LETTER|No2ndLetter|New}}''' under the "Clerk, patrolling admin and checkuser comments" section.
#*Note: if you used the "Start sockpuppet investigation plus CheckUser request" box to create your new request, then this will already be done, and the template will be placed under the "CheckUser request" section.
# Replace "CASE LETTER" with one of the '''[[Wikipedia:Sockpuppet investigations/SPI/Checkuser criteria and letters|code letters]]''' provided (A, B, C, D, E, or F)
# If a second reason to request CheckUser is necessary, then replace "No2ndLetter" with another code letter.
# A [[WP:SPI/CLERK|clerk]] will review the case and make a determination as to whether CheckUser is needed. A clerk will either [[File:Symbol support2 vote.svg|20px]]&nbsp;'''endorse''' the case for CheckUser attention or [[File:Symbol unsupport2 vote.svg|20px]]&nbsp;'''decline''' the case.
# If the case is ''declined'', then the case will be included back on the list of SPI cases that do not have CheckUser requests. If the case is ''endorsed'', then a CheckUser will check all given accounts for technical evidence; this may take a while. At the end, CheckUser may post their results under the "Clerk, patrolling admin and checkuser comments" section, stating which accounts are [[File:Artículo bueno.svg|20px]]&nbsp;'''confirmed''' to be the same user, which ones are [[File:Symbol support vote.svg|20px]]&nbsp;'''likely''', [[File:Symbol possible vote.svg|20px]]&nbsp;'''possible''', or [[File:Symbol unlikely.svg|20px]]&nbsp;'''unlikely''' that they are the same user, and which ones are [[File:Symbol unrelated.svg|20px]]&nbsp;'''unrelated''' or [[File:Symbol unsupport vote.svg|20px]]&nbsp;'''inconclusive'''. Sometimes, underlying [[File:Artículo bueno-blue.svg|20px]]&nbsp;'''IP(s)''' may also be blocked.
# The case is then placed back in the list of non-CheckUser requests pending further comments from clerks or patrolling administrators, or it may be closed by a CheckUser or clerk if all issues have been addressed.


===Quick CheckUser requests===
===Quick CheckUser requests===
{{main|#Quick CheckUser requests}}
''See [[#Quick CheckUser requests]].''
This page may also be used for other CheckUser requests unrelated to sock abuse, such as:
This page may also be used for other CheckUser requests unrelated to sock abuse, such as:
* Blatant attack or vandalism accounts, and an IP block is needed
* Blatant attack or vandalism accounts, and an IP block is needed
Line 67: Line 48:
{{ombox
{{ombox
| type=speedy
| type=speedy
| image=none
| image=
| width=400px
| textstyle = color: red; font-weight: bold; font-style: italic;
| textstyle = color: black; font-weight: bold; font-style: plain;
| text=If the evidence is sensitive, if privacy is needed, or if it involves sock puppetry from [[WP:ADMIN|administrators]], then seek advice by email from a member of the [[WP:AC|Arbitration Committee]] first. Do not post private information, emails, logs, etc. on the wiki that are not already on the wiki.
| text=If the evidence is sensitive, if privacy is needed, or if it involves sock puppetry from [[WP:ADMIN|administrators]], then seek advice by email from a member of the [[WP:AC|Arbitration Committee]] first. Do not post private information, emails, logs, etc. on the wiki that are not already on the wiki.
}}
}}
Line 78: Line 60:
* After submitting a case, consider notifying the suspected accounts by adding <code>'''{{tlsp|socksuspectnotice|PUPPETMASTER}}''' <nowiki>~~~~</nowiki></code> to the bottom of their talk pages. Notification is not mandatory, and may, in some instances, lead to further disruption or provide a sockpuppeteer with guidance on how to avoid detection.
* After submitting a case, consider notifying the suspected accounts by adding <code>'''{{tlsp|socksuspectnotice|PUPPETMASTER}}''' <nowiki>~~~~</nowiki></code> to the bottom of their talk pages. Notification is not mandatory, and may, in some instances, lead to further disruption or provide a sockpuppeteer with guidance on how to avoid detection.
* Do not use any section headers ("===") on case pages as this will break the report templates and mess up the formatting.
* Do not use any section headers ("===") on case pages as this will break the report templates and mess up the formatting.
* '''[[KISS principle|Keep it simple]]'''. Try and keep the presentation of the evidence short, concise, and easy for others to follow. Messy, long-winded, and otherwise poorly-presented evidence makes it harder to determine whether sock puppetry has occurred as well as taking such cases longer to complete.
* '''[[KISS principle|Keep it simple]]'''. Simple, concisely presented evidence leads to a quickly resolved case.

* After the case is submitted, if a CheckUser request was added, then the instructions in the "How to request CheckUser" will be followed. If a CheckUser request has not been added, then a patrolling administrator will look at the submitted evidence and determine whether sock puppetry has occurred. If it has occurred, then that administrator may block the involved account(s).
* After the actions, if any, have been taken by the patrolling administrator, the case will be marked as closed by a CheckUser or an SPI clerk. At that point, the case will be processed and archived by them.
* After administrators and/or checkusers have reviewed the case, it will be closed and archived by an SPI clerk. (Administrators may mark a case closed using {{tlx|SPIclose}}.)


==Submitting an SPI case==
==Submitting an SPI case==
If you are already familiar with the instructions, <font color="red">create the case by replacing "CASENAME" with the name of the puppet '''master''', or previous case name in the box below.</font> The name given to the case should be the original case name (if any), or the main name the user is known by (do not add the word "user:", or number the cases). For example, if the case name is about '''<span style="color:#002bb8">User:John Doe</span>''' or the existing case is at '''<span style="color:#002bb8">Wikipedia:Sockpuppet investigations/John Doe</span>''', then you should enter '''Wikipedia:Sockpuppet investigations/John Doe''' in the box. Then click the button to create a request page (or new section) and follow the instructions there.
If you are already familiar with the instructions, <font color="red">create the case by replacing "CASENAME" with the name of the oldest account, or previous case name in the box below.</font> For example, if the case name is about '''<span style="color:#002bb8">User:John Doe</span>''' or a prior case is at '''<span style="color:#002bb8">Wikipedia:Sockpuppet investigations/John Doe</span>''', then you should enter '''Wikipedia:Sockpuppet investigations/John Doe''' in the box, then click the button.


{| style="background:transparent; width:100%; margin: 2px 0; border:0px ridge #dcffe0;"
{| style="background:transparent; width:100%; margin: 2px 0; border:0px ridge #dcffe0;"
Line 111: Line 93:
</inputbox>
</inputbox>
|}
|}

{{Collapse top|Instructions for requesting checkuser on open cases|bg=#FFF|padding=5}}
Anyone can request CheckUser '''at any time''' on an open case if it is necessary. (This is done automatically if you use the "Request CheckUser" box to create your new request.) If you wish to request CheckUser to any existing open case, then do the following:
# Add '''{{tlx|RFCU|CASE LETTER|No2ndLetter|New}}''' under the "Clerk, patrolling admin and checkuser comments" section.
#*Note: if you used the "Start sockpuppet investigation plus CheckUser request" box to create your new request, then this will already be done, and the template will be placed under the "CheckUser request" section.
# Replace "CASE LETTER" with one of the '''[[Wikipedia:Sockpuppet investigations/SPI/Checkuser criteria and letters|code letters]]''' provided (A, B, C, D, E, or F)
# If a second reason to request CheckUser is necessary, then replace "No2ndLetter" with another code letter.
# A [[WP:SPI/CLERK|clerk]] will review the case and make a determination as to whether CheckUser is needed. A clerk will either [[File:Symbol support2 vote.svg|20px]]&nbsp;'''endorse''' the case for CheckUser attention or [[File:Symbol unsupport2 vote.svg|20px]]&nbsp;'''decline''' the case.
# If the case is ''declined'', then the case will be included back on the list of SPI cases that do not have CheckUser requests. If the case is ''endorsed'', then a CheckUser will check all given accounts for technical evidence; this may take a while. At the end, CheckUser may post their results under the "Clerk, patrolling admin and checkuser comments" section, stating which accounts are [[File:Artículo bueno.svg|20px]]&nbsp;'''confirmed''' to be the same user, which ones are [[File:Symbol support vote.svg|20px]]&nbsp;'''likely''', [[File:Symbol possible vote.svg|20px]]&nbsp;'''possible''', or [[File:Symbol unlikely.svg|20px]]&nbsp;'''unlikely''' that they are the same user, and which ones are [[File:Symbol unrelated.svg|20px]]&nbsp;'''unrelated''' or [[File:Symbol unsupport vote.svg|20px]]&nbsp;'''inconclusive'''. Sometimes, underlying [[File:Artículo bueno-blue.svg|20px]]&nbsp;'''IP(s)''' may also be blocked.
# The case is then placed back in the list of non-CheckUser requests pending further comments from clerks or patrolling administrators, or it may be closed by a CheckUser or clerk if all issues have been addressed.
{{Collapse bottom}}


==See also==
==See also==

Revision as of 20:16, 1 September 2009

WP:RFCU redirects here. You may be looking for Wikipedia:Requests for comment/User conduct (WP:RFC/U), CheckUser policy (Wikipedia:CheckUser), or Wikipedia:Changing username (WP:CHU).
Click here to purge this page
(For help, see Wikipedia:Purge)

Welcome to Sockpuppet investigations (SPI). Here, users can request discussion about possible breaches of the sock puppetry policy. Please see the sockpuppet policy for detailed definitions and descriptions of what sockpuppetry is and is not. This page is used to discuss whether a user is likely to have violated that policy, or breached other restrictions (eg blocks or bans) using multiple accounts.

For exceptionally sensitive matters (e.g. harassment, privacy), please contact any CheckUser or any Arbitration Committee member, by e-mail  (how to).


CheckUser

CheckUser is a tool that allows authorized users to look at technical information left when a user/IP makes an edit. This technical information can help determine if a single person is using more than one account. Use of the checkuser tool is governed by policies on the English Wikipedia and Wikimedia Foundation levels. For more information, see the Foundation policy, the local policy and the Foundation privacy policy.

When not to request CheckUser

There must be credible evidence supporting the suspicion of sockpuppetry. Requests for checkuser without supporting evidence will be declined, because CheckUser is not for fishing. CheckUser requests are also not  magic 8-balls or magic pixie dust, and such requests will likewise be rejected. CheckUser should not be requested to investigate canvassing or meatpuppetry, or if the account(s) suspected have not edited for many months (i.e. are  Stale). In addition, if behavioral evidence alone clearly indicates sock puppetry (see the duck test) then any CheckUser requests will likely be rejected.

Quick CheckUser requests

See #Quick CheckUser requests. This page may also be used for other CheckUser requests unrelated to sock abuse, such as:

Evidence and SPI case guidelines

You need to provide evidence showing the accounts or IPs are acting in a disruptive or forbidden manner, which other users will then assess. If there is no evidence, then nothing will happen and can result in the case being speedily closed by the SPI clerks. Most SPI cases are decided based upon behavioral evidence, that is, the behavior of the accounts or IPs concerned. This evidence needs to be explicit; that is, use verifiable evidence in the form of diffs, links to the pages in which the sock puppetry is occurring, and reasonable deductions and impressions drawn from said evidence. Evidence solely consisting of vague beliefs or assumptions will be rejected.

Some general guidelines when making your SPI case:

  • Remember to always assume good faith when possible.
  • After submitting a case, consider notifying the suspected accounts by adding {{subst:socksuspectnotice|PUPPETMASTER}} ~~~~ to the bottom of their talk pages. Notification is not mandatory, and may, in some instances, lead to further disruption or provide a sockpuppeteer with guidance on how to avoid detection.
  • Do not use any section headers ("===") on case pages as this will break the report templates and mess up the formatting.
  • Keep it simple. Simple, concisely presented evidence leads to a quickly resolved case.
  • After administrators and/or checkusers have reviewed the case, it will be closed and archived by an SPI clerk. (Administrators may mark a case closed using {{SPIclose}}.)

Submitting an SPI case

If you are already familiar with the instructions, create the case by replacing "CASENAME" with the name of the oldest account, or previous case name in the box below. For example, if the case name is about User:John Doe or a prior case is at Wikipedia:Sockpuppet investigations/John Doe, then you should enter Wikipedia:Sockpuppet investigations/John Doe in the box, then click the button.

Start an SPI case WITHOUT a CheckUser request Start an SPI case WITH a CheckUser request


Instructions for requesting checkuser on open cases

Anyone can request CheckUser at any time on an open case if it is necessary. (This is done automatically if you use the "Request CheckUser" box to create your new request.) If you wish to request CheckUser to any existing open case, then do the following:

  1. Add {{RFCU|CASE LETTER|No2ndLetter|New}} under the "Clerk, patrolling admin and checkuser comments" section.
    • Note: if you used the "Start sockpuppet investigation plus CheckUser request" box to create your new request, then this will already be done, and the template will be placed under the "CheckUser request" section.
  2. Replace "CASE LETTER" with one of the code letters provided (A, B, C, D, E, or F)
  3. If a second reason to request CheckUser is necessary, then replace "No2ndLetter" with another code letter.
  4. A clerk will review the case and make a determination as to whether CheckUser is needed. A clerk will either  endorse the case for CheckUser attention or  decline the case.
  5. If the case is declined, then the case will be included back on the list of SPI cases that do not have CheckUser requests. If the case is endorsed, then a CheckUser will check all given accounts for technical evidence; this may take a while. At the end, CheckUser may post their results under the "Clerk, patrolling admin and checkuser comments" section, stating which accounts are  confirmed to be the same user, which ones are  likely,  possible, or  unlikely that they are the same user, and which ones are  unrelated or  inconclusive. Sometimes, underlying  IP(s) may also be blocked.
  6. The case is then placed back in the list of non-CheckUser requests pending further comments from clerks or patrolling administrators, or it may be closed by a CheckUser or clerk if all issues have been addressed.

See also