Wikipedia:Sockpuppet investigations/Sarandioti

Sarandioti

Sarandioti (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Populated account categories: confirmed · suspected

For archived investigations, see Wikipedia:Sockpuppet investigations/Sarandioti/Archive.

– This SPI case is open.

03 August 2010

Suspected sockpuppets

• ZjarriRrethues (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• ObserverFromAbove (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Evidence submitted by Athenean

Background

Sarandioti was a particularly disruptive nationalist Albanian editor who, after multiple blocks for disruption, was eventually indef blocked for sockpuppetry in September of 2009. He has since created several sockpuppet accounts [1], and I strongly believe ZjarriRrethues is his latest.

Sarandioti's last confirmed socks on en-wiki were Muzakaj (talk · contribs) and NguyenneyugN (talk · contribs), though the last confirmed sighting of Sarandioti was on the Commons, were he was up to the usual trolling and edit-warring [2] as recently as February 25-27 2010. At exactly the same time, ObserverFromAbove (talk · contribs), editing from an open proxy [3], suddenly becomes involved in an ongoing dispute at Skenderbeg. In addition to the odd-sounding name and the fact that he edits from an open proxy, what arouses suspicion about Observer is that he seems to follow around me and User:Alexikoua, Sarandioti's arch-enemies, from the get-go. Here, he follows Alexikoua to an extremely obscure, just-created orphan article [4], which he could only have possibly found out about by looking at Alexikoua's contribs. Here, he posts at AN/I within six minutes of me posting [5], though I haven't had the slightest interaction with him up to this point, and a bona fide new user would not even be aware of ym existence, as I didn't participate in the discussion at Skanderbeg, let alone follow my contribs in real time. Others also express suspicion that this is a sock of Sarandioti [6]. On March 1 the proxy from which Observer edits is blocked, and Observer soon after vanishes without a trace. Strange behavior for someone who was building a userpage [7] [8], joining wikiprojects [9], etc.

ZjarriRrethues is created on March 10, and I become aware of him on March 13, when he becomes involved [10] in a highly arcane, obscure ongoing dispute between Greek and Bulgarian editors regarding 19th century ethnographic maps of the Balkans [11] [12]. Since then, I have been observing him closely, and am now fully convinced we are dealing with none other than Sarandioti himself. There is much evidence that ZjarriRrethues is not a new user, and even more that he is in fact Sarandioti.

WP:PRECOCIOUS

• Zjarri knows about warning templates right from the start [13].
• Zjarri claims he will know everything about wikipedia within a month [14], which sounds more like a sockpuppeteer trying to allay suspicion from others about how come he knows so much about wikipedia so soon [15] than a genuine new user.
• Zjarri dives into ongoing disputes right away, as with the ethnographic maps mentioned above [16], or at Skanderbeg [17] [18] (picking up right where Observer left off).
• As EdJohnston commented in one of the diffs above, Zjarri knows a lot about wikipedia for such a new account. Within a week of creating his account, he has made about 250 edits [19], some of which reveal a lot of knowledge about wikipedia, practically re-writing articles from scratch, adding templates, adding obscure ethnographic maps, sourcing, etc: [20] [21] [22] [23] [24]. Here he participates at a 3RR report on his 6th day of editing, explaining to everyone what a revert is [25]. He creates his first DYK [26] within 8 days of editing.
• Zjarri is fluent with quoting wikipolicy, all within the first month of opening an account: [27] [28].
• In addition, within the first month of editing, Zjarri is dishing out advice at AN/I [29] [30] [31], files an AIV report [32], files an SPI [33], files a 3RR report [34], participates at AfD, knowing what a content fork is [35], and requests a page move in a highly knowledgeable manner [36]. All within a month of editing (by which time he has ~1000 edits).

Similarities with Sarandioti

• When Zjarri creates his talkpage, he does so by posting this bizarre warning [37] [38], telling others not to leave warnings or he'll report them. I have never seen such pre-emptive hostility from a new user (let alone one who knew about reporting users). It's as if he expects trouble ahead. Tellingly, a similarly bizarre "notice" was used to dissuade users from posting on the talkpage of the Kreshni25 sock account [39].
• Zjarri is fluent in Greek [40] [41], French & German [42]. These are exactly the same languages that Sarandioti is fluent in [43].
• All of Zjarri's IPs that I have seen on IRC chat are in Athens, Greece. We know that Sarandioti lives in Greece [44], and the Alarichus sock [45] was based in Athens.
• One of Sarandioti's MAJOR obsessions was removing of Greek names from towns in Albania [46] [47] [48] [49] [50] [51] [52] and the concurrent addition of Albanian names to towns in Greece [53] [54] [55] [56] [57] [58], a trait Zjarri shares to a very high degree [59] [60] [61] [62] [63] (as well as labeling the removal of Albanian names as "vandalism").
• In conjunction with name removal, Sarandioti was particularly fond of cramming as many notable people of Albanian ethnicity in city articles, while at the same time removing notable Greeks, as a way of increasing the "Albanian-ness" and decreasing the "Greekness" of these places [64] [65] [66] [67], a trait also shared to a large extent by Zjarri [68] [69].
• Drawing a distinction between Greeks and Greek-speakers was extremely important to Sarandioti [70] [71] [72] [73], a trait shared by Zjarri [74]
• Sarandioti had a marked tendency to dismiss edits he disagreed with by incorrectly accusing his opponents of WP:IDONTLIKEIT [75] [76] [77], a trait shared to a very large extent by Zjarri [78] [79] [80] [81] [82], who bandies it about all the time.
• Sarandioti liked to use WP:BRD as a way of justifying his reverts [83], something which Zjarri does also [84] [85] [86].
• Sarandioti had a marked tendency of changing headings on his talkpage that he didn't like [87] [88] [89], something which Zjarri unmistakably replicates [90] [91].
• A strong overlap in articles, including highly obscure ones [92]. There is hardly an article edited by Sarandioti that is not edited by Zjarri. Of course, Zjarri has edited a lot more articles than Sarandioti, since many articles now exist that didn't when Sarandioti was still around.
• Zjarri absolutely HATES warnings on his talkpage, and removes them immediately [93] [94] [95] [96], just like Sarandioti [97] [98].
• Zjarri is active on IRC chat every single day, as were ALL of Sarandioti's socks (Alarichus, Kreshnik, Muzakaj)
• Zjarri has a habit of copy-pasting the same edit summary for identical edits [99], exactly like Sarandioti [100]
• Zjarri is characterized by an extreme defensiveness, always admonishing others to stop accusing him, taking any criticism as a personal attack, and especially likes to remind users that they have been "warned by admins" [101] [102] [103] [104]. He sounds EXACTLY like Sarandioti [105] [106] [107].

Time of edits

What removed any remaining doubts in my mind that ZjarriRrethues is a sock of Sarandioti was the time pattern of his edits. When we look at the distribution of times that the two accounts edit, they are identical down to the last detail [108] [109]. Note how the hours 1-5 UTC are the only ones that are relatively free of any edits, how editing usually begins around 6 am UTC, reaching a peak of activity around 9-10 am, followed by a dip around 12-13 (lunch?), reaching a secondary peak in the late afternoon and evening hours, finally tapering off around 00 hours. This is even more true if we compare the last 800 edits of ZjarriRrethues Sarandioti's ~800 edits (so that the graphs have the same number of entries): [110] [111]. Identical! Now, there are many, many users in that time zone, but NONE have a pattern so closely resembling that of Sarandioti [112] [113] [114]. I was also struck that Zjarri stays on till very late (2-3 am Greek time, UTC+2), just like Sarandioti. Compare Sarandioti's "bedtime" [115] with some of Zjarri's recent "bedtimes" [116]. Even when he doesn't edit particularly late, he is on IRC chat every single day till 2-3 am.

Figure of speech

Also very telling is the fact that Zjarri sounds exactly the same as Sarandioti. Many of the the figures of speech and expressions the two accounts use are identical. This evidence is listed in Table format here.

Note the length of most talkpage posts is roughly the same (mostly one-two liners, occasionally 4-5 sentences, anything longer than that is quite rare), many are quite defensive, condescending, and incivil, the level of English is the same, and the frequency with which he uses edit summaries is about the same.

A strange unblock request

Once I became convinced that Zjarri was a sock of Sarandioti, I let it be known that I would file an SPI in the near future [117]. Almost immediately, the original Sarandioti awakens from his apparent slumber to post an unblock request on his talkpage [118]. In addition to the strange timing, what is also suspect about this request is that when I post on his talkpage opposing the unblock request, contrary to Sarandioti's explicit instructions, there are none of the expected howls of protest and indignation by Sarandioti. Stranger still, Sarandioti does not protest when the request is turned down. Not a peep. This is identical to the behavior after Sarandioti was blocked for creating his first sock, Alarichus [119] (see point #2 in evidence). There is also a two hour gap between Zjarri's last edit prior to the request, the unblock request by Sarandioti, and the resumption of editing by Zjarri. This gives him plenty of time to go to another internet cafe to post the unblock request, so as to be CU-safe.

Previous SPI

I apologize for the the length of this SPI, but I am convinced that Zjarri has found a way to cover his tracks IP-wise, so behavioral evidence is key. I have been observing Zjarri on IRC for quite some time, and I note that while all of his IPs are from Athens, he uses a different ISP than Sarandioti (who used Otenet). Same location, different ISP. In the past, I hastily and carelessly included Zjarri in an SPI I filed [120]. There was much IP disruption at the time, and many of these IPs used edit-summaries highly reminiscent of Sarandioti. At the time, I was so confident that I would catch him as easily as in the past, that I included minimal behavioral evidence, thinking the CU would prove me right. However, since by then he had presumably changed ISPs (or started frequenting netcafes that used a different ISP), the CU came up negative. It is possible, if not easy, for a particularly determined sockpuppeteer to change ISPs or frequent different netcafes (and Sarandioti is nothing if not determined). However, it is impossible for him to change cities. I am not requesting a CU, because the logs for Sarandioti are by now stale, however, IF a CU is performed, I have no doubt that it will show that Zjarri is editing from the same city as Sarandioti. The odds of two different people sharing the same exact POV, speaking the same languages with the same level of fluency, and editing with the same time pattern from the same foreign city are small indeed. Combined with the overwhelming behavioral evidence, I think there is no doubt that ZjarriRrethues is a sock of Sarandioti.

So that this page does not degenerate into the kind of circus that the last SPI involving an Albanian user did (Guildenrich), I ask that participants try to limit themselves to a single post discussing the evidence and use the SPI talkpage for discussion. I would like to conclude the investigation by pointing out that we are not dealing with a run-of-the-mill amateur sockpuppeteer here. This is a serial sockpuppeteer who has been socking pretty much non-stop since this time last year. As soon as one account was blocked, he would pop up another one. I don't think there is ANY length that Sarandioti would not go to to continue socking, whether it is changing ISPs and computer, frequenting a different netcafe, using a proxy, etc... Athenean (talk) 23:02, 3 August 2010 (UTC)

Comments by accused parties   

See Defending yourself against claims. Well I must say that after being threatened by this user so many times I was wondering when he would report for something else other than being a sockpuppet. Replies:

• All the articles I've edited have also been edited by almost all active Albanian users on wikipedia like Sulmues (talk · contribs).
• All the summaries I have been using have also been used by most Albanian editors and some of them were copied by other users. Most users do have edit-summaries they frequently use.
• I don't think I have been incivil in wikipedia and I certainly don't think that I have left messages insulting anyone like the user whose sock I'm supposed to be.
• I have already been proved not to be someone's sock in the past report of me being Sarandioti (talk · contribs).
• "Major naming obsession", well if that's an argument used by Athenean, then my reply would be that all users in Albanian-Greek related articles seem to be doing the same thing. In fact Athenean himself along with other users like Alexikoua have been doing the same thing but I haven't reported the one being a sock of the other.
• Distinction between Greeks and Greek-speakers? Athenean I think I should remind you WP:OR, so if Sarandioti wanted to follow the policy then I'm certainly not the one responsible. It seems that all user on Albanian-related article have been the same thing like Alexikoua in this edit [121] making a distinction between Albanians and Albanian-speaking people.
• Time of edits?Using the same argument I could say that Alexikoua is also a sock of Sarandioti because he has approximately the same editing frequency. Is that an argument for anything else other than proving same timezone?

• I find it extremely disruptive that you feld the need to use this much server space to proceed in an attempt to remove me from wikipedia like you did with Sulmues (talk · contribs) and Kushtrim123 (talk · contribs) whom you reported or co-reported as Sarandioti's socks with approximately the same arguments as they too noticed. I have already been proven not to be the one who apparently according to you is the sockmaster of all Albanian editors. This is behavior of yours will be reported to AE and I will ask for a solution.(Btw the same arguments have been used in all your past failed reports and most of my answers have been also used to refute them)

• When I was CUed about 3 months ago it was shown that I wasn't him and Athenean suggests that somehow there has been an ISP change to fit his theory? Btw Athenean used a similar theory to frame Sulmues as Sarandioti when he suggested that Sulmues had given his password to Sarandioti and then left wikipedia, so I think that this user's reliability is obvious.--— ZjarriRrethues — ^talk 23:26, 3 August 2010 (UTC)

• Update: It seems that Sarandioti about just month ago asked to be unblocked [122] so really why would anyone who already controls all these accounts and frequently edits from them even bother doing such a thing when he has already "escaped" the CU?--— ZjarriRrethues — ^talk 23:55, 3 August 2010 (UTC)

Comments by other users

For the record: he knows about DYK because I explained it to him on IRC. DS (talk) 23:43, 3 August 2010 (UTC)

---