Wikipedia:Sockpuppet investigations/SPI/Administrators instructions: Difference between revisions
→Sock puppets (registered accounts): +cleanup/color |
→Sock puppets (IP addresses): +cleanup |
||
Line 108: | Line 108: | ||
{|class="wikitable" cellpadding="4" width="90%" align="center" style="margin: 1em auto 1em auto" |
{|class="wikitable" cellpadding="4" width="90%" align="center" style="margin: 1em auto 1em auto" |
||
|- |
|- |
||
|bgcolor= |
|bgcolor=blue| <tt><font color=white>'''I'''.</font></tt> |
||
|'''Determine whether a block is needed''' – sometimes, a block won't be necessary on an IP. In the following situations, a block should not be necessary: |
|'''Determine whether a block is needed''' – sometimes, a block won't be necessary on an IP. In the following situations, a block should not be necessary: |
||
*The [[WP:AUTOBLOCK|autoblock]] placed on the sockmaster is going to take care of the IP. |
*The [[WP:AUTOBLOCK|autoblock]] placed on the sockmaster is going to take care of the IP. |
||
Line 114: | Line 114: | ||
*The IP address is part of an entire range of IP addresses that have already been blocked; we usually refer to this as a [[WP:RANGEBLOCK|rangeblock]]. |
*The IP address is part of an entire range of IP addresses that have already been blocked; we usually refer to this as a [[WP:RANGEBLOCK|rangeblock]]. |
||
|- |
|- |
||
|bgcolor= |
|bgcolor=green| <tt><font color=white>'''II'''.</font></tt> |
||
|'''Block the IP |
|'''Block the IP if needed''' – Click "block user" by the corresponding IP account on the SPI case page. ''Account creation blocked'' should be set. The length of the block should be an arbitrary length determined by the admin, but it should not be indefinite nor too long as to not allow other persons to use the IP in the future. |
||
*''[[Open proxies]]'' – if an IP is a suspected or discovered open proxy, they must be processed in accordance with the [[Wikipedia:Open proxies|open proxies policy]]. Alternatively, patrolling admins may ask any CheckUser to confirm that the IP is an open proxy, or they may report it to [[Wikipedia:WikiProject on open proxies]]. |
*''[[Open proxies]]'' – if an IP is a suspected or discovered open proxy, they must be processed in accordance with the [[Wikipedia:Open proxies|open proxies policy]]. Alternatively, patrolling admins may ask any CheckUser to confirm that the IP is an open proxy, or they may report it to [[Wikipedia:WikiProject on open proxies]]. |
||
*''[[WP:SIP|Sensitive IP addresses]]'' – double-check to make sure that the IP being blocked is not on the list of [[WP:SIP|sensitive IP addresses]]. If it is, immediately contact the [[meta:Communications committee|Wikimedia Foundation Communications Committee]]. |
*''[[WP:SIP|Sensitive IP addresses]]'' – double-check to make sure that the IP being blocked is not on the list of [[WP:SIP|sensitive IP addresses]]. If it is, immediately contact the [[meta:Communications committee|Wikimedia Foundation Communications Committee]]. |
||
|- |
|||
|bgcolor=#d76b00| <tt>'''III'''.</tt> |
|||
|'''Tag only the sock puppet's user talk page''' – Unlike with registered accounts, we usually don't tag the user page since another person in the future may edit under that IP. On the bottom of the IP address's talk page, add <tt>{{tlsp|SockBlock|period=duration|sig=yes}}</tt>, replacing "duration" with the length of the block. |
|||
*''For [[open proxies]]'' – On the bottom of the open proxy's talk page, add <tt>{{tlp|Blocked proxy|host=proxy.example.com (optional)}}</tt>. |
|||
|} |
|} |
||
Revision as of 23:11, 23 October 2011
This page covers the procedures for patrolling administrators. For clerk and CheckUser procedures please see here. To open a case, please do so here.
This page outlines instructions by patrolling administrators for sockpuppet investigations (SPI), which is used to discuss whether a user is likely to have violated Wikipedia's sock puppetry policy. When reviewing cases, keep in mind that there are legitimate uses of multiple accounts, and that improbable things can happen by chance. Unfairly blocking someone as a sockpuppet is a harm not easily undone.
How to open an investigation
To open an SPI case, please follow the instructions at Wikipedia:Sockpuppet investigations#Submitting an SPI case, making sure you have read and understood the SPI case guidelines. Similarly, to request CheckUser, please follow the instructions in that same section (in the collapsed box below the two input boxes), making sure you have read and understood when and when not to request CheckUser at Wikipedia:Sockpuppet investigations#CheckUser.
Useful tools
- The markblocked script, which indicates if an account has been blocked already, either for a set period of time or indefinitely.
- Wikistalk, which can be used for analyzing the editing history of two accounts.
Taking administrative action on open cases
Any uninvolved administrator at any time may block any account that has violated the sock puppetry policy based on behavioral and/or technical evidence. Behavioral evidence consists of editing behaviors and patterns from suspected sock puppets as well as having similar usernames or IP addresses. Technical evidence consists of evidence provided by CheckUsers, in which the details are not shown to the public per the Wikimedia Foundation's privacy policy. Administrators are the primary people who hand out blocks in most SPI cases.
Non-CheckUser cases
- If the patrolling administrator (or any user) feels CheckUser is appropriate and necessary they may request it; see below.
![](http://upload.wikimedia.org/wikipedia/commons/thumb/e/e8/Duck3.jpg/200px-Duck3.jpg)
In usual SPI cases, where CheckUser is not requested, admins should look carefully and neutrally at the evidence and determine whether the behavioral and other evidence shown makes it very likely that sock puppetry is occurring. In many cases, sock puppetry can be determined just by behavioral evidence and without the need for technical evidence. Many admins normally apply what is colloquially called the duck test – if it looks like a duck, swims like a duck and quacks like a duck, it's probably a duck.
Patrolling administrators should be sure to:
- Check that any CheckUser-confirmed accounts have been blocked and tagged – Those accounts that have been
confirmed by CheckUser are normally blocked, but they should be double-checked to make sure that they are. If they have not been blocked, then follow the blocking procedures found in the Blocking and tagging section.
- Check evidence and block/tag any sock puppet accounts – For accounts that have not been confirmed by CheckUser nor already blocked, check the behavioral evidence along with the results of the technical evidence provided by CheckUser. Make a determination as to whether sock puppetry has occurred. If so, block those violating accounts, following the procedures under the Blocking and tagging section, and make a note of the blocks under the "Clerk, patrolling admin and checkuser comments" section of the SPI case page. If evidence has not shown that sock puppetry has occurred, then likewise make a note of that in the same section. Preface all such notes using the {{Admin-note}} template. For example:
- {{Admin-note}} Foo has been indefinitely blocked, 192.168.0.1 blocked for three weeks. ~~~~
CheckUser cases
![]() | Warning: CheckUser is a technical tool. If behavioral evidence suggests a strong likelihood of sock-puppetry or abuse, then this may be the case even if CheckUser shows no technical connection. |
Cases endorsed for CheckUser attention are identical in every way to non-CheckUser cases, except that a CheckUser will first add the results of their technical investigation to the case, and may have already taken some actions on the spot when abuse is found, before patrolling admins review the case.
CheckUsers will have posted their results under the "Clerk, patrolling admin and checkuser comments" section. The possible templates they could use include but are not limited to in order of most likely the same editor to unlikely the same edior:
Confirmed
Likely
Possible
Unlikely
Unrelated
Inconclusive - in other words can't depend on the results
- The IP addresses used by sock-puppets may also be
IP blocked.
Once Checkuser results have been added, any admin may re-assess and decide the issue.
Requesting CheckUser
If CheckUser has not been requested, you can request CheckUser assistance by changing {{SPI case status}}
on the top of the page to {{SPI case status|curequest}}
.
This does not guarantee that a CheckUser will run a check, but it will alert the SPI clerks and CheckUsers that a request may be needed. Normally, an SPI clerk or CheckUser will either endorse the case for CheckUser attention or
decline the case. Ultimately the decision is down to the responding CheckUser.
Any user can add this request to a case at any time, if appropriate. The most common reasons are:
- The behavioral evidence is not clear, and you cannot figure out all the socks
- There may be other hidden socks, or an unknown previous history of socking, and help is needed to find the sock-master or "sleepers"
- The underlying IP needs blocking, or more thorough investigation is required (eg in the case of an ongoing problem, confirming suspected block or ban evasion, suspected hidden problems, or serious repeated vandalism)
- (Full list)
If the case is declined, then the patrolling administrator must make that determination as to whether sock puppetry is going on and subsequently block all violating accounts. If the case is endorsed, then a CheckUser will add technical evidence and notes to the case first; this may take a while.
Closing
If the case is complete, all accounts have been looked at and any issues dealt with, and the case has run its course with no further action needing to be taken, then the clerks can be asked to review and close the matter. To request that the case be closed, change the parameter of the {{SPI case status}}
template on the top of the page to close along with adding a note in the "Clerk, CheckUser, and/or patrolling admins" section, confirming the final resolution and that all accounts have been addressed. For example,
======<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>====== {{Admin-note}} All accounts blocked and tagged. ~~~~ ----
The tagging will alert the SPI clerks and CheckUsers, who will do a final review before archiving the case.
Blocking and tagging
Follow these instructions to block sockmasters and sockpuppets.
Sockmaster (if not already blocked)
If the sockmaster has not already been blocked and tagged, then do the following:
I. | Make a determination as to the length of the block – an administrator may determine the length of the block of the sockmaster, after considering the following circumstances:
|
II. | Block the sockmaster – Click on the "block user" link under the sockmaster's account on the SPI page. The length of the block should have been determined per Part I.
|
III. | Tag the sockmaster's user page – Unless otherwise directed, the sockmaster needs to be tagged, if it has not already been done.
|
Sock puppets (registered accounts)
If a registered account has been shown in engaging in sock puppetry and is not the sockmaster, then perform the following tasks:
I. | Indefinitely block the account – click "block user" by the corresponding sock puppet's account on the SPI page and then block the user. |
II. | Appropriately tag the sock puppet's user page – Unless otherwise directed to, the sock puppet needs to be tagged, if it has not already been done. |
Sock puppets (IP addresses)
If an IP address has been shown in engaging in sock puppetry, then perform the following tasks:
I. | Determine whether a block is needed – sometimes, a block won't be necessary on an IP. In the following situations, a block should not be necessary:
|
II. | Block the IP if needed – Click "block user" by the corresponding IP account on the SPI case page. Account creation blocked should be set. The length of the block should be an arbitrary length determined by the admin, but it should not be indefinite nor too long as to not allow other persons to use the IP in the future.
|