Wikipedia:Sockpuppet investigations/Icewhiz

Icewhiz

Icewhiz (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Populated account categories: confirmed · suspected

For archived investigations, see Wikipedia:Sockpuppet investigations/Icewhiz/Archive.

14 May 2020

– This SPI case is open.

Suspected sockpuppets

• KasiaNL (talk⁺ · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• 2601:585:8200:F310:6CAB:E042:A5F3:F54A (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 2601:585:8200:F310:94AB:237E:EFDB:F025 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))
• 2601:585:8200:F310:B0C1:24F1:303:F986 (talk⁺ · tag · contribs · filter log · WHOIS · RBLs · proxy check · block user · spi block · block log · cross-wiki contribs · CheckUser (log))

• Tools: Editor interaction utility • Interaction Timeline • User compare report Auto-generated every hour.

I am filling this, expecting the finding that this account operates under a proxy as well, confirming that we are resigned to dealing with an army of abusive socks infesting the topic area (despite prior reports and the fact that several editors familiar with Icewhiz such as User:Volunteer Marek and User:MyMoloboaccount concur with me that the behavioral evidence is pretty clear; this really should be listed under a WP:LTA). I understand there are concerns with privacy (outing due to IP addresses reported here) and/or fear that a block based on behavioral evidence will be challenged and one will be criticized by their peers, but the mop and bucket are supposed to be used - and right now I am watching with more and more concern as this topic area deteriorates with socking at a level that I haven't seen in a decade or so, if ever. But here we go, again. I will also add a summary of the prior sock reports so you can see the patterns more clearly if you have not been following this closely.

• background note: Icewhiz was topic banned by ArbCom from EE TA on 22/23 September 2019 and indef banned for harassment or such a week later. Now, quoting from this newspaper interview published shortly after: "Icewhiz admits he can be a bit obsessive, and over the past year and a half he has documented almost fanatically what he claims is a systematic attempt by a handful of editors to rewrite the history of the Holocaust [article links to ArbCom case here]... Though Icewhiz has earned a bad reputation on Wikipedia, due to his combative personal style and aggressively pro-Israel position... Icewhiz says that he brought his story to Haaretz because he has all but lost the battle against Polish revision on Wikipedia." Do you think that a person who was invested enough to get a journalist interested in their story is just going to walk away from this?
• (1) AstuteRed (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log) (account created October 26 2019) he went dormant after my sock report here but reactivated on April 30). This account specializes in the LGBT topics that Icewhiz was interested in and overlapped at the obscure Polish historian who is both anti-LGBT and arguably anti-semitic (Chodakiewicz). Note that at an AfD of an article this account created, Wikipedia:Articles for deletion/About the Civilization of Death, we see the participation of another suspected sock I reported shortly after and will discuss below (User:I dream of Maple)
• (2) I dream of Maple (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log) aka IDOM (account created November 9) I refer to my extensive evidence at Wikipedia:Sockpuppet_investigations/Icewhiz/Archive#10_December_2019. While this account was ruled 'inconclusive' by CU (sigh), User:El C was also concerned that it raises many red flags and topic banned them from the TA for a good measure (thank you). That account has been inactive since; I assume that the topic ban removed their reason for existing (and switching to another TA of interest to Icewhiz would be too obvious...). However, for additional behavioral evidence, please note the pattern of quickly racking up edit count through what seems to be a recent change patrol, as well as quick adoption of Twinkle. Clearly 'not a new account' (rapid learner, adopts advanced jargon (BLP, etc.) and tools within a few weeks). Also, note the edit pattern of a few days of activity followed by breaks, shared by other socks as well. Those patterns started with this account and has been repeated by all main suspected sock accounts since.
• (3) Pestilence Unchained (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log) (account created Feb'20) See my evidence at Wikipedia:Sockpuppet_investigations/Icewhiz/Archive#24_April_2020. Nearly identical pattern to IDOM above (recent changes edit ramp, Twinkle, off and on every few days). Note that the account went dormant as soon as the SPI was filled, like others, but was reactivated on 8 May, shortly after the SPI case was closed. This is worrying and suggests Icewhiz came to the conclusion that the SPI reports here are just noise and having found access to unblocked proxies, he can now operate with impunity - and with multiple simultaneous accounts as well. Note that almost half of his recent edits relate to the EE/Jewish topic area. His edits there have a very aggressive POV that continues to match Icewhiz ([1] -> further behavioral evidence). Learning from IDOM's red flags, this account tries to pass off as a new user by Wikipedia:Adventure module (Feb 22). But another suspected sock I'll discuss below discovered this module earlier.
• (4) So, KasiaNL (the main star of today's report). The account was created on November 19. That is a month after another suspicious account with the same naming pattern (Polish female name and two capital letters; Kasia is a Polish name), JolantaAJ (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log), was created (it was an SPI created solely to harass me and got quickly blocked by User:SQL; Jolanta is a Polish name too). And on that naming pattern, note also Urszula73 (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log). This one made just a single edit, but in addition to matching the naming pattern (female Polish name + two symbols), it intersets with Icewhiz LGBT interests (the article it edited is also related to AstuteRed's and IDOM's activity: [2], [3]). Btw, I've been monitoring User:AlexNewArtBot/PolandSearchResult for 10+ years and this is a pretty unique naming pattern. But the naming pattern is not a problem (just a tale). Let's look at more.
  • Nearly identical pattern to IDOM and PU above (recent changes edit ramp, Twinkle, off and on every few days). Within a week of the creation, the account settles in the pattern of undoing minor vandalism ([4]), not raising a single red flag (clearly not a new user, what n00b knows what vandalism is and how to undo it, 100% error-free, within their first week here, without a single missstep?). This account quickly makes a Wikipedia:Adventure edit too (Jan 6) which is IMHO a way that Icewhiz attempts to deflect the IDOM's red flags of not being a 'new user'; PU was reported earlier but in the hindsight that account is just following the path cleared by Kasia. Unfortunately for him (err, her/them, I don't think Icewhiz ever disclosed their gender, and this account uses a feminine name...) they still learn way too quickly. By December 4 (so before IDOM is reported) Kasia knows how to report vandalism on a dedicated Wikipedia namespace page, using complex templates ([5], [6]). Kasia is a bit impatient and starts using Twinkle on the same day she did the Aventure ([7]). Since in my educator capacity I have taught over 1000 students the basics of Wikipedia editing, I can say it with somewhat of a professional air that 99.9% new editors will need years before they even become aware of Twinkle. Or of Wikipedia: Adventure module, for that matter. Or the Recent Changes tool (in all my years as an educator I never ever had a single one of my students ask me about any of those features). Anyway, Kasia goes full ham on recent pages patrol, not raising any red flags - for three more days, then goes inactive until April (I expect Icewhiz is operating a number of accounts that way, racking edit counts and waiting for the socks to mature and get auto-confirmed rights and such). Before the account goes dormant, she doesn't know how to sign on talk pages [8]. The account resumes minor mass production of recent changes Twinkle-powered undos in early April. During her break, she somewhow mastered the concept of signing talk pages ([9]. [10]). Within days she is active in technical areas such as AfDs ([11]) or RSN ([12]). At this point I think there is enough behavioral evidence to conclude that just like all previously discussed accounts, this is not a new user (I would also expect that admins/CUs would be familiar with such patterns as I am sure multiple sock masters employ similar strategies).
  • Anyway, being a non-disruptive sock doesn't usually warrant an SPI or such, so let's take a look at what ties this account to Icewhiz's patterns:
    • May 7th: [13] displays knowledge of SPLC and hate groups which is a TA overlap with Icewhiz, see for example Icewhiz's comments here Talk:Marek_Jan_Chodakiewicz#Activist
    • May 7th: [14] undoes my edit which added Category:Polish Jews to an obscure article that this user never edited before. They also don't have much history undoing category additions or asking for references for categories, as so far they stuck to undoing simple vandalism so far. Additionally, my edit there was related to the name of the subject being mentioned at Talk:Stanisław Kot, where PU was active shortly before and would make more edits, including talk pages, a day later ([15]). So this edit raises red flags as follows: a) Polish-Jewish TA, second obscure TA overlap b) connected to the area known to be of interest to a suspected sock (PU) c) challenging my edit (reminder: me and Icewhiz are not 'best buddies'...). In fact, I think in the last few weeks, starting with PU's involvement in the SK article, Icewhiz decided that it's time to harass me (since all his other regular opponents are topic banned or inactive). But one edit can be an accident, so I just marked it as intriguing and waited for more. And oh boy, the diffs just come pouring in even as I am writing this up.
      • Also compare both the category removal and the broken English (which I'll discuss more below) to [16], another account recently reported here
    • May 13: an IP editor removes some content from an article Icewhiz was active in before: [17] (this fits Icewhiz POV of minimizing Polish victimhood). I undo this per WP:BRD. May 13 Kasia revert me and gives me a talk page warning ([18]). Within two minutes I receive a personal attack "warning" from an IP on my talk page ([19]). Harassment angle: I also teach with Wikipedia and my students regularly post on my talk page.
    • May 13: makes a c/e edit to History of Israel. [20]. Icewhiz has edited that page before making copy editing-type edits as well ([21]), so that's another TA matched and a direct article overlap.
      • The above is also interesting as a big chunk of Kasia's edit there is copyediting for English prose/clarity (Icewhiz spoke fluent English). Contrast it with broken English used on my talk page [22]/[23] or here [24]. Seems like an attempt to obscure one's fluence on purpose ("Icewizh was fluent so account X which speaks broken English can't be Icewhiz, right?"). But the account is inconsistent and can make normal comment even ones with advanced and perfectly correct English: [25], [26], [27], "delve deeper", (here discusses the word psychedelic and knows English expression "to be high"), likewise discusses language here. As I work with ESL students I can say this is very irregular. Also, edit to Broken English page suggests an interest in this very topic ("how can I sound more natural while pretending I am not good at English?" Riight).
      • The inconsistent pattern of broken English can also be seen in edits by other accounts reported here. Consider PU [28] ("You think he a patriot? You approve of him?", tone very similar to [29], same style of personal attack (loaded question - and I am still wondering how that 'new account' was able to find and link a diff from 2005...).
    • May 13-14: the IP editor made a number of disruptive/controversial edits related to the Polish-Jews history (see 2601:585:8200:F310:6CAB:E042:A5F3:F54A (talk · contribs · (/64) · deleted contribs · filter log · WHOIS · RBLs · http · block user · block log), 2601:585:8200:F310:B0C1:24F1:303:F986 (talk · contribs · (/64) · deleted contribs · filter log · WHOIS · RBLs · http · block user · block log) 2601:585:8200:F310:94AB:237E:EFDB:F025 (talk · contribs · (/64) · deleted contribs · filter log · WHOIS · RBLs · http · block user · block log), some with clearly abusive edit summaries or claims on talk (WP:NPA: [30], [31]; all three IPs where blocked shortly ago by User:Materialscientist for disruptive editing). One would have thought that Kasia, interested in recent changes patrol, would help undo them since this was her bulk of edits (simple clicking undo button on disruptive edits). Nope. As I revert the anon editor, she quickly reverts every single of my edits: [32], [33], [34]. With regards to the last diff, that article was protected following my request at RfPP, and I suggested to the admin User:Anarchyte on his talk that changing it to semi may reveal a likely sock. He did so, and within minutes Kasia edited the article.
      • I also want to stress that the IP/Kasia edits above are related to a particular subtopic of the Polish-Jewish TA that Icewhiz was very active in and that was presented as evidence in the ArbCom: namely challenging / removing content about Polish Righteous and helping Jews in the ghettos (just CTRL+F for keywords ghetto or righteous in Wikipedia:Arbitration/Requests/Case/Antisemitism in Poland/Evidence). Also [35] shows the account is familiar with some very obscure/niche literature in the TA (Icewhiz, of course, was familiar with those sources)
    • May 14: She also nominates a category I just created ([36]) suggesting the concept of a Jewish merchant is anti-semitic... and then starts badgering me on talk including threats of getting me banned ([37] - that probably warrants a NPA warning, if anyone still belives they do a damn).
  • Editor Interaction Analyser also adds that both Ice and Kasia frequently edited Wikipedia:Neutral point of view/Noticeboard (Ice 43, Kasia 8 - impressive considering the account's age) and both posted on Talk:Ben Shapiro (interestingly, all in surveys/RfC: [38]+[39] vs [40]. Also on Talk:Donald Trump, but this is a high profile page, so - shrug.

On a side note, there is always a possibility some of the accounts here overlap with banned sockmaster User:יניב הורון (see that account and Icewhiz tag teaming at Talk:Marek_Jan_Chodakiewicz#Activist for example). And at least one sock reported in this SPI was found to be related to Wikipedia:Sockpuppet investigations/יניב הורון. I think the broken English is more reminiscent of יניב הורון and was quite visible in edits of the account reported at Wikipedia:Sockpuppet_investigations/Icewhiz/Archive#07_December_2019 (ping User:My very best wishes; I am not very familiar with יניב הורון but it also stands to reason that two indef banned editors sharing POV, one of whom is clearly confirmed to be socking, can exchange tips and otherwise coordinate some actions), but regardless, I think that in this case, the broken English is fake and simply an attempt to 'muddy' the waters and throw a wrench in the behavioral evidence (not that it needs much derailing...).

I will also ping admins/CU who commented on this issue before: User:Ivanvector, User:El C, User:Mkdw, User:Bbb23, User:Oshwah, User:TonyBallioni, User:Bradv. Guys, this is really getting serious, the ArbCom issued topic and indef bans for a reason, and they appear to be ignored or worse, treated with contempt. The socks are now so emboldened they are harassing me on my talk page... --_{Piotr Konieczny aka Prokonsul Piotrus| reply here} 10:07, 14 May 2020 (UTC)

So the excuse that "I looking at Piotrus's edits since 13 May, because of this edit" is also a red flag. Kasia has been doing uncontroversial RC patrol since Day 1, without making a single 'wrong' or 'controversial' edit (until now), which in itself is unlikely for a new account. Crucially, she never reverted or otherwise challenged or criticized any established user, she has been doing only the no-brainer rvv-type of edits. Regarding the two other category reverts presented as a defense - one is for a new user, another is for a user with no userpage and a block log (I assume there are some RC flags for this kind of stuff); on a sidenote - how many of you understood category system and that they require references in your month 4 on Wikipedia? And we are assuming she read those articles and confirmed those categories are unreferenced, really? Yet more high-level wiki skills not commonly found in a new editor; challenging controversial categories is not even the usual RC type of an edit). The closer we look, the more apparent it is we are not dealing with a new account, just someone pretending to be one (don't forget the inconsistent English fluency, either).

Anyway, I just reviewed her talk page edit log, again, and she never left a warning message on a talk page of any regular account (just IPs/new accounts). Since adopting Twinkle she also never left a non-template additional warning to anyone except me ([41]), nor engaged in any talk exchange outside her talk page. So what are the odds she reverts me several times in a few days, all on the Icewhiz-favorite TA? And that I became the first regular editor to receive her custom warning? My editing pattern is clearly totally different from the regular new account vandal/n00b she has been warning till now. So I am the first regular account that made an edit that made her interested in edits of a regular Wikipedian? Also, a good-faithed RC n00b, if we can imagine such a rare type of an editor, would likely be cautious and polite, and would not engage in aggressive badgering and ban threats in their first talk page interaction with a regular. Kasia's attitude towards me is very aggressive - again, perfectly reminiscent of Icewhiz's attitude towards those he wanted to pick a fight with (don't forget, he was indef banned for harassment in the end). And it's not like she is aggressive towards others, from what I can see of her limited interactions. Why attack me (or nominate my category for deletion in her first deletion nomination ever)? Coincidences, again?

Mind you, I am a very active user, and "since 13 May" I made ~200 edits or so. Which is why another red flag is the claim that "I got to this report, looking at Piotrus's edits." What are the odds that in my ~200 edits in those ~2 days she would find my post to this page of interest (edit summary did not mention her and she has no history of being interested in SPI investigations; also on the subject of the log, she can see my post here was very large, +22,267, c'mon, how many people want to review or even read long posts in Wikipedia space unless they specialize in this aspect of the project or are otherwise involved in the issue)? Vandalism to W-namespaces is super rare, what are the odds she would want to review this edit in more detail due to RC (I don't think she ever reverted any vandalism to RC pages)? Particularly given the volume of my daily edits? Most RC patrollers, or new users, would just ignore it (and ignore me). Unlikely innocent coincidence? Number 10 for this account? I lost track already. --_{Piotr Konieczny aka Prokonsul Piotrus| reply here} 01:52, 15 May 2020 (UTC)

Comments by other users

Accused parties may also comment/discuss in this section below. See Defending yourself against claims.

Comments by MyMoloboaccount

Joe in regards to your comment , what level of behavioural evidence is needed to link an account to him?

last time I reported a suspected sock-puppet JoeZ45 we had pretty damning behavioural evidence but it was ignored by Bbb23 for reasons unknown to me See:

• Icewhiz:

[42]Poles killed more Jews (100,000-200,000 per Gross) than Poles killed Germans (at most 30,000 per Gross).)

• Icewhiz:

[43]the Polish movement (outside of the failed Warsaw uprising mentioned in the text in 1944 where it is relevant) had little impact on war (if were are to mention it - perhaps it bears mentioning estimates that killed more Jew than Germans

• JoeZ451:

[44]Gross tells Poles killed more Jews than Germans.

Note use of the same use of language by Icewhiz and JoeZ451 in edit summaries and comments.

• JoeZ451:

[45]Wild claims from Home Army veteran organization.

Icewhiz:

[46] contains rather wild upper limits for the AK's

• Icewhiz:

[47]including the IPN Bulletin - mainly distributed in schools, full of hero worship and religious styled text..

• JoeZ451:

[48]Wikipedia should not use Polish schoolbooks parroting Home Army veterans.

• Icewhiz:

[49]UNDUE weight to small minority opinion, low quality sources

• JoeZ451:

[50]Replaced low-quality Polish language

• Icewhiz:

[51]Right-wing media - tag better source. [52] reliable sources as opposed to blogs

• JoeZ451:

[53] Polish blogs and right-wing media

The above behavioural evidence was pretty damning in my view. I struggle to understand why Bbb23 ignored this. This really needs to stop. --MyMoloboaccount (talk) 10:29, 14 May 2020 (UTC)

Comments by KasiaNL

Idea I editing from south Florida, where IP from: [54] is funny.

This filing is vindictive and retaliatory, response to posting concerns on Piotrus's page: [55].

I am looking at Piotrus's edits and got involved in few articles where Piotrus reverted the IP, after I discovered edit: [56]. In this edit Piotrus absuses a source (otwarta.org), and places: "In 2001, PhD Andrzej Leszek Szcześniak published Judeopolonia - the Jewish state in Poland, explaining the origins of pre-war Jewish saying 'our tenements, your streets'.".

But otwarta.org does not mention the book, the book is by an extremist nutjob, and "our tenements, your streets" ("Wasze ulice, nasze kamienice") is not a "Jewish saying" but "popular Polish saying, which anti-Semites ascribe to Jews"[57][58][59]. I give sources, but anyone who know little Polish understand how bad this is without sources. "Wasze ulice, nasze kamienice" known by everyone. I think this was good cause to look at Piotrus's edits.--KasiaNL (talk) 10:36, 14 May 2020 (UTC)

Evidence of my doing Wikipedia adventure, installing Twinkle, user warnings on January 6th is funny. I do all that after it was all suggested to me: [60]. --KasiaNL (talk) 10:49, 14 May 2020 (UTC)

So much false statements by Piotrus above, but I will refute his claim I "don't have much history undoing category additions". I remove imporper sourced categories all the time: [61] or [62] (which how I edit Shapiro to start with). I get to these from RC patrol or forking from other contribs. Once Piotrus put source for category, all good. I can refute more, but I feel Piotrus trying to deflect from his edit I described above.--KasiaNL (talk) 13:10, 14 May 2020 (UTC)

@MrClog:, I looking at Piotrus's edits since 13 May, because of this edit: [63] I described above. I got to Piotrus from meeting the IP/64 at RC patrol (I think this edit: [64] on 12 May), and I've been watching the IP/64's edits, as I have some concerns but also think IP/64 is trying being contructive. I got to this report, looking at Piotrus's edits.--KasiaNL (talk) 13:48, 14 May 2020 (UTC)

Comment by Nihil novi

No Polish person that I have ever spoken with has used such outlandish English vocabulary, grammar, and syntax – alternating with perfectly normal English usage – as KasiaNL has been favoring us with. I wonder: what is the purpose of such transparent misdirection? Nihil novi (talk) 10:59, 15 May 2020 (UTC)

Comment by François Robere

• @Joe Roe: Forgive my legalese, but it's a good basis for this decision. The standard of evidence in common law countries is (analogous to) "99% certainty" for criminal cases, and ">50% certainty" for civil ones; in civil law it's the same for the former, but much higher for the latter.[65] I submit that here the standard of evidence should be between the two, as SPIs are punitive in nature and can result in indef blocks and damage to editors' reputations. Of course, there's a cost-benefit trade off here: the higher the standard, the less "socks" you'll catch; the lower, the more false positives you'll have. Barring an all-out assault by "socks", and given the current state of the TA, I think we should be more worried about false positives - we don't want to throw out potentially good contributors just because their POV or interests intersect with those of a blocked editor, especially when there's no evidence of the sort of misconduct that got that editor blocked.
• A couple of things no one brought up yet are time sheets[66][67] and top edits.[68][69] For your perusal. François Robere (talk) 12:20, 15 May 2020 (UTC)

Question from MrClog

How exactly did KasiaNL find out about this report? They haven't been notified about the report. --MrClog (talk) 13:38, 14 May 2020 (UTC)

@Ivanvector: "if the mention is not on a completely new line with a new signature, no notification will be sent" (WP:PING). KasiaNL was not mentioned in the same line as Piotrus's signature. See also their above reply, according to Kasia, they have been watching Piotrus's edits since May 13. (Although I will note I'm not an expert on the Echo extension.) --MrClog (talk) 15:30, 14 May 2020 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

• I agree that we need to find a solution to this issue. If we accept that Icewhiz is perfectly capable of obscuring CU results using proxies, and it was always very likely that he would try and evade his ban, what level of behavioural evidence is needed to link an account to him? – Joe (talk) 10:14, 14 May 2020 (UTC)
• I got the ping and will try to look at this tonight. TonyBallioni (talk) 13:54, 14 May 2020 (UTC)
• @MrClog: the {{checkuser}} template pings users. Ivanvector (^Talk/_Edits) 15:24, 14 May 2020 (UTC)
  • It shouldn’t. I thought it was designed as an external link so it wouldn’t ping? TonyBallioni (talk) 21:34, 14 May 2020 (UTC)

---