Wikipedia talk:Sockpuppet investigations

	; Archives (Index) ;
	1; 2; 3; 4; 5; 6; 7; 8; 9; 10; 11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24; s/Archive1; s/Archive2; s/Archive3; s/Archive4; s/Archive5; s/Archive6; s/Archive7; s/Archive8; s/Archive9; s/Archive10; s/Archive11; s/Archive12; s/Archive13; s/Archive14; s/Archive15; s/Archive16; s/Archive17; s/Archive18; s/Archive19; s/Archive20; s/Archive21; s/Archive22; s/Archive23; s/Archive24; 25;
	This page is archived by ClueBot III.

Has CU broken completely down?

We have an open SPI case on scibaby that has lingered for 4 days (after being endorced)- and which is just growing larger and larger. Some of these have been blocked - but most have not. If there are any false positives amongst them - then it is problematic. --Kim D. Petersen (talk) 15:11, 10 April 2010 (UTC)[reply]

Hopefully this will change after the new checkuser/oversight elections, as the entire process seems to be hurting. Perhaps you could try asking individual checkusers if they could watchlist that case page? NW (Talk) 16:08, 10 April 2010 (UTC)[reply]

It is my perception (and maybe I'm wrong) that I've been the one doing most of the checkuser work here this week, and I've been avoiding it since I don't know much about serial sockpuppeteers, so that might be where the problem is. For what it's worth, checkuser requests going unanswered for four days used to be no strange thing, as there used to be a lot less checkusers. So at least there's that. But saying checkuser has "broken down" is a little bit dramatic, no? :) --Deskana (talk) 10:28, 11 April 2010 (UTC)[reply]

I guess people have other things to do than Wikipedia. Busy with real life, etc. --Bsadowski1 10:29, 11 April 2010 (UTC)[reply]

Was just about to post a similar comment on the need for more CU. I know the elections are ongoing, but I've definitely noticed longer than expected delays. The last two quick CU posts which I have been involved in have been a day or more before I ended up closing them out myself (in today's case by contacting J. Delanoy on email). 7 05:26, 23 April 2010 (UTC)[reply]

IMO I don't think more CheckUsers are going to help any (though ArbCom obviously disagrees with me on that). The thing is that most CUs are college students, and this is a busy time of the semester. It is very likely that you will see CheckUser activity pick up again within 3-4 weeks when school gets out. –MuZemike 05:32, 23 April 2010 (UTC)[reply]

Thanks a lot - now I feel really old. 7 05:42, 23 April 2010 (UTC)[reply]

(←) There's another one out there now here. If it hasn't been suggested already, it may make sense for all CU's to get access to the ACC site to allow them to clear up the backlog there. 7 01:21, 7 May 2010 (UTC)[reply]

Wikipedia:Requests for checkuser/Case/Upgrade1

I'm finding it as clear as mud how to reconcile the current instructions with the instructions that were in the above page from the older system. Specifically, having followed the instructions at the above page for reopening, which were to post a new request above a template on the page, I cannot see how to add that request into the current system. I did read the section on the current project page stating: "Note that these buttons may be used either for creating a new case or reopening an old one." but when I tried, it results in an entirely new page, with preloaded blank fields. A little help?--Fuhghettaboutit (talk) 03:18, 26 April 2010 (UTC)[reply]

All sorted, see: Wikipedia:Sockpuppet investigations/Crashingthewaves. Should you want to open a case on the user in future just use the input boxes on the main SPI page, and replace "SOCKMASTER" with "Crashingthewaves", don't worry about old RFCU cases existing. Hope this is all okay and makes sense. Kind regards, Spitfire^Tally-ho! 16:43, 3 May 2010 (UTC)[reply]

Thanks Spitfire! I do think it might be a good idea to update the notices on old RFCU templates to list that it's defunct, and give an explanation of what to do instead.--Fuhghettaboutit (talk) 20:57, 5 May 2010 (UTC)[reply]

There are notices at Wikipedia:Requests for checkuser and other related pages pointing users to SPI instead. If you have any suggestions on how to better do this, I would be open to making the changes. Tiptoety ^talk 21:02, 5 May 2010 (UTC)[reply]

Need a bit of help (formality wise)

I could use some help from a clerk, or anyone very knowledgable of SPI operations.There are two SPI investigations that Ive come accross that i think should be merged (both deal with the same editing trends); Wikipedia:Sockpuppet investigations/JC1123581321/Archive with Wikipedia:Sockpuppet investigations/The cheapo/Archive. I understand i need to get a clerk to do this? Sorry to bother any help would be most welcome Ottawa4ever (talk) 20:54, 1 May 2010 (UTC)[reply]

Done thanks for pointing it out. Kind regards, Spitfire^Tally-ho! 19:04, 6 May 2010 (UTC)[reply]

A potential new tool for SPI analysis.

I have just raised an SPI request. I don't want to talk about the specifics here, but do want to raise a discussion about the general principles which might apply quite independently of this particular case. I've been tracking SPIs for some months and the vast majority of such investigations are instigated against users who in general pretty naive about the analytic techniques that can be used to detect sock and meat puppets. A percentage of Wikipedians are relatively sophisticated in their knowledge of computing and such techniques. I know that I could easily defeat SP detection if I was sad enough to create such accounts. My questions arose from this potential situation.

How big is the issue of sophisticated sockpuppets that currently 'fly under the radar'?
Are there any other analytic tools which might help detect such potential abuses
Are there any other analytic tools which could help discriminate such cases once detected?

Now (1) are (2) are difficult Qs, but I have used a technique in the past in my then day job which I felt might be a (partial) answer to (3), and that is to construct a statistical analysis of post timing, and use this to test the question: are the posts for any two given users truly independent? I did this work a few months ago and have included a write-up at User:TerryE/Supplemental SPI analysis to explain this approach. I had a couple of suspect sockpuppets in this "sophisticated user" category, so I tried this test against these and also comparing the users to a number of "control accounts" -- that is other users with similar posting characteristics and for whom I had good supporting evidence that they weren't sock-puppets (e.g. they edited from different time-zones). The test seems to be effective in that it clearly rejected the controls but not the putative sock-puppets.

I would welcome comment and review. Have a look at the paper or refer it to colleagues who might be interested. I've included the main Perl script, so if you have Perl on your PC and the current MediaWiki::API then try it yourself on some test cases. Give feedback here or on the paper's talk page. I have also some thoughts about (2) but I am not sure if this is the correct place to raise them; if not then please point me to the appropriate page. -- TerryE (talk) 18:52, 6 May 2010 (UTC)[reply]

The problem is that even though the tools might be mathematically and statistically meaningful, this does not mean that they are behaviorally correct. I've seen analyses of exactly this sort used to say someone's obviously a sockpuppet because their edits overlapped; and I've seen analyses saying someone's obviously a sockpuppet because their edits did NOT overlap. Further, the "similar posting characteristics" are highly subjective in the absence of obvious things such as "always spells checkuser with a Q" or "always puts !!! in edit summaries". I, for one, will reject requests where analyses like these are the primary driver. --jpgordon^{::==( o )} 18:17, 7 May 2010 (UTC)[reply]

Such tools are an interesting input to the sockpuppet detection process, but can't be relied upon. As Jpgordon points out, the results can always be interpreted to match the intended result. We have a horrible problem with sockpuppeting, but there would be more benefit to loosening the rules about when checkuser can be run and tightening the rules about when alternate accounts are acceptable than trying for automated detection. We've had some sad tales of admins that got too wrapped up in sophisticated sock-puppet detection procedures and ultimately got desysopped as a result. I'd rather not go down that path.—Kww(talk) 20:07, 7 May 2010 (UTC)[reply]

If we are to rely on this, it would need much more extensive testing than a single case. Run it on our (lots) of serial sockpuppeteers and their confirmed socks along with control cases of unrelated users, throw in some unrelated socks for good measure. I'm open to using it as supportive (but not definitive) evidence if the false positive rate is acceptable. Tim Song (talk) 20:51, 7 May 2010 (UTC)[reply]

It's not a checkuser tool, at any rate -- it doesn't require any special information. --jpgordon^{::==( o )} 23:23, 7 May 2010 (UTC)[reply]

Correct. It's not a checkuser tool in that in its current form, it limits itself to using publicly accessible timestamp data. All it really asks is the Q: are these two users posts time uncorrelated, and rejection of this hypothesis at low alpha implies that they actually are. It requires a reasonalby prolonged parallel posting to produce a statistically significant result, and there are genuine circumstances where non-sock puppet / meat puppet users could generate a validly correlated result. A good example is if the two posters tend to work at similar times and are in a close edit or talk dialogue exchange and have cross WatchList monitoring. This can cause anomalous measures at low time deltas. I've seen this in some of the test cases that I've run. The TSVs can be directly imported into Excel or Calc, which is how I generate my plots, though it wouldn't take a lot more code to generate these directly with the right Perl libraries.

So under normal circumstances, it is at best supporting evidence. Of course, it might just throw up truly bizarre inter-relationships which should be questioned further. Can I suggest that if any of you are interested then take a local copy and have a play. I've given it a free-use licence so help yourselves. It's just that I've had an ANI raised against me for doing this SPI, and the way things are going I think that I am going to be banned for initiating it, so my user pages might just get deleted soon. -- TerryE (talk) 00:42, 8 May 2010 (UTC)[reply]

CheckUser and Oversight Elections have started

The May 2010 CheckUser and Oversight Elections have started. Please see the election page for details.

For the Arbitration Committee - KnightLago (talk) 15:01, 14 May 2010 (UTC)[reply]

Wikipedia:Sockpuppet investigations/Scibaby

Wikipedia:Sockpuppet investigations/Scibaby is relevant, as it's possible there's now open proxy use. Report is very old, now. Hipocrite (talk) 00:59, 16 May 2010 (UTC)[reply]

April and May archived cases not showing

The subject says it all. How do we fix the archives? I was also going to mention that I used the form and the case didn't get added to the queue, but now I notice the message saying that the ClerkBot is down, so that's probably that. II | (t - c) 04:12, 16 May 2010 (UTC)[reply]

That's because that system was abandoned in early March. It was nice to have a full archive list, but without the bot it was difficult and tedious to maintain. ~ Amory (u • t • c) 05:02, 16 May 2010 (UTC)[reply]

Request

It is requested that an edit be made to the semi-protected project page at Wikipedia:Sockpuppet investigations. (edit · history · last · links · protection log)

This template must be followed by a complete and specific description of the request, that is, specify what text should be removed and a verbatim copy of the text that should replace it. "Please change X" is not acceptable and will be rejected; the request must be of the form "please change X to Y".

The edit may be made by any autoconfirmed user. Remember to change the |answered=no parameter to "yes" when the request has been accepted, rejected or on hold awaiting user input. This is so that inactive or completed requests don't needlessly fill up the edit requests category. You may also wish to use the {{ESp}} template in the response. To request that a page be protected or unprotected, make a protection request.

I would like Wikipedia:Sockpuppet investigations/IRg0!ngt0cH4NG3D!S to be listed under User reported cases although I feel that it should be renamed under VTomi per the evidence in the SPI. Thanks, CHRONOSome 19:55, 16 May 2010 (UTC)[reply]