User:Tamzin/SPI is expensive

So a few days ago you spotted an account adding "BEST ACTOR EVER" to an article about a B-list actor. You reverted them a few times, then reported to AIV, where they were indeffed. You watchlisted the page, and today you noticed a new account add "I love this actor!!!!" there.

"I know what to do" you think. "WP:SPI!" You revert the edit, warn the user, and file.

Let's look at what happens next:

• Your filing pops up in the feed on IRC. One or two people may glance at it now. Most likely, they see the small scale of the disruption, decide no urgent action is needed, and let it pend in the general SPI queue. Let's say these one or two clerks have spent a combined 2 editor-minutes on immediate triage.
• In many cases it may take a week or more for someone to actually clerk the case, but if that happens it will probably be declined as stale, so let's say it is clerked within 24 hours.
  • A clerk now looks at the one edit from the second account, and the five edits from the first account. They're similar, but it's plausible that these are two different vandals / test editors. 1 editor-minute
  • The clerk considers the edit summaries, which are a bit more similar: The first's all say "best actor", while the second's one ES says "great actor". 1 editor-minute
  • The clerk checks sister-wiki edits, timecards, and a few other miscellany, finding nothing of interest. 1 editor-minute
  • The clerk checks if they have filter hits. They each do, an LTA filter that is labeled simply "LTA #XXXX". The clerk then looks at the LTA filter to see which part matched. It turns out it's just because the edits contained the actor's name, which an LTA a few years ago was known to use in a completely different context. 10 editor-minutes
  • The clerk checks the page history for similar edits. They find a few fan-vandalism edits, but none along those exact lines. 2 editor-minutes
  • The clerk concludes that the account is not blockable on behavioral evidence alone. They write up their findings and {{rae}} a check. 3 editor-minutes
• Now it probably pends for a while longer.
• A checkuser comes along.
  • They check both accounts. Uh-oh. They're in a country known for very bad IP address assignment. The accounts are on numerically nearby ranges, but in that country they could still be on opposite ends of the same state. Using various tricks, the CU traces a string of IP edits that is likely by the first user, making similar edits to a number of articles. They then find an older account on that IP, which made eight such edits before going inactive. They check that account too. Huh, there's an account on the same /24 that's actually been around quite a while, also makes entertainment edits, although not problematic ones. Could this be GHBH? They check that account. They get some results they don't quite understand. They flag down another CU on IRC to look. 10 editor-minutes so far
  • The other CU takes a long look. It seems that the more experienced account usually edits using proxies. They look into the proxy situation, finding nothing conclusive. The two CUs talk back and forth, finally determining that other information from the check suggests this is likely a coincidence. Between the two of them, another 20 editor-minutes
  • The CU posts to SPI that the second account is possible to the first account, and that the first account is likely to the older one they found, and leaves disposition of the case to the clerk. 1 editor-minute
• The clerk reviews the CU's findings. They determine that there isn't enough evidence to block the second account, but there is enough evidence to block the inactive older account. They write up their rationale and then, being a non-admin clerk, reqest admin assistance for that block. 5 editor-minutes
• A patrolling admin comes by and reviews the evidence. They indef. 2 editor-minutes
• The clerk moves the page to the older account, tags both, and closes the case. 1 editor-minute
• Another clerk reads through the case to make sure nothing has been missed, and then archives. 3 editor-minutes

Total editor time spent: 62 minutes

And here's the funny thing: That alleged sock account, which didn't get blocked? It never edits again. That inactive older account? It was never going to edit again, regardless of getting blocked. Over an hour has been spent on preventing 0 disruption.

Instead, keep the following in mind

• SPI is for sockpuppet investigations. It is not for sockpuppet blocks. Any admin can block any user if they see clear evidence that that user is a sockpuppet.
• SPI's workflow is not geared to optimize speed or efficiency, but rather to optimize accuracy.
• Blocks are preventative. This applies even to blocks of sockpuppets. Unless an account is known to dust off sleepers after long waiting periods, it's rarely worth reporting them.
• Blocking someone for sockpuppetry is much more complicated than blocking them for vandalism, spamming, or COI. You can always report someone for a non-sock offense and note in your report "May also be a sock of X". Admins aren't stupid. They can figure out the right thing to block for.

In other words

When it's possible to report someone to AIV, ANI, UAA, or another fast-acting noticeboard, or just the talkpage of the admin who blocked what you suspect to be the master account, do that instead of SPI.