Wikipedia talk:Sockpuppet investigations

Case merge

Please perform a case merge on Wikipedia:Sockpuppet investigations/Vzhodna asirska cerkev SURYOYO SAT with Wikipedia:Sockpuppet investigations/Piermark as it is an obvious duck as well as confirmed on slwiki by a CU. Thanks, A09|(talk) 19:52, 25 September 2024 (UTC)

Minimum requirements

I would like to have a better understanding of the minimum requirements for an SPI report. For example, the SPI page says, "Before opening an investigation, you need good reason to suspect sockpuppetry".

• A. What if the reason to suspect sockpuppetry or ban evasion is an apparent inconsistency between an account's revision count (across all wiki sites) and their experience level?
• B. What if, in addition to A, the account heads straight for a contentious topic area where ban evasion is relatively common?
• C. What if, in addition to A & B, there is evidence of source misrepresentation, bias/POV pushing, features associated with ban evasion, to the extent that the account is reported at AE?

Sean.hoyland (talk) 14:48, 28 September 2024 (UTC)

There's no perfect answer to these questions, but here's my take:

• A: See WP:PRECOCIOUS.
• B: Lots of new people head straight to contentious topics. People edit what they are interested in.
• C: Lots of people involved in editing contentious topics share biases. That doesn't make them socks.

These things are all just clues, and there's no easy way to define an algorithm for how many clues have to line up before your sock-o-meter buzzes. RoySmith (talk) 15:09, 28 September 2024 (UTC)

I agree with your views on B and C. They shouldn't have a significant impact on the sock-o-meter reading because within a contentious topic area those things are not really any more common among socks than non-socks, as far as I can tell anyway. So, let's say it's just A, but with the additional constraint that information provided by the user rules out the caveats in paragraph 2 of WP:PRECOCIOUS, what then? What I'm trying to get a better understanding of is the location of the boundary between reports that will trigger investigation and reports that won't. I know it must exist, it might have a fuzzy border zone, it might be different for every SPI clerk and checkuser, but it recently dawned on me (having filed numerous SPI reports in the past) that I really have no idea where that lower bound actually is. At the same time, I see numerous accounts that I would checkuser without hesitation if I could because the chance that ban evasion is involved is substantially higher than zero. So, I find myself in a kind of no-man's-land between ignoring potential ban evasion and reporting it...somehow, with an intractable cost vs benefit question I don't know how to answer.

Another question I have been thinking about is how best to present article intersection evidence when the objective is to justify a checkuser? Presenting lots of intersections is apparently not enough when accounts have made lots of edits and/or intersections are at non-obscure/popular-ish articles it seems. It should be possible, in principle at least, to write down a function that computes an importance score for each intersection based on...some things. What should they be is the question. I guess the score would be proportional to some things like number of edits at intersecting articles and inversely proportional to other things like user edit count, number of unique articles edited, per article revision counts, pageviews etc...or at least some way to rank the significance of intersections to boost signal over noise for SPI clerks to increase the chance of checkuser usage being approved. Sean.hoyland (talk) 16:22, 28 September 2024 (UTC)

It should be possible, in principle at least, to write down a function that computes an importance score for each intersection based on...some things. This is what machine learning is all about. Lots of very smart (and well-funded) people have been working on the general problem of machine learning for many years. They've made some progress, but it's still an area of active research and lots more to be done. Variation on the "is this a sockpuppet?" question include "Is this email spam?", "Will the price of this stock go up or down?", and "Is this a picture of a cancer cell?" RoySmith (talk) 16:39, 28 September 2024 (UTC)

I don't mean those kinds of high dimensional functions (that you can't write down). I mean a simple function like F = ma that could tell you that intersection A is more significant (more improbable) than intersection B because, for example, article A only has 100 revisions and 5 unique editors whereas intersection B has 20,000 revisions and 500 unique editors. Sean.hoyland (talk) 14:19, 29 September 2024 (UTC)

For example, 11Fox11 (2462 revisions) vs Mvqr (17248 revisions), blocked socks with 22 intersections, the objective would be a simple function that quantifies the fact that the intersection at Jeanne d'Arc (video game) is more significant than the intersection at Ted Nugent so that that intersection would be ranked higher in an evaluation of evidence in an SPI report. Sean.hoyland (talk) 14:58, 29 September 2024 (UTC)

I don't mean to be dismissive, but if it was really that easy, somebody would have written the tool already. What you're talking about here is Feature engineering. You've defined two features:

1. Both users have edited Jeanne d'Arc (video game)
2. Both users have edited Ted Nugent

and hypothesized that the first feature should be weighted higher than the second, based on a sample size of one. So now, run an experiment. Go through all the old SPI reports and find all the pairs of users who have been accused of being socks. Of those, find all the pairs who have edited both of those articles vs all the pairs where only one has edited both of those articles. See how well that correlates with having been declared a confirmed sock.

If you do that experiment, I strongly suspect you'll quickly find that there aren't enough data points to do anything useful. So your next step might be to change the definition of your features to something broader and try again. And pretty soon you'll be deep into reading the machine learning literature to discover what those who have gone down this road before you have learned and see if you can apply their techniques to this data set.

I'm not being at all facetious. It's an interesting area and you can get your feet wet with some ordinary programming skills and some basic understanding of statistics. And even if you don't make any substantial progress towards solving the sockpuppetry problem, you'll learn a bit about about the algorithms which are increasingly running our lives. RoySmith (talk) 15:25, 29 September 2024 (UTC)

In addition to the mentioned indicators and others that raise suspicions of a specific account being a sockpuppet, I have only opened SPIs where I know what other account(s) that specific account links to. That means either the suspicious account matches an existing farm I am familiar with, or I have found multiple accounts that produce the same suspicions. CMD (talk) 08:17, 29 September 2024 (UTC)

I'm not going to read all that, but try this tool if you want to a list of editors who edit the same articles. NinjaRobotPirate (talk) 02:59, 30 September 2024 (UTC)

Question re evidence

An editor who hasn't edited for months (and very little in the past year), and made an odd series of edits to a vey controversial stub article (domicide) just a minutes after I tidied it up. They had never edited on this article beforehand. I find it hard to believe that this is their only account and that they were not watching this article from another live account. However, is this something that can be considered under SPI or other type of investigation? thanks. Aszx5000 (talk) 11:03, 6 October 2024 (UTC)

I don't see anything there that makes me suspect sockpuppetry or any other kind of abuse. My suggestion is to engage with the other editor on the article talk page to see if you can each help the other understand your differing opinions. RoySmith (talk) 16:09, 7 October 2024 (UTC)

CU attention needed at UTRS

We have a few cases at UTRS that need Checkuser attention. Firefangledfeathers (talk / contribs) 15:03, 8 October 2024 (UTC)

@Firefangledfeathers: CU backlog cleared. DatGuy^Talk_Contribs 17:33, 9 October 2024 (UTC)

Requesting advice on how to request a sockpuppet investigation on users vandalising Manisha Ganguly

Hi all

Today I reported to ANI vandalism, including trying to get the page deleted all together and suspected sock puppets of multiple users editing Manisha Ganguly and its talk page here (the first time I've every reported anyone). I see that two of the usernames have been banned as suspected sock puppets. I have a question, to summarise:

1. The now banned sockpuppets showed that they were really quite knowledgable about Wikipedia, its different policies, how to nominate an article for deletion etc within 24 hours of creating both accounts, this makes me think that this was an established user who decided to use sock puppets to try to vandalise this page. The user also requested their account was deleted once their edits were reported to ANI.
2. An additional IP address has done an edit to again add one of the maintainance tags the sock puppets added, the first edit from that IP address.
3. The edit appear to be politically motivated to discredit the journalist, she writes about killings of journalists and bombings of hospitals in Gaza and the vandalism was done on the anniversary of the start of the Israel Hamas war. The articles is part of the WP:ARBECR on this topic. We know that the pro Israel government organisations has been using Wikipedia as a propaganda tool for many years eg reporting here and here here.

Is there a way of requesting that someone checks into other edits made by the IP address used by the sock puppets?

Thanks

John Cummings (talk) 17:31, 8 October 2024 (UTC)

See "How to open an investigation" at WP:SPI. RoySmith (talk) 17:34, 8 October 2024 (UTC)

Many thanks RoySmith yes I've read that, I guess I'm confused by the process since I've never been taken part before. In this case I do not know who the sockmasters name is but two of their accounts have been banned as sockpuppets. As I describe above I think its a reasonable and likely assumption these are not the primary accounts given that they less than 24 hours old but were familiar with many of Wikipedia's policies. Is it allowed to request someone check if these socks are connected to any other accounts? John Cummings (talk) 17:42, 8 October 2024 (UTC)

Well, at this point, I see the page has been protected, so that should deal with the immediate problem. RoySmith (talk) 17:58, 8 October 2024 (UTC)

Thanks for the reply RoySmith, I feel like perhaps I'm not being clear, to be specific, I want to tell people there may be a wider problem, do the rules allow for a wider investigation if the sockmaster is unknown? John Cummings (talk) 18:02, 8 October 2024 (UTC)

The main purpose of SPI is to stop ongoing disruption. Since the accounts that were making disruptive edits are already blocked and the page is already protected, there's really not much more SPI would do. RoySmith (talk) 18:44, 8 October 2024 (UTC)

Thank you RoySmith I've reported it anyway, at least so that people are aware of what has happened, perhaps there are other related cases. John Cummings (talk) 08:40, 9 October 2024 (UTC)