Wikipedia talk:Sockpuppet investigations - Wikipedia

Hi SPI, can you please give me some guidance about best practices for these kinds of filings:

1. If there are multiple socks and I think it's one master, should I open one SPI under the master and list all suspected socks (and then in the filing explain one by one why I think each one is a sock), or should I open multiple SPIs under the same master, one for each sock?
2. If I have a group of suspected socks but I think there are multiple possible masters, is it better to just pick a master and list all the socks under that master, or should I try and "best guess" which socks go to which master, and file multiple SPIs, and cross-reference them? Like, "here's a bunch of socks, I don't know if they're LTA1 or LTA2 or LTA3, but probably one or more of those", what's the best way to file that?
3. If I have a group of socks but no idea who the master is, is it better to file it under "best guess," or just pick the oldest suspected sock account and file it under that account as a 'new master'?
4. If I think it's a compromised account, or group of compromised accounts, and I don't know who the master is, again: should take a "best guess" and file it under that master, or open an SPI under the oldest account as the master with no sock, or open separate "one-account" SPIs, one for each account? (E.g., if I think they're compromised but don't know if they're compromised by the same person or different people.)

The SPIs I have in mind are all ARBPIA and could match to any of a half dozen or so sockmasters who have had socks sanctioned in the same relative time period (first half of 2024), some of whom are familiar LTAs. I know there are editors who are much more familiar with these ARBPIA LTAs than I am and could probably figure out who goes with whom. I'm wondering how much effort I need to put into connecting those dots, as opposed to just saying "here are suspicious accounts with suspicious behaviors [diff, diff, diff]" and letting a CU review it and sort it as they will. What is the best way to organize information in the above 4 categories from the point of view of SPI patrollers? (If there's a help doc that explains this, please point me to it.) Thanks in advance for any guidance, Levivich (talk) 18:12, 14 September 2024 (UTC)Reply

The answer to #1 is clearly open one SPI and list all the accounts you believe are socks. For the purpose of SPI, we define "the master" as the account which was created first. For cases 2-4, I guess just put it all into one SPI filing. SPI cases get split and merged all the time as information emerges, so don't sweat the details. RoySmith (talk) 20:10, 14 September 2024 (UTC)Reply

@RoySmith I've been thinking about similar myself but mostly from a UPE perspective than Levivich's situation. Do you think a table something like the below would be helpful?

	Suspected Master/one of their socks	Editor A	Editor B	Additional info
Article and/or behaviour	diff/log/other evidence (or ?/possibles) diff/log/other evidence (or ?/possibles)	diff/log/other evidence diff/log/other evidence	diff/log/other evidence diff/log/other evidence

This is extremely crude and it depends on the evidence as what makes sense structurally but I hope you get the idea. S0091 (talk) 20:38, 14 September 2024 (UTC)Reply

The best way to write a good SPI is to stick to hard evidence, which usually means diffs and links to log entries. Where things go off into the weeds is when people write long essays. If presenting the diffs in a table works for you, that's just fine, but the important stuff is the diffs themselves. RoySmith (talk) 21:38, 14 September 2024 (UTC)Reply

Thanks Roy! Levivich (talk) 15:22, 15 September 2024 (UTC)Reply

Is there a global lock log that says why a particular account was globally locked? User:Vanished user edc8363ad1718beb64ce9d923ab18295 has no local or global blocks, and I can't find anything at meta:SRG. Is there any public information anywhere? I'm specifically wondering if it's locked due to being a compromised account or due to socking. Levivich (talk) 18:09, 16 September 2024 (UTC)Reply

Whereas someone like Special:CentralAuth/Leola_Mayert has the log. Everything says to me it's a vanished user, for example one final edit was to add the retired tag. I guess you'd have to assume the log was hidden related to the vanishing. Anyway, the (public) global lock log: meta:Special:Log/globalauth. -- zzuuzz ^(talk) 18:48, 16 September 2024 (UTC)Reply

I see -- thanks, zzuuzz! Levivich (talk) 19:34, 16 September 2024 (UTC)Reply

@Levivich: Vanished users get locked to satisfy IIRC EU laws. You are correct though, such locks made through renaming processes are not logged in meta:Special:Log/globalauth. Please also remember that some accounts are locked without prior input on SRG, this is result of stewards performing CU actions through loginwiki or through private email channel. Best regards, A09|(talk) 20:54, 16 September 2024 (UTC)Reply

That's this one, right? Salomeofjudea → winter queen lizzie → cloaked rename request → 21:34, 20 August 2024 מקף globally renamed Winter queen lizzie to Vanished user edc8363ad1718beb64ce9d923ab18295 → contributions. I assumed they just decided to abandon this account. Sean.hoyland (talk) 03:40, 17 September 2024 (UTC)Reply

Yup. Levivich (talk) 03:56, 17 September 2024 (UTC)Reply

I have seen a new account, asking how to edit while blocked. How may I report this, when I don't know the suspected sockmaster? Andy Mabbett (Pigsonthewing); Talk to Andy; Andy's edits 16:25, 25 September 2024 (UTC)Reply

And the account is?--Bbb23 (talk) 16:39, 25 September 2024 (UTC)Reply

Is your answer to my question that the correct way to report this is to post about the account here? Andy Mabbett (Pigsonthewing); Talk to Andy; Andy's edits 16:47, 25 September 2024 (UTC)Reply

Please perform a case merge on Wikipedia:Sockpuppet investigations/Vzhodna asirska cerkev SURYOYO SAT with Wikipedia:Sockpuppet investigations/Piermark as it is an obvious duck as well as confirmed on slwiki by a CU. Thanks, A09|(talk) 19:52, 25 September 2024 (UTC)Reply

I would like to have a better understanding of the minimum requirements for an SPI report. For example, the SPI page says, "Before opening an investigation, you need good reason to suspect sockpuppetry".

• A. What if the reason to suspect sockpuppetry or ban evasion is an apparent inconsistency between an account's revision count (across all wiki sites) and their experience level?
• B. What if, in addition to A, the account heads straight for a contentious topic area where ban evasion is relatively common?
• C. What if, in addition to A & B, there is evidence of source misrepresentation, bias/POV pushing, features associated with ban evasion, to the extent that the account is reported at AE?

Sean.hoyland (talk) 14:48, 28 September 2024 (UTC)Reply

There's no perfect answer to these questions, but here's my take:

• A: See WP:PRECOCIOUS.
• B: Lots of new people head straight to contentious topics. People edit what they are interested in.
• C: Lots of people involved in editing contentious topics share biases. That doesn't make them socks.

These things are all just clues, and there's no easy way to define an algorithm for how many clues have to line up before your sock-o-meter buzzes. RoySmith (talk) 15:09, 28 September 2024 (UTC)Reply

I agree with your views on B and C. They shouldn't have a significant impact on the sock-o-meter reading because within a contentious topic area those things are not really any more common among socks than non-socks, as far as I can tell anyway. So, let's say it's just A, but with the additional constraint that information provided by the user rules out the caveats in paragraph 2 of WP:PRECOCIOUS, what then? What I'm trying to get a better understanding of is the location of the boundary between reports that will trigger investigation and reports that won't. I know it must exist, it might have a fuzzy border zone, it might be different for every SPI clerk and checkuser, but it recently dawned on me (having filed numerous SPI reports in the past) that I really have no idea where that lower bound actually is. At the same time, I see numerous accounts that I would checkuser without hesitation if I could because the chance that ban evasion is involved is substantially higher than zero. So, I find myself in a kind of no-man's-land between ignoring potential ban evasion and reporting it...somehow, with an intractable cost vs benefit question I don't know how to answer.

Another question I have been thinking about is how best to present article intersection evidence when the objective is to justify a checkuser? Presenting lots of intersections is apparently not enough when accounts have made lots of edits and/or intersections are at non-obscure/popular-ish articles it seems. It should be possible, in principle at least, to write down a function that computes an importance score for each intersection based on...some things. What should they be is the question. I guess the score would be proportional to some things like number of edits at intersecting articles and inversely proportional to other things like user edit count, number of unique articles edited, per article revision counts, pageviews etc...or at least some way to rank the significance of intersections to boost signal over noise for SPI clerks to increase the chance of checkuser usage being approved. Sean.hoyland (talk) 16:22, 28 September 2024 (UTC)Reply

It should be possible, in principle at least, to write down a function that computes an importance score for each intersection based on...some things. This is what machine learning is all about. Lots of very smart (and well-funded) people have been working on the general problem of machine learning for many years. They've made some progress, but it's still an area of active research and lots more to be done. Variation on the "is this a sockpuppet?" question include "Is this email spam?", "Will the price of this stock go up or down?", and "Is this a picture of a cancer cell?" RoySmith (talk) 16:39, 28 September 2024 (UTC)Reply

In addition to the mentioned indicators and others that raise suspicions of a specific account being a sockpuppet, I have only opened SPIs where I know what other account(s) that specific account links to. That means either the suspicious account matches an existing farm I am familiar with, or I have found multiple accounts that produce the same suspicions. CMD (talk) 08:17, 29 September 2024 (UTC)Reply