This page is an archive of past discussions. Do not edit the contents of this page. If you wish to start a new discussion or revive an old one, please do so on the current talk page.

The SPI status colors have indeed changed. Asartea made an edit request to change {{ SPI case status}} to use consistently WCAG AA Normal or better color contrast ( MOS:COLOR). Firefly found a way to keep moreinfo eye-catching while keeping it in the same color range as before, but there wasn't really any way to do that for administrator, so that's been changed from a noncompliant bright orange to a compliant bright green (rather than a compliant dull orange). For consistency's sake, I made a matching change to {{ SPIstatusentry/color}}, the template that is called on the SPI list. I welcome any feedback. -- Tamzin ^{cetacean needed} (she/they) 05:07, 21 January 2022 (UTC)

Small request that we change the bright green to something else since the CU checked is also green (though dull), and they might get lumped together. Also, generic comment that the accessibility guideline really shouldn't be in MOS space since everything other than accessibility is only applicable in mainspace... though nothing we can do about that here :-) TonyBallioni ( talk) 05:58, 21 January 2022 (UTC)

@ TonyBallioni:

• So, this is what it used to be: Black text. Blue link. Visited blue link.
• Asartea's original proposal: Black text. Blue link. Visited blue link.
• Green background we went with instead: Black text. Blue link. Visited blue link.

I wanted to retain the general logic that CUrequest, moreinfo, admin, and clerk are the four most eye-catching categories, and it doesn't look like there's a way to do that with orange in an a11y-compliant fashion. Thing is, all the main parts of the color wheel are already taken for something: yellow for CU, blue(ish) for endorse, red/pink for open and declined, dull green for checked, purple/magenta for hold and more info, reddish for clerk. So the way I see it:

1. We could use Asartea's original proposal.
2. We could use a shade of red distinct from that of awaiting clerk. They're conceptually similar so it wouldn't be that different from having both moreinfo and hold being in the same neighborhood.
3. We could switch the dull green of checked to a dull orange. Which might actually be a good idea, in terms of the psychology of color: I feel like sometimes the checked queue gets negelected despite often containing fairly time-sensitive cases.

I think that covers all the options. -- Tamzin ^{cetacean needed} (she/they) 07:12, 21 January 2022 (UTC)

I agree with Tony, and personally I would actually prefer Asartea's original duller orange proposal rather than the current green, since the CU completed status is also green (and, more selfishly, I've been conditioned over the years to look for orange). I think orange as a color is inherently eye-catching in the context of the contrasting colors of yellow and green. Mz7 ( talk) 08:04, 21 January 2022 (UTC)

I would also prefer sticking with some (more accessible) shade of orange, simply because I'm very used to it. -- Blablubbs ( talk) 13:02, 21 January 2022 (UTC)

I think orange works better. I think "awaiting admin" should be important and eye-catching, given that it usually means socks need to be blocked. Orange is quite eye-catching, and is what most people are used to. Though, if we want to change the color, red would also be good, though maybe a bit too urgent. Invalid ^OS _talk 13:16, 21 January 2022 (UTC)

@ TonyBallioni, Mz7, Blablubbs, and InvalidOS: Okay, I've switched to Asartea's original proposal, but seeing it alongisde the other colors on the table, I think it looks a bit too much like the open and declined colors, especially if my screen's on night mode. Thoughts? -- Tamzin ^{cetacean needed} (she/they) 13:51, 21 January 2022 (UTC)

OK, I do see the issues on night mode, it's definitely harder to tell the difference. Maybe we could try white text on darker colors for the "awaiting x" statuses? It's still more eye-catching and urgent, but also remains accessible. Invalid ^OS _talk 16:18, 21 January 2022 (UTC)

@ InvalidOS: I actually considered that, but the issue is the link coloring. Could highlight the links white within the orange background, but I think that would look very jarring, as you can see here. -- Tamzin ^{cetacean needed} (she/they) 16:25, 21 January 2022 (UTC)

Yeah, I don't think this will look good. Also I have bad news: originally I ignored {{SPI case status|clerk}} because its accessible against black, but I just realised when it gets used in the table it is of course used against links. -- Asartea ^{Talk | Contribs} 16:34, 21 January 2022 (UTC)

( edit conflict) Oh, that is really bad. Maybe the "Open" case color could be changed, but that might as well be less of a good idea. I'm just really not a big fan of that green though. Invalid ^OS _talk 16:36, 21 January 2022 (UTC)

@ Asartea et al: Okay, what do y'all think of this? It's an AA pass. -- Tamzin ^{cetacean needed} (she/they) 17:18, 21 January 2022 (UTC)

I'm happy as long as it meets AA; I don't actually do any SPI work, so I'll leave the determination of which colors work to people who actually have to look at them on a regular basis. -- Asartea ^{Talk | Contribs} 17:35, 21 January 2022 (UTC)

Okay. Well, I think that for admin, this for clerk, and we should be good? Will implement later if no one objects. -- Tamzin ^{cetacean needed} (she/they) 17:51, 21 January 2022 (UTC)

Okay, switched to that pair of colors now. About as close to the originals as possible while staying within AA Normal, so hopefully this works for people. (Currently there's nothing in the table with these statuses, but you can do what I did and mess around with inspect element. Hexes are #F9AC71 for ADMIN and #FF8E7A for CLERK.) -- Tamzin ^{cetacean needed} (she/they) 06:37, 22 January 2022 (UTC)

Nice work! Mz7 ( talk) 02:23, 23 January 2022 (UTC)

Looks great! Invalid ^OS _talk 12:33, 25 January 2022 (UTC)

{{long rant about accessibility, the need for it to be a policy etc here}} -- Asartea ^{Talk | Contribs} 16:32, 21 January 2022 (UTC)

First may I offer congratulations to all of you who have worked so hard to reduce the backlog.

I have an observation which may not be borne out by real life. When CU is requested a new investigation is almost always handled comparative quickly. When not requested it can feel to someone not intimately involved with the SPI process that it is treated as less urgent.

This may be because there are more non CU requests than there are CU requests, and I accept this may be a result of the human frailty of seeing patterns where none exist. The purpose of this post is to alert you very busy SPI folks of my perception.

I hasten to add that I am not complaining. I also subscribe to the view that there is never a need to rush on Wikipedia. Fiddle^Timtrent  Faddle^Talk to me 22:41, 26 January 2022 (UTC)

I think this may be partially due to CUs focusing on cases with CU requests. I certainly generally focus on cases marked as needing CU and then to the open cases. This may also be due to the CU cases being slightly further up the list (so are seen first).

On the other hand, at the moment only two CU complete cases are newer than the oldest non-cu case. Furthermore, I would say that a combination of non-cu requests also including IP-only SPI cases and when filing cases CU being marked as "only check this if you need it" when using the preload form probably means that there are generally more non-cu cases than cu cases. Dreamy Jazz ^{talk to me | my contributions} 23:20, 26 January 2022 (UTC)

I can quite understand your thought process here. I think very hard before requesting CU and try to err on the side of not doing so. I do take your point about non CU cases being physically lower on the list, as well as being likely to be greater in number than CU cases because of the wise preload discouragement of flagging for CU. Fiddle^Timtrent  Faddle^Talk to me 23:29, 26 January 2022 (UTC)

Another thing to consider is that non-CU cases typically fall into three categories: 1) IP/account or all-IP cases, 2) cases coming out of a long dormancy, and 3) cases filed by people inexperienced with SPI who don't know to request CU. (Yes, there's a smattering of "Too obvious to bother with a CU request" cases thrown in, but those are often picked off as they come in.) All three of those categories are relatively effort-intensive to clerk. If I clerk a CU request, all I need to do is see that a threshold of reasonable suspicion has been met and that a check would be policy-compliant, and then I can hand it off to a CU for technical analysis. Your post here inspired me to take a look at the oldest pending "open" case, which fell into Category 1. It was a well-made filing, and about as short as it could be expected to be, but still pretty long. It required a weighing of big-picture behavioral analysis, tells, past procedural history, and the nuances of the sockpuppetry policy, and I had to be extra-sure of my conclusion because there won't be a CU safety net to tell me I got the wrong guy. Clerking that took me quite a bit longer than it takes to say "Yep, both of these accounts created the same draft with similar edit summaries. {{ endorse}}." So a lot of the discrepancy between CU and non-CU cases is just inherent in what they demand of the clerk team, I think. -- Tamzin ^{cetacean needed} (she/they) 00:40, 27 January 2022 (UTC)

I knew a great deal of work happened behind the scenes. I was not aware of quite how much. I've often been tempted to put myself forward for work in this area, but I think AFC is enough for me right now. At least I get a regular chance from AFC to set 'em up for SPI specialists to knock down. Not that I always get it right!

Thank you for treating my post as potential inspiration, as I hoped it would be received, rather than as a whine. Fiddle^Timtrent  Faddle^Talk to me 09:17, 27 January 2022 (UTC)

Please see Template talk:SPI report § Proposed change to sock list. -- Tamzin ^{cetacean needed} (she/they) 04:46, 5 February 2022 (UTC)

While I was at WP:PERM, something clicked me. That if someone changes their username after a SPI case had been filed against them, the SPI link at {{ rfplinks}} would *probably* show up as a red-link, making this Template useless. Can someone more knowledgeable confirm this? And if this is true, we should fix it so that a username change automatically creates a redirect from the new username SPI page to the old one where a case was actually filed. --- CX Zoom(^he/_him) ( ^{let's talk}| _contribs) 06:44, 13 February 2022 (UTC)

If my observations are untrue, that username change does create appropriate redirect, someone should note them at the documentation for SPI processes. Thank you. --- CX Zoom(^he/_him) ( ^{let's talk}| _contribs) 07:04, 13 February 2022 (UTC)

User pages are usually redirected to the new name as part of the rename process, although a renamer can choose whether to suppress the redirects creation. I think they mostly allow it in normal circumstances. Additionally someone can manually remove the redirect afterwards, however, but that'd create edit history which can be inspected to determine where the user-page used to redirect. – Ammarpad ( talk) 13:28, 13 February 2022 (UTC)

I was referring to the fact that if User:Example, who has some SPI history, renames to User:Foo. The automatic SPI link thus created by {{ rfplinks}} will be WP:Sockpuppet investigations/Foo, effectively *superficially* hiding the prior case logged at WP:Sockpuppet investigations/Example, unless a retarget is created from the WP:Sockpuppet investigations/Foo to WP:Sockpuppet investigations/Example or vice versa. Ofcourse, username change history will also be logged and admin can check SPI/RFAR history manually but that would require more effort from the admin than there needs to be ideally. Or occasionally may be overlooked by them too. --- CX Zoom(^he/_him) ( ^{let's talk}| _contribs) 13:38, 13 February 2022 (UTC)

I think the question here is about the SPI page in particular. I am not aware of any automated process that moves SPI pages when users are renamed. This means that at the moment that SPI cases can in theory be left at the old username, and potentially forgotten about if the link was not included in any block log. I think I've found a way to determine if a user exists, and as I cannot find a pre-existing module to do this I will be creating one. Dreamy Jazz ^{talk to me | my contributions} 13:43, 13 February 2022 (UTC)

Not just the SPI page, but also the RFAR page to be specific. Also, I'm unaware if there are any other kind of pages to which links should ideally be preserved. --- CX Zoom(^he/_him) ( ^{let's talk}| _contribs) 14:17, 13 February 2022 (UTC)

I've created two categories that are automatically filled with SPI cases when either:

• The userpage and user talkm page both do not exist (unless it's an IP address)
• The user talk page is a redirect to somewhere outside the user's userspace

Unfortunately it was not possible to detect if the user does or does not exist without access to the API, which is not possible using Lua or parser functions. As such, for the time being that gives a list of SPI cases that could be worth checking. I'll likely move this over to a bot, as from looking at this method it includes a fair number of false positives. Dreamy Jazz ^{talk to me | my contributions} 10:21, 15 February 2022 (UTC)

To update, I've created User:Dreamy Jazz/spipagestofix which contains a list of spi pages where a non-IP address master has no associated global or local account. Most of these probably need merging. Dreamy Jazz ^{talk to me | my contributions} 02:10, 17 February 2022 (UTC)

Replied to RFAR at WT:AC. Dreamy Jazz ^{talk to me | my contributions} 10:21, 15 February 2022 (UTC)

In practice, I don't think this is a big deal. If there were actually issues with sockpuppetry, then typically the user would have been blocked, or perhaps at minimum a message would have been left on their user talk page, so even if the reviewing administrator misses the SPI link, they would probably still discover the past conduct issues when they check the block log and the user's talk page. Mz7 ( talk) 08:29, 15 February 2022 (UTC)

but I seem to have ballsed up this shiney new report somehow, and can't work out the code to fix it. The loading form froze at one point, so it was probably something to do with that; unfortunately, I didn't notice. D'oh! SN54129 20:57, 20 February 2022 (UTC)

 Clerk note: Thanks for pointing it out. I think this was all that was needed, unless I missed something. -- Tamzin ^{cetacean needed} (she/they) 20:59, 20 February 2022 (UTC)

Thanking you, clerk; that seems to have sorted it. SN54129 14:39, 21 February 2022 (UTC)

How do you combine investigations? User:Lieutenant of Melkor and User:Guardian of the Rings are the same account (renamed in 2014) but I don't think anyone has realized until now that we have sock investigations under both names which do not reference each other. Horse Eye's Back ( talk) 17:38, 23 February 2022 (UTC)

@ Horse Eye's Back, I was able to find Wikipedia:Sockpuppet_investigations/Lieutenant_of_Melkor, but I couldn't find one for Guardian of the Rings as Wikipedia:Sockpuppet investigations/Guardian of the Rings doesn't exist (and searching subpages of SPI doesn't show a different case). Could you link to the separate case for Guardian of the Rings.

With regards to how you merge/combine cases, this is nearly always performed by a clerk or a CU who is comfortable merging cases. WP:SPIHELPER is used by those who merge cases. Raising it here if you are in neither group is the best option, as spihelper.js doesn't allow you to merge if you are neither a clerk or checkuser.

Thanks for raising this. Dreamy Jazz ^{talk to me | my contributions} 23:43, 23 February 2022 (UTC)

@ Dreamy Jazz: Category:Wikipedia sockpuppets of Guardian of the Rings and Category:Suspected Wikipedia sockpuppets of Lieutenant of Melkor both exist. I should have been more specific about what exactly was to be combined, that being said I can't find the sockpuppet investigation for the sockpuppets of Guardian of the Rings, they aren't in the Wikipedia:Sockpuppet_investigations/Lieutenant_of_Melkor archive. Horse Eye's Back ( talk) 23:47, 23 February 2022 (UTC)

Thanks for clarifying Horse Eye's Back. I've re-tagged the accounts so that all the accounts are in either Category:Suspected Wikipedia sockpuppets of Lieutenant of Melkor or Category:Wikipedia sockpuppets of Lieutenant of Melkor. I've also deleted the old category as it's now empty.

With regards to not finding a sockpuppet investigation, all but one of those accounts were self-admitted socks based on the diff presented on their userpages. The other account as confirmed by a CU. This means that both may not have been reported in the usual sense, as with all but one there was no need to investigate it as the connection was self-disclosed and with the last a checkuser may have just ran a check and then blocked without an investigation. Happy editing, Dreamy Jazz ^{talk to me | my contributions} 23:59, 23 February 2022 (UTC)

Thank you! Horse Eye's Back ( talk) 00:00, 24 February 2022 (UTC)

This is all interesting, I've been clerking since 2015 and have done plenty of merges, but have never once used spihelper to do it. I didn't even know it could. Ivanvector ( ^Talk/ _Edits) 00:23, 24 February 2022 (UTC)

@ Ivanvector: That's because in User:Ivanvector/vector.js, you're using importScript('User:Timotheus Canens/spihelper.js');—which is totally fine and functional, if this is the version you prefer. However, GeneralNotability has been maintaining an updated version of the script that has a bunch of new features, including automated merging. It can be installed by replacing importScript('User:Timotheus Canens/spihelper.js'); with importScript( 'User:GeneralNotability/spihelper.js' );. Mz7 ( talk) 01:58, 24 February 2022 (UTC)

Changes, such as the introduction of the {{ socklist}} template, is likely to break the older version of spihelper. This could be updated so that the older version still works, but perhaps it might be better to redirect the older script to GN's version which is being kept up to date. I wouldn't want to do this without the support of Timotheus Canens, but this might be something to consider so that just because you have a different version installed you don't get new features etc. Dreamy Jazz ^{talk to me | my contributions} 02:12, 24 February 2022 (UTC)

Well, I owe the three of you (and GeneralNotability) a beer. FWIW I haven't noticed that the "old" spihelper is broken, but I think I've only ever really used it for archiving. Ivanvector ( ^Talk/ _Edits) 14:46, 24 February 2022 (UTC)

I've reported a good number of socks over the years. I'm an admin but don't work in this area. I've identified an IP user as a sock without any doubt (edit same articles; restored 32k of text removed in 2019 as a result of a sockpuppet investigation). What do I have to do? Do I need to open an investigation or can I just go ahead, block the IP, and add the IP address to the list of previously identified socks? A sock would usually be blocked indefinitely, but I believe that's no longer possible for IP addresses. So do I go for the maximum length of time or are there options to permanently block an IP? Schwede 66 08:41, 24 February 2022 (UTC)

Answering by email. Cabayi ( talk) 10:06, 24 February 2022 (UTC)

Thanks. Have dealt with it. It looks like a static IP address but that's not my area of expertise; please check that it is! Schwede 66 19:02, 24 February 2022 (UTC)

Hi everyone, I recently created a template that can be used to mark votes/comments cast by sockpuppets. The template is {{ Sock vote}}. I didn't spent a lot of time to create this and it may require some modification. Please feel free to review and modify the template as appropriate and then use it! Thanks! --- CX Zoom(^he/_him) ( ^{let's talk}| _contribs) 16:59, 28 February 2022 (UTC)

Nice work, but there are already {{ csm}} and {{ csp}} for this, as well as a series for other inappropriate comment situations (like {{ single-purpose account}}). Ivanvector ( ^Talk/ _Edits) 17:03, 28 February 2022 (UTC)

So, I got a hunch that a number of accounts (Saurabh darade 1998, Shivadikarshreyash73, RudrakshaVaity, Navneet77, Kalpana234, Mdshayansiddiqui3, Aru Jaiswar, Mitul46, Ajayso.wp) are sockpuppets of User:Deep. 123456 based on their userpages/sandboxes but they are all inactive for several years. Is it still worth reporting them? Asking because several userpages were just tagged as U5 speedy deletion and thus showed up on the speedy deletion queue, and when checking I noticed a pattern. Jo-Jo Eumerus ( talk) 10:09, 4 March 2022 (UTC)

@ Jo-Jo Eumerus If you think there's value to getting them into the record, my suggestion would be to file an SPI, note that it's just for historical purposes, and then close the case yourself. That'll get it into the archives for future reference. But it's very unlikely anybody would spend any time investigating accounts which have been inactive for several years. -- RoySmith (talk) 15:39, 4 March 2022 (UTC)

I wouldn't, in this particular case. I remember the FOSS newbie vandalism thing from around that time, as I recall it turned out to be a misguided school project. Adding more accounts to the case (again, in this specific instance) won't do anything to help prevent abuse, and might document connections that don't actually exist if any of these users decide to take up Wikipedia in the future. Ivanvector ( ^Talk/ _Edits) 17:25, 4 March 2022 (UTC)

I've been repeatedly frustrated by this, even when I note that its for historical purposes the admin acts like its a waste of their time. From my perspective there is *always* value in identifying sleeper or abandoned sock accounts. Horse Eye's Back ( talk) 16:28, 4 March 2022 (UTC)

The deletion (not archiving) of SPI reports is not something that has made sense to me, so it would be helpful to know what the wider expectations are. CMD ( talk) 07:27, 5 March 2022 (UTC)

From what I've seen in edit histories, the case page Wikipedia:Sockpuppet investigations/Dealer07 has an earlier username involved, and should be moved to Wikipedia:Sockpuppet investigations/Eurofan2000. Both Eurofan2000 and Dealer07 behaved the same as Greek IPs pursuing edit-warring behavior, and both were intensely interested in Greek/Albanian/Macedonian nationalities, with the intent to diminish non-Greek connections. They were also trying to weaken the UK by dividing "British" descriptions into English, Scottish, etc. Below I've listed the named accounts that I have seen. A massive number of Greek IPs is also part of this case. Binksternet ( talk) 01:12, 13 March 2022 (UTC)

• Apr–Jul 2021 – Eurofan2000. At the Eleni Foureira bio, this account added something about Foureira being inspired by Bebe Rexha, [1] the same as a later sock. [2] This username reduced the Albanian nationality of a singer. [3] The username was blocked by GiantSnowman because of multiple accounts, edit-warring first with a Greek IP, then with Eurofan2000, then with John07234. [4] [5] [6]
• Jun–Jul 2021 – John07234 was created to continue the edit-warring of Greek IPs and Eurofan2000. Two edits removed "Albanian" nationality from the Foureira bio. [7] [8] John07234 signed his username to a talk page edit made by Greek IP.
• Jul–Sep 2021 – Dealer07. This account first appeared at the Foureira bio, saying "I already have an account and know how wikipedia works..." Dealer07 continued the warring over nationality, and restored a paragraph that Eurofan2000 had added about Bebe Rexha as an influence. [9]
• Nov 2021 – LefterisA continued the edit warring of Greek IP Special:Contributions/176.92.18.206.
• Jan 2022 – LefterisAp continued the edit warring of Greek IP Special:Contributions/5.55.202.226.
• Jan 2022 – LefterisApos continued the usual edit warring over nationality.
• Mar 2022 – Somebody07 continued the edit warring of Greek IP Special:Contributions/5.54.232.220.
• Mar 2022 – Someonejk continued the edit warring of Greek IP Special:Contributions/176.92.1.94.

Since Amalthea (bot) ( talk · contribs) has been down since August 2021, my bot Mz7 (bot) ( talk · contribs) has been updating User:Mz7/SPI case list to serve the SPI case list that you see on Wikipedia:Sockpuppet investigations. I've now WP:BOLDly updated my bot such that it will now update the page Wikipedia:Sockpuppet investigations/SPI/Cases instead of my userspace. I've redirected my old userspace title to point to the new location. I chose this new name instead of the former Wikipedia:Sockpuppet investigations/Cases/Overview, as if Amalthea's bot ever comes back up, I don't want to clash with their bot. The format "Wikipedia:Sockpuppet investigations/SPI/___" also aligns with other information pages relating to the clerk team. I do not foresee any complications arising from this change, but please let me know if I have indeed messed anything up. Thanks, Mz7 ( talk) 00:18, 29 March 2022 (UTC)

Well, you broke spi-tools. Any chance you could undo this until I can get a fix out? -- RoySmith (talk) 00:47, 29 March 2022 (UTC)

Per [10] it looks like you managed to fix the issue. I'll reiterate what I said in that thread: I deeply apologize for the lack of foresight here. In the future, I will definitely give a heads up here before I make any major changes to the bot's behavior. Mz7 ( talk) 02:39, 29 March 2022 (UTC)

A relatively new user who is not an admin or clerk has tagged the user and user talk pages of socks. Not sure if this is allowed (or what to do if not) so I figured I'd bring it to your attention here. Nardog ( talk) 03:58, 11 May 2022 (UTC)

@ JJMC89: You haven't reverted all of them, is that deliberate? Nardog ( talk) 13:51, 12 May 2022 (UTC)

I undid the rest as it doesn't seem productive and actually seems borderline like trolling. PRAXIDICAE💕 14:47, 12 May 2022 (UTC)

Recently I found a phrase "Infinite torque at zero rpm" on an article. Such thing does not really exist, except in Wikipedia. I did further investigation, and here is what I found:

• 2018-08-29 Inowen Infinite torque at zero rpm
• 2018-12-10 Ser Amantio di Nicolao Holden Special Vehicles
• 2018-12-25 Marine3800 Ford small block engine
• 2022-02-17 BrownHairedGirl Internal combustion engine
• 2022-03-16 BrownHairedGirl Pontiac Firebird
• 2022-03-16 BrownHairedGirl Renault Clio
• 2022-04-11 BrownHairedGirl Chevrolet big-block engine

I found that suspicious. ⸻ Nikolas Ojala ( talk) 09:43, 17 May 2022 (UTC)

@ Nikolas Ojala's suspicious mind would have been better deployed by looking at the diffs before posting here.

Each of those edits was made using WP:REFLINKS, one of those secondary tasks is (annoyingly) to use redirects in place of section links. In these cases, Reflinks replaced Torque#Machine torque with the redirect Infinite torque at zero rpm.

In my case, I pay no attention to those part of Reflink's changes, and was unaware that they had been made. I have no view on whether they are appropriate. BrownHairedGirl (talk) • ( contribs) 10:07, 17 May 2022 (UTC)

Now that you are aware of this discussion, I want to ask: In four articles you replaced a link like this torque by a link like this torque. Why did you do that four times? Is that phrase "Infinite torque at zero rpm" somehow important to you? ⸻ Nikolas Ojala ( talk) 10:32, 17 May 2022 (UTC)

@ Nikolas Ojala: BHG literally just answered that. Now, if you don't have any other evidence of sockpuppetry, I think we're done here. -- Tamzin ^{cetacean needed} (she/they) 10:35, 17 May 2022 (UTC)

Yes. I just realized what had to be done. Case closed anyway. ⸻ Nikolas Ojala ( talk) 11:55, 17 May 2022 (UTC)

@ Nikolas Ojala: the civil and collaborative response at his stage would have been for you to apologise for wasting the time of other editors my making an allegation of sockpuppetry without first doing some simple basic checks such as reading the edit summaries to see that these edits all use WP:REFLINKS.

Instead, you responded by apparently not even reading the reply which I promptly posted, and asking a question which I had just answered.

Sometimes this place sucks. Thanks a bunch for this round of suckinesss. BrownHairedGirl (talk) • ( contribs) 21:09, 17 May 2022 (UTC)

Rejoice! You got your day as a Wikipedia martyr. This fine opportunity was unexpectedly offered to you by me. ⸻ Nikolas Ojala ( talk) 22:02, 17 May 2022 (UTC)

@ Nikolas Ojala: Please apologize. Both for the initial reckless sockpuppetry allegation and for the completely uncalled-for snark when BHG rightly took polite exception to it. -- Tamzin ^{cetacean needed} (she/they) 22:07, 17 May 2022 (UTC)

Would an SPI clerk or better please review the new LTA subpage nominations at MfD? SmokeyJoe ( talk) 05:46, 21 May 2022 (UTC)

I have almost no experience with SPI, so please bear with me if this is a dumb question. I've recently reported a new suspected sock into an old existing case - will it autopopulate into the big table on the main SPI page, or since it's an old SPI will I need to make some sort of additional action to bring attention to it? Hog Farm _Talk 01:32, 22 May 2022 (UTC)

Hi @ Hog Farm: So long as it's opened correctly (I always suggest using Twinkle to make life easy, though your milage may vary) it will autopopulate into the table. I've just checked now and Wikipedia:Sockpuppet investigations/Hary1mo is both filed correctly and has been added to the table. Thanks for checking, -- Jack Frost ( talk) 01:36, 22 May 2022 (UTC)

Thanks! They're being a bit of a pain in the butt so I wanted to make sure it didn't languish in malformed land. Hog Farm _Talk 01:45, 22 May 2022 (UTC)

Just as an explanatory sidenote: The case list is not populated by Twinkle or the filers themselves, but by a bot over at Wikipedia:Sockpuppet investigations/SPI/Cases and then transcluded over, so it can take a while until new cases and status changes show up in the table. If a case hasn't shown up after 40 minutes or so, something is probably borked – it happens on occasion, usually because the bot is down, or because people ignore the instructions we have and don't follow the case format; the bot and other tools really don't like it when {{ SPI case status}} or other important elements are missing. If a case hasn't shown up for a while, please post here so we can either fix the filing or annoy the bot operator with a million pings. -- Blablubbs ( talk) 08:38, 22 May 2022 (UTC)

It seems to be stopping Twinkle from showing up on new user talk pages that haven't been created yet. Doug Weller talk 16:31, 23 May 2022 (UTC)

@ Doug Weller use the General's version! User:GeneralNotability/spihelper.js. :) firefly ( t · c ) 16:57, 23 May 2022 (UTC)

@ Firefly will do, thanks! Doug Weller talk 17:32, 23 May 2022 (UTC)

Ha! I’ve already got it, so removed TC’s. Doug Weller talk 17:36, 23 May 2022 (UTC)

I don’t know where “manage scripts” came from, but it’s brilliant. Doug Weller talk 17:38, 23 May 2022 (UTC)

Sorry SPI. I filed Wikipedia:Sockpuppet investigations/ArsenalAtletico2007 in the wrong place, having mistyped the user's name? Should I refile at Wikipedia:Sockpuppet investigations/ArsenalAtletico2017 or is it better for someone to move it? Firefangledfeathers ( talk / contribs) 13:34, 26 May 2022 (UTC)

@ Firefangledfeathers: I have un-goofed . -- Blablubbs ( talk) 13:37, 26 May 2022 (UTC)

Hi @ Jezebel's Ponyo, Blablubbs, Cabayi, and Bbb23:, Would you please check this SPI case Wikipedia:Sockpuppet investigations/Nepalaya001? Fade258 ( talk) 09:49, 27 May 2022 (UTC)

@ Fade258: Your ping failed (you have to add the ping template in the same edit as you add your signature), but I saw this anyway. I'm not sure why you are seemingly trying to expedite the processing of a case you filed 20 minutes ago. If you want to speed things up, there are some tips for writing good filings here ( this and this seem particularly relevant). -- Blablubbs ( talk) 10:04, 27 May 2022 (UTC)

Blablubbs, I will look into this. If you think I made mistake on opening SPI case then please correct that case. Fade258 ( talk) 10:07, 27 May 2022 (UTC)

I have added two IP suspected sockpuppets of indeffed user Moka Mo /info/en/?search=Wikipedia:Sockpuppet_investigations/Moka_Mo. I believe I somehow screwed up the latest case as filing date shows unknown. Regards,   Aloha27  talk  12:52, 30 May 2022 (UTC)

They all fall onto the shoulders of a very select few, and I'm not at all sure how you manage without burnout. One thing I notice often is that the non CU request queue seems to get less of your attention, perhaps because it's lower down the list. Or is my perception incorrect? Oughtn't Duck cases to be somehow simpler, fewer folk involved?

I'm not "pushing" for anything except equality. There's no deadline for anything because those with the rights can correct many issues at a few keystrokes. I'm honestly not complaining. I think there need to be more of you guys. But that's true of all specialist areas of WP. So what is the real answer? 🇺🇦  Fiddle^Timtrent  Faddle^Talk to me 🇺🇦 19:09, 31 May 2022 (UTC)

@ Timtrent funny you should ask. You're on my list of people who I'm hoping will volunteer for clerk training at WT:SPI/C#Active requests :-) -- RoySmith (talk) 19:15, 31 May 2022 (UTC)

@ RoySmith I think I deserved that hint! I have thought of it a number of times, and set the thought aside because I think my skills lie more in AFC. I suspect clerking requires a very tightly focussed attention to detail. I also might find folk were encouraging me towards adminship, something I have never aspired to, indeed I aspire to remain a run of the mill editor. 🇺🇦  Fiddle^Timtrent  Faddle^Talk to me 🇺🇦 19:19, 31 May 2022 (UTC)

I'm going to try monitoring this list more closely. I have CU tools so should be able to help out with any report that has CU requested. Frankly, though, most of the work falls on the clerks. Current clerks and future clerks, thanks for all the thankless work you do! -- Yamla ( talk) 19:31, 31 May 2022 (UTC)

Yeah, typically the backlog is at its highest in the Northern hemisphere summer months (late May-early September) then disappears around October after all the new CUs are appointed. Stays pretty low October through April, then gets high again in May.

SPI has traditionally been driven by CU activity (clerks do have an important role, but CUs go through the cases without CU requests as well and check as needed, and this often clears those.) If you think about the demographic that get appointed CU, this kinda makes sense. It tends to be people who have been administrators at least a year, if not longer, and who are still active in the day-to-day activity of the project to the level that they're known and respected by the active editing community.

That degree of activity typically doesn't last for more than a couple of years based on interests changing and real life happening. The Northern summer is usually a time of transitions in life, work, school, etc. Add in vacations, trips after 2 years of pandemic etc. it makes sense that "longer term" users like CUs would probably be less active now, and its my theory for why we see the pattern every year... also why I make a similar post to this every year. TonyBallioni ( talk) 19:38, 31 May 2022 (UTC)

Hello,

I've just noticed that the button for submitting a report seems to have broken for IP editors. The button should only direct you to the talk page if you are opening a brand new investigation and need to create a new page, if you are adding a new section to an existing report then you can edit the page directly. I seem to remember that there used to be two boxes you could use which covered both possibilities? 192.76.8.78 ( talk) 13:27, 7 June 2022 (UTC)

Whoops, think that's on me. Half a mo'. -- Tamzin ^{cetacean needed} (she/they) 13:28, 7 June 2022 (UTC)

Okay, I think this should have fixed it, 192? Let me know if it didn't. Very sorry for the inconvenience my tweak to the header caused. -- Tamzin ^{cetacean needed} (she/they) 13:38, 7 June 2022 (UTC)

@ Tamzin That fixed it, Thanks! 192.76.8.78 ( talk) 14:05, 7 June 2022 (UTC)

See, this is why they made me a full clerk. Gotta have someone on the team who's capable of cleaning up my messes. ;) -- Tamzin ^{cetacean needed} (she/they) 14:32, 7 June 2022 (UTC)

Due to a copy-paste error, I've just created a new case at Wikipedia:Sockpuppet investigations/ Honest Yusuf Cricket instead of adding it to Wikipedia:Sockpuppet investigations/Honest Yusuf Cricket. I hope someone can clean up after me; very sorry for the trouble! -- JBL ( talk) 19:11, 17 June 2022 (UTC)

Section moved and typoed page deleted. Since you're the only contributor, your signature ought to provide sufficient attribution. Thanks for posting. :) -- Tamzin ^{cetacean needed} (she/they) 19:14, 17 June 2022 (UTC)

Thank you! -- JBL ( talk) 19:25, 17 June 2022 (UTC)

Hmm, [11] shows 33 cases with leading spaces. I see at least one, Wikipedia:Sockpuppet investigations/ Kautilya3, that should be merged with the correct case (both were declined as baseless, but someone having been twice wrongly accused is a good thing to know), and I'm guessing that's not the only one. For resulting soft redirects, or ones created as a result of past moves/merges (which is most of the 33), my inclination is to delete any without backlinks. Does anyone else have thoughts on the matter? -- Tamzin ^{cetacean needed} (she/they) 20:21, 17 June 2022 (UTC)

Not a clerk, but FWIW that seems eminently reasonable. I might also suggest titleblacklisting leading-space SPI pages, or might that have unintended consequences? firefly ( t · c ) 10:39, 18 June 2022 (UTC)

I realize of course that there's a huge backlog, but Wikipedia:Sockpuppet investigations/ZemenfesKidus has been open for more than three weeks now, and though one of the IP ranges has been blocked by Drmies after 500 or more block-evading edits, the account listed ( BeteAmora ( talk · contribs)) has made more than 600 edits and is still going strong. ☿  Apaugasma ( talk  ☉) 11:11, 20 June 2022 (UTC)

Not sure what to do with this. A new article Tylerbrizyy (musician) has been created, and it looks like a recreation of something deleted earlier after this AfD: Wikipedia:Articles for deletion/Tylerbrizyy (hence I've requested speedy on it). At the AfD it was mentioned that its creator Tylerbrizyy was blocked as a puppeteer, and David DXL was also mentioned. This new article has been created by the latter, now twice. I haven't filed a formal case as I don't know if this is enough of a reason to, but I reckon something's ducky here. -- DoubleGrazing ( talk) 13:23, 1 July 2022 (UTC)

A single-minded interest in creating a spammy article previously created/defended by a bunch of socks? Sounds like the quack heard around the world - either sockpuppetry or meatpuppetry (e.g. paying someone else to create the article) which can be treated in identical fashion.  Blocked without tags, closing. :) firefly ( t · c ) 13:32, 1 July 2022 (UTC)

Duck me, that was quack! Sorry, quick. -- DoubleGrazing ( talk) 13:33, 1 July 2022 (UTC)

We aim to please :) firefly ( t · c ) 13:40, 1 July 2022 (UTC)

Hello, SPI folks,

I've probably created a dozen SPI reports since I started editing here regularly and today when I did this, the "submit" won't go through. It kept bringing me back to an editing screen with no explanation of what the problem could be. I've gone through this now three times in case I was inputting the information incorrectly but I get the same response each time. Any advice? Liz ^{Read! Talk!} 02:48, 23 June 2022 (UTC)

It turns out that there was some interferences with "Bawl", an editing tool I installed some time ago. It kept insisting that I add a subject line and I didn't notice this was preventing the report from being submitted. So, I added a subject line that I just had to remove later. Just thought I'd keep this message here in case another editor runs into this problem with Bawl. Liz ^{Read! Talk!} 04:29, 23 June 2022 (UTC)

Apologies, fixed. — Alexis Jazz ( talk or ping me) 09:34, 24 June 2022 (UTC)

@ Liz now I know why I see edit summaries saying "Bawl"! Doug Weller talk 07:49, 7 July 2022 (UTC)

Why? Doug Weller talk 11:13, 5 July 2022 (UTC)

@ Doug Weller I think "CU completed" applies to the 2 June case submission, and "CU requested" applies to the 3 June submission. firefly ( t · c ) 13:00, 5 July 2022 (UTC)

@ Firefly that makes sense. I don't know why I missed that. Oops! Doug Weller talk 13:14, 5 July 2022 (UTC)

@ Doug Weller easily done! Not exactly intuitive when the table lists two statuses for the same case :) firefly ( t · c ) 13:26, 5 July 2022 (UTC)

And congratulations on you promotion to full clerk! Doug Weller talk 07:46, 7 July 2022 (UTC)

@ Doug Weller Thanks! (That's arb-, not SPI-clerk but I do a passing impression of an SPI clerk now and then too as a patrolling admin :P) firefly ( t · c ) 09:27, 7 July 2022 (UTC)

Oops, my bad. Good luck, before I was an Arb I was recruited as a clerk. The request to become one was quite a surprise! But that was long ago now. :) Doug Weller talk 09:39, 7 July 2022 (UTC)

I've seen a few SPI fillings that link to mobile diffs, and would a bot task to change to desktop diffs be useful? 0x Deadbeef 05:34, 10 July 2022 (UTC)

Wikipedia talk:Sockpuppet investigations/Gingie11 → Wikipedia:Sockpuppet investigations/Gingie11
Instructions weren't clear whether an explicit request was needed, making one just to be safe. Thanks, 2406:3003:2077:1E60:C998:20C6:8CCF:5730 ( talk) 21:49, 18 July 2022 (UTC)

 Done. In the future, no, no need to post here. :) -- Tamzin ^{cetacean needed} (she|they|xe) 04:15, 19 July 2022 (UTC)

I've recently started becoming slightly active here at SPI, and noticed some peculiarities regarding how the backlog works here. Firstly, the list of unarchived closed cases seems to be well over 100 cases long, and includes cases that haven't been modified in nearly a month. I assume that every once in a while, a clerk begrudgingly does the tedious work of archiving these cases and clears out the list periodically. Is archiving closed cases a sufficiently straightforward and clear-cut task that we might recruit the help of a bot to do it? Or is it something that requires subjective evaluation by a human or complex decision-making?

Secondly, I've noticed that the list of "open" cases contains a relatively large number of stale cases that have never had any edits made to them since they were originally created, with the list similarly stretching nearly a month back. Maybe they're just uninteresting cases. Maybe the requester gave very little info and therefore a lot of digging would be required by anyone that tries to handle the case. Or perhaps there just aren't enough people working at SPI to handle all the incoming cases. Anyway, I'm wondering what eventually happens to these stale cases? Is there a time limit after which they're just closed without comment? Or do all cases eventually get some kind of response from a clerk/admin/CU? —⁠ScottyWong⁠— 15:04, 20 July 2022 (UTC)

Basically, "too many cases, not enough people working them".

Archiving requires human eyes. It's quality control where somebody looks over the case to make sure there's no loose ends. As a simple example, somebody might have said they were going to tag socks, but didn't. Once in a while when I was doing a lot of archiving, I would see something that just didn't seem right and ping the person who worked the case for clarification. Bogus cases get deleted under WP:G6 instead of archiving.

The bottom line is we need more people working SPI. There's a list of people (some of whom are exceptionally qualified) who have applied to get clerk training at WT:SPI/C. You could add yourself. And, looking at my fellow CUs, we really do need a better process for triaging applicants and getting the good ones trained up. In addition to the clerks, any admin is welcome to help out. See WP:SPI/C#Admin_patrollers for details, although I'll admit that the instructions aren't wonderful. I got my start that way.

As for the open cases, yes, sometimes by the time you get to them, there's no point in doing anything. If none of the accounts have edited in several months, I'll typically just close the case with no action per WP:BLOCKP. That might be a good place to jump in as a patrolling admin. Or, you might look for cases where the person working them said they were going to close it but it got left open and politely ping them to see if it's OK to close :-). -- RoySmith (talk) 15:42, 20 July 2022 (UTC)

There's a discussion happening at Wikipedia talk:Edit warring#Reverting actions performed by banned users in violation of a ban, and sockpuppets or meatpuppets of banned or blocked users., and input from people experienced in anti-sockpuppetry work would be appreciated. Firefangledfeathers ( talk / contribs) 14:54, 4 August 2022 (UTC)

I have recently been having an exchange with Somebody040404 in relation to a minor content dispute at Languages of the Democratic Republic of the Congo. A new user called JustSomeone08 had now made exactly the same disputed edit with an edit summary which is almost verbatim what the other user added a few days earlier entirely separately on my talk page. There is also an obvious similarity of usernames. I see that the two users also edit the same other articles ( 1 2) on Congolese languages, often on the same days, sometimes only hours apart.

Although it is perhaps also unfair to raise this allegation, I also wonder whether the single-use account TSHepo050302 is another sock of the same user given the similar edit history and naming format but I apologise sincerely if this is not the case.

I am not familiar with the processes in this area. Could someone let me know what is necessary to take it forward?— Brigade Piron ( talk) 20:42, 8 August 2022 (UTC)

@ Brigade Piron go to Wikipedia:Sockpuppet investigations, search for "How to open an investigation", click the "show" button, and follow the directions there. -- RoySmith (talk) 00:04, 9 August 2022 (UTC)

FYI Template:SPI ( | talk | history | links | watch | logs) has been nominated for deletion at TfD -- 64.229.88.43 ( talk) 05:02, 18 August 2022 (UTC)

At Wikipedia talk:Sockpuppet investigations/Orca Vision Inc., an IP had misindentified the SPI page as protected and added an {{ edit semi-protected}} SPI request. Requesting a CU/clerk to merge the talk page with the actual SPI page. Thanks! — CX Zoom[he/him] ^{( let's talk • { C• X})} 08:49, 25 August 2022 (UTC)

In my view the filing should just be deleted. It's pointless as everyone involved has already been blocked/locked. Spicy ( talk) 10:44, 25 August 2022 (UTC)

I suppose tagging would be at least a bit helpful? 0x Deadbeef 10:50, 25 August 2022 (UTC)

There is little value in tagging obvious troll accounts, and I suspect there's some WP:GHBH stuff going on with the filer. Spicy ( talk) 10:57, 25 August 2022 (UTC)

I've blanked it per the unusual circumstances Spicy outlined above. Thank you for bringing this here, CX Zoom. :) -- Blablubbs ( talk) 11:23, 25 August 2022 (UTC)

Thank you everyone! — CX Zoom[he/him] ^{( let's talk • { C• X})} 14:19, 25 August 2022 (UTC)

From those of you with more experience at this, what do you do if you think you've spotted someone you recognize, but it's *way* too early to have substantive evidence yet. For example, this editor only registered hours ago and they have eight total edits, but they immediately reminded me of Hopelesswiki. Now what? Mathglot ( talk) 03:37, 30 August 2022 (UTC)

I assume you have at least some evidence because if there's no evidence at all, then it probably isn't right to be suspicious. In that case, you should file a SPI and request checkuser to investigate. Even if you don't feel there is enough evidence to warrant a check, you should file a case anyways in my opinion, leave it open, and monitor for future edits. 0x Deadbeef 10:01, 30 August 2022 (UTC)

I have tried "Intersect Contribs" but I see no common interest there between Mr. Mustache and Hopelesswiki/related IPs. The Banner  talk 10:19, 30 August 2022 (UTC)

To answer Deadbeef's question, yes, I do, but it's too thin to be sure or even have a well-founded suspicion yet. To Banner's point: the pattern is completely stylistic and independent of specific pages or topics. I'll continue to monitor their contributions for the time being and see what develops, and if the pattern continues, I'll file. Thanks, all; this was helpful. Mathglot ( talk) 17:47, 30 August 2022 (UTC)

Hm, Dior's Mustache has been indeffed now as a sock (not of the master I suspected, though). Now I feel sorry I spent so much time on their Talk page, trying to be helpful. Is there an essay, WP:Assume good faith, but not too much? Oh, well. Btw, Hammersoft, how did you discover the connection with Vicpumu ( talk · contribs), if there isn't some secret sauce involved? Mathglot ( talk) 04:38, 31 August 2022 (UTC)

I'd prefer not to discuss in the open. -- Hammersoft ( talk) 12:34, 31 August 2022 (UTC)

I have a question. A throw-away account was created to commit one act of vandalism, which it did, and has been blocked. Is there a way to request that CheckUser determine who the sockmaster is? It was clearly a throw-away account created by a person who used it for a bad joke. If I had reason other than idle suspicion to guess who else had used that IP address during that time window, I could submit an SPI request, but I only know of one address, so I can't specify who else to check. Robert McClenon ( talk) 01:51, 3 September 2022 (UTC)

Throw-away socks are a dime a dozen. If they're already blocked, it's not worth investing much effort to figure out who they're a sock of. -- RoySmith (talk) 02:14, 3 September 2022 (UTC)

See also User:Tamzin/SPI is expensive. KevinL (aka L235 · t · c) 12:34, 3 September 2022 (UTC)

I think I've found another potential sock of Jurrasic kid ( User:2019Rocks), but I can't find any previous cases involving them (Jurrasic kid) in the archives and I don't want to file it under the wrong name. Would it even be worth it to start an investigation, since 2019Rocks already blocked?

Asparagusus (interaction) 22:42, 9 September 2022 (UTC)

Just file it under Jurrasic kid. It'll get sorted out. This is why SPI clerks get paid so well. -- RoySmith (talk) 23:25, 9 September 2022 (UTC)

I think Wikipedia:Sockpuppet investigations/Isuzu.tf was created incorrectly and I cannot close it. Can someone check? The IP who created it was spot on, unfortunately the report didn't transclude to the open SPI list and the sock ran amok for a several weeks .-- Jezebel's Ponyo ^{bons mots} 19:56, 13 September 2022 (UTC)

Spicy fixed it, the case status banner was missing. Ivanvector ( ^Talk/ _Edits) 21:05, 13 September 2022 (UTC)

Ta!-- Jezebel's Ponyo ^{bons mots} 21:09, 13 September 2022 (UTC)

Asking for some guidance on somewhat speculative reporting. I've just come across two drafts at AfC, Draft:Nuvoco Vistas and Draft:Akhil Talreja, which were created by new users. Both articles (by which I mean, articles on these topics, not necessarily identical in content) have previously been created by socks. If I can't find any other connection to the earlier socks (ie. no similarity in eg. usernames), is the mere recreation of an article previously associated with socking enough of a reason to report to SPI? In other words, is it better to report 'just in case', or not to bother you guys without more evidence? Cheers, -- DoubleGrazing ( talk) 06:55, 17 September 2022 (UTC)

I know that you don't usually connect IPs to accounts, but what are we supposed to do when we have good reasons to believe that someone is IP socking? Thanks. M.Bitton ( talk) 23:00, 23 September 2022 (UTC)

Create an SPI without checkuser requested.-- Jezebel's Ponyo ^{bons mots} 23:07, 23 September 2022 (UTC)

Thank you for the quick reply. M.Bitton ( talk) 23:13, 23 September 2022 (UTC)

And when you do, please ping @ MarioGom on it; it sounds like it'll be a good one for him to take a look at as part of his training :-) -- RoySmith (talk) 23:20, 23 September 2022 (UTC)

  Done M.Bitton ( talk) 15:28, 24 September 2022 (UTC)

I would like to know whether it is technically possible to perform an investigation between two users editing from two different countries. The reason why I ask this is because an admin of the Italian Wikipedia called Ignis claims that user Jacquesparker0 may have engaged in "POV pushing" on their project using my IP address just because we edited the same article about Margaret Singer. They seem to think that I'm a sockpuppet or meatpuppet of him. Of course I am not as I edit from Italy, which you can easily verify, but Ignis is absolutely convinced I am. Here you can find the discussion. I'd be happy if you could clarify the point. Thanks. 151.31.243.65 ( talk) 15:38, 17 October 2022 (UTC)

The English Wikipedia has no influence over what happens on the Italian Wikipedia. Spicy ( talk) 20:31, 17 October 2022 (UTC)

Also note that Wikipedias are organized per language, not per country. MarioGom ( talk) 19:05, 18 October 2022 (UTC)

OK, got it. But what can I do to prove that I'm not his sockpuppet as I've been accused of it, despite being Italian and despite this user don't even speak Italian? 151.31.243.65 ( talk) 08:36, 20 October 2022 (UTC)

You'd have to ask on the Italian Wikipedia. -- Yamla ( talk) 08:58, 20 October 2022 (UTC)

There is one SPI for this sockmaster ( Wikipedia:Sockpuppet investigations/Anglo Pyramidologist) resulting from a series of merges but four sock categories:

• Category:Wikipedia sockpuppets of Goblin Face
• Category:Wikipedia sockpuppets of Anglo Pyramidologist
• Category:Wikipedia sockpuppets of Quack Hunter
• Category:Wikipedia sockpuppets of BookWorm44

Should these be merged? I'm asking for the purposes of determining the scope of Wikipedia:Contributor copyright investigations/GreenUniverse - which users should be added? MER-C 13:49, 27 November 2022 (UTC)

I'll check if dual tags apply. MarioGom ( talk) 21:05, 27 November 2022 (UTC)

MER-C: Based on behavior, article overlap, and the fact that someone else already made the decision of merging the cases before, these should all be dual-tagged with the same alternative master. I'm not looking forward to re-tag 171 accounts within 4 different confirmed groups, but I think you should consider all of them as part of the same group. MarioGom ( talk) 21:19, 27 November 2022 (UTC)

Thanks. The merger is not critical, I've run the four categories separately. It's a lot of potential copyvio to go through but WP:PDEL+G5 make a powerful combination. MER-C 19:15, 28 November 2022 (UTC)

HEADER

This quick case is open.

• Sk5505 ( talk ⁺ · tag · contribs · deleted contribs · logs · filter log · block user · block log · CA · CheckUser( log) · investigate · cuwiki) Thailandhindi ( talk) 02:22, 3 December 2022 (UTC)

Thailandhindi, as I asked in the SPI you filed: why? What has Sk5055 done that merits the use of the checkuser tool? And while we're at it, how did you, a brand-new user, file a sockpuppet investigation as your first edit? GeneralNotability ( talk) 02:24, 3 December 2022 (UTC)

This user nominated an article from a popular profile, calling it clear propaganda. This leads to suspicion that this is a mother's account with a complete lack of information. Either the blind is shooting arrows in the dark. Thailandhindi ( talk) 02:27, 3 December 2022 (UTC)

I see no such activity on the English Wikipedia, which suggests that this is a dispute from a different language Wikipedia. We are not going to take action here based on a dispute elsewhere. Raise your concerns wherever these issues are happening, not here. GeneralNotability ( talk) 02:29, 3 December 2022 (UTC)

See

Wikipedia:Miscellany for deletion/Wikipedia:Long-term abuse/Kiyanu Kim,

Wikipedia talk:Long-term abuse/Archive 6#Blanking practice, and

Wikipedia:Administrators' noticeboard#Blanking inactive LTA pages.

I maintain that MfD is an incompetent forum for authorising the deletion of LTA and SPI subpages without the involvement of an SPI clerk or checkuser.

I don’t think it is wise to allow random editors to blank LTA subpages. Precedent may be set by experienced users and admins that opens the door to others doing selective blanking for nefarious reasons. There should be some rule, and I suggest the rule that clerking of LTA be limited to SPI clerks. Alongside, I suggest serious consideration of the blanking of all LTA subpages, due to it containing more problems than useful resources, and it being abandoned by regular management. SmokeyJoe ( talk) 02:13, 4 December 2022 (UTC)

To avoid fragmenting discussions, let's continue this at the unarchived AN thread: Wikipedia:Administrators' noticeboard#Blanking inactive LTA pages. ಮಲ್ನಾಡಾಚ್ ಕೊಂಕ್ಣೊ ( talk) 10:33, 4 December 2022 (UTC)

He has been making disruptive editing at Template:Dance drama of Southeast Asia Tellisavas ( talk) 16:16, 11 December 2022 (UTC)

Barnstars all round!

		The Wikignome Award
		For beavering away in a thankless area, creating order out of chaos, this award is for all who undertake the detailed task of nuking sockpuppetry, and most particularly for the current low level of backlog of SPI reports 🇺🇦  FiddleTimtrent  FaddleTalk to me 🇺🇦 17:33, 13 December 2022 (UTC)

My new filing Wikipedia:Sockpuppet investigations/BiniamAmbachew doesn't currently appear at Wikipedia:Sockpuppet investigations/SPI/Cases even after a purge. Maybe this is a due to a delay while waiting for a robot to extract the strings for the columns? Boud ( talk) 13:19, 15 January 2023 (UTC)

@ Boud the list is indeed updated by a bot, which runs on a set cadence. It's showing up now :) firefly ( t · c ) 15:00, 15 January 2023 (UTC)

Would it be useful to look for patterns which might indicate potential socks, such as rapidly making exactly ten edits then becoming dormant, or would that constitute unwarranted fishing? I understand that any such trawl would include false positives from good-faith editors and require corroboration from other activities before meriting any sort of investigation. Certes ( talk) 15:11, 15 January 2023 (UTC)

@ Certes: When I was very active in NPP, I came across a lot of users like that. In my guess, 85% of such users are returning editors, 2% new ones read about it on wikipedia itself and then go dormant till becoming auto confirmed, 8% seem to read about it somewhere else with searches like "how to publish article on wikipedia", and get a normal idea. Around 5% are genuine/goodfaith editors who simply cant/dont edit after one or two days for whatever reasons. Even though the 85% are returning ones, it is extraordinarily difficult to guess who the master is. —usernamekiran (talk) 15:48, 15 January 2023 (UTC)

It is already done to some extent. See WT:WPSPAM for example, which is fairly good at catching spam page creations. MarioGom ( talk) 19:53, 15 January 2023 (UTC)

Thanks. Of course, the 85% have various motives, and it's hard to tell good from bad sleepers who, by definition, haven't provided evidence either way. If it's in hand, well done; I'll leave you to it and not ask for further details. Certes ( talk) 20:21, 15 January 2023 (UTC)

Hello. I do not know how to handle all this sockpuppetry investigation stuff. However, I strongly suspect Mysteronfax and Historian442 of being sockpuppets of each other. They only edit one article, Jerome Sinclair. They have both been editing only since January 8, 2023 at the EXACT same time. They mirror and back up each other in debates, such as the ones on this talk page. On that page, they responded to the previous commenter within minutes apart, on two (four) occasions! It's clear as day they're sockpuppets, I just don't know how to get them banned. Paul Vaurie ( talk) 09:07, 18 January 2023 (UTC)

Paul Vaurie Note that there is a difference between a ban and a block. I think you are referring to a block. If you are having difficulty making an SPI report, it may be easier for you to do if you enable Twinkle in your account Preferences; Twinkle is a gadget that makes most reporting tasks easier to carry out. 331dot ( talk) 09:28, 18 January 2023 (UTC)

I've created the SPI report. - UtherSRG (talk) 12:29, 18 January 2023 (UTC)

IMO, this EIA is a no-doubter. https://sigma.toolforge.org/editorinteract.py?users=Historian442&users=Mysteronfax Regards,   Aloha27  talk  13:39, 18 January 2023 (UTC)

@ 331dot: Sorry, I did not distinguish between a ban and a block. Regardless, someone's on it, and that's what counts. Paul Vaurie ( talk) 15:22, 18 January 2023 (UTC)

Mz7 (bot) will no longer add pages in the User or Template namespaces to the SPI case table even if the template {{ Checkuser needed}} is placed on them. There is currently an issue where adding the CU needed template to a page will cause the bot to add all pages that transclude that page to the SPI table as well. Since more than a hundred pages transclude WP:AIV, for example, this resulted in an overwhelming amount of duplicate entries in the table when it was used there—see [12] for an illustration of this issue. Off the top of my head, I could not think of an easy solution to skip these sorts of "nested" transclusions directly, so I decided to implement this solution instead. Almost all pages that transclude pages like WP:AIV are in the User and Template namespaces, and it seems unlikely that a legitimate use of the {{ Checkuser needed}} template will occur in those namespaces. Please let me know if you notice any other issues with the bot. Thanks, Mz7 ( talk) 22:52, 31 January 2023 (UTC)

Please refer to Wikipedia:Sockpuppet investigations/Izaaqnewton/Archive and to Wikipedia:Sockpuppet investigations/Mark Mulwanyi/Archive.

I suppose the alternative question is "Does it matter?" 🇺🇦  Fiddle^Timtrent  Faddle^Talk to me 🇺🇦 10:17, 7 February 2023 (UTC)

At some level, no, it doesn't really matter. But having the histories combined can provide a better baseline for future comparisons. Is there something specific in the archives that you noticed which makes you think they're the same? You're not the first person to suggest they might be connected; I can't disclose the details, but the possibility is discussed in the cuwiki notes. -- RoySmith (talk) 14:43, 7 February 2023 (UTC)

RoySmith The problem is that I just have a feeling about it. Each sock farm is likely UPE specialising in Hamis Kiggundu. Kiggundu is a wealthy Ugandan, and unlikely to need a sock farm nor UPE to qualify for an article here, but every edit by this growing (pair of?) sock farm(s) is promotional. They even created an article about HK on Wikiquote!

I suppose it comes down to my not liking to be fooled, in the same way that SPI folk dislike attempts to fool them, coupled with a desire for loose ends to be tidied away.

All this is way above anything I have a right or a need to see. I suppose I am also wondering what level of a "more than suspicion" is required to trigger someone being authorised to get the drains up and have a good dig about. I think my mind has more than "It's a fishing expedition" in it, but concrete things without admin goggles are hard to assemble into a case 🇺🇦  Fiddle^Timtrent  Faddle^Talk to me 🇺🇦 16:18, 7 February 2023 (UTC)

I suspect you're right. Let me do a little digging and I'll get back to you. -- RoySmith (talk) 16:31, 7 February 2023 (UTC)

Heh, I can stop being coy about what I know; it's in the public record by Mz7. I'll get them merged, thanks for the heads up. -- RoySmith (talk) 16:36, 7 February 2023 (UTC)

Being suitably coy is never a bad thing in this delicate arena. I'm glad there are rules which bind us against going fishing, though sometimes frustrated by that concept in equal measure. 🇺🇦  Fiddle^Timtrent  Faddle^Talk to me 🇺🇦 16:45, 7 February 2023 (UTC)

That looked as though it was hard work. I hope your helper script just achieves the merge by itself, though. 🇺🇦  Fiddle^Timtrent  Faddle^Talk to me 🇺🇦 17:23, 7 February 2023 (UTC)

Just a note that the CheckUser queue on the Account Creation Interface is backlogged: currently at 36 requests and four weeks. If any CUs have some spare time, processing some of these would be much appreciated. (Noting this here because I figure a bunch of CUs have this watchlisted and I can't think of anywhere better. :) ) — Mdaniels5757 ( talk •  contribs) 17:19, 8 February 2023 (UTC)

Hey, there's a discussion about what WHOIS lookup link is best to use for ranges at Template talk:Range vandal and I suspect SPI people are probably the ones to ask. Feel free to help out! -- Trialpears ( talk) 14:29, 20 February 2023 (UTC)

There are three sockpuppet investigation which are opened. 1: Wikipedia:Sockpuppet investigations/Whybob19 2: Wikipedia:Sockpuppet investigations/Hilola Jurakulova 3: Wikipedia:Sockpuppet investigations/Panpanchik

The first investigation is by me in which I wrote "All first four accounts are created in interval of 2-3 hours at the same day and I think that they all are about same user because they all regularly create unsourced and one sentence articles about towns and villages in Uzbekistan.", second is by @User:Bbb23 in which he wrote "Generally, this involves the creation of drafts/articles on Uzbekistani topics, mostly places and mosques. There are a slew of users who create the drafts, and then usually the master or Dilshod's project move the drafts to article space. The master and Dilshod's project also create pages on their own, and sometimes the other users also create pages directly into article space on their own. Occasionally, the master and Dilshod's project edit the same pages. With the exception of the master, all of the accounts were created at roughly the same time. I'm requesting a check to confirm and also to look for other accounts. I found most of the suspected socks from following the history of the pages in the masters and Dilshod's project's history, but I don't think I found all of them." and third is by @User:Onel5969 in which he wrote "Okay, not sure exactly what this is, but these 6 editors, 4 of them created in the last day or two, went on a stub-spree today. Each of them created about 20+ articles on Uzbekistan subjects, using the exact same sourcing and framework. Not sure if its the same editor or not, but I thought perhaps it might be worth taking a look at. I'll provide a link to one article from each of them, but as I said, if you look at their contributions, each did quite a few. Here are the articles: To'xtaboyvachcha Mosque, Tillasheykh mosque, [Qambarboyvachcha uy Mosque]], Chor Xaros Mosque (although that one's a little bit different, but same subject matter from a recently created account, but it's their only creation today), Uzun Hovuz Mosque, and Tinchob Mosque." and the similarity of these all three investigation is that the suspected users of this investigation creates articles related to Uzbekistan which means that this all investigations is about one subject and should be merged.

I think that this all three investigations should be merged with Wikipedia:Sockpuppet investigations/Whybob19 since this investigation was made first. I request you for merging it. ​​​​​​​𝐋𝐨𝐫𝐝𝐕𝐨𝐥𝐝𝐞𝐦𝐨𝐫𝐭𝟕𝟐𝟖🧙‍♂️ ^{Let's Talk !} 12:06, 26 February 2023 (UTC)

Clerks are aware of this and will merge the cases when it is convenient. There is no need to post about this at several different venues. Spicy ( talk) 12:12, 26 February 2023 (UTC)

Okay ​​​​​​​𝐋𝐨𝐫𝐝𝐕𝐨𝐥𝐝𝐞𝐦𝐨𝐫𝐭𝟕𝟐𝟖🧙‍♂️ ^{Let's Talk !} 12:13, 26 February 2023 (UTC)

Does anyone recognise the editing pattern of new editor EggsAndCakey? Curb Safe Charmer ( talk) 09:51, 6 March 2023 (UTC)

Apparently yes: [13]. MarioGom ( talk) 21:12, 7 March 2023 (UTC)

I did it again - see Wikipedia:Sockpuppet investigations/DilHaiChhotaSaChhotiSiAasha. I just intended to move the latest case into Wikipedia:Sockpuppet investigations/ANASKHAN777, but I misclicked and histmerged the two cases - sorry! Rationale: I'm not sure about the connection to this master - previous socks are stale, CU logs show IPs that geolocate to the same city as TheAnasKhan's IPs, so it's certainly  Possible, but some behavioural analysis would be needed to be confident. What I am certain about is that TheAnasKhan and Lillyput4455 are  Confirmed to one another, and to Jaalkipoy, who is a confirmed sock of ANASKHAN777. Can someone fix my mess? Girth Summit _(blether) 15:52, 30 March 2023 (UTC)

Pinging a few recently active clerks in hopes of a quick resolution before anyone further complicates the edit histories: Vanjagenije, Sir Sputnik, Spicy. Girth Summit _(blether) 16:07, 30 March 2023 (UTC)

Thanks for the ping, but I don't think I can help with this. I'm not entirely sure, but this seems like it would require a histsplit to unwind the histories of the two cases. Spicy ( talk) 16:12, 30 March 2023 (UTC)

Yeah, I was thinking that it might take some special tools, which I probably have, but don't know how to use properly. Hopefully one of the adminclerks above can help. I've gotta be more careful... Girth Summit _(blether) 16:25, 30 March 2023 (UTC)

@ Girth Summit: Can you clarify the situation? What should be at Wikipedia:Sockpuppet investigations/DilHaiChhotaSaChhotiSiAasha and what should be at Wikipedia:Sockpuppet investigations/ANASKHAN777? Vanjagenije (talk) 17:21, 30 March 2023 (UTC)

Thanks for looking Vanjagenije. Wikipedia:Sockpuppet investigations/ANASKHAN777 archive should have the case from April 2017 in it. The cases from November and December 2022 should be in the archive at Wikipedia:Sockpuppet investigations/DilHaiChhotaSaChhotiSiAasha. The active case, which was raised under DilHaiChhotaSaChhotiSiAasha, should remain at ANASKHAN777 (since I have confirmed the accounts to a confirmed sock of that master). Does that make sense? Girth Summit _(blether) 17:42, 30 March 2023 (UTC)

In short, this edit was a goof, and needs moving back over to where it came from. I could have a stab at it, but don't want to make matters worse by cluttering the histories if I mess it up. Girth Summit _(blether) 17:44, 30 March 2023 (UTC)

@ Girth Summit: Is it ok now? Vanjagenije (talk) 18:20, 30 March 2023 (UTC)

I think so - thanks! Girth Summit _(blether) 20:13, 30 March 2023 (UTC)

Please will one you you bring this small SPI to a conclusion. 🇺🇦  Fiddle^Timtrent  Faddle^Talk to me 🇺🇦 14:47, 12 April 2023 (UTC)

 Done, although please note that we have a perennially lengthy backlog at Wikipedia:Sockpuppet investigations. I would not encourage editors to request attention at specific cases on this talk page unless there is something truly urgent, lest this talk page overflows with such requests. Thanks, Mz7 ( talk) 23:17, 13 April 2023 (UTC)

Hey there,

Please merge Wikipedia:Sockpuppet investigations/GizzyCatBella with Wikipedia:Sockpuppet investigations/Jacurek, per this ArbCom block.

Thanks. François Robere ( talk) 20:03, 27 April 2023 (UTC)

This is now done. [14] Mz7 ( talk) 01:18, 9 May 2023 (UTC)

Please check [15] and [16]. 2804:14D:5C32:4673:18FC:2E3D:DBD7:7AA2 ( talk) 14:36, 7 May 2023 (UTC)

Now already dealt with. Thanks for bringing this to our attention; in the future, please use WP:AIV to request attention against obvious vandalism such as this. More administrators watch that page, and this page is more for discussing the sockpuppet investigations process itself rather than for reporting sockpuppetry. Thanks, Mz7 ( talk) 01:21, 9 May 2023 (UTC)

Can someone please add Wikipedia:Sockpuppet investigations/Ytrezq to the list of cases. An IP user created it, and I moved it to the correct locale based on their request, but I don't know how to make it show up on the list. Thanks! -- Jayron 32 17:12, 16 May 2023 (UTC)

It's showing up for me. You might need to purge the page or find the underlying template and purge it directly, or just try a hard refresh. Ivanvector ( ^Talk/ _Edits) 17:15, 16 May 2023 (UTC)

@ Jayron32 There's a mistake here. Yes, the group with Vladlen Terezhe is the same, but place of the IP isn't the same and Ytrezq constantly argues regarding to the blockchain sources whereas here it's reliable valid WP:PRIMARY third party sources 2A02:8428:80AB:1F01:95E9:56A6:D0DF:C4CC ( talk) 22:58, 16 May 2023 (UTC)

Hi, the user I think is sockpuppeting hasn't bothered to make an account this time and seems to be just using a IP address. How do I go about reporting it in this case? I believe it to be Brogo13 – Mesidast ( talk) 19:03, 17 May 2023 (UTC)

Mesidast, you can file a SPI like you normally would. Just don't request CU as it can't be used to connect an IP to a registered account. Spicy ( talk) 23:12, 18 May 2023 (UTC)

Wikipedia:Village_pump_(policy)#Should_editing_on_Wikipedia_be_limited_to_accounts_only? - Notice about a discussion asking whether editing on Wikipedia should be limited to accounts only? - jc37 16:16, 18 May 2023 (UTC)

Sorry admins, I made a mistake with an autofiling. I had meant to submit a filing for DJdjPollard15 (the target filing) but I accidentally filed it under DjdjPollard15 (my filing). Can an admin merge the two into the correct ones please? The C of E God Save the King! ( talk) 07:08, 24 May 2023 (UTC)

 Done Vanjagenije (talk) 22:21, 24 May 2023 (UTC)

Hey CUers, admins and SPI clerks,

I was just browsing the list on the main SPI page and was wondering why there are some SPI investigations listed that were last actioned in February, March and April. I know that your schedules are full of SPI cases to investigate so it seems like these older ones should have aged off the list at this point to make room for new cases. I can't imagine there are still cases that have been left open for 2 or 3 months so I guess I'm just wondering what bot moves cases along (and off) the list on this page. Thanks. Liz ^{Read! Talk!} 21:52, 25 May 2023 (UTC)

The only thing a bot does is build the big table broken down by case status. Cases don't actually change status until a human makes the change. And once a case is closed, it doesn't get archived until a clerk or CU gives it a final look over to catch any problems. You're right that things are backed up. They often are at SPI. We'd be happy to have more admins helping out with the caseload (hint, hint). -- RoySmith (talk) 22:53, 25 May 2023 (UTC)

Hi all, I know there's a backlog and admins must be flooded with things to do, but is there a chance that some of the oldest open SPI cases will be evaluated in the near future? I'm asking because one of the suspected sockpuppets I reported back in May ( here) hasn't been looked at yet but is still very much active and continues to disrupt multiple articles, so I'm considering bringing a report to WP:ANI, but I really think it would be better dealt with here first (it seems to me a fairly blatant case of WP:BLOCKEVADE). Thanks for any advice and/or update on where things stand. R Prazeres ( talk) 17:53, 22 June 2023 (UTC)

@ R Prazeres if it is urgent to be dealt with I would suggest taking this to WP:ANI or WP:AIV. WP:SOCK can handle complicated cases, but in the cases of clear disruption using other processes is likely to be a lot quicker. Determining if they are a sock can be done after the block for the disruption. Dreamy Jazz ^{talk to me | my contributions} 20:30, 22 June 2023 (UTC)

Thanks for the feedback. That's what I was starting to think, so I'll keep this in mind now for next time. And thanks for going ahead and performing the CheckUser operation in the meantime. Cheers, R Prazeres ( talk) 21:51, 22 June 2023 (UTC)

Please, can someone have a look at this case? A sock master with not much else to do is creating one SP after another. Thanks. M.Bitton ( talk) 14:03, 23 June 2023 (UTC)

A user has made a few weird removals of data about himself, mostly from talk page archives, claiming that he is "archiving" something. The data is mostly SPI-related stuff about the person "archiving" the data. Do we just revert?

A few examples: Special:Diff/1162994107, Special:Diff/1163282068, Special:Diff/1163353374, Special:Diff/1163283656. There's more if you check the user's contributions. I spotted this by chance because I had one of the edited pages on my watchlist. -- Stefan2 ( talk) 11:58, 4 July 2023 (UTC)

Looks like a long sleeper with a history of vandalism. Blocked. RoySmith (talk) 12:22, 4 July 2023 (UTC)

@ Stefan2 yes, I'd recommend you revert their disruptive edits. RoySmith (talk) 12:23, 4 July 2023 (UTC)

NVM, I'll take care of it. RoySmith (talk) 12:24, 4 July 2023 (UTC)

I reverted a lot of them. Looks like you caught some I missed. - jc37 12:37, 4 July 2023 (UTC)

Placing {{ Admin backlog}} in Wikipedia:Sockpuppet investigations/SPI/header lists both the SPI page and the header in Category:Administrative backlog, which is not ideal. Any objection to moving {{ Admin backlog}} back to Wikipedia:Sockpuppet investigations? cc Dreamy Jazz – Novem Linguae ( talk) 13:20, 16 July 2023 (UTC)

@ Novem Linguae, I have wrapped it in includeonly tags to fix the issue. I moved it there as I added a parser function to hide it once the count was less than 200. Hopefully that works. Thanks and happy editing, Dreamy Jazz ^{talk to me | my contributions} 13:27, 16 July 2023 (UTC)

Nice solution. Looks good to me :) – Novem Linguae ( talk) 13:31, 16 July 2023 (UTC)

See Wikipedia:Miscellany for deletion/Wikipedia talk:Sockpuppet investigations/119.75.204.218. Does User:Lemonaka have standing to seek deletion of SPI pages? SmokeyJoe ( talk) 10:58, 24 July 2023 (UTC)

No, I'm sorry. I believed this is a G3 or G5 case, but I'm not sure. So I turned to MfD. I didn't have enough experience about that. -Lemonaka‎ 11:51, 24 July 2023 (UTC)

It's trolling but, if a sockmaster chooses to tell us what they think their distinctive tell may be, I'll take the report. ¯\_(ツ)_/¯ It's at Wikipedia:Sockpuppet investigations/Faster328. - Cabayi ( talk) 13:35, 24 July 2023 (UTC)

Why is Wikipedia:Sockpuppet investigations/Onlinenow under that name when Billy Hathorn is older than Onlinenow. Jo-Jo Eumerus ( talk) 19:00, 13 August 2023 (UTC)

I'm not sure why you think that. Onlinenow was created in 2005, and Billy Hathorn shows as created in 2013, but that's actually not true and no doubt has to do with account unification; in any event, their first edits were in 2006.-- Bbb23 ( talk) 19:44, 13 August 2023 (UTC)

Nevermind, Onlinenow was created in December 2095 and Billy Hathorn in March 2006. JoJo Eumerus mobile ( main talk) 20:16, 13 August 2023 (UTC)

Pretty much what I just said, although I did it without a typo. :p-- Bbb23 ( talk) 20:48, 13 August 2023 (UTC)

@ Bbb23 and Jo-Jo Eumerus: Why is Billy Hathorn not tagged as a sockpuppet of Onlinenow? Vanjagenije (talk) 16:45, 14 August 2023 (UTC)

Fwiw, as someone who’s pretty familiar with both sockmasters, I don’t think they’re the same person. Moneytrees🏝️ (Talk) 17:36, 14 August 2023 (UTC)

You'd have to ask the various admins and CUs involved in the case back in 2021. It's pretty messy to look at. All I know is there's no case for Billy anymore but instead for Onlinenow, and no one seemed to care much about the tagging issue.-- Bbb23 ( talk) 17:40, 14 August 2023 (UTC)

I'd say there's a strong correlation between "it's a year and a half old" and "nobody seems to care much about the tagging" :-) RoySmith (talk) 17:48, 14 August 2023 (UTC)

A while ago RoySmith made a request at WP:AN for more administrators to patrol SPI to help out with what he described as a seasonal backlog. One administrator - forget who - thought it would be a good idea to put up a backlog notice on the SPI page like the ones you see at AIV and RFPP. I think it should be removed. First, those notices at other boards are handled by bots so they are added and removed when some algorithm decides they should be, whereas the notice at SPI will only be removed if someone decides it should be removed, and there don't appear to be any agreed-upon criteria for when it should be placed or when it should be removed. Second, based on past experience there will almost always be a backlog at SPI in one category or another, so what's the point? I doubt it will attract any admins who don't already patrol SPI anyway. Is it supposed to "shame" CUs or clerks to be more active? We don't usually do that - and with good reason. Anyway, I think it should be removed as valueless.-- Bbb23 ( talk) 11:34, 8 August 2023 (UTC)

I disagree about the shaming point completely, it's a subjective indicator of a backlog, at the very least, it's good to categorize and draw attention through Category:Administrative backlog. -- qedk ( t 愛 c) 12:56, 8 August 2023 (UTC)

The backlog notice is produced by the following markup at Wikipedia:Sockpuppet investigations/SPI/header:

<includeonly>{{#ifexpr:{{PAGESINCATEGORY:Open SPI cases|pages}} > 100|{{Administrative backlog}}}}</includeonly>

It will hide automatically after Category:Open SPI cases drops below 100 pages (as of the time I'm writing this, it's at 124). I'm personally not bothered by the template, and I understand its intent as trying to recruit more administrators rather than guilting CUs/clerks into working harder, but at the same time, I am somewhat skeptical of its effectiveness (how many of us actually look at Category:Administrative backlog?). Mz7 ( talk) 21:40, 8 August 2023 (UTC)

I briefly looked into how we can get rid of or change the misleading language in the template that says "change this to {{ no admin backlog}}", but it seems the template is pretty inflexible there at the moment. Mz7 ( talk) 21:45, 8 August 2023 (UTC)

Thanks for the explanation! -- Bbb23 ( talk) 21:52, 8 August 2023 (UTC)

Update: Dreamy Jazz figured out how to change that text with this edit. I missed the |auto= parameter when I was looking into this! Mz7 ( talk) 20:38, 9 August 2023 (UTC)

I think I was the one that added it. My goal was to get this page into Category:Administrative backlog, which myself and some other admins patrol when looking for things to do. If the visible template is the problem, a solution might be adding a parameter to the template to turn off its visibility while still placing the category, or just replacing the template with the category. Also, it's not meant to be a badge of shame or anything like that. It's used all over Wikipedia, and in a lot of places whether it is shown or not is automated by feeding it a count of how many of X are open (using a template/module usually) over Y threshold. Hope this helps. – Novem Linguae ( talk) 22:58, 8 August 2023 (UTC)

FWIW I look regularly at CAT:AB, and I'm quite sure I'm not the only one. But also, once you've been around the various admin noticeboards a bit, you'll realize that SPI and CCI are essentially permanently backlogged; not through any fault of the editors who work those venues, but because of the persistent and prolific nature of copyright problems and sockpuppetry. As such it's not a bad idea for SPI to be appearing in the backlog, but also any regulars who check on where admins are needed already know that SPI always needs admins. Vanamonde ( Talk) 00:09, 10 August 2023 (UTC)

If the notice is showing too often, the threshold for number of open cases could be increased. Dreamy Jazz ^{talk to me | my contributions} 10:30, 10 August 2023 (UTC)

It's gone now. As a clerk, I am fine with the notice. If I get a bit nitpicky, I would say cases awaiting archive should not count towards the notice threshold though. It's a harmless category, and non-clerks should not come in to archive cases anyway. MarioGom ( talk) 06:24, 21 August 2023 (UTC)

AFAICT, closed cases (I assume that's what you mean by "awaiting archive") do not count. I believe it's the only category that doesn't count.-- Bbb23 ( talk) 12:03, 21 August 2023 (UTC)

I mean closed cases. Apparently the banner uses Category:Open SPI cases which includes closed cases. I am not sure if I'm looking at a caching issue though. MarioGom ( talk) 18:34, 21 August 2023 (UTC)

That's easy enough to change:

{{#ifexpr:({{PAGESINCATEGORY:Open SPI cases|pages}}-{{PAGESINCATEGORY:SPI cases awaiting archive}}) > 100|{{Administrative backlog|auto=yes}}}}

Note that the number also includes subcategories, so add 18 to the desired threshold. – bradv 18:46, 21 August 2023 (UTC)

@ Bradv: When the |pages parameter is applied to the PAGESINCATEGORY magic word, it will exclude subcategories from the count, see mw:Help:Magic words#Statistics, so the 18 subcategories don't have to be factored into the threshold. Mz7 ( talk) 06:58, 23 August 2023 (UTC)

Thanks for catching that @ Mz7. I've fixed it, but now the backlog notice is up again. – bradv 13:04, 23 August 2023 (UTC)

Personally, I think 100 was a good threshold. I feel like SPI is above 50 cases for the wide majority of the year, but all I have is anecdotes. One of these days I've been meaning to write something that can parse the history of Wikipedia:Sockpuppet investigations/SPI/Cases and get historical data on backlog size, and this could be a good excuse to work on that. Mz7 ( talk) 06:13, 24 August 2023 (UTC)

• Could someone (anyone but I'll ping two) tell me (1) what cases are now counted toward the backlog (use the terminology in the SPI table, please) and (2) what the threshold number is? @ Bradv and Dreamy Jazz:-- Bbb23 ( talk) 13:12, 22 August 2023 (UTC)

  It's currently all pages in Category:Open SPI cases, which is to say all of the cases in all categories currently listed in the table on the page (including closed cases). The threshold is 100, but that number includes 18 subcategories, so really the threshold is 82.

  I propose to change this to exclude closed cases, as those are the responsibility of SPI clerks and do not constitute an administrator backlog, and to reduce the threshold accordingly. – bradv 14:02, 22 August 2023 (UTC)

  Thanks much. What will the new threshold be?-- Bbb23 ( talk) 14:45, 22 August 2023 (UTC)

  According to the existing formula the current count is 113, including 18 subcategories. If we remove closed cases from that count the current number is 62 (again including 18 subcategories). If we agree that the board is currently just on the verge of being backlogged, we can set the threshold at 50 + 18 subcategories = 68. Does that make sense, or should it be lower/higher? – bradv 14:50, 22 August 2023 (UTC)

  I'm woefully ignorant of the mechanics of all this. What do you mean by "subcategories"? As a general principle, though, I'm in favor of a higher threshold.-- Bbb23 ( talk) 14:57, 22 August 2023 (UTC)

  Okay I'll just make the change and we can discuss here going forward if the backlog notice is showing up at the appropriate times. – bradv 16:21, 22 August 2023 (UTC)

  +1, we can go back at this next time it's triggered ;-) MarioGom ( talk) 18:03, 22 August 2023 (UTC)

  Absolutely. We might even be able to make the backlog notice ping you when it pops up so you don't miss the next discussion. – bradv 18:10, 22 August 2023 (UTC)

Hi. I suspect that these two accounts were operated by same person because of editing pattern. I didn't filling a SPI for these users yet because I didnt notice any disruptive edits by these editors. So, I bring this up here for better suggestions. Thank you ! Fade258 ( talk) 07:03, 24 August 2023 (UTC)

The edits themselves don't need to be disruptive as socking itself is defacto disruption. Regardless, I've already blocked and tagged the accounts. They have large dynamic ranges available to them so they'll be back.-- Ponyo ^{bons mots} 16:28, 24 August 2023 (UTC)

All make the exact same edits A type of cabinet ( talk) 05:49, 1 September 2023 (UTC)

Diff1

Diff2

Diff3 A type of cabinet ( talk) 06:00, 1 September 2023 (UTC)

@ A type of cabinet: I have now blocked these users as part of Wikipedia:Sockpuppet investigations/1Samuel afful. Please note that this talk page is not the right place to report sockpuppetry. You can find the instructions for how to properly start an investigation in the future on the main WP:SPI page if you expand the text that says "How to open an investigation". Thanks, Mz7 ( talk) 06:56, 1 September 2023 (UTC)

My apologies. Thank you for the assistance. A type of cabinet ( talk) 07:03, 1 September 2023 (UTC)

{{ Uw-socksuspect}}

I've been debating whether to TfD this talk page notice and thought some feedback from SPI regulars would be useful. This template essentially duplicates the functionality of {{ Socksuspectnotice}} (the old yellow box talk notice), which was removed from twinkle and deleted last year following a request [17].

I think most SPI regulars would agree that notifying people that you've spotted they're a sock is at best unproductive and at worst results in a significant amount of disruption. Having the suspected sock show up to engage in 200k of "You're a sockpuppet" "no I'm not" arguments is a waste of time for everyone involved. In my experience most of the people who use these notices are newcomers who don't realise how unproductive the notices are.

Does anyone have any thoughts on whether this template is actually worth keeping? I think it would probably be better for clerks/checkusers to invite people to an investigation when they are needed, rather than doing it relativley indiscriminately with twinkle/redwarn. 192.76.8.91 ( talk) 14:26, 10 September 2023 (UTC)

Please go to the WT:Sockpuppet investigations/SPI/header page to help with an edit request. Thank you in advance! P.I. Ellsworth ,  ed.  ^{put'er there} 09:04, 15 September 2023 (UTC)

Hello fellow CUs and SPI folk! I'm unravelling Wikipedia:Sockpuppet investigations/Amansharma111 and will definitely need more hands on deck. This is a massive UPE sockfarm that is using proxies extensively to create multiple accounts and articles daily. Cross checks are going to be needed as every check I make, more socks fall out. I've been heavy handed with the G11 and G5 deletions and have now started protecting some targets in article space as they typically create a draft then move it themselves to article space. It may be a good idea to loop in WP:NPP and WP:AFC to catch them early ( Wikishovel seems to have picked up on their pattern, which is helpful). Also, we'll need to shore up the proxy/P2P blocks. All of my checks will likely need to be rerun as I was unaware of the scope of the socking yesterday when I first starting checking the accounts. -- Ponyo ^{bons mots} 17:02, 22 September 2023 (UTC)

@ Ponyo sounds like fun! *goes off to find my CheckUser goggles* firefly ( t · c ) 17:07, 22 September 2023 (UTC)

If I can provide any advice it would be: don't approach it like I did (i.e. no method, all madness). -- Ponyo ^{bons mots} 17:12, 22 September 2023 (UTC)

I am usually all madness, all the time, Ponyo, so that is good advice :) firefly ( t · c ) 17:13, 22 September 2023 (UTC)

(redacted) Uhai ( talk) 18:50, 22 September 2023 (UTC)

@ Uhai: I'm deleting what you wrote so as to avoid giving our socks information about what we know so they can improve their game and help avoid detection. I'm going to revdel that in a moment. I know that's really pushing the limits of what revdel is for, but I plead WP:IAR and authorize any admin to revert my revdel if they feel I've overstepped my authority. RoySmith (talk) 23:24, 22 September 2023 (UTC)

The individual(s) involved in this sockfarm do not seem to be particularly intelligent, so I wouldn't be too worried. If this was a more devious sockfarm or LTA, I wouldn't have said anything. Uhai ( talk) 09:06, 23 September 2023 (UTC)

I just filed a SPI prior to seeing this. I realize I have no tools to search like you do so just laying this out there. The SPI I filed involves a user with similar styled username. Not sure if this would part of the same group or not. -- CNMall41 ( talk) 22:34, 22 September 2023 (UTC)

It turns out that it was the same person. Reaper Eternal ( talk) 18:46, 23 September 2023 (UTC)

Since it is a globally locked user, and there are cross-wiki creations (on simple wiki), global locks should be requested. I have no time to do that now though. MarioGom ( talk) 08:36, 24 September 2023 (UTC)

@ Tamzin regarding your quick request on 60.242.166.182, I'm curious how many indefs you've found on IPs. I would think (hope, anyway) those would be exceptionally rare. RoySmith (talk) 17:29, 28 September 2023 (UTC)

@ RoySmith - here is a query listing them. There are over 200, of which most seem to be old proxy blocks - we should probably go through and check whether they're still needed. firefly ( t · c ) 17:43, 28 September 2023 (UTC)

Interesting. I see a few marked per request of <school>. I'm surprised we would be placing blocks at the request of outside entities. If a school wants to forbid their students from editing, they can implement it in their firewall. No reason we need to be complicit in that. RoySmith (talk) 18:11, 28 September 2023 (UTC)

Don't have it readily available, but I know at some point there was a consensus against such blocks. I think it can be reasonable to take network sysadmin request into account when it's already within admin discretion to block (e.g. a moderate level of vandalism), but it shouldn't be the only reason, and in any case shouldn't be indef.

As to my own look through the category, you can see a few IP indefs I reversed at Special:Log/block/Tamzin (sorry, imprecise link; on mobile and in a rush). Two or three others were reversed by the blocking admin at my prompting. -- Tamzin^{[ cetacean needed} (she|they|xe) 18:38, 28 September 2023 (UTC)

Fwiw, there's also User:ST47/indef-blocked_ips, which provides convenient formatting and is auto-updated every couple weeks. -- Blablubbs ( talk) 18:23, 28 September 2023 (UTC)

Heh, I should've known there would already be something :) firefly ( t · c ) 18:30, 28 September 2023 (UTC)

FWIW, "IP addresses should rarely, if ever, be blocked indefinitely" has been part of WP:Blocking policy since 2008 ( added by Luna Santin). RoySmith (talk) 21:04, 28 September 2023 (UTC)

You can also get a half-decent up-to-date listing via Special:BlockList, including partial blocks which have probably been forgotten about. There was an amnesty for indef-IPs a few years ago at VPR ( archive link), which used an upper length of approximately 10 years. I haven't seen it cause any subsequent problems. -- zzuuzz ^(talk) 21:20, 28 September 2023 (UTC)

Please see WT:BP#Blocking IPs per request of school administration? RoySmith (talk) 15:23, 29 September 2023 (UTC)

A lot of the proxy blocks from 2006 are still valid, which can be easily noticed because of the AS (e.g. SoftLayer). We should probably reblock these as long-term {{ webhostblock}} though. MarioGom ( talk) 07:24, 1 October 2023 (UTC)

In addition to the myriad other sources mentioned above, there is also Wikipedia:Database reports/Indefinitely blocked IPs, updated every 28 days. Mz7 ( talk) 01:41, 2 October 2023 (UTC)

I've changed Wikipedia:Sockpuppet investigations/JoinFluffy250 to Clerk status but thought it prudent to drop a note here as well. I've blocked several socks, some of which were being used over a long period to vote in and, in some cases sway the outcome of AfDs. Extra eyes would be appreciated to untangle the deceptive edits.-- Ponyo ^{bons mots} 18:15, 6 October 2023 (UTC)

Rehashing this from the Incidents Noticeboard:

I have noticed that numerous IP addresses and accounts that have been posting pornographic imagery mostly involving phalluses for the past few months appear to have characteristics that suggest that they are based in Sweden and are the same person (same nature of images and threats of police action to impose their edits). Is there a possible way to pinpoint the exact location and to determine how extensive is this possible sockpuppet network? Borgenland ( talk) 16:01, 6 October 2023 (UTC)

I am starting off with User talk:Ghjkghjkasdf, and /info/en/?search=Special:Contributions/Qwertyufan53. Will build up once more cases start filing up. Borgenland ( talk) 16:05, 6 October 2023 (UTC)

This probably doesn't help much but this is almost daily vandalism, if not several new users/ip's a day. Just found one, Ghjkghjkasdf ( talk · contribs) and that's at least the second today. I'm on Wikipedia every day (lots of free time) so I see a lot of them but there are more that I don't see. Knitsey ( talk) 16:06, 6 October 2023 (UTC)

Are these different to the Fuerdai vandal? Knitsey ( talk) 16:08, 6 October 2023 (UTC)

Haven't encountered that vandal yet. There was one time that certain users used Swedish words and made similar threats to call cops (that was the exact term they used) and the tended to post a picture of a Swedish-labeled can in place of a phallus. Borgenland ( talk) 16:20, 6 October 2023 (UTC)

Unfortunately by the time I realized there was a link, the offending edits had been removed. Borgenland ( talk) 16:22, 6 October 2023 (UTC)

Same user made a sock: /info/en/?search=User_talk:Ghjkghjkasdf_is_not_a_sock_of_CHEEIZY. Borgenland ( talk) 16:22, 6 October 2023 (UTC)

@ Borgenland: I know the one you're talking about. They post a series of pornagraphic photos?

I think there are maybe 3 lots of 'porn' vandals.

Cheeizy (who posts a long series of photos, Fuerdai who usually includes something about testicle going up and down along with a single photo and the ones who sometimes post on Swedish(and sometimes German) articles with a single photo and summary about call the cops. Knitsey ( talk) 16:33, 6 October 2023 (UTC)

I am beginning to recall that Cheezy. Sometimes they also deface using a McDonalds interior. Borgenland ( talk) 17:18, 6 October 2023 (UTC)

Now I'm thinking of the one who always posts interiors of metro stations, usually escalators. I've gone down the rabbit hole now. Knitsey ( talk) 17:50, 6 October 2023 (UTC)

Knitsey, for what it's worth, the person who posts a long series of photos, and the one who posts in Swedish with the same photo and calling the cops, is the same person, Cheeizy. -- Ferien ( talk) 06:18, 9 October 2023 (UTC)

That makes things a bit easier then @ Ferien:. Thanks. Knitsey ( talk) 08:41, 9 October 2023 (UTC)

I have stumbled into a link to an SPI against me completely at random while reading a section in Arbitration/Requests/Enforcement. Shouldn't I have been pinged or informed on my talk page or something? JM2023 ( talk) 02:41, 15 October 2023 (UTC)

There's no obligation to do so, as far as I am aware. It's often deliberately not done, especially in cases of long-term abuse. Wikipedia:Sockpuppet investigations/SPI/Guidance lists, as step V, to "Consider notifying all the users you are accusing", but doesn't make it mandatory. -- Yamla ( talk) 09:23, 15 October 2023 (UTC)

Notifying "by default" is something we've generally discouraged. This thread concerning removal of the autonotification option from Twinkle's SPI module, which happened two years ago at the request of SPI regulars, explains some reasons for that. I also touch on it in an essay here. This may seem odd given that many of our conduct noticeboards do have notification requirements, but SPI is a bit of a different animal because it essentially serves as a highly structured fact-finding mission as opposed to a community discussion venue. -- Blablubbs ( talk) 10:35, 15 October 2023 (UTC)

I'll also note that the standard SPI templates such as {{ checkuser}} deliberately display usernames in a way that suppresses pings. Users get explicitly pinged when whoever is working the case needs some specific input. BTW, just to save people some time, we're talking about WP:Sockpuppet investigations/JM2023 RoySmith (talk) 16:13, 15 October 2023 (UTC)

If any CU is up to it, I've come across a large (has there ever been any other size?) UPE studio spam ring. Start with a check on FilmyTV, then run a "get edits" on the IPs showing multiple users. I'm heading out in a moment or I would continue pulling the threads and watching the socks unravel.-- Ponyo ^{bons mots} 18:43, 24 October 2023 (UTC)

Sometimes accounts are suspicious solely because they are doing something only experienced editors would do on their first edits, or their usernames suggest LTA, but no master is known. The existing format of SPI is not conducive to requesting investigations of these accounts as the format presumes there's a suspected sockmaster. I think we should have a different process for investigating these sorts of cases. Jasper Deng (talk) 00:05, 29 October 2023 (UTC)

I don't think there should be a formalized procedure. In other words, it should not be done at SPI. In practice, most editors contact a CU, either on their Talk page or privately, depending on the kinds of suspicions one has. I've also seen editors use {{ Checkuser needed}}.-- Bbb23 ( talk) 00:53, 29 October 2023 (UTC)

I'll offer a different opinion. I'd rather see an SPI opened, where it will be looked at by the next available sockwalla. It's not a big deal if you file it under the new account name and it ends up being merged once the correct sockmaster is identified. When somebody asks me on my talk page to investigate a sock, I'll almost always request that they file an SPI unless it's from somebody I know well and whose opinion I respect. But that's just me; I know other CUs welcome direct requests. RoySmith (talk) 01:07, 29 October 2023 (UTC)

I have closed - and will continue to close - one-user SPIs.-- Bbb23 ( talk) 13:57, 29 October 2023 (UTC)

I agree with Bbb23. I don't think it's a good idea to make requests for discretionary checks at SPI because not all CUs are open to running these sorts of checks and if the check doesn't turn anything up, the SPI page is useless. Also, some people have good instincts for spotting socks, but a lot of people don't, and I think having a formal process for this would lead to a lot of baseless requests. Spicy ( talk) 13:46, 29 October 2023 (UTC)

"doing something only experienced editors would do"... it's possible to gain plenty of experience as an IP and then create an account. Unless there's more to the suspicion, i.e. a sockmaster, there's nothing to act on. Cabayi ( talk) 14:11, 29 October 2023 (UTC)

And there are plenty of reasons to create a new Wikipedia account that are well within policy. "Acting like an experienced editor" is simply not grounds for opening an SPI case. I think cases without master might occasionally be valid, but I think we should strongly discourage them unless we want even more people to resort to SPI for things they should use AIV, ANI or other venues. MarioGom ( talk) 17:18, 29 October 2023 (UTC)

Let's put it in another way: if I see two accounts in a case, I can usually make a good call about whether there's WP:ILLEGIT use or not. If there is a single account, it is one of the following: a) disruption is enough to issue a block without any sockpuppetry investigation or b) it might be possible but very hard to make a call on whether there's WP:ILLEGIT use or not. MarioGom ( talk) 17:22, 29 October 2023 (UTC)

I agree that SPI isn't well suited for these sorts of CheckUser requests. My recommendation has been and is to contact a checkuser privately if you suspect that an account is a sockpuppet but are not sure who the sockmaster is. You can simply email a checkuser via Special:EmailUser for this, or alternatively use the VRT queue at checkuser-en-wpwikipedia.org, with the understanding that not many checkusers actively look at that queue. User talk pages are also okay if all of the evidence is on-wiki. Mz7 ( talk) 04:39, 30 October 2023 (UTC)

I've been wondering about this myself since sometimes it can be hard to pin down who the sockmaster is. A few LTAs show some behavioral overlap, but also know how to change IPs. TornadoLGS ( talk) 18:16, 1 November 2023 (UTC)

It's also worth mentioning that if an account is being abusive, that's enough to block them on. Figuring out who they're a sock of (or if they are a sock at all) is secondary. RoySmith (talk) 20:35, 1 November 2023 (UTC)

Fair point. I guess just recognizing it as LTA/socking just gives it a higher priority. Though I know one LTA, known for playing the AGF card, once managed to trick an admin into unblocking them. But I figure that's a rare occurrence. TornadoLGS ( talk) 02:12, 2 November 2023 (UTC)

Admins get suckered all the time. It's a big bad world out there. RoySmith (talk) 02:25, 2 November 2023 (UTC)

I'm almost certain that I've found a connection between two accounts, and it was being used as a WP:STRAWSOCK. The problem is, the sockpuppet was used for only two edits, and that was a few months ago. They were being used abusively (unless, of course, it turns out that they aren't related) but I don't know if too much time has passed since the violations. Any advice? Cheers~ ‍ ‍ Relativity ‍ ‍ 02:04, 3 November 2023 (UTC)

If more than a few months have passed since the account's last edit, it's unlikely that any CU information would be available, so it would be difficult to come to a conclusion. Probably not worth it for two edits months ago. Spicy ( talk) 09:07, 3 November 2023 (UTC)

Alright, thanks. ‍ ‍ Relativity ‍ ‍ 02:09, 5 November 2023 (UTC)

Just to expand on what Spicy said, even if we could prove they were the same, WP:BLOCKP says "Blocks should be used to ... prevent imminent or continuing damage and disruption". If nothing's happened for several months, it's hard to argue that blocking them would meet that requirement. RoySmith (talk) 03:02, 5 November 2023 (UTC)

In the past 2 months, we have had 3 administrators desysopped under circumstances relating to sockpuppetry: CorbieVreccan and Mark Ironie in August (resigned facing ArbCom inquiry about meatpuppetry) and Lourdes this month (resigned facing ADMINCOND inquiry, then self-outed as a sock of Wifione).

One thing that was raised when I first brought the Mark/Corbie case to the community's attention is that this page's header begins, If you suspect sockpuppetry by an administrator, you should email the Arbitration Committee to open an investigation. As far as I can tell, that's not actually part of WP:SOCK, just a "house rule" here. Here are the four reasons I perceive for that rule, and my rebuttals:

Admins are more trustworthy

Pound for pound, maybe, but the past few months show that sockpuppetry is a significant concern among admins. There was also Eostrix two years ago, who came within inches of getting adminship as a sock of a globally banned user.

Admins are more likely to draw spurious reports

This is true of all users involved in anti-abuse efforts; we do just fine handling spurious reports against others through G6 speedy deletions and warnings or blocks of reporting users. Plus this only moves the spurious reports to other venues such as AN/I.

A reported admin may go rouge [ sic

This is not a serious concern in many cases (particularly meatpuppetry), and even when it is, that's not a line of reasoning we use anywhere else. Even when an admin has made a massively bad block—prima facie evidence that they are at high risk of further abuse of the tools—we don't insist that the matter be discussed in private. Rather, public AN or ArbCom filings are the norm in such cases. Rouge-ness is also much less of a concern these days, as most admin abuse can be prevented by block.

ArbCom handles these cases just fine

Empirically, in the Mark/Corbie case, they did not, as acknowledged by multiple arbs after the community bounced the case back to them following their initial decision not to impose sanctions. This isn't a criticism of the people who volunteer a lot of time and emotional energy for the thankless job of arbitrator, just an acknowledgment of dynamics: Arbitrators are not generally experts in investigating sockpuppetry, and the fewer eyes there are on an investigation, the more things are likely to slip through the cracks.

Furthermore, the focus on administrators is strange and gives an impression of us being above the law. It doesn't even make sense in terms of avoiding abuse: Many of the worst things an admin can do, a bot operator or template editor can do as well.

In light of all this, I would propose either removing the line outright or making the following change:

If you are reporting an administrator or other user in a position of trust, you should notify the Arbitration Committee by email about your report, and note in the report that you have done so.

This draws more eyes to the case, both ensuring that spurious reports will be handled promptly (since all arbs have clerk powers as CUs) and that ArbCom will be aware of any risk of rouge-ness. Personally I have a slight preference for removal, though. Enough arbs watch SPI pages, and enough admins/clerks know how to get in touch with an arb on short notice. -- Tamzin^{[ cetacean needed} (they|xe|she) 15:55, 6 November 2023 (UTC)

In my view, the rule shouldn't apply to reports filed, or endorsed (not in the CU sense, but in an "I think this is legit" sense), by a CheckUser. With that change, it seems to serve a useful purpose. I defer, though, to my functionary colleagues, some of whom I know have been discussing this. Best, KevinL (aka L235 · t · c) 00:07, 7 November 2023 (UTC)

• ( edit conflict) I actually brought this wording up on the functionaries mailing list a few months ago following this edit request to the header. One interesting bit of history I learned was that part of the original reason for this idea to report admin socking discreetly was the fact that it used to be impossible to truly block a rogue administrator without desysopping them, which could take a while (a bureaucrat or steward needs to be awake). Historically, administrators used to have the ability to unblock themselves in all cases; nowadays, this is no longer the case: blocked administrators can no longer unblock themselves unless they were the ones to place the block (as a safety precaution against compromised accounts, blocked administrators can still block the administrator that blocked them). Basically, we wanted to keep suspicions of admin-socking discreet to make sure that a rogue administrator, upon learning someone is onto them, doesn't cause a severe amount of damage to the encyclopedia.
  As times have changed, I find that I don't really have a solid counterargument here against transparency. If this provision asking editors not to publicly report admin socking is a relic from the past when we didn’t have as safeguards like not being able to unblock oneself, then I am on board with simply removing the line and allowing administrators to be reported on-wiki at SPI like anyone else. Mz7 ( talk) 00:10, 7 November 2023 (UTC)

  FWIW, the first mention I can find of this is Special:Diff/263394205, way back in 2009. RoySmith (talk) 00:16, 7 November 2023 (UTC)

• While I am not sure how I feel about the proposal overall, I'm not finding the cited examples particualrly compelling.

• Nobody that I am aware of expressed a suspiscion that Lourdes was Wifione, and from what I understand, CU would not have caught the connection either. (As an aside, I've always found it a bit odd that admins get WP:IPBE automatically whether they need it or not. Obviously I have not myself ever run a check on the Lourdes account, but from what I do know they may have benefited from this, using proxies to appear to be somewhere Wifione, from what we do know of them, wouldn't have been.)
• Corbie and Mark were not hiding what they were doing, at all, in the errant belief that the committee had previously agreed to look the other way in perpetuity. That being the case, it probably would have had to go to the committee anyway so that aspect could be investigated. That case to me fell into the rtealm of "admins who were elected back in the early days and just have wrong or outdated ideas about how things work in the modern environment." This is a regular feature in admin conduct cases, whether they involve sock/meat issues or not.
• Eostrix was caught by the committee, before they could become an admin. In that case, again, I think the committee was in fact the best place for that specific investigation. Obviously I can't go into details (I don't think I could remember them all at this point anyway) but the person behind that account is one of the worst long-term-abusers around, and those details I spoke of are not public knowledge, and also not known to the abuser, exactly because the committee handled it.

I'm really not trying to dog your proposal, I certainly do agree with the idea that admins are not supposed to be above the law, in particualr with regard to bedrock policies like socking, I'm just not sure this change would have prevented any of the speific cases you cited. Beeblebrox ( talk) 00:53, 7 November 2023 (UTC)

I'm not meaning to say that any of these cases would have gone differently if this procedural rule didn't exist. Now, I can tell you that in pursuing the Mark/Corbie case the rule gave me significant pause, and again did lead some commenters to suggest the case had been thrown out. (I didn't realize then, and I suspect they didn't either, that the rule doesn't actually apply outside of SPI. But how it's perceived is what matters.) There was also of course the SPI previously filed against Mark and Corbie. Its deletion was partly due to oversightable information, but the no-admin-SPI rule foreclosed the possibility of redacting it and continuing on-wiki. After an unresolved behind-closed-doors review by the functionaries which apparently gave Mark and Corbie the impression that they had done nothing wrong, several years of meatpuppetry followed. As to other cases, I have no idea. Maybe Eostrix would have been caught faster, or maybe Lourdes would have been caught by someone other than herself, if there were less of a taboo against reporting admins for sockpuppetry. Or maybe not. My point is to show that these things do happen, fairly regularly, and that the current system has been slow at catching it. -- Tamzin^{[ cetacean needed} (they|xe|she) 02:23, 7 November 2023 (UTC)

• Coming back from the void on this as I've dealt with admin socking before, and I think the current system works well. I'd oppose this proposal on two grounds:

1) the law of least dramah. Admin socking cases create a ton of drama and if a case was filed SPI would not really have the capacity to handle it based on the design of the page (anyone who has seen an SPI with a ton of back and forth will know they linger forever because they're skipped.)

2) ArbCom is all CUs but most of them don't use it and you're more likely to have a thorough investigation done by a non-arb CU who will then ask for a concurring opinion from a second non-arb CU, who will then pass it to ArbCom where the arb CUs will look at it and report their thoughts to the committee. You could email the committee first, but it would likely eventually get passed to the ground level at some point, and it would take more time to reach a result. If the goal is to get a socking admin out, the best way really is to email a CU whom you trust who is active in sock investigations.

TonyBallioni ( talk) 01:05, 7 November 2023 (UTC)

• I agree with Beeblebrox. Further, there is a power dynamic aspect. Admins are hesitant to block other admins. Plus, what if you get it wrong? Part of the reason the Committee has taken on admin sock blocks is to ensure maximum review. The other part is to take the blame if it goes wrong. Better for ArbCom to make a mistake than an admin. If you're a regular admin and you wrongly block a fellow admin, the psychological and social ramifications of that would be intense. ArbCom exists in part to bear that burden. As much as Wikipedia is mostly non-hierarchical, this is one place where the hierarchy is intentional. The admin buck stops with ArbCom for a reason. CaptainEek ^{Edits Ho Cap'n!} ⚓ 01:29, 7 November 2023 (UTC)

  I think what you're saying is a good argument for keeping ArbCom in the loop on any investigation of an admin, in line with the "replace" option of my proposal. But I don't see how it justifies keeping investigations purely in the jurisdiction of ArbCom, an entity that is not selected for expertise in sock-hunting and that we have seen this year has significant institutional issues when it comes to doing so. Which I genuinely say with the utmost respect, Eek. There isn't a person on the Committee who I don't respect as both a person and a colleague. But I had multiple arbitrators say to me, directly, that the Committee's private procedures were ill-suited to handle a case like Mark and Corbie, and that doesn't surprise me, because 10–15 people voting in private, many without experience in anti-sock work, is not a great way to investigate sockpuppetry. Sometimes it might be the only way possible for privacy reasons, but it should never be the first choice. (And for what it's worth, I have zero problem blocking an admin who socks, and I can't imagine I'm the only SPI admin who feels that way. SPI admins are generally expected to be able to make difficult blocks, sometimes of users with more social capital than the average admin.) -- Tamzin^{[ cetacean needed} (they|xe|she) 02:35, 7 November 2023 (UTC)

  To a great extent, this is all moot. Our policies restrict actions people can take, they don't restrict what conversations they can have. And fundamentally, an SPI is just a conversation. If I want to accuse Tamzin of being a CaptainEek sock, there's nothing to prevent me from posting to WP:AN, "Hey folks, I think Tamzin is CaptainEek, and here's why I think that..." And if I can do that, then I can certainly wrap it up in some fancy templates and call it an SPI. I still can't post private evidence. I still can't desysop them. I (as a CU) still can't run a check on them unless I meet the requirements of WP:CHECK, but that's equally true whether the conversation is going on at WP:SPI or at WP:ARC. I could block them both, but I could do that even without the SPI, subject only to the requirement that I justify my action if challenged.

  As for the header language banning an admin SPI, I don't think it does. It says If you suspect sockpuppetry by an administrator, you should email the Arbitration Committee ... If you need to ... you must contact the checkuser team privately to open an investigation. Private information, emails, logs, and other sensitive evidence must not be posted on Wikipedia. The first one is a should which is generally taken to be advisory. The next two are musts, which are obligatory. I assume whoever wrote that language used those specific words exactly because they mean different things. So as far as I can tell, if you file an SPI against an admin, as long as you don't violate any of the musts, you're fine. It won't be very useful because SPI can't desysop, and the changes Tamzin proposes won't change that, nor allow the posting of private or off-wiki evidence. So there's not really any point in filing an SPI against an admin, but I don't see that doing so is actually forbidden. And, seriously, if you're going to have people accusing admins of socking, wouldn't you rather it happen on SPI instead of WPO or Discord?

  As a practical point, one disadvantage to filing an admin SPI is that it's virtually guaranteed to degenerate into a total shit-show. Historically, SPI clerks have been less willing and/or less able to control drama than arb clerks are, partly because the arb clerks are working with a more rigid case structure and word count limits. RoySmith (talk) 03:58, 7 November 2023 (UTC)

  I should clarify that the "should" language is something I inserted WP:BOLDly in September [18] in response to this discussion. The more longstanding text that existed prior to that was: If you suspect sockpuppetry by an administrator, or if you need to submit off-wiki evidence for some other reason, you must email the checkuser team to open an investigation. Mz7 ( talk) 12:11, 7 November 2023 (UTC)

• Only ArbCom has the power to desysop for cause on English Wikipedia (with the sole exception of CBANs). An admin socking case is highly likely to result in desysopping (without necessarily an indefinite ban), so I don't see the point of an SPI when the involvement of ArbCom is required anyways. -- King of ♥ ♦ ♣ ♠ 04:15, 7 November 2023 (UTC)