User:Oshwah/Clerking

June 15, 2018
We're frequently on IRC at the same time, and that can be used for some questions and discussions, but most of the training should be done where it can be seen by other CUs and clerks. So, to get started, I'm going to shamelessly "borrow" some things from, who apparently borrowed them from. ​—DoRD (talk)​ 16:25, 15 June 2018 (UTC)
 * This page seems to have fallen dormant. Are we still on for this? ​—DoRD (talk)​ 02:32, 27 June 2018 (UTC)
 * Hey DoRD - Yes, for sure. I'm busy with real life stuff for awhile but I'll be active again next week. Is that okay? :-)  ~Oshwah~  (talk) (contribs)   04:21, 27 June 2018 (UTC)

If you haven't already done so, please read Sockpuppet investigations/SPI/Clerk and checkuser procedures. After that, answer the following questions:
 * 1) What kinds of behavior are considered disruptive from a policy standpoint?
 * A: Everything listed at WP:BADSOCK is what's considered a violation or misuse of Wikipedia's sock puppetry policy by using multiple accounts for illegitimate purposes.
 * RESP: Yes, BADSOCK covers nearly everything, but I have seen other situations crop up from time to time.
 * 1) What can a clerk do in a case?
 * A: Assuming we're talking about non-admin clerks and what the specific rolls of clerks are, they can endorse or decline a case to be "checked" by a CU, archive, merge, move, and perform page-related tasks for SPI upkeep, and keep comments on-subject by removing off-topic ones.
 * Followup: What about clerks with the admin tools?
 * A: Admin clerks (on top of being able to perform the tasks that non-admin clerks can do), can take administrative action against the accused users (provided that evidence exists at a level of confidence beyond plausibility and through behavioral similarities) and can comment on the report as a patrolling administrator.
 * RESP: Correct, but admin clerks also have the advantage of being able to view deleted revisions where appropriate.
 * 1) What can't a clerk do in a case?
 * A: They obviously can't run a CU check (lol) or perform admin decisions (if they're not administrators), but trainee clerks (obviously) can't train a new clerk, and they can't do things they're told not to do by their trainer.
 * RESP: Yes, but rather than, "they can't do things they're told not to do by their trainer", which sounds a little too close to micromanagement, I'd say "they shouldn't do things that their instructor hasn't cleared them to do".
 * 1) When evaluating a new case, what would be your checklist of things to look at?
 * A: Well, if the OP didn't sign their case, add their signature for them. Then make sure that the case is filed under the username of the sock master; if not, move or merge the case over to the correct page (outlined here). Then, I'd look at the evidence submitted by the OP and make a decision based off of observations and the gathering of additional evidence (timeline of edits, time span between account creations, similar pages edited, similar habits such as code spacing, grammar, phrases, spelling, subtle similarities unique to each person, edit summary usage and wording, etc) and make a decision to endorse a CU, decline a CU, ask for more diffs or evidence, or close the case because it's unfounded, etc.
 * RESP: Sounds good. Because the standard SPI template automatically adds the filer's signature, though, you're more likely to see duplicate sigs rather than missing sigs. Also see diffsneeded for CU requests lacking evidence.
 * 1) When evaluating a reopened case, what would be be your checklist of things to look at?
 * A:Other than the availability of evidence from past cases where associations have been confirmed and can be used to help establish evidence with the re-opened case (which is helpful), and the difference with the technical procedures for maintaining the SPI case page itself (procedures for moving the case to the correct page, archiving the case, etc), the general process regarding the processing of evidence and the endorsement / decline of CU, and making decisions would be the same.
 * RESP: Sounds good as well.
 * 1) What steps would a clerk take to decide whether to endorse for CheckUser?
 * A:I would examine the evidence provided in the SPI report to determine if the information and evidence submitted is sufficient to warrant an investigation or a further in-depth look into the accused users' editing history and participation. If the evidence provided is determined to be incomplete, partial, unclear, or lacking important details, the submitter will be asked to provide the additional information needed. If insufficient evidence exists to warrant an investigation or the accused users are determined to clearly not be in violation of any sock puppetry policies, the SPI case will be declined and closed. If the evidence submitted shows that an investigation is warranted, a further examination and determination is conducted. If the findings show a connection between the accused accounts at the level of confidence beyond plausibility and through behavioral similarities or other evidence that does not require the use of the CheckUser tool and that the sock puppetry policy was violated by the accused accounts, any CheckUser request by the submitter would be declined and an endorsement for the use of the CheckUser tool would not be recommended or applied to the report. Instead, the appropriate action would be taken against the accused based on the behavioral evidence found and without the need or use of the CheckUser tool and the report would proceed from this point. If the findings from the investigation do not meet the level of confidence beyond plausibility with behavioral evidence to block the accused accounts without use of the CheckUser tool, but enough evidence exists that show a reasonable amount of user correlation (i.e. past SPI cases and evidence, timeline of edits, time span between account creations, similar pages edited, similar habits such as code spacing, grammar, phrases, spelling, subtle similarities unique to each person, edit summary usage and wording, etc) and certainty that the use of the CheckUser tool is appropriate and that an acceptable amount of information exists that a level of discretion can be asserted with its use (or if the probability of the accused being in possession of additional accounts, sleeper accounts, etc is plausible) - the request for a CheckUser would be granted and endorsed.
 * RESP: Very good.

July 11, 2018
, I have chosen two cases that I'd like for you to look over and give me your initial thoughts about. A thorough analysis isn't necessary, just a quick look to see if the allegation is plausible and why. Thanks —DoRD (talk)​ 21:21, 11 July 2018 (UTC)
 * DoRD - Just finished. Let me know if you have questions or if I'm missing a key piece of information that I may not have caught.  ~Oshwah~  (talk) (contribs)   22:40, 11 July 2018 (UTC)


 * Sockpuppet investigations/Downstatedoc
 *  Absolutely plausible and blockable - The first account was editing articles and wording them non-neutrally. After it was blocked for non-disclosed paid editing and promotion, this second account was created but 26 minutes later, began editing Rod Rohrich immediately after, and used the same phrase when editing the article as the first account (changing "professor" to "Distinguished Professor") Diffs: 1, 2, 3, 4, 5, 6, 7.
 * I agree with your conclusion and actions taken. —DoRD (talk)​ 12:40, 12 July 2018 (UTC)
 * Sockpuppet investigations/StLouis2
 *  Some, but little plausibility - I mean, sure, it's naturally suspicious to see StLouis2 pop out of dormancy to immediately participate in this discussion and add the same support, but the timeline of each user's edits seem to be constant between their own editing patterns as well as between both accused users (about 10-12 hours apart), meaning that appears that these two people probably live far apart from one another and operate on completely different time zones. Without diving into behavioral similarities and similar edits, this timeline appears to check out. This may be more of a case of canvassing and possible meat puppetry than it is sock puppetry if Jawadmdr contacted StLouis2 off-wiki to recruit him to participate in this dispute knowing that he'd take Jawadmdr's side. It appears that this may have happened before with StLouis2 canvassing and recruiting Jawadmdr. However, off-wiki canvassing has not been proven with any evidence - only accusations have been made...
 * I agree with this as well. I'll add that, unlike the case above, their use of edit summaries is very different. I don't want to get bogged down with this case, though. —DoRD (talk)​ 12:40, 12 July 2018 (UTC)

July 12, 2018
Please look at Sockpuppet investigations/Eric1985. With the available evidence, is CU necessary? Would you endorse CU or would you take action without CU evidence? Explain. —DoRD (talk)​ 12:40, 12 July 2018 (UTC)
 * , I added a final question below a while back. If you don't have time to wrap this up, I'll return the case to the queue. —DoRD (talk)​ 11:14, 26 July 2018 (UTC)


 * DoRD - I'd take action without CU. The three suspected sock puppets accounts are definitely operated by the same person. It's interesting to see that they're all created in different time periods, but the time span of the votes being only within an hour or so of each other, the fact that the edits to the AFD and the FinCon article were either their first edit or first edit in a number of many years, and given the similarities of the votes left between the three (each add "Strong Keep", list the major attractions and media that the event brings, list no diffs or policies, leave no edit summary and leave no signature) are enough for me to block the three accounts without the need of a CU. I don't believe that the accused sock master is related in any way to the listed sock puppet accounts and I wouldn't take action against it - there's nothing that connects this account, their participation at AFD, their edits, or any similarities - to any of the sock accounts.
 * I also don't think that the three accounts are operated by Eric1985, but have you considered the possibility of off-wiki canvassing? -DoRD
 * DoRD - I have, but the timeline and similarities between the three edits to the AFD by the three accounts ("Strong Keep", listing the the major attractions and media that the event brings, no citing of policy or any URLs, no edit summaries, no signatures - and a time-span of just an hour) - are indicative of sock puppetry to me, not meat puppetry. Even if this were a case of meat puppetry and off-wiki canvassing, we don't have any evidence outside what we're given that could prove this.
 * My take on the situation a bit different. Granted, the new account could easily be a sock, but I have a harder time making the leap to the older accounts being reactivated sleepers. -DoRD
 * So, given our on- and offwiki discussions, what clerk action would you take in this case? -DoRD
 * DoRD - I would block the three accused sock puppet accounts, proceed no further with investigating the accused sock master, decline the CU request, and move to close the report.
 * Okay, you're the clerk. Please process and close the case. -DoRD
 * After mulling this over for a couple of days, I've decided to change my approach to the case. CU results confirm my suspicions that the three suspects appear to be separate people. I didn't look at Eric1985. -DoRD
 * DoRD - So you were correct on your thoughts. Looks like I need more training. Thank you for showing me wrong :-)  ~Oshwah~  (talk) (contribs)   06:27, 20 July 2018 (UTC)
 * With this, and the new information provided by JBW, how would you proceed? -DoRD
 * DoRD - I'd proceed as I described previously; block the accused socks and move to close.  ~Oshwah~  (talk) (contribs)   22:36, 26 July 2018 (UTC)

I agree with blocking the SPAs/suspected socks, but I would also suggest cautioning Eric1985 (via a ping in the SPI) to not solicit support off-wiki. -DoRD
 * DoRD - I agree with your suggestion to ping Eric1985 in the SPI report in order to caution the user and educate them about off-wiki canvassing. Let me know what you'd like me to do next.  ~Oshwah~  (talk) (contribs)   00:41, 31 July 2018 (UTC)
 * Go ahead and make the blocks, linking to the case in the block rationale, but don't tag them. Then give your rationale and leave the message for Eric1985 as above and close the case. Thanks —DoRD (talk)​ 00:56, 31 July 2018 (UTC)
 * DoRD - ✅.  ~Oshwah~  (talk) (contribs)   02:27, 31 July 2018 (UTC)
 * Quick bit of feedback on this case. Please don't archive cases that you've closed yourself. Part of the archiving process is a review by a second pair of eyes, to be sure the closer hasn't missed anything. Sir Sputnik (talk) 02:53, 31 July 2018 (UTC)
 * Sir Sputnik - Just saw your revert - thanks for undoing and for letting me know :-)  ~Oshwah~  (talk) (contribs)   04:08, 31 July 2018 (UTC)
 * Yes, SS is correct here, and I guess that I left that out of my instruction. Clerks shouldn't archive cases they've worked and closed, particularly early on. Otherwise, it looks good. —DoRD (talk)​ 12:10, 31 July 2018 (UTC)
 * DoRD - No worries; this training is how I learn those things ;-). Thank you both for the feedback.  ~Oshwah~  (talk) (contribs)   17:11, 31 July 2018 (UTC)

More training
Hi DoRD - Just pinging you here regarding SPI clerk training. I left you a message here that went unanswered (it's now archived); I just wanted to check in about it and see what's up. If you're busy, please don't worry - just get back to me when you're free. Thanks :-)  ~Oshwah~  (talk) (contribs)   00:21, 10 September 2018 (UTC)

October 18, 2018
Hey, I hope you and don't mind me butting in here. I saw your note at Sockpuppet investigations/D3bug l0gic and thought I'd comment, but we usually do this with trainees on their training pages (I assume someone's planning on deleting this when you're through the training, per WP:BEANS) rather than on the case itself. I haven't checked the accounts but I did quickly look at their behaviour. I see that the new sock posted a note about a similar point to the supposed master on the same talk page, but I also noted that this seems to be an issue that is brought up frequently on that talk page. I also see that the new account took 6 edits to build up a proper reference, while the older account seemed pretty familiar with how refs work. Do you think any of this would change your endorsement for CU? Ivanvector (Talk/Edits) 16:25, 18 October 2018 (UTC)
 * Hi Ivanvector! No, I don't mind at all. The more training and questions regarding my comments in SPI, the better I become and the more experience I gain... so, by all means, please don't hesitate to contribute here. I did notice the similar behavior, and I also did notice that it took a few edits (six, as you counted) to properly cite a reference vs the accused master. I, however, didn't take note to see if other users had also noted the same thing on the talk page as these two accounts did. Given this information, the overall similarities I saw appear to be less unique than I originally viewed them as, and I would probably not have endorsed a CU check given the facts you added about other editors saying the same thing...  ~Oshwah~  (talk)  (contribs)   16:40, 18 October 2018 (UTC)
 * Well, Tony beat me to checking and found the two unrelated, so I guess this is moot. Personally I would have endorsed the check here, because the behaviour was inconclusive. This was a brand new account diving straight into an issue that another probably-not-new account was involved in just a few days ago - not close enough to say they're definitely socks, but also not different enough to say they're definitely not, so technical results would have been helpful. I might have also just waited a bit to see if they edited something else related to the first account's narrow set of interests before I commented at all. I wasn't really trying to challenge your endorsement here, I just kinda wondered if you'd noticed those couple of things. Ivanvector (Talk/Edits) 18:19, 18 October 2018 (UTC)
 * Ivanvector - No, by all means... please challenge them! Poke holes in my thinking and point me to where I might be missing. This is exactly what will help me to gain more experience and learn! Thank you for challenging me here and for twisting my arm to question my thoughts - it's seriously very helpful and I appreciate it a lot! :-)  ~Oshwah~  (talk) (contribs)   07:42, 19 October 2018 (UTC)
 * Ivanvector - Also, I was told that DoRD has pretty much retired from the project and left due to specific frustrations and reasons. Though I'm obviously not 100% certain, it seems to be the case. If this is indeed true, I'm pretty much a trainee with no trainer right now... so any kind of pokes, prods, challenges to my thinking and decision-making here are more than welcome and are very helpful to me. :-)  ~Oshwah~  (talk) (contribs)   07:49, 19 October 2018 (UTC)
 * Thanks, I'll keep that in mind and drop you some notes if I think of it. I don't think I should take over your training, I've only been a checkuser for a week, but maybe we can convince someone more experienced to take you under their wing. Ivanvector (Talk/Edits) 12:03, 19 October 2018 (UTC)


 * Just commenting here: I didn’t see Oshwah had updated anything when I ran the check. Some of the things I noticed where the SPA nature of the account, the emphasis on DHS, and the editing of the refs afterwards to emphasize this (different in one way like IV points out, but the other account also previously edited comments to emphasize the DHS connection.) All that being said, the accounts are not technically connected and I agree there’s not enough to block behaviorally. TonyBallioni (talk) 13:19, 19 October 2018 (UTC)
 * TonyBallioni - I appreciate the comment. If there are other SPI cases that you feel would be good for me to SPI clerk train with, let me know and I'll be happy to do so. :-)  ~Oshwah~  (talk) (contribs)   14:21, 15 November 2018 (UTC)

December 12, 2018
Hi ! After consulting with the checkusers (on the process, not on these specific cases) I've semi-randomly picked some cases for you to have a look at. I'm not taking over for (who seems to be semi-active) but just giving you something to do in the meantime. These are permalinks in case another clerk gets to them in the meantime, and some of them are pulled from archives, I'm sure you know you could look forward to see what actually happened but I'm looking for your evaluation based on the snapshot, so no cheating ;) If you're already using the helper scripts there will be some giveaways as well, but do your best. Please suggest whether you would [self-]endorse CU, block based on behaviour, or something else, and any necessary clerk actions, and be as descriptive as you like as we'll delete this page afterwards anyway (WP:BEANS). Ivanvector (Talk/Edits) 15:39, 12 December 2018 (UTC)


 * Ivanvector - Thanks for doing this! I really appreciate it and this is perfect for challenging my skills and thinking in this area. I've responded to a couple of cases so far, but I'll finish them up as soon as I can... Seriously, thank you! :-)  ~Oshwah~  (talk) (contribs)   06:31, 17 December 2018 (UTC)


 * Wikipedia:Sockpuppet investigations/Amenable 19 February 2018
 * Just behavioral evidence is needed to block both the master and the first listed sock account. Not sure why the 'Example' account is listed as a sock puppet...  ~Oshwah~  (talk) (contribs)   06:31, 17 December 2018 (UTC)
 * Yes, the behaviour is pretty obvious in this instance, but I'm really looking for you to explain here why it's obvious (on this page, not necessarily in real cases) so anyone reviewing this can get a bit of a sense of how you're thinking. Also, regarding the Example account, it's important to follow up with the filer when this sort of error happens, since they might have meant to report a third account. Or it might just be a template error, but it's important to know which. Ivanvector (Talk/Edits) 15:47, 8 January 2019 (UTC)


 * Wikipedia:Sockpuppet investigations/Eleonóra Dubiczki 01 May 2018
 * No CU is needed to block the listed master and sock puppets given the similar usernames and similar vandalism, except for the first listed sock - which the account username doesn't exist (misspelling maybe? Did the user mean to list Rightpedia 1488?). A request for CU for sleeper accounts would be legitimate if the accounts were created months in the past (May 1, 2018, and February 3, 2018), however the SPI was filed on May 1st - if I were evaluating the SPI at that time, I would not endorse a CU check; all of the needed evidence is already here...  ~Oshwah~  (talk) (contribs)   06:31, 17 December 2018 (UTC)
 * Again, important to check the filer's intent when there's an error in the submission, or something that's not clear. I was looking for your initial impressions with this case, it got complicated fast. Based on the history (I should have given you an archive link) it's reasonable to request CU here, because it hasn't been clear in the past whether this is sockpuppetry or meatpuppetry, because the vandals tend to mass-create accounts and also recruit friends (read up on brigading if you're not already familiar), plus it can reveal some other technical details that CUs can act on. In this case (see the current version of the archive) we found and disabled access from a previously unknown Tor node some of the accounts were using. Ivanvector (Talk/Edits) 15:47, 8 January 2019 (UTC)


 * Wikipedia:Sockpuppet investigations/Iamskindia 20 June 2018
 * The two sock puppets listed are definitely tied due to the same article/draft created (Beautiful Accidents/Draft:Beautiful Accidents). Given the timeline of the creation of the accounts, I'd suspect sock puppetry more than I would meat puppetry. Still looking into the behavior of the accused sock master...  ~Oshwah~  (talk) (contribs)   06:31, 17 December 2018 (UTC)


 * Wikipedia:Sockpuppet investigations/Thomsonobrien 29 May 2018


 * Wikipedia:Sockpuppet investigations/Moocat12 12 December 2018


 * Wikipedia:Sockpuppet investigations/157.43.83.254 08 December 2018