Wikipedia:Abuse response/Guidelines

The Abuse Response project consists of a team of volunteers who investigate reports of severe abuse to Wikipedia and make reports to "responsible organizations" such as internet service providers and educational institutions. The Abuse Response project is not an official Foundation-sponsored function, but a community initiative as part of Wikipedia's overall counter-abuse strategy which is endorsed by the community.

Objective
The objective of Abuse Response is simply to report abuse to responsible organizations with the overall goal of deterring, treating, or preventing potential/current abusers from abusing Wikipedia.

We believe that Abuse Response is relevant to Wikipedia. There are different levels of relevance, with regard to Abuse Response's potential impact on abuse. It has the potential in these respects:
 * Deterrent effect. Potential abusers decide not to abuse for fear of being reported and possibly suffer consequences with their responsible organization.
 * Prescriptive effect. Abusers stop abusing by choice due to a report being made and or a warning from their responsible organization.
 * Remedial effect. Abusers are stopped due to having their ability to abuse otherwise inhibited due to a report being made.

But... do they do anything?
The most frequently asked question is something along the lines of: "Do ISPs or schools actually do anything because of your report?"

Well, the short answer is: Yes, they do.

In some cases, a response from a person is received stating that they will investigate. In rare cases, that person may request additional information for the purposes of their investigation. In some rarer cases, that person may actually state that they will immediately take action. In each of these cases, it is considered a success. The vast majority of these cases come from educational institutions rather than ISPs.

Whether reporting abuse is effectual has been debated ad nauseam. The resulting consensus has typically resulted, that even if action is not taken on the majority of cases, that the effort is still worth the effect that is achieved. Further, the deterrent effect is not one that should easily be discounted, as it is impossible to calculate.

Ultimately, whether or not a responsible organization takes action, proximately due to a report that we submit, is largely inconsequential. Our goal is to alert the responsible organization of the abuse and it is up to them to determine whether the user has violated their network policies.

What Abuse Response is
The primary purpose is to serve as the reporting mechanism for the Wikipedia community for reporting abuse to responsible organizations. We make contact with responsible organizations, either initiated by individuals who discover habitual offenders or other abuse departments refers a case over requesting that a responsible organization be contacted due to the abuse.

What Abuse Response is not

 * Abuse Response does not handle sock-puppet investigations, or single incidents of abuse.
 * Abuse Response cannot contact responsible organizations for usernames alone. An SPI, or other sort of CheckUser investigation must be completed before Abuse Response can contact a responsible organization.  Even then, contact should only be made when blocking of usernames or sockpuppets is not sufficient to prevent further abuse.  Because blocking ends abuse from an account, a persistent abuser will turn to either creating a new account or posting using their IP.  In either scenario, an SPI investigation will need to be concluded before an Abuse Response case can proceed.
 * Abuse Response is not bludgeon to be used on persistent abusers. As such, users should not be "bitten" or "threatened" with a report to their responsible organization. It has been fairly-well established that users who respond to any such threat are not likely to be deterred by it, in fact it is more likely that such a threat would increase - not diminish - the volume of abuse from the user.
 * Abuse Response is not a punitive action to be taken against abusers, like Mediation only the responsible organization can make a decision, even then suggested remedies can be ignored at their whim/discretion. If abuse from the suspected user has ceased by means other than a block, then contact with the responsible organization should not be pursued.

The Team
The team consists of volunteers which include project coordinators and investigators. Activities include:
 * Research and investigation of IP addresses and account abuse
 * Determining which organization has jurisdiction over the IP address in question
 * Analysis of abuse and formulation of modus operandi
 * Preparation of comprehensive reports
 * Communication with responsible organizations and reporting to them

Selection of team members
Prospective team members can nominate themselves at Abuse response/Nominate, upon which they will be asked questions of assumed knowledge (what the user should already know). Current team members will then make the following checks:


 * The user has a general understanding of Internet Protocols, IP ranges, and blocks.
 * Has the ability to conduct and understand WHOIS results.
 * Has a history of being calm, understanding and polite and exhibit good character in general.
 * Does not have a history of blocks or offenses.

If there is enough consensus for membership, the nomination will be closed and archived and the nominee should then browse past cases to familiarize themselves with the work of an Abuse Response team member, successful nominees are also encouraged to ask for help when and where needed. Current team members are listed at Abuse response/Volunteers.

Transparency and privacy
In general, Abuse Response should comply with the general concept of transparency. While the internal workings of a particular case may be kept private, the results of cases as well as contact records should be publicly documented and recorded. However, personally identifiable information must never be made publicly available in any way shape or form, not even with consent and should only be made available to those necessary for conducting investigation. In compliance with Wikipedia's privacy policy, IP addresses should not be linked to usernames unless otherwise permitted. All workings should also comply with Wikipedia's privacy policy, any other Wikipedia policy, as well as applicable federal, state, and local law.

The email communications between investigators and responsible organizations will not be publicly accessible or viewable and should remain private.

Case processing
This section contains general policy requirements regarding case processing. For specific step-by-step processing of cases, see WP:GTAR. Team members will try to process accepted cases within seven days.

Reporting cases
When reporting cases it is recommended that the reporting user:
 * Has been on Wikipedia actively for ~3 months
 * Is not filing about sockpuppetry or long-term abuse
 * Has checked that the IP:
 * Has been blocked at least five times
 * Is currently blocked
 * The current block was placed less than three months ago
 * At least one block was imposed for a year or more
 * Has been suitably warned prior to each block

Criteria for accepting cases
For vandalism-related abuse:
 * The IP address has been blocked at least five times
 * The IP has been blocked within the last three months

For threats of violence or related offenses:
 * Reports may be filed, and contact made on the first offense.

Who is contacted
Abuse Response serves as a liaison between the organization or person listed as the responsible contact person on the publicly viewable WHOIS report for the given IP address. Contact with any other organizations, including but not limited to consumer agencies is not the function of Abuse Response and will not be conducted. Contacting the parents or guardians of minors and law enforcement agencies is not the function of Abuse Response and will/must never be conducted under any circumstance by anyone acting for Abuse Response. For issues involving any level of law (except for vandalism), the matter must be referred to the Wikimedia Foundation and the Administrators' noticeboard. All contact with responsible organizations should be logged and made available on the case page.

Stale cases and ripeness
The goal of Abuse Response is to stop abuse to Wikipedia, Abuse Response is not the last court of appeal. If a case is not "ripe" — that is to say that if the abuse has otherwise ceased, then a contact with a responsible organization is no longer required. As a general rule, reports should not be made when abuse has ceased, notwithstanding a current, ongoing block.

There will be reports that — while valid at the time of the report — are no longer applicable. A stale case is one where there has been no abuse within four months of the submission of the report, such cases will be rejected as stale, notwithstanding the validity of the case at the time of reporting. Whereas, there are instances where a report is still warranted. In the case of educational institutions, it may still be worthwhile to make systems administrators aware of abuse from their network so that they may take preventative measures.