Wikipedia:Sockpuppet investigations/ゼーロ/Archive

09 October 2015

 * Suspected sockpuppets


 * See "Update" below for reason for striking.
 * See "Update" below for reason for striking.
 * See "Update" below for reason for striking.
 * See "Update" below for reason for striking.
 * See "Update" below for reason for striking.


 * User compare report Auto-generated every hour.
 * Editor interaction utility

These IPs and have all been commenting on talk:David L. Jones and the page's AFD.

Reason for requesting CheckUser: coincidence of timing suggests that at least one of these IPs may have been used by the suspected sockmaster while logged in.

Summary of the chronology (all times in UTC)

2015-09-21T18:37:08 three of the IPs listed here (4., 109., and 32.), all with no or almost no prior edit history, begin commenting at talk:David L. Jones, arguing against the page's content and existence, and making a couple of related changes to related pages. 2015-09-28T13:18:47‎ User account, after four edits in the last two years, is renamed to ゼーロ. About 20 minutes later...  2015-09-28T14:17:08 ゼーロ begins posting at talk:David L. Jones arguing for the article's stubbing and deletion. None of these IPs make any further edits to this or any other page except the AFD page when it appears later. 2015-10-02T10:16:58 ゼーロ after several false starts creates the Articles for deletion/David L. Jones (2nd nomination) with a "delete" !vote. Subsequently posts several other comments supporting deletion to that page (see page history). No problems so far, but... 2015-10-05T01:44:08 Two of the same IPs already involved, plus two more IDd above (86. and 2600:), these with no  prior history, appear and post "delete" !votes to the AFD. Most of these are in a tight group of edit times interleaved with ゼーロ's edits. -- Jeh (talk) 16:47, 9 October 2015 (UTC)

Details and diffs

Unless stated otherwise all of the following edits are to talk:David L. Jones, and all are arguing, with similar arguments and wording, against the existing content in the article or against the article's existence on WP:N and WP:BLP grounds. With one excaption I have not attempted to quote or summarize the actual text of the edits. The first two diffs are for edits to other pages; I have summarized them individually.

Each IP's or username's first appearance in this sequence is highlighted in bold, and prior edit history at WP summarized along with geolocate info.

2015-09-21T18:37:08 diff 4.26.51.74 (Level 3 Comm., Hartford CT, USA) (IP has had one prior edit in September, then one in June, then nothing prior for 17 months) IP edits Antistatic bag, putting "dubious" tag on a statement that was ref'd to an EEVblog video (that's David L. Jones' YouTube channel). 2015-09-22T01:55:37 diff 32.213.188.105 (Frontier Comm., Avon CT, USA) (IP has one prior minor, unrelated edit) IP Edits David L. Jones, adding "Advert" and "Failed verification" tags 2015-09-23T10:14:53‎ diff 109.176.80.234 (Kcom Group, London, UK) (IP has had no prior edits) 2015-09-23T15:12:51‎ diff 4.26.51.74 2015-09-23T23:14:31‎ diff 32.213.188.105 2015-09-24T13:42:13 diff 109.176.80.234 2015-09-24T14:13:58 diff 4.26.51.74 2015-09-25T07:58:01 diff 109.176.80.234 2015-09-28T13:18:47‎ diff After a long period of near-inactivity (four edits in almost two years), user Mojo-chan is renamed to ゼーロ 2015-09-28T14:17:08 diff ゼーロ, 20 minutes after getting his new username, joins the discussion at talk:David L. Jones. Language is not indicative of someone who hasn't visited the talk page before, quite the contrary: "I think this has been done to death now. Unless there are compelling objections I'll call for deletion on Wednesday. The article has had plenty of time to improve, but contributors just keep adding more weak material to it."

After ゼーロ gets his new name and begins editing the talk page, there are no further edits to the talk page by any of the IPs.

Now there would be nothing wrong with an unregistered editor, who happens for various reasons to show up on different IPs at different times (work ISP, home ISP, phone ISP, coffee house ISP, etc.), registering and then proceeding to edit under the registered name.

But, one, ゼーロ was already registered, just under a different name, Mojo-chan. And two, you're not supposed to continue editing without logging in after you have a registered username. Accidents do happen and one might forget to log in now and then, but...

...The IPs' activity resumed in the deletion discussion. Two of the above-mentioned IPs, plus two additional ones (86. and 2600:), posted one "delete" !vote each to the AFD, all in a short period of time, interspersed with ゼーロ's edits. Thus giving the impression of five different people registering "delete" !votes.

The following only shows edits by ゼーロ and these IPs. See the full page history for edits by other users. All diffs following are editors arguing for deletion, again on WP:N and WP:BLP grounds and in most cases in a "me too" manner.

2015-10-02T10:16:58‎  ゼーロ created the AFD 2015-10-03T16:28:50 diff ゼーロ 2015-10-05T01:44:08 diff 32.213.188.105 2015-10-05T10:17:04 diff ゼーロ 2015-10-05T12:47:36 diff 4.26.51.74 2015-10-05T14:11:28 diff ゼーロ 2015-10-05T15:15:40 diff 86.2.115.144 (Virgin Media, Portsmouth, UK) (IP had no prior or later edits, unless you count one from six years ago) Note phrasing: "This has been done to death". same as used by ゼーロ on the subject article talk page previously 2015-10-05T16:28:40 diff 2600:1000:b106:6cf1:0:17:9713:4a01 (Verizon Wireless, Cromwell CT, USA) (IP had no prior or later edits) 2015-10-08T08:17:20 diff ゼーロ makes another edit to the AFD (several days later) There are no more edits to the AFD by the IPs. In fact there are no more edits to anything by any of the IPs. ゼーロ does make several later edits to the AFD. Jeh (talk) 23:02, 13 October 2015 (UTC)

Avon and Cromwell are both small towns on the outskirts of Hartford, Connecticut, USA. Portsmouth is on the British southern coast, about 60 miles from London.

Comment: To support the notion that this is all just coincidence, we have to believe that three two different anon editors (in addition to 109.176.80.234, revealed later by ゼーロ to be him- or herself) with no or almost no prior WP history both showed up at talk:David L. Jones around the same time with similar opinions (all agreeing with previous comments supporting removal of material and article deletion). And despite their previous considerable participation on that talk page, all of them stopped contributing to that discussion the moment ゼーロ showed up, apparently all willing to let ゼーロ speak for them.

And then two of those chimed in again at the article's AFD, along with two more who also had no prior edit history... all with "me too" !votes for "delete". And then, having said their piece at the AFD, these IPs take no further interest in editing WP at all. And although the AFD lasted for seven days, all of the IP activity there just happened to be within a single 16-hour period, all but one within six hours, all closely interspersed with ゼーロ 's comments. Three of the five IPs geolocate to within about 10 miles of each other in Connecticut, USA, and the other two to within about 60 miles of each other in the UK. All by coincidence Jeh (talk) 17:15, 14 October 2015 (UTC)

The hop from London and environs, UK, to Connecticut USA is the only piece of evidence that does not support the SP charge. But at the most charitable interpretation it means we are dealing with a grand total of two users (the Connecticut-based one having done nothing wrong) instead of just one; certainly not six. But, proxy servers are everywhere. Jeh (talk) 18:08, 14 October 2015 (UTC)

Update: I have struck the references to 109.176.80.234. ゼーロ, With this edit a few hours ago, noted that while editing as that IP they had "forgotten to log in". Ok, that happens. Editing the article talk page a few times as an IP and then later under a registered name, without revealing that you're the same person as that IP until a month and many edits later, is certainly not "best practice" but nowhere near cause for an SPI... unless it happened in something like an AFD. I wish to stress that IP 109.176.80.234 was not used at all in the AFD discussion, which is of course my main concern here. The other IPs still deserve investigation in my opinion. Jeh (talk) 21:29, 27 October 2015 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

(Comment by block-evading sockpuppet removed per WP:DENY. See Sockpuppet investigations/Janagewen.)


 * Not just my idea. The possibility of sockpuppetry, or at least canvassing, was raised by the admin who closed the AFD here. "Aaron J", who has self-identified as longtime sockmaster Janagewen, is a long-time report page stalker simply because he's reported so often, often by me, so I trust his veiled accusation against me here will carry little weight. (Also, this IP of Aaron J will be reported momentarily.) Jeh (talk) 06:12, 14 October 2015 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * I've declined the CU request. We almost never publicly disclose the IP(s) of a registered user.--Bbb23 (talk) 00:56, 14 October 2015 (UTC)
 * I'm closing this case because of the lack of evidence.  Vanjagenije  (talk)  22:28, 27 October 2015 (UTC)

09 March 2016

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.
 * Editor interaction utility

Conclusive new evidence in case previously closed for insufficient evidence.

User ゼーロ opens an ADF with an explicit DELETE vote . The AFD received a swarm of IP votes (which were discounted by the closer). An SPI was opened trying to link this user to the general swarm of IP votes. Notably, evidence was presented that this User and this specific IP both used the particular phrase "this has been done to death". Case declined for insufficient evidence.

The user has subsequently claimed explicit ownership of the IP address. (Edit summary: forgot to log in.) This firmly establishes they cast at least two votes in the AFD. If they cast two votes then it's likely they cast the other IP votes as well. I see additional thin suggestive evidence of this, in addition to evidence listed in the previous SPI. However I'm not sure there's much to be gained by expanding this case to the other IPs. A 2 vote sock isn't much different from a 5 vote sock.

Reason for SPI: Aside from the general value of addressing an abusive account, I discovered this evidence while I was examining an RFC for closure. The RFC is on the same article they double-voted to AFD. If this user is blocked for abusive voting on this article, I believe it may be reasonable to strike their RFC votes on this article before evaluating the close. Alsee (talk) 20:03, 9 March 2016 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

I'm the person who opened the previous case. In the previous case I had requested a Checkuser. This was declined on the basis that a report of a match would reveal the person's IP address (one of them, anyway). Since the accused has already admitted to using the 86. IP that was used during the AFD !vote, that is no longer a concern. I also want to mention that while "ordinary" sockpuppetry is one thing and can be accidental, using a sockpuppet to both propose an AFD and then !vote in it as well is far worse; there is no way the person can reasonably claim "oh, I happened to be not-logged-in when I forgot that I myself proposed this AFD and I decided to !vote". If confirmed this is a serious breach of trust and deserves a correspondingly strong reaction, and should not be ignored just because it's been some time. n.b.: I'm not asking for any of the accused's other IP addresses (that he used while logged in) to be revealed, but a geolocate on them may well prove interesting. Jeh (talk) 23:54, 9 March 2016 (UTC)

* The 86 address is a shared one, I'm one of many users who have access to it. It's possible that one of them contributed, as I had discussed the article with them. I asked those who are here now but none came forward to claim the edit. I'll see if I can track the others down, but I'm not sure if that would actually help as the address assigned to that connection seems to have changed when I looked today and I doubt they have access to it any more.


 * As such, there is no evidence I cast two votes, only that I used a shared IP address. Obviously I can't prove a negative.

* Oh, and please allow sufficient time for me to respond, particularly at weekends. I can't edit from my home connection right now. ゼーロ (talk) 16:13, 10 March 2016 (UTC)
 * Jeh's comments are made in bad faith and are irrelevant to this matter. Please refrain from such speculation and accusation. Geolocation, depending on the accuracy, will only serve to dox the subscriber of the shared connection. ゼーロ (talk) 16:12, 10 March 2016 (UTC)


 * I wasn't aware of any other SPI. Is there a link to it? I wasn't informed or able to participate. I'd also point out that there was on-going discussion of the AfD on the EEVBlog forum, and a number of users from there came to comment, so it's likely that any IPs were users of that forum. If there is any other evidence I can provide, please ask. ゼーロ (talk) 18:09, 10 March 2016 (UTC)
 * ゼーロ, I'll copy it from the top of this page: For archived investigations, see Sockpuppet investigations/ゼーロ/Archive.
 * Regarding your discussions with anyone else using the IP address, see policy WP:Canvassing, as well as WP:MEAT and particularly the subsection on WP:SHAREd IP. Closely connected users may be considered a single user for Wikipedia's purposes if they edit with the same objectives. On one hand we don't want to assume bad faith, on the other hand "someone else on my shared connection" is an easy and flimsy excuse. If you're editing on a shared connection then you need to use extra care to avoid anything that might look like socking or meatpuppet-collusion.Alsee (talk) 17:32, 11 March 2016 (UTC)
 * I suggest that "AGF violation" is an invalid response to an SPI report. Sockpuppetry is quite obviously not acting in GF, so any SP accusation must be an accusation of acting in bad faith. If we insist that every SPI report start with an assumption of good faith then there can be no SPI reports at all, only assumptions of well-meaning accidents. Jeh (talk) 18:29, 11 March 2016 (UTC)
 * Jeh, you have a clear conflict of interest here. ゼーロ (talk) 15:05, 12 March 2016 (UTC)
 * By exactly what provision of WP:COI do you make that claim? Jeh (talk) 21:17, 13 March 2016 (UTC)
 * Jeh, I don't think they meant COI. I believe they meant you were involved in the RFC and have an interest here.
 * ゼーロ, editors who are involved are allowed to present evidence and arguments. An uninvolved Admin or Checkuser will evaluate the case. Alsee (talk) 00:21, 14 March 2016 (UTC)
 * It's not just the RfC, it's the on-going issues I've had with this editor. As I stated below, it's bordering on harassment now. 109.176.80.234 (talk) 08:54, 14 March 2016 (UTC)


 * Alsee, it seems like you didn't understand what I wrote. It was a bit scattered. Anyway, to reiterate:
 * It's not my connection. It's the neighbouring building's WiFi that I occasionally use with permission. I'm not making any excuses because I have nothing to excuse. I'm merely speculating as to what could have happened. In any case, I didn't ask or tell anyone to intervene, there is no collision.
 * If you have any evidence please provide it, because obviously I can't prove a negative. Everything you posted so far is circumstantial and I can't offer a proper defence.
 * Can this be brought to a higher authority who can judge your case, rather than me having to make an impossible defence? ゼーロ (talk) 15:15, 12 March 2016 (UTC)

After reviewing the previous accusation, I believe that Jeh needs to both remove themselves from this discussion and be sanctioned for their prior actions. I was not even notified that an investigation took place, and Jeh's continuing actions represent harassment. ゼーロ (talk) 18:49, 13 March 2016 (UTC)


 * There is no requirement to notify of an SPI. (The SPI form says "You may wish to notify the accused ..." - emphasis added.) And I didn't start this investigation, so I don't know what "continuing actions" you're talking about. Anybody can comment on an SPI. Jeh (talk) 19:08, 13 March 2016 (UTC)
 * In particular, I mean the way you continually probe at my identity here and elsewhere. I've had issues with harassment and doxing, and changed by username to try to put an end to it. 109.176.80.234 (talk) 08:54, 14 March 2016 (UTC)
 * "Continually"? I asked you once for further clarification about a COI issue that had already been raised by someone else. And that was long after you changed your username, so don't try to imply that you changed it because of harassment from me. And I didn't bring up that issue here, you did. If you have evidence of any other "probes at your identity" that you think I've done, or anything else WP would regard as "harassment", let's have it. Actually, either take it to AN/I or drop it. To me these accusations of AGF, harassment, etc., all just look like attempts at deflection from the real issue of your SPI. Jeh (talk) 09:46, 14 March 2016 (UTC)

I have nothing more to add to this. There is no hard evidence to refute. Please make a decision quickly because I don't like having this hanging over me. It's also holding up the RfC. 109.176.80.234 (talk) 08:54, 14 March 2016 (UTC)

Sorry, logged out again. The 109 address is me. Note to self: be more careful checking you are logged in next time. ゼーロ (talk) 09:18, 14 March 2016 (UTC)

I've been reviewing this and discussing it on IRC, and it seems that what I originally wrote is apparently quite confusing. So I strike it all and will try to be clearer.

1. Editing logged out is not against the rules, and I did it in error. More than once. My browser is set to clear cookies on close, sometimes I forget to log back in. I have taken some advice and set a non-default editor so that it's obvious, hopefully preventing future issues.

2. I did not "admit" anything, I simply pointed out that I had forgotten to log in and corrected this mistake. That is not the action of someone trying to use sock puppets.

3. The shared IP is used by many students and teachers, some of whom are studying electrical engineering. The article in question is about the most popular electronic engineering channel on YouTube. The article in question has received a vast amount of discussion and edits.

4. I did not induce or invite anyone to edit the article or AfD or anything else, ever. I have mentioned that the article was getting a lot of discussion on the talk page. If that is against the rules then I apologise, but I don't believe it was. Having reviewed the rules on meat puppets, it seems that if anything the users of the site in question are guilty of which, which I complained about with the effect that IP votes were discarded. If I had been meat puppeting, it would make no sense to get IP votes ignored. Note that I'm not making any claims here, merely speculating as to what could have happened, and pointing out that the IP in question may have been dynamically assigned to some other connection. I don't have enough visibility to make a proper defence here.

5. I normally need to use a VPN to edit from home. There is an issue with my connection. I have previously had IPBEs to allow this. Occasionally I have issues with the VPN and use the shared IP, as I am at this very moment because my IPBE has expired and I'm waiting for an admin to review it. If you review my contribution history, you can see that this is an on-going issue for me and I have been trying to find consensus to address it.

6. The shared IP changes regularly, so might not even have been assigned to the same company when the other person used it.

7. I can't refute circumstantial evidence like phrasing. It's a common phrase, and likely in the writer's mind as I had used it earlier in the discussion. This is extremely flimsy at best.

8. I have been getting harassment from another site off-wiki, related to this article. Mostly by email, but also by post and attempts to log in to my accounts and vandalize my blog. These efforts seem to be synchronized with Jeh's efforts here. As Jeh points out, making a formal complaint is likely to look suspect now.

9. I changed my username a while back to escape the harassment. It obviously didn't work.

10. Most of what Jeh says is irrelevant. The only issue is if the 86 and myself are the same person, and I don't believe that case has been made convincingly.

11. The decision making process and standard of proof is not laid out well in the documentation, so please give me an opportunity to address any concerns or doubts as I understand appealing SP bans is very difficult.

12. I have reviewed the rules on shared IP addresses and there doesn't seem to be much I can do about it, but I'm open to suggestions. All the connections I have access to are shared - home VPN, borrowed wifi, work, mobile.

13. My account is in good standing and has existed for quite some time now, with many good and constructive edits.

ゼーロ (talk) 23:53, 14 March 2016 (UTC)

14. I accept the result of the AfD, and the RfC. ゼーロ (talk) 20:15, 16 March 2016 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * Having looked over the past SPI and the AfD, considering the age and experience of the master, and assuming rather a lot of good faith, I'm closing this without action. Although slightly frustrating, considering that the suspected master has provided at least a little explanation and has not made any attempt to double-!vote or otherwise double-participate in any discussion since the last SPI (claiming the edit), I don't think there's anything actionable here., you are advised to be very careful in the future with any discussion to avoid the appearance of sockpuppetry. To the clerk who archives this, please do more than a cursory review before archiving this; a full review of this close would be helpful. Thanks. Kevin ( aka L235 ·&#32; t ·&#32; c) 04:02, 10 April 2016 (UTC)