Wikipedia:Sockpuppet investigations/99.251.125.65/Archive

08 August 2012

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.

This IP seems to be a sockpuppet of someone. Can a checkuser try to figure this out? Note that he has acted as GabeMC in this diff and has mentioned Coren, Jimbo, and GabeMC here Ryan Vesey 17:52, 8 August 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''
 * I'm requesting checkuser; this bullshit has gone too far now.  R ad io pa th y  •talk•  00:49, 9 August 2012 (UTC)
 * @DeltaQuad, That's ridiculous. Non-checkuser blocks can be wrong.  See Sockpuppet investigations/Dannyboy1209/Archive. Ryan Vesey 01:17, 9 August 2012 (UTC)
 * This person had the audacity to drag my name into this again, and he had better fucking well prove that it's me.  R ad io pa th y  •talk•  01:19, 9 August 2012 (UTC)
 * I've got to agree. I'll expand on this and say that although says that self requests for checkuser aren't approved on en.wiki to prove innocense,  I am requesting checkuser. Ryan Vesey 01:22, 9 August 2012 (UTC)


 * I've added the formal CUrequest tag above, and I won't respond to the request myself (because I would be forced to decline), although I doubt it will be endorsed simply because CU generally doesn't connect IPs and names, to prove innocence or guilt. Technically, it was already declined, but again, will let others look at it since this is unusual. Dennis Brown - 2&cent;    &copy;   Join WER 01:25, 9 August 2012 (UTC)
 * I'm curious, is there any particular reason why this was declined? This IP user has been causing disruption and harassing me for over a month now, and this continual passing of the buck to avoid solving this issue is getting frustrating. IMO, the actions of this IP user are starting to cross legal boundries and are entering into fraud and legal harassment. Why is no one willing to get to the bottom of this IP user who is most likely a sock and almost certainly a troll? Also, "we don't run a checkuser to prove innocence" does not make any logical sense to me. Why can't CU be used to clear an accused user's name? ~ GabeMc  (talk 00:40, 10 August 2012 (UTC)
 * CheckUser doesn't run a checkuser on IPs under almost all circumstances, due to privacy policy concerns. This is standard operating procedure.  Dennis Brown -  2&cent;    &copy;   Join WER 00:48, 10 August 2012 (UTC)
 * Perhaps this is precisely why the IP user in question will not register an account. This is a silly loophole that is basically saying that if you edit as an IP you are immune to CU. ~ GabeMc  (talk 00:51, 10 August 2012 (UTC)
 * It isn't a loophole, it is a private policy that recognizes the differences between an IP and a registered user. For instance,  I have no idea where you live, but I know the IP is just north of Toronto .  Linking registered names to IPs would be a form of outing them, which might have real world negative consequences. Dennis Brown -  2&cent;    &copy;   Join WER 00:54, 10 August 2012 (UTC)
 * I don't entirely disagree with the logic, it makes sense, but the practical application of it is that IPs are immune from CU, so that still seems like a loophole for trolls and socks, even if the logic behind it is not unreasonable. ~ GabeMc  (talk 00:59, 10 August 2012 (UTC)
 * In addition, under that thought process, editors who sock with IP addresses are immune. Ryan Vesey 01:01, 10 August 2012 (UTC)
 * But that statement doesn't exist. Checkuser says that "it is hard to avoid and "Wikipedia norms are not a suicide pact" – a user who is disruptive and needs to be addressed as such may have to accept that the price of disruption is that their IP becomes linked to their account." and that "Users who engage in problematic conduct to the point that requests for administrative action or blocking are raised and considered valid for CheckUser usage, and where CheckUser then determines that the user probably has engaged in such conduct, must expect that the protection of the project is given a higher priority than the protection of those who knowingly breach its policies on editorial conduct, if the two conflict or there is a problematic editing history." Ryan Vesey 01:01, 10 August 2012 (UTC)
 * The level of disruption here is far below the threshold to have CU connect any registered account to the IP. This is more than a quote in the CU policy, this is about the privacy policy of the entire project, which clearly says we won't publicly disclose those kinds of relationships, period.  Simply put, it isn't going to happen here, and laboring it won't change that fact. Dennis Brown -  2&cent;    &copy;   Join WER 01:07, 10 August 2012 (UTC)
 * Then can we make a decision to remove the stated connection between this IP and radiopathy? If we state that this is his sock, we are still connecting him to this IP. Ryan Vesey 01:13, 10 August 2012 (UTC)
 * Not quite. You have inferred or deduced a connection, unless the editor himself has confirmed it from both his IP and account. Only a CheckUser can actually confirm a connection between the two. WilliamH (talk) 01:15, 10 August 2012 (UTC)
 * Is this helpful or relevant? ~ GabeMc  (talk 01:19, 10 August 2012 (UTC)
 * I'm saying that the stated decision of this SPI is that this is Radiopathy's sock. At this point we have no confirmation that this is his sock.  In addition, I don't believe a similarity between editing habits has been presented.  If we don't have any proof, I find it baseless to archive this as radiopathy's sock and we cannot block him either.  We should close this as a request with an undetermined master. Ryan Vesey 01:20, 10 August 2012 (UTC)
 * There has been no finding to this effect. There has been a move based on a gut feeling by a clerk, but no final determination, which is why the investigation is still open.  I'm confused as to why this is being bludgeoned here.  It hasn't been open very long, two days.  Some cases are open a week or two.  I'm not clerking here anyway, just trying to answer questions, but it is getting a bit much.  You both know how this works, but taking it a bit personal.  Give it time.  Dennis Brown -  2&cent;    &copy;   Join WER 01:31, 10 August 2012 (UTC)
 * I don't think there is any hard evidence whatsoever of who this IP user's master is. So the logic here is apparently that any given IP can troll and harass and disrupt until it becomes appropriate for CU, but who decides when that time has come? ~ GabeMc  (talk 01:25, 10 August 2012 (UTC)
 * We don't need CU to block a troll or someone harassing. The vast majority of blocks for that have nothing to do with SPI.  Actually, most sock blocks don't happen here at SPI.  Dennis Brown -  2&cent;    &copy;   Join WER 01:27, 10 August 2012 (UTC)
 * Right, I agree and I suggest that we can safely indef this IP now as a sock troll. ~ GabeMc  (talk 01:30, 10 August 2012 (UTC)
 * We don't indef IPs Gabe. The guy has probably already turned his modem off and on and has a new IP.  Dennis Brown -  2&cent;    &copy;   Join WER 01:32, 10 August 2012 (UTC)
 * "We don't indef IPs Gabe", does Coren know this rule? See here. ~ GabeMc  (talk 01:42, 10 August 2012 (UTC)
 * Also, if the IP user has a static IP then turning off his modem will not result in new IP addy. Maybe they went to a local library, or a coffee shop with WiFi after their home IP was indeffed by Coren. ~ GabeMc  (talk 01:45, 10 August 2012 (UTC)
 * Then that was Coren's mistake. There are very few instances where we would indef an IP, and only when we know the end point (corporation), and even that is very, very rare. Dennis Brown -  2&cent;    &copy;   Join WER 01:48, 10 August 2012 (UTC)
 * So, it sounds like you are telling me that IPs are virtually immune to both CU and indef blocks. Why? We indef IP addys known to be proxy servers with no rationale other than they are proxy servers, which do have some perfectly legitimate uses. ~ GabeMc  (talk 01:57, 10 August 2012 (UTC)
 * I don't. I've never indef'ed an IP and very few admins will. I consider it a mistake under 99% of circumstances. IPs change, even static ones.  Mine do every couple of years for a variety of reasons.  And we don't block proxy servers, just open proxies, which is a very different thing.  CU isn't designed for IPs anyway, we already know their IP address, the main piece of information that a CU pulls up, it is to connect two names.  I've worked on networks for 15 years (and with computers for 30) and I've still much to learn, but it isn't just a simple block and they go away. If it was, we wouldn't need SPI.  Even here, the majority of investigations are behavior based, not CU.  If they are using open proxies, the CU will be negative even though we know they are the same person.  CU isn't as useful as you might think, it is only one tool.  Dennis Brown -  2&cent;    &copy;   Join WER 12:38, 10 August 2012 (UTC)


 * Let me make sure I'm entirely clear on this. Right now we have "determined" a sockpuppet but blocked nobody (except the obvious puppet).  In addition, the only evidence that this is a sockpuppet of Radiopathy is that it is a similar IP address to another SPI that was withdrawn.  What exactly are we doing then?  Are we turning our heads the other way and ignoring the sockpuppetry or are we accusing Radiopathy based on no evidence? Ryan Vesey 00:48, 10 August 2012 (UTC)

Clerk, CheckUser, and/or patrolling admin comments
— Berean Hunter   (talk)  18:20, 8 August 2012 (UTC) — Berean Hunter   (talk)  18:33, 8 August 2012 (UTC)
 * Got it. The case is Radiopathy. Compare his IPs. I'll wait for confirmation (admin 2nd opinion) before we move to correct master. No checkuser will be necessary.
 * Adding that the case name is for Radiopathy but that was never clearly established that it was this user. Nonetheless, this is the same sock as comparable to this July 12 report.

— Berean Hunter   (talk)  18:40, 8 August 2012 (UTC)
 * My block was only for 48 hours but I see the block log of the other IP that was indeffed by Coren. The block time likely needs increased.


 * I'm sorry but Checkusers will not run a check to prove innocence, and I see no other grounds to run a check. -- DQ  (ʞlɐʇ)  01:06, 9 August 2012 (UTC)


 * I can not comment publicly if any accounts and IPs are related as I am bound by the Checkuser and Privacy Policies. While I agree that blocks can be wrong, admins should have enough evidence to make a block before they block it, not block it then get a CU (even though it wouldn't happen in this case). -- DQ  (ʞlɐʇ)  00:11, 10 August 2012 (UTC)
 * I put "checked" above though that's not strictly what I did. It is clear that:
 * a) This is the same troll on the IP I had blocked previously.
 * b) This is ❌ to both Radiopathy or Andreasegde. At all.  Not even close.
 * I've also adjusted said IP block; it first appeared to have been statically allocated, though that's no longer clear since our IP troll has hopped to a new one in a slightly different range. &mdash; Coren (talk) 03:03, 10 August 2012 (UTC)
 * Since there is no apparent named master, I've renamed the case to the previous IP, and with nothing else to do, I'm closing it as well. ​—DoRD (talk)​ 12:25, 10 August 2012 (UTC)

07 January 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

Same cable company, same MO. GabeMc (talk&#124;contribs)  00:35, 7 January 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * The sole edit of the IP seems unrelated to anything posted by the other trolls. Closing, unless you can provide further evidence. Reaper Eternal (talk) 18:06, 7 January 2013 (UTC)

26 January 2013

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.
 * Editor interaction utility

7 months of similar harrassment, stalking and disruption. I have dozens of diffs if needed, but I can say that at least two admins have expressed concern that Plant's Strider is a sock.

I quote Plant's Strider: "it's not that I once had a look at Gabe's contributions and started to edit the pages accordingly"
 * 19 January 2013, erroneously questioning and confronting my work as his first edit of the day.
 * 19 January 2013, 2nd edit of the day, following me to yet another page that PS had never edited before.
 * 20 January 2013, 2 hours and 20 minutes after I edited the page for the very first time, PS also edit’s the page for the very "first" time.
 * 21 January 2013: At Slade, one minute after my edit there, PS made their very first edit ever to the page
 * 21 January 2013, 3 minutes after my edit to Jethro Tull, PS makes their very first edit to the page GabeMc  (talk&#124;contribs)  01:25, 26 January 2013 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''


 * Comment by Evanh2008: I have to agree with Gabe on all points. The socking is obvious, and the penetration of Wikipedia's editor infrastructure likely far deeper than we'll ever know. I think anyone who takes the time to look into it comes away with a good idea of who the sockmaster is, and I'm damn sorry I didn't pursue it further when the possibility was still open. I realize that there are technical limitations to the checkuser process, but there are many more artificially imposed limitations on it. I know very well that a CU can be run (and at least several of which I have personal knowledge have been run) to establish a connection between anonymous and registered users. I don't think I'm blowing open any "cabal" secrets by stating that openly.


 * The fact that so many trolls are able to come back again and again is unavoidable, but it could be lessened very easily. It only takes a few seconds to acquire a new IP address, but creating a new email address to register an account takes significantly longer. CU requests are routinely denied simply because an IP address happens to be involved. We've created a privileged class in the name of "privacy", because heaven forbid someone with checkuser authority know roughly what part of the world a troll originates from (never mind the fact that the majority of them are using proxies anyway), and reality itself would be sure to implode if we got the name of their ISP! This isn't Rschen's fault, of course, so I hope no one feels picked upon. The point I am making is that this problem is systemic; this is not an isolated incident.


 * So, yes, I suppose there's nothing to be done. Or, rather, there is, but everyone's afraid to do it. The floodgates are open, and no one cares to close them. While all the constructive editors being driven away go under, those who want to throw them a lifejacket are written off as paranoids with an irrational distrust of anyone with numbers next to their posts. In two weeks or two months or two years he'll be back. Maybe he'll use some racial epithets again and get another account blocked, but do you think that will stop him? SPI is a joke; Checkuser doubly so. Evanh2008 (talk&#124;contribs) 02:30, 26 January 2013 (UTC)
 * The issue is that the privacy policy forbids CUs from linking the two. You may wish to read the Privacy policy, which is entirely out of our control. --Rschen7754 02:33, 26 January 2013 (UTC)
 * I know it. It's out of the community's control, at least as far as direct action is concerned. The vast majority of you CU guys do a great job with the situation you've been given. I just wish you had a more reasonable set of rules to play by. Evanh2008 (talk&#124;contribs) 02:42, 26 January 2013 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

 * - CU will not connect accounts to IP addresses. Rschen7754 01:26, 26 January 2013 (UTC)
 * That logic would seem to imply that any troll who begins as an IP is immune from CU. GabeMc  (talk&#124;contribs)  01:28, 26 January 2013 (UTC)
 * There are no other named accounts to CU with. Connecting accounts to IP addresses is a violation of the privacy policy, and cannot be done except in cases of extreme abuse. --Rschen7754 01:32, 26 January 2013 (UTC)
 * That being said, admins are still free to examine behavior to make a determination - CU is just one of the tools that we have available to us. --Rschen7754 01:33, 26 January 2013 (UTC)
 * Will they CU if I name a potential master who is also a vanished user? GabeMc  (talk&#124;contribs)  01:36, 26 January 2013 (UTC)
 * GabeMc, that depends on how long ago the potential master last edited. If their edits are stale, CU won't be able to see anything. ​—DoRD (talk)​ 01:39, 26 January 2013 (UTC)
 * Is 90+ days too stale? GabeMc  (talk&#124;contribs)  01:42, 26 January 2013 (UTC)
 * Sorry, but yes, that would count as stale. ​—DoRD (talk)​ 01:48, 26 January 2013 (UTC)
 * Then it would seem that using IPs and/or waiting 90 days after vanishing is all one would ever need to do to get away with almost anything here, that's a massive loophole that contributes to good-faith editor loss IMO. Can you provide any suggestions for a registered user in good standing who has been continuously harrassed for more than 7 months? GabeMc  (talk&#124;contribs)  01:52, 26 January 2013 (UTC)
 * It isn't a loophole, it is a technical limitation. We can't keep logs forever, and the very nature of the internet is such that anyone can bypass anything if they try hard enough.  He has been blocked twice, if it happens again, ask Todd to review, I'm betting it will be an indef then.  As much as I wish SPI could cure all the ills that plague us, it can't.  Dennis Brown -  2&cent;    &copy;  Join WER 12:27, 26 January 2013 (UTC)