Wikipedia:Sockpuppet investigations/Questionable pulse/Archive

11 February 2012

 * Suspected sockpuppets




 * User compare report Auto-generated every hour.

As I am a checkuser myself, albeit inexperienced, and based on plausible behavorial and timing evidence from the edit histories of the articles NXIVM and Keith Raniere, I did a preliminary check to see if this seemed worthy of further investigation. In my opinion based on what I saw there, it does at least warrant a closer look. I seek help from a more experienced checkuser. I have sent my results privately to checkuser-l. Jimbo Wales (talk) 09:03, 11 February 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments

 * On hold for now, will be back. Amalthea  11:26, 11 February 2012 (UTC)
 * This SPI should be helpful -I've sent an email to the list too. TN X Man  15:08, 11 February 2012 (UTC)
 * - This seems to be the only way to poke about to see if there is any progress with us being 10 days in now. So anything? (If not, go ahead and put it back on hold) -- DQ  (ʞlɐʇ)  15:36, 21 February 2012 (UTC)
 * Not much. Nobody seems quite sure what to do with it. Allow me some more time to try and talk to the user first. Amalthea  15:49, 23 February 2012 (UTC)
 * Talking ... Amalthea  11:00, 25 February 2012 (UTC)
 * Still ... if I can't get this resolved during the next two days or so I'll just publicize what I can and let y'all try and make sense of it. Amalthea  14:40, 28 February 2012 (UTC)

Sorry that this one took so long. Nobody seems to know what to do with it, and discussions with some involved accounts did nothing to clear it up for me. So I just summarize what I can tell.

Edits of the editor in question come from the range of a hosting company. Besides the account under investigation there are many other accounts. Their exact relations are unknown, but some are definitely related. I do know that it's more than one person there. There are at least two groups of accounts that have a significant enough timing overlap to make it very unlikely they are the same. Practically all edits in this range are very similar to each other. The vast majority of edits is gnomish and appears constructive.

On first glance, no abuse of multiple accounts is apparent.

The explanation I was given after discussion with one account was that this is done to protect privacy. In my opinion, considering the big picture, this is not a sufficient explanation for all of this. Two or more people in the same range making the same kind of edits, thousands of edits spread over those accounts, meticulously using one IP per account and switching/faking UAs, IPs from a hosting provider - this takes effort and money. Would any legit user, whose only intention is to improve Wikipedia, do that? I don't know.

There /are/ potentially problematic edits. I have not really looked at edit content, so only know one example: There may be a significant connection here: according to our article NXIVM sued Rick Ross' institute. That was nine years ago though. And could be a coincidence. Someone would need to take a much longer look to determine whether there is a problem here.
 * Original concern was about edits at NXIVM and Keith Raniere which may (!) not be NPOV.
 * Another account from the range, LogicalFinance33, added criticism to Rick Ross (consultant) with quotes labeling him "so-called expert" and "hardline anticultist".

Here are some of the groups that I am convinced are operated by the same person:

✅:

✅:

based on timing:

based on edit summary:

Then there is a sequence of accounts that were created on January 31 within a brief period, all to make 6-11 edits and then stop editing (some have resurfaced since):

These groups may or may not be related with each other. There are further accounts with yet more of the same kind of edits, but I haven't looked at them enough to call them one way or another yet.

Again, all of those I mention here (plus others) edit using a dedicated IP per account, and the person I've talked to claims this is all innocent.

Amalthea 15:07, 1 March 2012 (UTC)


 * Interesting. Are they connected to these:
 * Chrisrus (talk) 04:25, 2 March 2012 (UTC)
 * Those usersnames are all new to me. Amalthea  16:56, 3 March 2012 (UTC)
 * If you would like to, please see their contributions and user and discussion pages. Chrisrus (talk) 17:05, 3 March 2012 (UTC)
 * Chrisrus (talk) 04:25, 2 March 2012 (UTC)
 * Those usersnames are all new to me. Amalthea  16:56, 3 March 2012 (UTC)
 * If you would like to, please see their contributions and user and discussion pages. Chrisrus (talk) 17:05, 3 March 2012 (UTC)
 * Chrisrus (talk) 04:25, 2 March 2012 (UTC)
 * Those usersnames are all new to me. Amalthea  16:56, 3 March 2012 (UTC)
 * If you would like to, please see their contributions and user and discussion pages. Chrisrus (talk) 17:05, 3 March 2012 (UTC)
 * If you would like to, please see their contributions and user and discussion pages. Chrisrus (talk) 17:05, 3 March 2012 (UTC)

I've opened a discussion here. Input welcome. TN X Man 14:55, 5 March 2012 (UTC)
 * Amalthea: perhaps this is a question better off answered via email, but given that this case was personally opened by Jimbo, I'm mildly unsure of what to do here. Has there been any discussion on the lists in terms of recommendations on how to handle these results? —  Hello Annyong  (say whaaat?!) 05:35, 4 March 2012 (UTC)
 * Maybe he will want to talk to his friend about it. She might know something or be in a position to find out. Chrisrus (talk) 08:05, 4 March 2012 (UTC)
 * HelloAnnyong, no recommendations I'm afraid. There wasn't really a list discussion, pretty much only me sending the above results asking for opinions and Tnxman pointing out the related SPI, but like I said, nobody seems to know what to do with this. In particular, Jimbo's role here was only brining it to attention (after being himself prompted by Chrisrus I believe) and finding cause for a closer look. I don't know what to do here either. But my AGF broke down when confronted with the behavior described above. There are way over 10,000 edits here that may hide inappropriate edits and may need to be cleaned up. I can offer a couple of possible ways to proceed though:
 * Call wider community attention to this
 * Organize a review of all contributions (in a WP:CCI-style kind of way)
 * If I'm alone in finding the described situation worrisome: close it with no action
 * Amalthea 12:05, 4 March 2012 (UTC)
 * Closing with no action is not an option. Honestly I'm inclined to block all of the confirmed accounts based on the findings and behavior. I'm mildly hesitant to take this to AN or ANI, but I suppose we may not have a choice there given how far-reaching this is. Any other CUs or clerks want to chime in? —  Hello Annyong  (say whaaat?!) 15:06, 4 March 2012 (UTC)
 * I note that the accounts listed above have all stopped editing. I don't think that a block by itself would resolve this situation. Amalthea  11:11, 5 March 2012 (UTC)
 * That ANI thread was far less than helpful. I've blocked the first four groups. This whole thing is, to be honest, a huge clusterfuck. No idea how to sort it out from here, but.. —  Hello Annyong  (say whaaat?!) 04:14, 8 March 2012 (UTC)

Note: There was the Sockpuppet_investigations/P0PP4B34R732/Archive in February that brought up the above accounts. So, might want to put that under this report. 14 of the 18 blocked accounts were in the P0PP4B34R732 report, plus others I asked Tnxman307 about. Me, a peon, the SPI goes nowhere. Jimbo, a somebody, brings results. I spent hours fixing up the messes they were creating. I'm pissed. Bgwhite (talk) 09:18, 8 March 2012 (UTC)
 * thank you for your original report, Bgwhite. I'm going to archive this case under /Questionable pulse/Archive for coherency, but I appreciate your initial contribution to this. Cheers, SpitfireTally-ho! 21:42, 10 March 2012 (UTC)