Wikipedia:Sockpuppet investigations/Rotten regard/Archive

17 October 2012

 * Suspected sockpuppets


 * User compare report Auto-generated every hour.

Obvious sock of someone, see the few contribs. Tried for 3 hours to find a CU on IRC, no one was around (I can't blame them, we have waaaay too few CUs since losing 4 this month), so filing here so it eventually gets attention. I can move it once we figure out the master. Dennis Brown - 2&cent;    &copy;   Join WER 23:57, 17 October 2012 (UTC)

Comments by other users
''Accused parties may also comment/discuss in this section below. See Defending yourself against claims.''

Clerk, CheckUser, and/or patrolling admin comments
I've blocked on behavioural grounds. This account is an illegitimate alternate of someone, and it doesn't matter who. Alternate accounts are not permitted to vote at AFDs, and are certainly not permitted to edit-war closes of AFDs.&mdash;Kww(talk) 04:51, 18 October 2012 (UTC)
 * - Dennis Brown -  2&cent;    &copy;   Join WER 23:58, 17 October 2012 (UTC)
 * Unless there is evidence to support the assertion that this is abusive sockpuppetry, "he's someone's sock" is not sufficient grounds for a check. Hers fold  (t/a/c) 02:31, 18 October 2012 (UTC)
 * So you are saying you can never request a CU without a master? You would be the first, since I see sock cases without masters regularly here, as standard operating procedure in these types of cases.  Assuming you actually looked at the contribs, I'm puzzled how you saw this as "perfectly normal".  I could spell it out, but I thought CU/clerks weren't supposed to educate the sockpuppets, and that would be.  Glad to see you removed the accusation of fishing in your last edit.   Dennis Brown -  2&cent;    &copy;   Join WER 02:42, 18 October 2012 (UTC)
 * I apologize, my original comment was overly harsh. While checks can be done against a single user (with no suspected master), what is there to indicate that this is abusive? I did look at the contributions, and while involvement in deletion stuff right off the bat is certainly odd, it doesn't look immediately abusive. I don't see that there is a pattern to the articles being edited, it looks as though they took time to read articles before removing the PROD or CSD tags, and they've got vandalism reversions. I believe it's plausible that this is an established user who is attempting a clean start or similar, and forgot that for the time being they're a new user again and probably shouldn't be doing non-admin closures. If there's something I'm missing, please point it out. In the meantime, I've left a question on their talk page about this issue, and we'll see how they respond. Hers fold  (t/a/c) 03:05, 18 October 2012 (UTC)
 * Would a clean start "forget" long enough to close an AFD? Are there any blocked candidates in that article's history?  Would a clean start install twinkle, assuming they were clean starting (ie: keeping a low profile)?  Would a sincere clean start jump instantly into contentious areas?  Start reverting others?  Would every single edit of their be a revert or AFD for a clean start?   These are the things I usually don't like to spell out at SPI because then they might change their methods, making it harder to spot next time. I respect that we need good cause to run CU, but my experience as a clerk here (and as an defense investigator in my salad days) says that this is consistent with previous socks and passes the bar to justify a check.  If you disagree, I understand, but it isn't about one single thing, it is about the totality after investigating deeply and looking at it broadly.   Dennis Brown -  2&cent;    &copy;   Join WER 03:39, 18 October 2012 (UTC)
 * I would also add that I think it is my duty to find socks early, before they get too abusive, as long as I can provide an adequate rationale for doing so. This is a "new" user.  If they are a banned or blocked user, for instance, then "abuse" is irrelevant, which is why broad, general behavior is the primary consideration, rather than just the individual edits themselves.  Dennis Brown -  2&cent;    &copy;   Join WER 03:43, 18 October 2012 (UTC)
 * In light of the fact that Kww has already blocked the account for socking, I checked the account. As I suspected, no other accounts are editing from the IP addresses used by this account. Even if there are other accounts, this user is on a dynamic ISP, so the chances of noticing them without something to compare to are slim to none. Which, now that I mention it, is also a large part of the reason we need a suspected master, or at least something to compare to. I agree that the edits by this account are somewhat suspicious, but I still feel that a check was inappropriate here. Double-checking the clean start policy, it seems that Kww's block was appropriate in any event, as clean-start accounts are banned from deletion discussions until they've independently established themselves. However, I do not see the fact that they did edit deletion subjects as prima facie evidence that they are a blocked or banned user, particularly as the edits appear to demonstrate a good-faith attempt to contribute. So, yes, I do disagree. When I looked at the contributions (and I'm sure I did just as much investigating as you did, he's only got so many edits, so do stop insinuating that I only gave this a passing glance), I saw simply an editor who'd had an account before - not someone deliberately acting disruptively and deserving of checkuser attention. In any event, I have checked, found nothing, and Kww has blocked the account for violation of WP:SOCK and/or WP:CLEANSTART, so this is moot. Hers fold  (t/a/c) 04:58, 18 October 2012 (UTC)
 * For the record, it wasn't just editing deletion topics that convinced me it was an alternate: it was the fact that the account was created during the first AFD for Flat Bastion Road and then rapidly spun up to autoconfirmed a several weeks later in order to close the second AFD for the article. That's a behaviour pattern that defies innocent explanation. On a technical basis, I sympathise with Herfold. When it's a dynamic ISP, a checkuser on a single account can't get much, because there's nothing substantial to compare to. The only time it is beneficial is when the user is sufficiently dim to use a static IP. Unfortunately, we tend not to be dealing with the dimmest of bulbs at SPI.&mdash;Kww(talk) 05:06, 18 October 2012 (UTC)
 * Agree, and this is where the CU tools alone are insufficient, and instead experience working at SPI regularly would be helpful, to compare geolocations with known blocked/banned users. I didn't expect more on the same IP either, I expected a match to a user blocked or banned in the past month or two, which requires memory and sleuthing, but can still come up short. This is why CU shortage is a problem, as too few CUs are being overworked and have no time for other things, which is why 3 of the 4 recent CU losses was probably tied to burnout. Dennis Brown -  2&cent;    &copy;   Join WER 10:59, 18 October 2012 (UTC)

As a conclusion, Rotten regard has claimed to be a return of User:General announcement and that the password for that account has been lost. Reviewing the contributions of the two accounts, I find the claim credible. As a result, I have blocked General announcement and have unblocked Rotten regard.&mdash;Kww(talk) 02:09, 19 October 2012 (UTC)