Wikipedia:Sockpuppet investigations/SPI/Administrators instructions: Difference between revisions
Content deleted Content added
→Sock puppets (registered accounts): shortcut for redirect to user page so that you don't have to manually do each one - feel free to tweak my kludged formatting |
→Sock puppets (IP addresses): "arbitrary" has definitions/connotations that don't work here, rewrite and ce |
||
| (48 intermediate revisions by 31 users not shown) | |||
Line 1:
{{SPI navigation}}
{{shortcut|WP:SPI/AI}}
: ''To get involved in SPI patrolling, and how patrollers can help at SPI, see [[WP:SPI/C#Helping at SPI and requesting to join the clerks team|Helping at SPI]].''
: ''
This page
SPI is a delicate area; patrollers should keep in mind that there are [[WP:SOCK#LEGIT|legitimate uses of multiple accounts]], and that improbable things can happen by chance. Unfairly blocking someone as a sockpuppet is a harm not easily undone.
== Getting involved in patrolling, and how patrollers can help ==
==Useful tools==▼
For details on what patrollers can do to help at SPI, and how to get involved, and background on how SPI works, see [[WP:SPI/C|the clerks page]], and more specifically '''[[WP:SPI/C#Helping at SPI and requesting to join the clerks team|the section of that page about patrolling and getting involved]]'''.
*[[User:NuclearWarfare/Mark-blocked script.js|The markblocked script]], which indicates if an account has been blocked already, either for a set period of time or indefinitely.▼
Decisions and case control at SPI are routinely managed by any admin. While Checkusers add evidence, and Checkusers and Clerks ''may'' take action, any admin can make decisions on cases and their management (as with any dispute) within the norms of SPI. With more administrators patrolling, SPI cases will have more watchers, be updated faster, and have a greater chance of being reviewed independently. Admin patrollers are warmly welcomed!
The easiest cases for admins new to the area are the ones in the beige-colored "Open" category. The green "CU completed" cases tend to be a bit more challenging, but that category also tends to need the most help.
▲==Useful SPI scripts and tools==
▲* "Strike out usernames that have been blocked" from [[Special:Preferences#mw-prefsection-gadgets]] (formerly [[User:NuclearWarfare/Mark-blocked script.js
* [https://tools.wmflabs.org/sigma/editorinteract.py Editor Interaction Analyzer], which shows the common pages that two or more editors have both edited, sorted by minimum time between edits by the users.
* [https://interaction-timeline.toolforge.org/ Interaction Timeline], primarily designed to combat harassment but potentially useful in other situations, too
* [https://tools.wmflabs.org/ptools/intertwined.php Intertwined Contributions]
* [https://intersect-contribs.toolforge.org/ Intersect Contribs], faster than the Editor Interaction Analyzer but without as much detailed information
* [[Special:CentralAuth]], quick and easy way to determine edit count and cross-wiki footprint (''much'' faster than XTools or the Global Contributions tool)
* [[User:GeneralNotability/spihelper]], a script which is primarily for clerks, checkusers and patrolling administrators (but can be used by other users). It gives a menu of options which help those users deal with sockpuppet cases and case pages.
== Opening or re-opening a case ==
To open an SPI case, please follow the instructions by opening the section "How to open an investigation" at [[Wikipedia:Sockpuppet investigations]], making sure you have read and understood the SPI case guidelines at the top of that page. For a quick CheckUser request, please follow the instructions at [[Wikipedia:Sockpuppet investigations#Quick CheckUser requests]], making sure you have read and understood when and when not to request [[WP:CheckUser|CheckUser]]. CheckUser attention on other pages can be requested with {{tl|Checkuser needed}}. Please use this judiciously, as it causes the [[Bat-Signal]] to go off.
== Taking administrative action on open cases ==
Any uninvolved [[WP:ADMIN|administrator]] at any time may block any account that has violated the [[WP:SOCK|sock puppetry policy]] based on behavioral and/or technical evidence. ''Behavioral evidence'' consists of editing behaviors and patterns from suspected sock puppets as well as having similar usernames or IP addresses. ''Technical evidence'' consists of evidence provided by [[WP:CHECKUSER|CheckUsers]], in which the details are not shown to the public per the Wikimedia Foundation's [[m:privacy policy|privacy policy]]. Administrators are the primary people who hand out blocks in most SPI cases. Non-admin clerks may request that an administrator block an account or IP address. These cases will usually be labeled as "administrator attention requested". If the request seems reasonable, act on it.
===Non-CheckUser cases===
Line 19 ⟶ 35:
In usual SPI cases, where CheckUser is not requested, admins should look carefully and neutrally at the evidence and determine whether the behavioral and other evidence shown makes it very likely that sock puppetry is occurring. In many cases, sock puppetry can be determined just by behavioral evidence and without the need for technical evidence. Many admins normally apply what is colloquially called the [[WP:DUCK|duck test]] – ''if it looks like a duck, swims like a duck and quacks like a duck, it's probably a duck''.
In cases where there has been minimal disruption or which could have occurred as a result of a good-faith misunderstanding of policy, consider a warning.
# '''Check that any CheckUser-confirmed accounts have been blocked and tagged''' – Those accounts that have been [[File:Artículo bueno.svg|20px]] '''confirmed''' by CheckUser are normally blocked, but they should be double-checked to make sure that they are. If they have not been blocked, then follow the blocking procedures found in the [[#Blocking and tagging|Blocking and tagging]] section.▼
▲# '''Check evidence and block/tag any sock puppet accounts''' – For accounts that have not been confirmed by CheckUser nor already blocked, check the behavioral evidence along with the results of the technical evidence provided by CheckUser. Make a determination as to whether sock puppetry has occurred. If so, block those violating accounts, following the procedures under the [[#Blocking and tagging|Blocking and tagging]] section, and make a note of the blocks under the "Clerk, patrolling admin and checkuser comments" section of the SPI case page. If evidence has not shown that sock puppetry has occurred, then likewise make a note of that in the same section. Preface all such notes using the {{tl|Admin-note}} template. For example:
▲#:''<nowiki>{{Admin-note}} Foo has been indefinitely blocked, 192.168.0.1 blocked for three weeks. ~~~~</nowiki>''
===CheckUser cases===
Line 30 ⟶ 45:
Cases endorsed for CheckUser attention are identical in every way to non-CheckUser cases, except that a CheckUser will first add the results of their technical investigation to the case, and may have already taken some actions on the spot when abuse is found, before patrolling admins review the case.
CheckUsers will have posted their results under the "Clerk, patrolling admin and checkuser comments" section.
*{{confirmed}}
*{{likely}}
*{{possible}}
*{{unlikely}}
*{{unrelated}}
*{{inconclusive}} – in other words can't depend on the results
Once Checkuser results have been added, any admin may re-assess and decide the issue.
▲
=== Requesting CheckUser ===
If CheckUser has not been requested, you can request CheckUser assistance by changing <
This does not guarantee that a CheckUser will run a check, but it will alert the [[WP:SPI/CLERK|SPI clerks]] and CheckUsers that a request may be needed. Normally, an SPI clerk or CheckUser will either [[File:Symbol support2 vote.svg|20px]] '''endorse''' the case for CheckUser attention or [[File:Symbol unsupport2 vote.svg|20px]] '''decline''' the case. Ultimately the decision is down to the responding CheckUser.
Line 48 ⟶ 71:
=== Closing ===
If the case is complete, all accounts have been looked at and any issues dealt with, and the case has run its course with no further action needing to be taken,
<pre>
======<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>======
{{Admin-note}} All accounts blocked and tagged. ~~~~
Line 58 ⟶ 82:
==Blocking and tagging==
{{shortcut|WP:SOCKTAG}}
Follow these instructions to block sockmasters and sockpuppets.
Line 65 ⟶ 90:
{|class="wikitable" cellpadding="4" width="90%" align="center" style="margin: 1em auto 1em auto"
|-
|bgcolor=
|'''Make a determination as to the length of the block''' – an administrator may determine the length of the block of the sockmaster, after considering the following circumstances:
*''If not blocked'' – make a determination as to the length of the block. The length of the block may be temporary, or it may be indefinite, depending on
*''If already on a temporary block when the sock puppetry has occurred'' – the sockmaster's block may be reset and/or be extended.
*''If already indefinitely blocked'' – no action is needed.
|-
|bgcolor=
|'''Block the sockmaster''' – Click on the "block user" link under the sockmaster's account on the SPI page. The length of the block should have been determined per Part I.
*'''If the information does not fill in, select "Abusing multiple accounts" or "Block evasion" and under additional reasons link the case page.'''
|-
|bgcolor=
|'''Tag the sockmaster's user
*''Tag the sockmaster's user page:''
**If confirmed by CheckUser, on the sockmaster's user page, replace all content with <
**If not confirmed by CheckUser, on the sockmaster's user page, replace all content with <
|}
===Sock puppets (registered accounts)===
If a ''registered account'' has been shown
{|class="wikitable" cellpadding="4" width="90%" align="center" style="margin: 1em auto 1em auto"
|-
|bgcolor=
|'''Indefinitely block the account''' – click "block user" by the corresponding sock puppet's account on the SPI page and then block the user.
|-
|bgcolor=
|'''Appropriately tag the sock puppet's user page''' – Unless otherwise directed to, the sock puppet needs to be tagged, if it has not already been done.
*''If confirmed by CheckUser'' – Replace all content on the sock puppet's user page with <
*''If
|}
===Sock puppets (IP addresses)===
If an ''IP address'' has been shown
{|class="wikitable" cellpadding="4" width="90%" align="center" style="margin: 1em auto 1em auto"
|-
|bgcolor=
|'''Determine whether a block is needed''' – sometimes, a block won't be necessary on an IP. In the following situations, a block should not be necessary:
*The sockmaster is known to be IP-hopping across dynamic IP addresses. We refer to the blocking of such IPs as playing "[[Whac-A-Mole|Whack-A-Mole]]".
*The IP address is part of an entire range of IP addresses that have already been blocked; we usually refer to this as a [[WP:RANGEBLOCK|rangeblock]].
|-
|bgcolor=
|'''Block the IP
*''[[Open proxies]]'' – if an IP is a suspected or discovered open proxy, they must be processed in accordance with the [[Wikipedia:Open proxies|open proxies policy]]. Alternatively, patrolling admins may ask any CheckUser to confirm that the IP is an open proxy, or they may report it to [[Wikipedia:WikiProject on open proxies]].
*''[[WP:SIP|Sensitive IP addresses]]'' – double-check to make sure that the IP being blocked is not on the list of [[WP:SIP|sensitive IP addresses]]. If it is, immediately contact the [[meta:Communications committee|Wikimedia Foundation Communications Committee]].
|-
|bgcolor=
|'''Tag only the sock puppet's user talk page''' – Unlike with registered accounts, we usually don't tag the user page since another person in the future may edit under that IP. On the bottom of the IP address's talk page, add <
*''For [[open proxies]]'' – On the bottom of the open proxy's talk page, add <
|}
{{Wikipedia sock puppetry}}
[[Category:Wikipedia
[[Category:Administrator instructions]]
| |||