(Translated by https://www.hiragana.jp/)
Wikipedia:Sockpuppet investigations/SPI/Administrators instructions: Difference between revisions - Wikipedia
Wikipedia

Wikipedia:Sockpuppet investigations/SPI/Administrators instructions: Difference between revisions

Browse history interactively
← Previous edit
Content deleted Content added
VisualWikitext
→‎Sock puppets (IP addresses): Corrections to show commonly-accepted practices
→‎Sock puppets (IP addresses): "arbitrary" has definitions/connotations that don't work here, rewrite and ce
 
(27 intermediate revisions by 22 users not shown)
Line 1:
{{SPI navigation}}
{{shortcut|WP:SPI/AI}}
: ''To get involved in SPI patrolling, and how patrollers can help at SPI, see [[WP:SPI/C#Helping at SPI and requesting to join the clerks team|Helping at SPI]].''
: '' See also: -– Clerk and CheckUser SPI procedures [[Wikipedia:Sockpuppet investigations/SPI/Clerk and CheckUser procedures|here]], opening or re-opening an SPI case [[Wikipedia:Sockpuppet investigations#Submitting an SPI case|here]].''
 
This page explains the most common procedures for [[WP:SPI/C#Helping at SPI and requesting to join the clerks team|administrators patrolling]] the '''[[WP:SPI|sockpuppet investigations (SPI) pages]]'''. SPI is where users can bring concerns that an individual may be misusing [[WP:ACCOUNT|accounts]] or IP editing in violation of Wikipedia's [[WP:SOCK|sock puppetry policy]], for example to breach sanctions, blocks, or agreements, to bias content and discussions, to attack other users, or to disrupt, deliberately mislead, or vandalize.
 
SPI is a delicate area,; patrollers should keep in mind that there are [[WP:SOCK#LEGIT|legitimate uses of multiple accounts]], and that improbable things can happen by chance. Unfairly blocking someone as a sockpuppet is a harm not easily undone.
 
== Getting involved in patrolling, and how patrollers can help ==
For details on what patrollers can do to help at SPI, and how to get involved, and background on how SPI works, see the clerks page ([[WP:SPI/C|the clerks page]]), and more specifically '''[[WP:SPI/C#Helping at SPI and requesting to join the clerks team|the section of that page about patrolling and getting involved]]'''.
 
Decisions and case control at SPI are routinely managed by "any admin". While Checkusers add evidence, and Checkusers and Clerks ''may'' take action, any admin can make decisions on cases and their management (as with any dispute) within the norms of SPI. TheWith more administrators patrolingpatrolling, the more eyeballs SPI cases will have, themore fasterwatchers, theybe areupdated updatedfaster, and thehave a greater thechance certaintyof that they arebeing reviewed independently. Admin patrollers are warmly welcomed!
The easiest cases for admins new to the area are the ones in the beige-colored "Open" category. The green "CU completed" cases tend to be a bit more challenging, but that category also tends to need the most help.
 
==Useful SPI scripts and tools==
* "Strike out usernames that have been blocked" from [[Special:Preferences#mw-prefsection-gadgets]] (formerly [[User:NuclearWarfare/Mark-blocked script.js|The markblocked script]]), which indicates if an account has been blocked already, either for a set period of time or indefinitely.
* [https://tools.wmflabs.org/sigma/editorinteract.py Editor Interaction Analyzer], which shows the common pages that two or more editors have both edited, sorted by minimum time between edits by the users.
*[http://toolserver.org/~mzmcbride/cgi-bin/wikistalk.py Wikistalk], which can be used for analyzing the editing history of two or more accounts.
* [https://interaction-timeline.toolforge.org/ Interaction Timeline], primarily designed to combat harassment but potentially useful in other situations, too
*[http://toolserver.org/~snottywong/editorinteract.html Editor Interaction Analyzer], like Wikistalk, while it can only analyze two accounts at once, it provides some additional information.
* [https://tools.wmflabs.org/ptools/intertwined.php Intertwined Contributions]
* [https://intersect-contribs.toolforge.org/ Intersect Contribs], faster than the Editor Interaction Analyzer but without as much detailed information
* [[Special:CentralAuth]], quick and easy way to determine edit count and cross-wiki footprint (''much'' faster than XTools or the Global Contributions tool)
* [[User:GeneralNotability/spihelper]], a script which is primarily for clerks, checkusers and patrolling administrators (but can be used by other users). It gives a menu of options which help those users deal with sockpuppet cases and case pages.
 
== Opening or re-opening a case ==
To open an SPI case, please follow the instructions by opening the section "How to open an investigation" at [[Wikipedia:Sockpuppet investigations#Submitting an SPI case]], making sure you have read and understood the [[Wikipedia:Sockpuppet investigations#Evidence and SPI case guidelines|SPI caseat guidelines]]the top of that page. Similarly,For toa requestquick CheckUser request, please follow the instructions inat that[[Wikipedia:Sockpuppet sameinvestigations#Quick sectionCheckUser (in the collapsed box below the two input boxes)requests]], making sure you have read and understood when and when not to request CheckUser at [[WikipediaWP:SockpuppetCheckUser|CheckUser]]. investigations#CheckUser attention on other pages can be requested with {{tl|Checkuser needed}}. Please use this judiciously, as it causes the [[Bat-Signal]] to go off.
 
== Taking administrative action on open cases ==
Any uninvolved [[WP:ADMIN|administrator]] at any time may block any account that has violated the [[WP:SOCK|sock puppetry policy]] based on behavioral and/or technical evidence. ''Behavioral evidence'' consists of editing behaviors and patterns from suspected sock puppets as well as having similar usernames or IP addresses. ''Technical evidence'' consists of evidence provided by [[WP:CHECKUSER|CheckUsers]], in which the details are not shown to the public per the Wikimedia Foundation's [[m:privacy policy|privacy policy]]. Administrators are the primary people who hand out blocks in most SPI cases. Non-admin clerks may request that an administrator block an account or IP address. These cases will usually be labeled as "administrator attention requested". If the request seems reasonable, act on it.
 
===Non-CheckUser cases===
Line 28 ⟶ 35:
In usual SPI cases, where CheckUser is not requested, admins should look carefully and neutrally at the evidence and determine whether the behavioral and other evidence shown makes it very likely that sock puppetry is occurring. In many cases, sock puppetry can be determined just by behavioral evidence and without the need for technical evidence. Many admins normally apply what is colloquially called the [[WP:DUCK|duck test]] – ''if it looks like a duck, swims like a duck and quacks like a duck, it's probably a duck''.
 
# '''Check evidence and block/tag any sock puppet accounts''' – For accounts that have not been confirmed by CheckUser nor already blocked, check the behavioral evidence along with the results of the technical evidence provided by CheckUser. Make a determination as to whether sock puppetry has occurred. If so, block thoseWhen violatingblocking accounts, followingfollow the procedures under the [[#Blocking and tagging|Blocking and tagging]] section, and make a note of the blocks under the "Clerk, patrolling admin and checkuser comments" section of the SPI case page. If evidence has not shown that sock puppetry has occurred, then likewise make a note of that in the same section. PrefaceNotes allcan suchbe notesprefaced using the {{tl|Admin-note}} template. For example:▼
Patrolling administrators should be sure to:
#:''<nowiki>{{Admin-note}} Foo has been indefinitely blocked, 192.168.0.1 blocked for three weeks. ~~~~</nowiki>''▼
 
In cases where there has been minimal disruption or which could have occurred as a result of a good-faith misunderstanding of policy, consider a warning.
# '''Check that any CheckUser-confirmed accounts have been blocked and tagged''' – Those accounts that have been [[File:Artículo bueno.svg|20px]]&nbsp;'''confirmed''' by CheckUser are normally blocked, but they should be double-checked to make sure that they are. If they have not been blocked, then follow the blocking procedures found in the [[#Blocking and tagging|Blocking and tagging]] section.▼
▲# '''Check evidence and block/tag any sock puppet accounts''' – For accounts that have not been confirmed by CheckUser nor already blocked, check the behavioral evidence along with the results of the technical evidence provided by CheckUser. Make a determination as to whether sock puppetry has occurred. If so, block those violating accounts, following the procedures under the [[#Blocking and tagging|Blocking and tagging]] section, and make a note of the blocks under the "Clerk, patrolling admin and checkuser comments" section of the SPI case page. If evidence has not shown that sock puppetry has occurred, then likewise make a note of that in the same section. Preface all such notes using the {{tl|Admin-note}} template. For example:
▲#:''<nowiki>{{Admin-note}} Foo has been indefinitely blocked, 192.168.0.1 blocked for three weeks. ~~~~</nowiki>''
 
===CheckUser cases===
Line 45 ⟶ 51:
*{{unlikely}}
*{{unrelated}}
*{{inconclusive}} -– in other words can't depend on the results
*The '''IP addresses''' used by sock-puppets may also be {{ipblocked}}.
 
Once Checkuser results have been added, any admin may re-assess and decide the issue.
 
▲#Patrolling '''Checkadmins should check that any CheckUser-confirmed accounts have been blocked and tagged''' –. Those accounts that have been [[File:Artículo bueno.svg|20px]]&nbsp;'''confirmed''' by CheckUser are normally blocked, but they should be double-checked to make sure that they are. If they have not been blocked, then follow the blocking procedures found in the [[#Blocking and tagging|Blocking and tagging]] section. For any accounts or IP addresses that have not been blocked, follow the same instructions for a non-CheckUser case, keeping in mind any evidence or advice posted by CheckUsers.
 
=== Requesting CheckUser ===
If CheckUser has not been requested, you can request CheckUser assistance by changing <ttsamp>{{tlx|SPI case status}}</ttsamp> on the top of the page to <ttsamp>{{tlx|SPI case status|curequest}}</ttsamp>.
 
This does not guarantee that a CheckUser will run a check, but it will alert the [[WP:SPI/CLERK|SPI clerks]] and CheckUsers that a request may be needed. Normally, an SPI clerk or CheckUser will either [[File:Symbol support2 vote.svg|20px]]&nbsp;'''endorse''' the case for CheckUser attention or [[File:Symbol unsupport2 vote.svg|20px]]&nbsp;'''decline''' the case. Ultimately the decision is down to the responding CheckUser.
Line 64 ⟶ 71:
 
=== Closing ===
If the case is complete, all accounts have been looked at and any issues dealt with, and the case has run its course with no further action needing to be taken, then the clerks can be asked to review and closearchive the mattercase. To request that the case be closedarchived, change the parameter of the <ttsamp>{{tlx|SPI case status}}</ttsamp> template on the top of the page to <ttsamp>close</ttsamp> along with adding a note in the "Clerk, CheckUser, and/or patrolling admins" section, confirming the final resolution and that all accounts have been addressed. For example,
<pre>
 
Line 75 ⟶ 82:
 
==Blocking and tagging==
{{shortcut|WP:SOCKTAG}}
Follow these instructions to block sockmasters and sockpuppets.
 
Line 82 ⟶ 90:
{|class="wikitable" cellpadding="4" width="90%" align="center" style="margin: 1em auto 1em auto"
|-
|bgcolor="blue"| <ttsamp><fontspan colorstyle="color: white">'''I'''.</fontspan></ttsamp>
|'''Make a determination as to the length of the block''' – an administrator may determine the length of the block of the sockmaster, after considering the following circumstances:
*''If not blocked'' – make a determination as to the length of the block. The length of the block may be temporary, or it may be indefinite, depending on how much socking and/or disruption has been done.
Line 88 ⟶ 96:
*''If already indefinitely blocked'' – no action is needed.
|-
|bgcolor=green| <ttsamp><fontspan colorstyle="color: white">'''II'''.</fontspan></ttsamp>
|'''Block the sockmaster''' – Click on the "block user" link under the sockmaster's account on the SPI page. The length of the block should have been determined per Part I.
*'''If the information does not fill in, select "Abusing multiple accounts" or "Block evasion" and under additional reasons link the case page.'''
|-
|bgcolor=red| <ttsamp><fontspan colorstyle="color: white">'''III'''.</fontspan></ttsamp>
|'''Tag the sockmaster's user page''' – Unless otherwise directed, the sockmaster needs to be tagged, if it has not already been done.
*''Tag the sockmaster's user page:''
**If confirmed by CheckUser, on the sockmaster's user page, replace all content with <ttsamp>{{tlp|sockpuppeteer|<nowiki>blocked|checked=yes|spipage=CASENAME</nowiki>}}</ttsamp>
**If not confirmed by CheckUser, on the sockmaster's user page, replace all content with <ttsamp>{{tlp|sockpuppeteer|<nowiki>blocked|spipage=CASENAME</nowiki>}}</ttsamp> if the user has been indefinitely blocked. Do not make any change if the user has only been blocked for a limited amount of time.
|}
 
===Sock puppets (registered accounts)===
If a ''registered account'' has been shown into be engaging in sock puppetry and ''is not'' the sockmaster, then perform the following tasks:
 
{|class="wikitable" cellpadding="4" width="90%" align="center" style="margin: 1em auto 1em auto"
|-
|bgcolor=blue| <ttsamp><fontspan colorstyle="color: white">'''I'''.</fontspan></ttsamp>
|'''Indefinitely block the account''' – click "block user" by the corresponding sock puppet's account on the SPI page and then block the user.
|-
|bgcolor=green| <ttsamp><fontspan colorstyle="color: white">'''II'''.</fontspan></ttsamp>
|'''Appropriately tag the sock puppet's user page''' – Unless otherwise directed to, the sock puppet needs to be tagged, if it has not already been done.
*''If confirmed by CheckUser'' – Replace all content on the sock puppet's user page with <ttsamp>{{tlp|sock|SOCKMASTER|confirmed}}</ttsamp>.
*''If it's a [[WP:DUCK]] or case where CU was not involved or was not confirmed'' -– Replace all content on the sock puppet's user page with <ttsamp>{{tlp|sock|SockMasterSOCKMASTER|blocked}}</ttsamp>.
|}
 
===Sock puppets (IP addresses)===
If an ''IP address'' has been shown into be engaging in sock puppetry, then perform the following tasks:
 
{|class="wikitable" cellpadding="4" width="90%" align="center" style="margin: 1em auto 1em auto"
|-
|bgcolor=blue| <ttsamp><fontspan colorstyle="color: white">'''I'''.</fontspan></ttsamp>
|'''Determine whether a block is needed''' – sometimes, a block won't be necessary on an IP. In the following situations, a block should not be necessary:
*The [[WP:AUTOBLOCK|autoblock]] placed on the sockmaster is going to take care of the IP.
*The sockmaster is known to be IP-hopping across dynamic IP addresses. We refer to the blocking of such IPs as playing "[[Whac-A-Mole|Whack-A-Mole]]".
*The IP address is part of an entire range of IP addresses that have already been blocked; we usually refer to this as a [[WP:RANGEBLOCK|rangeblock]].
|-
|bgcolor=green| <ttsamp><fontspan colorstyle="color: white">'''II'''.</fontspan></ttsamp>
|'''Block the IP if needed''' – Click "block user" by the corresponding IP account on the SPI case page. ''Account creation blocked'' should be set. The length of the block shouldis beup anto arbitraryadmin length determined by the admindiscretion, but it should not be indefinite nor tooso long as to not allowprevent other persons tofrom useusing the IP in the future.
*''[[Open proxies]]'' – if an IP is a suspected or discovered open proxy, they must be processed in accordance with the [[Wikipedia:Open proxies|open proxies policy]]. Alternatively, patrolling admins may ask any CheckUser to confirm that the IP is an open proxy, or they may report it to [[Wikipedia:WikiProject on open proxies]].
*''[[WP:SIP|Sensitive IP addresses]]'' – double-check to make sure that the IP being blocked is not on the list of [[WP:SIP|sensitive IP addresses]]. If it is, immediately contact the [[meta:Communications committee|Wikimedia Foundation Communications Committee]].
|-
|bgcolor=redblue| <ttsamp><fontspan colorstyle="color: white">'''III'''.</fontspan></ttsamp>
|'''OnlyTag tagonly the sock puppet's user talk page if the IP seems relatively static''' – Unlike with registered accounts, we usually don't normally tag IPsthe user page since another person in the future may edit under that IP in the future. On the bottom of the IP address's talk page, add <ttsamp>{{tlsp|SockBlock|period&#61;duration|sig&#61;yes}}</ttsamp>, replacing "duration" with the length of the block.
*''For [[open proxies]]'' – On the bottom of the open proxy's talk page, add <ttsamp>{{tlp|Blocked proxy|host&#61;proxy.example.com (optional)}}</ttsamp>.
|}
 
{{Wikipedia sock puppetry}}
[[Category:Wikipedia sock puppetrysockpuppetry]]
[[Category:Administrator instructions]]
Retrieved from "https://en.wikipedia.org/wiki/Wikipedia:Sockpuppet_investigations/SPI/Administrators_instructions"