Wikipedia:Sockpuppet investigations/SPI/Guide to filing cases

From Wikipedia, the free encyclopedia
Jump to navigation Jump to search

Sockpuppet investigations (SPI) is the investigation and resolution of allegations of sock puppetry (editor abuse of multiple Wikipedia accounts). If you believe there is good evidence from Wikipedia edits that an individual is using multiple accounts or IPs to violate our policy on sock-puppetry to abuse or manipulate editor discussions or processes on Wikipedia, or to evade blocks or bans, this is the right place to open (or re-open) an investigation. Administrators and others with experience in dealing with sock-puppetry will determine from the evidence whether to take administrator action.

An investigation can only be opened if your evidence clearly shows, from suspicious Wikipedia edits and/or log entries, that two or more accounts (or different IP editors) seem likely to have the same operator and to be breaching our sock-puppetry policy.

Wikipedia’s CheckUser team also watches these pages. CheckUsers are Wikipedia editors who are highly experienced and trusted at investigating sock puppetry cases. Their access to the "Checkuser" tool may provide additional technical evidence in some cases. A request for CheckUser can be helpful when abuse is likely but the visible public evidence alone is insufficient to show the underlying situation clearly. Checkuser has strict usage and privacy policies. The CheckUser tool will be used only if a CheckUser believes there is clear evidence of likely sock abuse and also good reason why Checkuser is needed to resolve the matter. Requests for CheckUser attention without both of these will be declined.

Important notes[edit]

  • Almost nothing matters in posting to an SPI report except evidence showing that multiple accounts are (or aren’t) likely to have common ownership and are being used in breach of policies.
  • Before submitting a case, verify that there isn’t one already in progress using this page's search box:
  • Without exception, you must supply clear and simple evidence (diffs and any reasonable deductions and impressions as a result) showing that the accounts you list are likely to be operated by the same individual. Evidence helps the clerk follow your thinking and ensure you haven’t overlooked anything. Clerks are not clairvoyant, so they may not immediately notice similarities between different accounts (e.g., editing approach, time, and behavior) that you may have seen. Additionally, if you want to request a CheckUser, proper evidence and a reason why CheckUser is needed are mandatory.
  • Try to assume good faith in relation to all but the most obvious socks.
  • You may notify the suspected accounts by adding {{subst:socksuspectnotice|PUPPETMASTER|sig=yes}} to the bottom of their talk pages. (Notification is courteous but isn’t mandatory, and in some cases it may be sub-optimal. Use your best judgement.)
  • Keep it simple! Simple, concise factual evidence leads to a quickly resolved case.
  • If accused, follow the same advice. Keep it calm, brief, and evidence-based.

Whether or not to request CheckUser in a case[edit]

  • CheckUser is a tool that can provide extra case evidence under tight controls and usage criteria for cases needing it. See introduction or CheckUser policy for details including examples of when it may be useful to request CheckUser evidence.
  • Most of the time, a determination can be made based on the accounts’ behaviour alone, and in such cases unless there are other reasons (e.g., likely undetected socks) CheckUser is not needed.
  • Requests for a check can be added to a case by anyone at any time with good evidence and an explanation why it is appropriate or needed (you must provide both!). A clerk will review and endorse it for CheckUser attention if it appears to meet usual criteria. As clerks understand current CheckUser norms, they can also self-endorse requests they add.
Ultimate discretion to use or not use the tool in any matter, including requests not formally shown at SPI via email or other means, remains solely with individual CheckUsers.

What happens in the case[edit]

  1. Open, or re-open, the case. The collapsed section, "How to open an investigation", on Wikipedia:Sockpuppet investigations explains how to create or open a case. To add a CheckUser request, edit the case (if already created). At the top of the edit box find and change the line {{SPI case status}} to {{SPI case status|curequest}}. The request will be queued for review.
  2. If CheckUser is requested:
    • A clerk will review the case and the reason, and decide if it meets the criteria for CheckUser. The clerk will endorse it for CheckUser attention or decline it. Anyone may ask the clerk to reconsider if they think this is mistaken, a good reason exists, or as the case develops.
    • If CheckUser is not requested or is Symbol unsupport2 vote.svg Declined: The case will be decided on the basis of whatever evidence already exists or is found without CheckUser. Evidence and analysis can be added by anyone and the case will ultimately be decided by any CheckUser, clerk or uninvolved administrator. A request for CheckUser evidence may be added by anyone at any time if the criteria for its use are met.
    • If CheckUser is Symbol support2 vote.svg Endorsed: A CheckUser will decide if they agree CheckUser should be used on the case (and will "decline" if not).
    • Note: cases can usually be progressed and some actions taken while waiting. Other users, clerks and administrators can add information to the case or take action while waiting for a CheckUser. Just be aware if you do, that the case may be missing information in some areas. Use commonsense. (For example, an administrator might block some socks and raise some issues while the case awaits a CheckUser to look at less obvious socks or "sleepers".)
  3. If CheckUser is agreed and used:
    • A CheckUser will examine the technical evidence related to the case. He or she will add their findings under the section "Clerk, patrolling admin and checkuser comments", for example stating any accounts that are Artículo bueno.svg Confirmed to be the same user; Symbol support vote.svg Likely, Symbol possible vote.svg Possible, or Symbol unlikely.svg Unlikely to have the same operator; or probably Symbol unrelated.svg Unrelated. In some cases, the result is Symbol unsupport vote.svg Inconclusive. The findings may be added piece by piece or all at once. Other editors can use the information to help resolve the case.
    • CheckUsers (if involved) may or may not complete the case; they may leave routine matters and follow-up for parties, other users, clerks, or patrolling administrators to conclude, so they can move to other cases.
    • Note: CheckUser is just one way to find evidence; it is not Pixie dust.png magic pixie dust or a Crystalball.jpg crystal ball. Even if CheckUser shows "unrelated" or "inconclusive", it means that the CheckUser tool did not reveal any connection or is inconclusive. In some cases it may be clear or likely on behavioral grounds and an adverse finding could be justified by the evidence taken as a whole. In short, don't take IP addresses at face value. [1]
  4. Discussion and resolution. Any user can contribute to an SPI case by providing evidence and analysis about the use of multiple accounts on Wikipedia (as described above). Cases can be expanded or CheckUser requests added, if needed. All users are expected to focus only on evidence of sock policy breach and its analysis; disruptive conduct may lead to removal from the case pages. Experienced users (usually clerks, administrators, and CheckUsers) will make final decisions and any formal findings, and whether an administrative action is needed.
  5. Other decisions might also be made by anyone at any time, as usual. For example a user may want to email a CheckUser to discuss something sensitive, or the case may be relevant to other discussions or pages, other users might need to be told of the matter, or an experienced user may decide to raise or act upon some aspect of the case separately (for example, SPI evidence of gross abuse may lead a user to separately propose a community ban).
  6. Closure: When all necessary case actions are done, any administrator or clerk can mark the case as closed. A clerk will give the case a final check to ensure there are no obvious loose ends and then archive it. The case will automatically be de-listed and appended to existing archived cases for the sock master (if any).

The inner-workings of SPI[edit]

The day-to-day running and housekeeping of SPI is undertaken by the "SPI Clerks" team, editors with considerable experience who help ensure cases are managed properly and remain in good order, and who provide clerical and administrative support when needed. SPI clerks also evaluate CheckUser requests before endorsing for CheckUser attention, review completed cases for loose ends before closure, and help with other tasks such as userpage-tagging of confirmed and blocked socks.

For administrators: If you would like to assist at SPI, please feel welcome, and thank you for contributing. We maintain a set of procedural notes on common SPI patroller procedures and the Clerks’ page contains information on patrolling and how patrollers can help. If you need any further help, please ask one of the active SPI clerks, or join #wikipedia-en-spi connect on Freenode IRC.