Wikipedia:Sockpuppet investigations/SPI/Guide to filing cases

Sockpuppet investigations (SPI) is the investigation and resolution of allegations of sock puppetry (editor abuse of multiple Wikipedia accounts). If you believe there is good evidence from Wikipedia edits that an individual is using multiple accounts or IPs to violate our policy on sock-puppetry to abuse or manipulate editor discussions or processes on Wikipedia, or to evade blocks or bans, this is the right place to file an investigation. Administrators and others with experience in dealing with sock-puppetry will determine from the evidence whether to take administrative action.

An investigation will only take place if your evidence clearly shows, from suspicious Wikipedia edits and/or log entries, that two or more accounts (or different IP editors) seem likely to have the same operator and to be breaching our sock-puppetry policy.

Wikipedia’s CheckUser team also watches these pages. CheckUsers are Wikipedia editors who are highly experienced and trusted at investigating sock puppetry cases. Their access to the "Checkuser" tool may provide additional technical evidence in some cases. A request for CheckUser may be helpful when abuse is likely but the visible public evidence alone is insufficient to show the underlying situation clearly. Checkuser has strict usage and privacy policies. The CheckUser tool will be used only if a CheckUser believes there is evidence of likely sock abuse and also good reason why Checkuser is needed to resolve the matter. Requests for CheckUser attention without both of these will be declined.

Important notes

• Almost nothing matters in posting to an SPI report except evidence showing that multiple accounts are (or aren’t) likely to have common ownership and are being used in breach of policies.
• Before submitting a case, verify that there isn’t one already in progress and check if the account(s) you want to report have previously been investigated using this page's search box:

• Without exception, you must supply clear and simple evidence (diffs and any reasonable deductions and impressions as a result) showing that the accounts you list are likely to be operated by the same individual. Evidence helps the clerk follow your thinking and ensure you haven’t overlooked anything. Clerks are not clairvoyant, so they may not immediately notice similarities between different accounts (e.g., editing approach, time, and behavior) that you may have seen. Additionally, if you want to request a CheckUser, proper evidence and a reason why CheckUser is needed are mandatory.
• Try to assume good faith in relation to all but the most obvious socks.
• You may notify the suspected accounts if you wish. (Notification isn’t mandatory, and in some cases it may be sub-optimal. Use your best judgement and err on the side of not notifying, since a clerk, admin, or checkuser can always do it later if needed.)
• Keep it simple! Simple, concise factual evidence leads to a quickly resolved case.
• If accused, follow the same advice. Keep it calm, brief, and evidence-based.

Whether or not to request CheckUser in a case

• CheckUser is a tool that can provide extra case evidence under tight controls and usage criteria for cases needing it. See introduction or CheckUser policy for details including examples of when it may be useful to request CheckUser evidence.
• Most of the time, a determination can be made based on the accounts’ behaviour alone, and in such cases unless there are other reasons (e.g., likely undetected socks) CheckUser is not needed.
• Requests for a check can be added to a case by anyone at any time with good evidence and an explanation why it is appropriate or needed (you must provide both). A clerk will review and endorse it for CheckUser attention if it appears to meet usual criteria. As clerks understand current CheckUser norms, they can also self-endorse requests they add.
• An individual CheckUser retains discretion to use the tool in relation to SPI even in cases when it is not requested on the SPI case page.

Ultimate discretion to use or not use the tool in any matter, including requests not formally shown at SPI via email or other means, remains solely with individual CheckUsers.

The two most common use cases for requesting CheckUser are:

• Suspicion of sleeper accounts: you believe that the sockmaster is operating more accounts than those filed in the SPI. You should explain why you think there may be more accounts - if a case's archive shows a history of sleeper accounts, that can frequently be enough to warrant a check.
• Complex cases: your evidence indicates that the accounts of interest may be socks, but the accounts' behavior is not clear enough to block on its own. You should provide evidence connecting the two accounts and indicate why behavioral evidence is not sufficient on its own.

When not to request CheckUser

• Obvious, disruptive sockpuppets  – these may be blocked on behavior alone.
• Requests to connect an account to a specific IP address  – CheckUsers will not publicly connect an account to an IP address.
• Requests to CheckUser yourself to "prove your innocence"  – CheckUsers do not perform these checks.
• Suspected administrator sockpuppetry  – contact the Arbitration Committee.

What happens in the case

1. File the case. The collapsed section, "How to open an investigation", on Wikipedia:Sockpuppet investigations explains how to file a case. To add a CheckUser request, edit the case (if already filed). At the top of the edit box find and change the line {{SPI case status}} to {{SPI case status|curequest}}. The request will be queued for review.
2. If CheckUser is requested:

   • A clerk will review the case and the reason, and decide if it meets the criteria for CheckUser. The clerk will endorse it for CheckUser attention or decline it. Anyone may ask the clerk to reconsider if they think this is mistaken, a good reason exists, or as the case develops.
   • If CheckUser is not requested or is  Declined: The case will be decided on the basis of whatever evidence already exists or is found without CheckUser. Evidence and analysis can be added by anyone and the case will ultimately be decided by any CheckUser, clerk or uninvolved administrator. A request for CheckUser evidence may be added by anyone at any time if the criteria for its use are met.
   • If CheckUser is  Endorsed: A CheckUser will decide if they agree CheckUser should be used on the case (and will decline if not).
   • Note: cases can usually be progressed and some actions taken while waiting. Other users, clerks and administrators can add information to the case or take action while waiting for a CheckUser. Just be aware if you do, that the case may be missing information in some areas. Use common sense. (For example, an administrator might block some socks and raise some issues while the case awaits a CheckUser to look at less obvious socks or "sleepers".)

3. If CheckUser is agreed and used:

   • A CheckUser will examine the technical evidence related to the case. He or she will add their findings under the section "Clerk, patrolling admin and checkuser comments", for example stating any accounts that are  Confirmed to be the same user;  Likely,  Possible, or  Unlikely to have the same operator; or probably  Unrelated. In some cases, the result is  Inconclusive. The findings may be added piece by piece or all at once. Other editors can use the information to help resolve the case.
   • CheckUsers (if involved) may or may not complete the case; they may leave routine matters and follow-up for parties, other users, clerks, or patrolling administrators to conclude, so they can move to other cases.
   • Note: CheckUser is just one way to find evidence; it is not  magic pixie dust or a  crystal ball. Even if CheckUser shows "unrelated" or "inconclusive", it means that the CheckUser tool did not reveal any connection or is inconclusive. In some cases it may be clear or likely on behavioral grounds and an adverse finding could be justified by the evidence taken as a whole. In short, don't take IP addresses at face value.

4. Discussion and resolution. Any user can contribute to an SPI case by providing evidence and analysis about the use of multiple accounts on Wikipedia (as described above). Cases can be expanded or CheckUser requests added, if needed. All users are expected to focus only on evidence of sock policy breach and its analysis; disruptive conduct may lead to removal from the case pages. Experienced users (usually clerks, administrators, and CheckUsers) will make final decisions and any formal findings, and whether an administrative action is needed.
5. Other decisions might also be made by anyone at any time, as usual. For example a user may want to email a CheckUser to discuss something sensitive, or the case may be relevant to other discussions or pages, other users might need to be told of the matter, or an experienced user may decide to raise or act upon some aspect of the case separately (for example, SPI evidence of gross abuse may lead a user to separately propose a community ban).
6. Closure: When all necessary case actions are done, any administrator or clerk can mark the case as closed. A clerk will give the case a final check to ensure there are no obvious loose ends and then archive it. The case will automatically be de-listed and appended to existing archived cases for the sock master (if any).

The inner-workings of SPI

The day-to-day running and housekeeping of SPI is undertaken by the "SPI Clerks" team, editors with considerable experience who help ensure cases are managed properly and remain in good order, and who provide clerical and administrative support when needed. SPI clerks also evaluate CheckUser requests before endorsing for CheckUser attention, review completed cases for loose ends before closure, and help with other tasks such as userpage-tagging of confirmed and blocked socks.

For administrators: If you would like to assist at SPI, please feel welcome, and thank you for contributing. We maintain a set of procedural notes on common SPI patroller procedures and the Clerks’ page contains information on patrolling and how patrollers can help. If you need any further help, please ask one of the active SPI clerks, or join #wikipedia-en-spi ^connect on Libera Chat IRC.

See also

• User:Blablubbs/How to file a good SPI
• User:Tamzin/SPI is expensive, for when to use other venues instead of SPI