Wikipedia:Suspected sock puppets/Kraken7
- The following discussion is an archived debate of the case of suspected sockpuppetry. Please do not modify it. No further edits should be made to this page. All edits should go to the talk page of this case. If you are seeing this page as a result of an attempt to open a new case of sockpuppetry of the same user, read this for detailed instructions.
- Suspected sockpuppeteer
Kraken7 (talk · contribs · deleted contribs · page moves · block user · block log)
- Suspected sockpuppets
Ghost account 8 (talk · contribs · deleted contribs · page moves · block user · block log) (blocked)
Ghost account 2 (talk · contribs · deleted contribs · page moves · block user · block log) (blocked)
Ghost account 1 (talk · contribs · deleted contribs · page moves · block user · block log) (blocked)
Bkonrad0 (talk · contribs · deleted contribs · page moves · block user · block log) (blocked)
Filmman1 (talk · contribs · deleted contribs · page moves · block user · block log) (blocked)
Uguion (talk · contribs · deleted contribs · page moves · block user · block log) (blocked)
Rexus Graco (talk · contribs · deleted contribs · page moves · block user · block log) (blocked)
90.185.70.238 (talk · contribs · deleted contribs · page moves · block user · block log)
18.246.5.218 (talk · contribs · deleted contribs · page moves · block user · block log)
71.166.49.7 (talk · contribs · deleted contribs · page moves · block user · block log)
211.178.81.118 (talk · contribs · deleted contribs · page moves · block user · block log)
12.198.94.194 (talk · contribs · deleted contribs · page moves · block user · block log)
68.108.3.215 (talk · contribs · deleted contribs · page moves · block user · block log)
76.104.162.147 (talk · contribs · deleted contribs · page moves · block user · block log)
64.113.84.91 (talk · contribs · deleted contribs · page moves · block user · block log)
69.30.195.20 (talk · contribs · deleted contribs · page moves · block user · block log)
81.201.56.15 (talk · contribs · deleted contribs · page moves · block user · block log)
74.86.134.106 (talk · contribs · deleted contribs · page moves · block user · block log)
209.121.220.178 (talk · contribs · deleted contribs · page moves · block user · block log)
75.127.83.84 (talk · contribs · deleted contribs · page moves · block user · block log)
12.165.108.130 (talk · contribs · deleted contribs · page moves · block user · block log)
69.80.238.93 (talk · contribs · deleted contribs · page moves · block user · block log)
24.69.51.102 (talk · contribs · deleted contribs · page moves · block user · block log)
159.49.254.2 (talk · contribs · deleted contribs · page moves · block user · block log)
72.46.157.18 (talk · contribs · deleted contribs · page moves · block user · block log)
72.167.36.135 (talk · contribs · deleted contribs · page moves · block user · block log)
67.40.254.33 (talk · contribs · deleted contribs · page moves · block user · block log)
67.88.206.99 (talk · contribs · deleted contribs · page moves · block user · block log)
69.144.68.215 (talk · contribs · deleted contribs · page moves · block user · block log)
68.150.128.201 (talk · contribs · deleted contribs · page moves · block user · block log)
24.16.204.98 (talk · contribs · deleted contribs · page moves · block user · block log)
- Report submission by
BusterD 17:31, 5 October 2007 (UTC)[reply]
- Evidence
This user has 79 mainspace edits over roughly 16 months since account creation. Edits are on three pages exclusively, 52 of those on Mexican-American War, with 34 of 58 total talkspace edits in the Talk:Mexican-American War page. The very first account post is here, and since this time user has continually pushed this particular assertion through various talk discussions (including page move discussions). Consensus doesn't agree with this position.
Since the unsuccessful page move request in mid-July, the pagespace has been vandalized some 57 times, by listed ip users and "Ghost accounts", in all circumstances on the subject of disputing the name of the war and the corresponding name of the pagespace, and in a majority of cases by an ip or account using "rv" or "reverted vandalism" in edit summary, usually mocking the editor who reverted user's previous vandalism attempt.
Accounts User:Ghost account 1, and User:Ghost account 2 have already been blocked as socks and several of the ips listed are Tor nodes.
It is possible that some other user is running these socks and in that case I will offer apology to User:Kraken7. It seems more likely to me that user is a content-area-specific sock puppetmaster for someone using other content-area-specific sock puppetmasters as middle managers to avoid blocking.
No matter the culprit, it is obvious that someone is running these socks and proxies, and while the accused may not be the guilty party, sock behavior is demonstrated here.
Diffs (with edit summaries):
Ghost account 8
05:04, 5 October 2007 (Undid revision 162344447 by Haemo (talk)rv vandalism by user Haemo (talk))
15:11, 5 October 2007 (no summary)
15:50, 5 October 2007 (Undid revision 162469233 by BusterD (talk)reverted obvious vandalism by BusterD)
Ghost account 2
03:09, 4 October 2007 (edit symantics)
07:13, 4 October 2007 (Undid revision 162177327 by Griot (talk) rv vandalism by (talk))
17:43, 4 October 2007 (Undid revision 162214529 by BusterD (talk) rv vandalism by BusterD (talk))
19:18, 4 October 2007 (removed repeated vandalism by North Shoreman (talk))
Ghost account 1
17:09, 29 September 2007 (changed as per talk page)
17:20, 29 September 2007 (Undid revision 161146315 by Bkonrad (talk)reverted to title name as found in talk page)
17:27, 29 September 2007 (Undid revision 161147920 by Bkonrad (talk)do not continue to violate the 3rr BKonrad)
68.108.3.215
0:609, 23 September 2007 (Edit spelling)
12.198.94.194
18:47, 23 September 2007 (Undid revision 159773626 by Griot (talk)rv vandalism by user Griot)
18:48, 23 September 2007 (Undid revision 159773840 by Griot (talk)rv vandalism by user Griot)
20:36, 23 September 2007 (Undid revision 159848624 by BusterD (talk)removed vandalism by BusterD)
211.178.81.118
21:15, 23 September 2007 (Undid revision 159872196 by Bkonrad (talk)removed vandalism by user Bkonrad)
71.166.49.7
21:58, 23 September 2007 (Undid revision 159879864 by BusterD (talk)removed repeated vandalism attempts by user BusterD)
209.121.220.178
04:29, 5 September 2007 (no summary)
01:39, 6 September 2007 (Undid revision 155798162 by Darkspots (talk))
01:46, 6 September 2007 (Undid revision 155961326 by North Shoreman (talk)Re: identified vandalism by North Shoreman)
74.86.134.106
18:02, 7 September 2007 (changed spelling)
18:10, 7 September 2007 (Undid revision 156315764 by North Shoreman (talk)No I was always taught the other name.)
81.201.56.15
16:39, 8 September, 2007 (Undid revision 156321532 by Griot (talk) rv; vandalism by user Griot)
23:17, 9 September 2007 (Undid revision 156805033 by North Shoreman (talk)Undid repeated vandalism by North Shoreman - who made you the Führer?)
69.30.195.20
17:15, 9 September 2007 (Undid revision 156511663 by BusterD (talk)edit grammar)
64.113.84.91
21:54, 9 September 2007 (Undid revision 156737543 by Bkonrad (talk)Re: rv repeated vandalism by Bkonrad) 76.104.162.147
22:48, 9 September 2007 (Undid revision 156797378 by North Shoreman (talk)Undid repeated vandalism by North Shoreman)
67.88.206.98
04:05, 25 August 2007 (no summary)
159.49.254.2
16:52, 25 August 2007 (Undid revision 153538822 by Bkonrad (talk)re: Undid vandalism by BKonrad)
24.69.51.102
02:07, 26 August 2007 (Undid revision 153599286 by Bkonrad (talk)re: removed vandalism by Bkonrad)
03:32, 26 August 2007 (Undid revision 153665597 by North Shoreman (talk)edit: removed vandalism by North Shoreman - do not change the name)
69.80.238.93
19:58, 26 August 2007 (Undid revision 153675060 by Bkonrad (talk)Edited to undo vandalism by Bkonrad)
12.165.108.130
03:15, 27 August 2007 (Undid revision 153812444 by North Shoreman (talk)Re: removed VANDALISM by North Shoreman)
75.127.83.84
20:42, 28 August 2007 (Undid revision 153924895 by Bkonrad (talk)re: Undid vandalism by Bkonrad)
- Comments
I've requested checkuser here. BusterD 16:11, 6 October 2007 (UTC)[reply]
- Admin Haemo states when actively looking he found some 30 "Ghost accounts" cued up for use. BusterD 16:30, 6 October 2007 (UTC)[reply]
If the above is accurate, there seems to be evidence of vandalism and sockpuppetry on the page in question. I am accused of being the culprit because these events happened after I made edits or comments that appear relevant to the vandalism or sockpuppetry. I am also accused of being a "content-area-specific sock puppetmaster for someone using other content-area-specific sock puppetmasters as middle managers to avoid blocking."
My response to those charges: I have never vandalized Wikipedia or any other website, nor have I ever used a sockpuppet on Wikipedia or any other website. No evidence connects me to these events beyond the post hoc ergo propter hoc fallacy. That is, the proliferation of vandalism and sockpuppetry after I have made my comments is NOT in and of itself proof that I am the sockpuppeteer. As for the charge of being a "content-something-or-other," I have no idea what that is. If someone would explain it to me, I can tell you whether I have done so. Be that as it may, no evidence is shown for why my being a "content-something-or-other" is "more likely" than the possibility that "some other user is running these socks."
Obviously I have upset some very tender sensibilities in trying to open a line of inquiry while following Wikipedia procedures the best I could. So be it. Ban me for life from Wikipedia for being an upsetter of very tender sensibilities, but not for vandalism, sockpuppetry, or content-something-or-other.
Regarding some of the specific pieces of evidence:
"Consensus does not agree with this position." What consensus? When, how, and with whom was this "consensus" built? Whether consensus exists or not, what does that have to do with my being the culprit?
How does the use of "rv" or "reverted vandalism" prove that I am the culprit?
Why is it significant that two accounts "have already blocked been blocked as socks" and that "several of the ips listed are Tor nodes"? And what does that have to do with my being the culprit?
What is the significance of "Admin Haemo states when actively looking he found some 30 'Ghost accounts' cued up for use"? How is this related to me? How does this finding (if accurate) make it more likely that I am the culprit? Kraken7 22:53, 6 October 2007 (UTC)[reply]
- When I gathered evidence for this case, effort was made to meet two criteria:
- 1) Demonstrated harm requiring investigation--A clear case of connected ips and socks used in coordinated effort to apply vandalism to the page
- On the methods-The use of "rv" and "reverted vandalism" links many of the edit summaries, suggesting the same user
- On the methods-The use of mimicking the previous reversion edit summary language (possibly to mock reverters) likewise links many of the edit summaries, suggesting same user
- On the methods-Several of the edit summaries of these contained POV buzzwords which suggest a similar if not the same user:
- On the methods-The reality that 30 sock accounts had been prepared already before this process was filed demonstrates a desire on the part of the puppetmaster to continue this pattern; this provides a compelling reason for a full investigation by responsible parties no matter the culprit —Preceding unsigned comment added by BusterD (talk • contribs) 21:43, 7 October 2007 (UTC)[reply]
- On the merits-The specific content of the edits (changing "Mexican-American War" to "Mexican War") links all of the edits, suggesting a similar user, but not necessarily the same user
- 2) Identify suspect fitting method/opportunity/motive--when looking at the universe of all users and ips editing en.wikipedia, which user or users seemed the likely suspect(s)?
- User's editing history reveals a very narrow pagespace focus (3 pages with more than one edit, 2 talk pages with edits, as of the filing of this case)
- User's editing history on Mexican-American War and Talk:Mexican-American War often demonstrates a narrow focus of content, specifically that of changing the lede section of the article more in line with the assertion made in user's very first post. Based on discussion, user holds strong opinions on the subject. Even now there's discussion about whether the modifier "more" should be inserted in the phrase "...the conflict is commonly known as..." to create "...the conflict is more commonly known as..."
- Even though user first raised this issue 16 months ago, and though the issue has been much discussed in talkspace and failed requested page move discussions, user continues to make the same assertion in the same talkspace even today
- As demonstrated by user's response to evidence above, even now user refuses to see evidence that the assertion (if I understand the position correctly) "Mexican War is the most common name for conflict in literature, and therefore this page should read 'Mexican War' and page space should be moved to 'Mexican War'" isn't supported by consensus as reflected in unsuccessful page move attempts and like discussion on talk
- 1) Demonstrated harm requiring investigation--A clear case of connected ips and socks used in coordinated effort to apply vandalism to the page
- After I had written this case, I submitted it for examination to an administrator who had already made him or herself involved in this matter (by reverting and blocking sock 8). Said administrator suggested I had enough evidence for checkuser, and while I deferred at that moment, I requested checkuser when I submitted this case for SSP. When this process and the checkuser process are complete, I hope the puppeteer will be revealed and blocked in a way which prevents easy recidivism. BusterD 17:07, 7 October 2007 (UTC)[reply]
- In proceeding with this accusation, it appears two criteria were met: insinuation and guilt by implied association. However, there is still no evidence to connect me to the vandalism and sockpuppetry reported above.
- 1) It is alleged that the use of "rv," "reverted vandalism," and "mimicking the previous reversion edit summary language" suggest "the same user." Likewise, the use of "POV buzzwords" and "the specific content of the edits" is supposed to suggest "a similar if not the same user" and "a similar user, but not necessarily the same user." Perhaps. However, it is also equally likely that all of this suggests: a) several users sharing the same politics and a penchant for vandalism, b) copycat vandal(s), or c) some combination of a) and b). It would seem incumbent on the accuser to exclude these possibilities and then to show how at least some of these deeds could only have been done by me.
- Further, regardless of whether the "reality" of "30 sock accounts . . . provides a compelling reason for a full investigation," I find the predicate "no matter the culprit" to be disingenuous since this investigation focuses exclusively on me. Moreover, what evidence connects even 1 of these 30 sock accounts, assuming for the moment their "reality," to me specifically?
- 2) Is "user" supposed to refer to me or a "universe of all users"? If the former, why resort to euphemism? If the latter, why is only the singular or singular possessive employed throughout? I will assume the former to be the case in what follows, but I would expect that someone appropriating Zola's rallying cry to be more forthright.
- What relevance does an alleged "very narrow pagespace focus" have to my being the culprit? Is it not good Wikipedia practice to "adopt" a page?
- How does a supposed "narrow focus of content" or my having "strong opinions" (itself a matter of speculation) make it more likely I am the culprit? What is the relevance of my participating in a continuing discussion?
- How is my perceived persistence relevant to my being the culprit? As for the issue being "much discussed in talkspace," that would depend on the definition of "much" and the standards of discussion since there's been little substantive discussion at all.
- As for my refusing to "see evidence" that my contention "isn't supported by consensus," I see that "consensus" has been declared here on this talkpage for the second time, but I'm not sure repetition in and of itself necessarily makes that declaration true. I think not. But, even if consensus exists, what of it? Does a consensus foreclose now and forever a talkpage discussion? Besides, what is the specific relevance of this to the charges made against me?
- I look forward to a process that will reliably reveal the identity of the puppeteer. Maybe this process should have been initiated before accusing me as the culprit? Kraken7 16:08, 9 October 2007 (UTC)[reply]
Today I added a new sock which has appeared on Mexican-America War; Bkonrad0 is a username which resembles that of an established editor on the page. BusterD 11:54, 10 October 2007 (UTC)[reply]
- That one is now blocked as an obvious bad-faith account. —Wknight94 (talk) 13:31, 10 October 2007 (UTC)[reply]
- It seems likely that the new SSP case above (Wikipedia:Suspected sock puppets/BusterA) is somehow related to this case. BusterD 12:53, 12 October 2007 (UTC)[reply]
- Really? What evidence shows they are related? What exactly is the relationship? Kraken7 16:16, 12 October 2007 (UTC)[reply]
- Added another account doing the same mischief. BusterD 18:39, 17 October 2007 (UTC)[reply]
- Added two more new accounts making same edits and similar edit summaries. BusterD 20:50, 20 October 2007 (UTC)[reply]
- Added another account doing the same mischief. BusterD 18:39, 17 October 2007 (UTC)[reply]
- Really? What evidence shows they are related? What exactly is the relationship? Kraken7 16:16, 12 October 2007 (UTC)[reply]
- It seems likely that the new SSP case above (Wikipedia:Suspected sock puppets/BusterA) is somehow related to this case. BusterD 12:53, 12 October 2007 (UTC)[reply]
If my accuser were serious about finding out who is behind the sockpuppetry that has plagued this page instead of just going after me personally, then one might expect a thorough examination of the other two pages I am said to edit to see if they too have suffered from similar outbreaks of sockpuppetry and vandalism. If an identical pattern were found to exist on either or both pages, then I would expect the weak circumstantial case against me would be somewhat bolstered. However, if these pages were relatively untouched or no such pattern were evident, then my accuser might find it difficult to explain this seeming anomaly. Kraken7 14:04, 18 October 2007 (UTC)[reply]
- Conclusions
The named accounts are already blocked and while there is obvious socking going on here, as Haemo says on the RFCU page, it's impossible to tell who the puppetmaster is. Rlevse 16:10, 23 October 2007 (UTC)[reply]