Wikipedia talk:Sockpuppet investigations/Renamed user 51g7z61hz5af2azs6k6

RFC

I feel drawn to open an RFC to see if the community agrees with the close. 73.162.132.47 should be blocked, as it's clearly a sock of 169.230.155.123; clerks refuse to even allow an SPI to mention the IP. As far as I can tell, a checkuser is totally called for in this case. link to case (link edited to refer to editable copy since live copy has been disrupted), which includes detailed argument backed by policy and IIRC, common practice.

RFC: Is it reasonable to expect to be able to ask for and expect a clear response from a clerk with respect to each IP I've noted on this page: Sock? And to do so without being subject to the chilling effects of vague intimidating comments by admins? Should a CheckUser be run in this case? Why/Why not? (Struck; I'm told I can't request comments on that question.) Which of the reported IPs should be blocked? Why is this being quashed/covered up? Summary: SPI reported socking and requested a checkuser because multiple IPs are editing the same articles and tells indicate the master is very experienced [Edit: and we have an admission.] It's confirmed that there's socking, but no checkuser is done; the close is:

"*Two sock IPs blocked for 3 days, master IP warned. Range-block is not possible, as the range is very large. CheckUser can't help here, it is used only to compare named accounts, not anonymous IPs. I'm closing the case. <sig of Vanjagenije>"

The fourth IP was not blocked; the involved Admin and CheckUser refuse to block it OR explain why. They refuse to check if other IPs are the same (not-logged-in) user, arguing nonsensically that the privacy policy doesn't allow it - while policy doesn't allow (logged-in) accounts to be publicly connected to IPs; connections between IPs are allowed. [Edit: There's a bunch of bluster and distraction in the replies below.]

--Elvey^(t•c) 17:41, 11 December 2015 (UTC)

As the SPI page mentions, "Additionally, CheckUsers will not publicly connect an account with an IP address per the privacy policy except in extremely rare circumstances." To me, this isn't an exceptional case. Also, I agree with Vanjagenije's comments. Please note that checkuser requests are not subject to consensus. Checkusers are trusted to use the tool appropriately and won't run checks that conflict with our policies or procedures. We can certainly run checks against IPs privately, be we won't comment on it. In a SPI case it's best to determine the merits of a block on the behavior and known technical data of the IPs. (e.g. If they geolocate close or belong to the same range.) Mike V • Talk 22:32, 11 December 2015 (UTC)

You say you could run checks against IPs privately, but the closing indicates Vanjagenije did NOT do that, so your point is cold comfort. It's obvious if you read even half of what I wrote on the case that I'm quite aware of your first point, so I don't know why you're making it. It's a distraction; I'm tempted to {{cot}} it. You say you agree with his comment (there's only one), yet you don't refer to any polices to back up your ILIKE IT and his comment doesn't refer to policies that back it up either. I'd prefer a reply that didn't bring up obvious points of agreement as if they're points of contention but did address the points I raised, to the reply you've left, User:Mike V. --Elvey^(t•c) 23:34, 11 December 2015 (UTC)

Well, let's look at Vanjagenije's statement: Two sock IPs blocked for 3 days, master IP warned. I agree with the action taken and the duration of the block. Range-block is not possible, as the range is very large. This is correct. The IPv4 is a /16 range and the IPv6 is a /28 range. Unless there is significant disruption and minimal collateral damage, we won't block ranges this large. There's no policy saying we should or should not block the range. It's using proper discretion to achieve the desired results while impacting as little users as possible.

CheckUser can't help here, it is used only to compare named accounts, not anonymous IPs. I'm closing the case. As I mentioned, We won't use checkuser to connect IPs to accounts. If you were looking to connect the IPs together, that doesn't require the use of checkuser tools and a determination can be made via WHOIS, geolocation, and/or rDNS. Even if a private checkuser was run, we will not make a comment on the SPI page. In this specific instance, a private check will not be run because there is no evidence of account abuse, everything has occurred via IP addresses. Mike V • Talk 00:42, 12 December 2015 (UTC)

Again, I don't know why you bring up irrelevant points of non-contention. I've collapsed/commented them out as they're an irrelevant distraction. [Edit: and you've put them back!] If you insist on continuing the disruptive distraction, I guess you'll revert my commenting out and chastise me. Hopefully you won't do something so POINTY. Clearly you're not actually reading what I'm asking you and Vanjagenije, again and again, to read and address. Again: You say you agree with his comments, yet you STILL don't refer to any polices to back up your ILIKEIT and his comment doesn't refer to policies that back it up either.

Instead you appeal to authority. AGAIN. Shame on you for that. STOP IT!

AGAIN: I'd prefer a reply that didn't bring up obvious points of agreement as if they're points of contention but did address the points I raised, to the reply you've left.

What part of [Your claim that "We won't use checkuser to connect IPs to accounts." is not true (and I challenge you to find policy to support it)] do you not understand? I've proven it with examples and reference to policy; link to case (link edited to refer to editable copy since live copy has been disrupted), which includes detailed argument backed by policy and IIRC, common practice. Which trump your appeal to authority. --Elvey^(t•c) 03:50, 12 December 2015 (UTC)

From the checkuser policy:

The disclosure of actual checkuser data (such as IP addresses) is subject to the privacy policy, which requires that identifying information not be disclosed except under the following circumstances:

With the permission of the affected user;

Where the user has been vandalising articles or persistently behaving in a disruptive way, data may be released to non-checkusers to allow the making of IP blocks or rangeblocks, or to assist in the formulation of a complaint to relevant Internet Service Providers or network operators; and

Where it could reasonably be thought necessary to protect the rights, property or safety of the Wikimedia Foundation, its users or the public. Mike V • Talk 16:33, 12 December 2015 (UTC)

That in no way helps you. I understand and don't dispute that "CheckUsers will not publicly connect an account with an IP address per the privacy policy". It's clear you are simply not reading what I've written. I can't force you to. But it pisses me off that you totally ignore that I've proven it with examples and reference to policy; link to case (link edited to refer to editable copy since live copy has been disrupted), which includes detailed argument backed by policy and IIRC, common practice. --Elvey^(t•c) 00:29, 15 December 2015 (UTC)

In regards to this, it seems you missed my comment above where I said, If you were looking to connect the IPs together, that doesn't require the use of checkuser tools and a determination can be made via WHOIS, geolocation, and/or rDNS. Mike V • Talk 01:17, 15 December 2015 (UTC)

No. You're jumping to a mistaken conclusion. It does not follow from this that I missed your comment at all. Rather, it seems you [missed|repeatedly ignored my comments directing you to] my comment where I said, "Even if only to identify other IPs associated with these IPs, CheckUser can be used to help here." CheckUser User:DeltaQuad has admitted the info is available to do this. Your comment is not relevant because the connection between the IPs is firmly established, not through WHOIS, geolocation, and/or rDNS, but rather through the behavioral evidence - including the diff I labeled "SMOKING GUN" and have directed you to umpteen times now; You STILL haven't blocked 73.162.132.47, which I reported as part of this SPI ages ago. Why are you protecting sock 73.162.132.47? You could be using the CheckUser tools to identify other IPs associated with these IPs being used to sock, without publicly connecting an account with an IP address, without violating policy. WHY AREN'T YOU DOING IT? --Elvey^(t•c) 04:57, 15 December 2015 (UTC)

• Hi @Elvey:. So I've seen your ping here (and I don't know the context of what your talking about with me), and I've tried to read what's going on. I'm not sure I fully understand, please bear with me. As I read it, you wish for us to connect IPs to other IPs without commenting publicly, but just blocking? If that's the case, i'll address that. It's not technically possible for us to be able to determine if an IPv4 and IPv6 address are related. IPv6 doesn't have any useful geolocation, and I'm not comfortable connecting an IP to another IP purely on a useragent, it's just not how CU works. If your asking about between the two IPv6 connections, unless they are on the same range, I run in to the exact same issue. I have removed your request for an RFC as it's up to a CU to determine if it is within the checkuser and privacy policies to run a check. If you wish to have an RFC on clerk procedures, please feel free to do so at WT:SPICLERK. -- Amanda (aka DQ) 05:49, 15 December 2015 (UTC)
  • This issue was brought up in the #wikipedia-en IRC channel by Elvey, and I was going to write a longer comment, but User:DeltaQuad's comment here explains it perfectly. I consider this matter resolved. --(ʞɿɐʇ) ɐuɐʞsǝp 01:55, 18 December 2015 (UTC)

• (restored comment) DQ, I understand why you're not comfortable connecting an IP to another IP purely on a user agent - it's gotten you into trouble before. It was merely your mention of user agents when discussing that trouble, that prompted me to mention you. Thanks for piping up. However, this carefully retained capability to keep browser fingerprints made it rather hard for me to see how it could be true that "It's not technically possible for us to be able to determine if an IPv4 and IPv6 address are related." I've asked a CU about this on IRC. I was told that CU data DOES include fingerprint data, but the CU left without disclosing what data was included beyond the user agent string. Another CU implied the CU tool gives IP and user agent, but not whether more info was logged. In any case, it's my understanding that all the following are clearly true:

1. We can see that the IPv4 and IPv6 addresses I reported are all confirmed related purely on behavioral evidence- including the diff I labeled "SMOKING GUN" and on admissions that I have directed your fellow investigators to review umpteen times now.
2. I do wish for you to connect IPs to other IPs. No CU of any kind has been done on ANY of the 6 9 reported IPs, however.
3. Why is Mike V STILL protecting sock 73.162.132.47 despite the SMOKING GUN evidence I keep pointing him to? I have no clue; the excuse that the data is old rings hollow.
4. A CU could check to see if any logged in users have used any of the 6 9 listed IPs that this socking person (and it appears only this socking person) used while not logged in. That is WP:NOTFISHING; it would not be a policy violation to do so or disclose any results state (without disclosing any results) that this had been done. (Correction - swapped end of this line and the following.)
5. A CU could check to see if any IPs in the range of the 6 9 listed IPs that this socking person (and it appears only this socking person) used while not logged in have edited in related areas. That is WP:NOTFISHING; it would not be a policy violation to do so or state (without disclosing any results) that this had been done disclose any results.

Do you dispute any of them?--Elvey^(t•c) 05:08, 18 December 2015 (UTC)

Also, DQ: Your removal of my RFC feels very heavy handed, and unnecessarily so. I would ask you to reconsider, and rather than being so heavy handed, express yourself in a comment, as it is after all a Request for Comments. The question was not merely whether it is within the checkuser and privacy policies to run a checkuser in this case; you misrepresented it, and closed it based on that clear misrepresentation. --Elvey^(t•c) 05:08, 18 December 2015 (UTC)

I'm not 100% on what exactly is covered by Browser fingerprinting, so i'll tell you more directly. Available to us in Checkuser is only a useragent and IP attached to every single edit or logged action. No further information is available to us. 1 & 3 I don't have an opinion on, as I have been speaking generically, and not addressing this specific case. #2 I haven't looked at the CU logs, and as I have declined to do so before, I will decline again on identifying if an IP has been checked when it relates to an account. It's been subject of several discussions on WT:CheckUser, of which the majority if not all checkusers agree that we don't identify if something has been checked if it risks infringing privacy rights. The 2601:643:8100:8AF4:/64 IPs are very likely the same person by default. Individual users in IPv6 are assigned a subnet /64 to themselves. The other two IPv4 addresses we could give a result on, but if there is a smoking gun as you say...then it wouldn't be needed in the first place. When comparing IPv6 to IPv6 (in a different subnet) or to IPv4, we run into an issue. We rely on geolocation of IP addresses to connect them togeather. IPv6 has either no geolocation or really crappy geolocation (like wrong country). So until that is remedied, it's not possible to make that connection. #4/5 I would be able to check the IP for accounts, but I would not be able to say if I checked the IPs as it could hint to any blocked accounts (or relating edits) being connected to those IPs. So it's possible if that is satisfied. Re. the RfC, could you please then state the purpose of the RFC? If it has the whether or not a CU should be done part removed, I shouldn't have much objection to it. But also depending what it is, this is a horrible venue to hold an RFC at, and if you give the scope, I'd be willing to point you in the right direction. -- Amanda (aka DQ) 07:37, 18 December 2015 (UTC)

DQ, thanks for the detailed reply. I notice that you have (in the Non-denial denial sense) NOT directly indicated whether you a)are aware of and b) know for a fact whether: more info useful for identifying socks is logged than just current login (if any), IP and user agent, however. I wouldn't press the existence of logs of "other information as well", if the supposed/implied lack of them wasn't being used as an excuse not to connect IPs to other IPs, or if the hostility some folks directed toward me about this for no apparent reason didn't make me feel like said folks were hiding something.

You and Vanjagenije direct me to WT:CheckUser. I find no discussion there showing consensus that checkusers cannot say if they checked IPs. Please link to the discussion(s) you refer to. Rather, I'm able to find many discussions, where checksesrs have stated that they've checked IPs. a recent example. This supposedly applicable policy to refuse to use/disclose usage of the tool is shown by such examples to be a smokescreen.

This part of your reply re. #2 is way off: "if there is a smoking gun as you say...then it wouldn't be needed in the first place". It's nonsense because the smoking gun connects some of the IPs I reported, but not all of them. This is obvious if you examine this specific case. I find your actions exceedingly frustrating, in that you thereby not only ARE addressing this specific case and yet refusing to properly examine this specific case, but at the same time you are claiming that you are "not addressing this specific case". I would like to tag the IPs for which there's a smoking gun or admission, but I feel I've been vaguely threatened with repercussions if I do so without independent confirmation that there's a smoking gun or admission.

You say "The other two IPv4 addresses we could give a result on." Well, then I say, I hereby request you do so. There are now three. I've been conflicting advice as to whether I can consider that the admissions or smoking guns result in proven socking for the IPs to which they apply. I think it's reasonable to expect to be able to ask for and expect a clear response from a clerk with respect to, each IP I've noted on this page: Sock? And to do so without being subject to the chilling effects of vague intimidating comments by admins. Isn't it?--Elvey^(t•c) 23:43, 18 December 2015 (UTC)

First, let me apologize if I forget to answer any of your questions here or make any small mistakes, I'm very tired but wanted to be able to provide you a response.

I do know for a fact that the information available to checkusers (as in the user right, not the interface) is solely the user agent and IP address of each edit. Active login details are not available to checkusers. That's all that I have additional access to as a checkuser, and I don't have any extra tools that you don't have to get more information.

As for the policies, your right that there is no consensus about it on that page. Only examples of declines are there. That is because as a Checkuser and oversighter, I have had to sign a legal agreement with the WMF to get access to checkuser. That agreement is the Access to nonpublic information policy. Under this section, point A, I must "community members with access to the CheckUser tool must comply with the global CheckUser Policy, and, unless they are performing a cross-wiki check, they must also comply with the more restrictive local policies applicable to the relevant site." So its not consensus that determines what I can and can not do, it's a legal document. I am not willing to violate that agreement in any way and put myself in any legal jeopardy. You also link to Berean Hunter's comments. He is not a checkuser, and only used a tool linked in that text, which does not require any level of special access to use. So he did not have access to useragent data when he made the assessment, which is the only additional information I would have access to if I ran a check on an IP.

I have not at all looked at the case except for reading the list of IP addresses to see what type of IPs we were comparing. If you would like me to look at your case, I'll need time to go through it and decide whether there is significant enough evidence to run a check, as I am not allowed to take your word for it, again by legal agreement. As for your bolded statement, I'll make response to that at a later time. Have a good night. -- Amanda (aka DQ) 06:25, 19 December 2015 (UTC)

FFS, @Elvey: cold stop. You are arguing for the wrong things in the first place. This editor is ONLY editing as an IP of one form or another and is not using an account so there's nothing that a checkuser can do for you. Browser fingerprinting does occur but you aren't getting that this info isn't lifted from the Apache logs and propagated forward to the database for checkuser purposes. This issue is not part of this case so it is only detracting from the matters at hand. No one is protecting anyone so you may owe Mike V an apology. Contrary to your postings here and my talk page, I have been working on the case. I guess you didn't get my ping the other day? That would be the one where I'm letting you know that I'm working on it. I have emailed a bureaucrat (on the same day) with a question concerning the case and I haven't heard back from them. That step is important here. I don't want to open the case on a now non-existent account. I haven't seen any actual disruption and your only claims are that they are avoiding scrutiny, I believe. You are assuming that they have an account but I don't believe so. That IP editor is actually making some good edits and probably a valuable contributor on the whole. They owned up to the other IPs being theirs and have not attempted to influence anything in terms of consensus. The one thing they have done is misused our courtesy vanishing because they came back...er, really never left. I know who this is and I'm not protecting them but I am seeking further guidance from the bureaucrat(s) before going forward. What you may get in this case is the identity of the user but I would be inclined to not block based solely on the violation of the vanishing guideline but rather encourage that editor to resume their account. Between family and very important matters, I will be busy most of the day and I don't see this as being something that requires urgent attention. Now, if you want to present evidence of illegitimate socking here then that might be helpful. Again, all that I've seen so far is that they didn't really vanish but I haven't delved fully into every thread they've been in so I'll let you digest the evidence in my sandbox for now.
 — Berean Hunter (talk) 14:32, 20 December 2015 (UTC)

You say, incorrectly, "Your only claims are that they are avoiding scrutiny." Search the SPI for 'scrutiny' for the others.

You say "They owned up to the other IPs." They've owned up to a small fraction of the IPs we think are theirs being theirs, and only that after what seems like an unintentional slip left a smoking gun. Long after exhortations to stop socking. --Elvey^(t•c) 21:35, 20 December 2015 (UTC)

Apologies?? Protection?? I don't see Mike V apologizing for anything - for his appeals to authority or for bringing up obvious points of agreement as if they're points of contention. I see no apology for my having to debunk the patently false claim that CheckUser is used only to compare named accounts. I don't see anyone apologizing for the false and defamatory claims that I've been pushing anyone to violate the checkuser or privacy policies. Good luck convincing me that no one is protecting this user while the bulk of the IP socks remain neither tagged nor blocked. You say 169.230.155.0/24 is all him, but there's no block?!

Sorry, I did not see your ping. Good. Good. Good. Thank you. Better would be to see that the IPs were being tagged with IPsock.

Edit: note: (ec; hadn't seen Hunter's comment above when I left this comment.) Thank you, DQ. I appreciate you calmly providing an answer that (to my eyes) cannot be seen as a Non-denial denial that you have access to browser fingerprint data beyond user-agent. What do you mean when you say "Active login details"?

I just don't see how anything that I've asked for (except for what's struck and marked "Correction", above) is asking that the agreement be violated in any way. I don't see how doing anything I've asked for here would be doing what Berean Hunter has done - publicly connect an account and an IP. It's common for SPI's to be closed with tags indicating that a checkuser has been performed and that IPs connected to socking users had been blocked by a commenting admin. The first SPI I thought to check disclosed this. It clearly bears repeating: Valid Wikipedia:Sockpuppet_investigations/SPI/CheckUser_criteria include "Likely undetected or "sleeper" socks, getting an IP block (of a repeat sock-user)" - clearly in the latter case, CheckUser is necessarily used to compare named accounts and IPs. WELL?

I get your point about Hunter not being a CU. I would like permission to post the case at this page to the normal place (this talk page's main page) so that the tools and process can work normally. As far as I can tell, doing so would be following the proper procedure for opening an SPI. If not, what's wrong and fixable or not fixable, per PAG?--Elvey^(t•c) 19:13, 20 December 2015 (UTC)

I see that instead of discussing, Vanjagenije is "refusing to be responsive to good-faith questions", choosing instead to do that which is 'unconstructive and creates animosity between editors, making it harder to reach a consensus'.  :-( (substantiation below) --Elvey^(t•c) 00:58, 25 December 2015 (UTC)

The above comment was removed on the basis that it was unsubstantiated. It seems to me to be obvious what I'm referring to, but let me make it more clear that they are substantiated :

Vanjagenije performed 6 edits, including 3 reverts on December 21, 2015; this is the first; the first 3 show what I am referring to as what Vanjagenije chose to do - to do that which is 'unconstructive and creates animosity between editors, making it harder to reach a consensus'.. As far as "refusing to be responsive to good-faith questions", there were several questions I asked; some were implicit; here we see Vanjagenije not only "refusing to be responsive to good-faith questions"but also DELETING some of those questions. I stated, If it't not clear whether this user's behavior constitutes socking, I propose an RFC on that question. And I claimed, Posting from many different IPs on many different networks for months without disclosing, by a user who has had an account while violating our vanishing guideline is socking. But received no reply; instead the comments were evidently ignored and quickly archived without comment. I see no good reason for censoring any discussion in which I ask for confirmation that the tools are giving inaccurate results and for information as to why. I did not have adequate time to provide more evidence; you said the user "misused our courtesy vanishing because they came back...er, really never left"; to me that, along with the blocks that were performed, are strong indicators of adequate evidence in the eyes of clerks and checkusers and I had been unable to figure out what was nonetheless inadequate in your eyes about the evidence that you were referring to or whether you had looked at or understood all the evidence I'd posted. --Elvey^(t•c) 20:13, 26 December 2015 (UTC)

No response needed. Unless you feel like simply being responsive to my good-faith questions, please don't respond at all. I feel that I made no unsubstantiated allegations and I'm not sure if I'm expected or welcome to defend myself from the accusation or not at this point, given the differing views. Am I? It's frustrating when some of my edits that provide unique evidence further substantiating the allegations/issues are repeatedly reverted. --Elvey^(t•c) 20:25, 26 December 2015 (UTC)

I take the lack of response as conceding the point - I made no unsubstantiated allegations.--Elvey^(t•c) 02:57, 3 January 2016 (UTC)

Intentional Disruption

Why do you insist on keeping your disruptive comments in the discussion? Seems very POINTY. I'd written, "I don't know why you bring up irrelevant points of non-contention. I've collapsed/commented them out as they're an irrelevant distraction. If you insist on continuing the disruptive distraction, I guess you'll revert my commenting out and chastise me. Hopefully you won't do something so POINTY." And yet you did the POINTY thing. (You seem to have missed that the policy that you should be familiar with - but don't seem to be - states (at WP:NOTFISHING): "it is not fishing to check an account where the alleged sockmaster is unknown, but there is reasonable suspicion of sock puppetry, and a suspected sock-puppet's operator is sometimes unknown until a CheckUser investigation is concluded.") --Elvey^(t•c) 00:29, 15 December 2015 (UTC)

Newly Discovered, More Damning Evidence

I'm here to provide some of the newly discovered evidence further substantiating the allegations I've made.

I'm being prevented from keeping - and threatened (by a blatantly unCIVIL admin) for placing - additional relevant info on the SPI page. I've identified more socks, but if I open a new SPI, I expect I'll get grief because they haven't edited recently, so I don't see clearly if/why I should do that. Why will no admin tag User talk:73.162.132.47? It's made hundreds of edits.

This person has claimed to be a retired PhD Medicinal Chemist and yet recently claimed working (per User_Talk:Vanjagenije) in pharmaceutical development as a medicinal chemist, but now at UCSF, from whose IP space he sometimes posts AND has claimed to have never been paid for editing AND have no COI with respect to pharmaceutical companies. I just discovered Formerly 98 has admitted to using multiple named accounts in the past: source I've identified a couple of them that are not blocked.  :-( Wonder if the folks involved in the SPI knew that. Well, folks? Did you? (Only one's been identified at the 'real' SPI and is now Renamed_user_51g7z61hz5af2azs6k6.) The statement, "I am curious as to the conditions that would pertain if I were to register." (diff) has become particularly blatant evidence of the worst of sockpuppetry, since my establishing that the user has quite certainly registered at least 3 accounts. It's specifically listed violation of the WP:SOCK policy to deceive editors.

That, on top of all the other evidence, is most certainly abusive sockpuppetry. I'd open an SPI about it if I didn't think it would be closed with no action. The evidence is very strong; if an admin is willing to take decisive action to contain the sockpuppetry, even though the sock accounts I've found haven't been used recently, I'll lay it all out. Some off-wiki evidence will need to be disclosed to fully make the case. --Elvey^(t•c) 22:32, 6 January 2016 (UTC)

• @Elvey: What outcome do you expect from this? What action do you want us to take? Vanjagenije (talk) 02:19, 7 January 2016 (UTC)

Already answered:"no action." Block the UCSF IPs only this user seems to have used, and the accounts. --Elvey^(t•c) 23:37, 7 January 2016 (UTC)

@Elvey: Blocking IP ranges is very sensitive issue. No administrator will block an IP range unless there is ongoing disruption (see:WP:RANGE, se careful judgement and make them as brief as possible). In this particular case, no edits were reported in the past few weeks. So, we will not block any of those IPs or IP ranges unless they become active again. Regarding registered accounts, you have to tell us their names if you want us to block them. Vanjagenije (talk) 00:25, 8 January 2016 (UTC)

Elvey, I'm recently back from a several month break from my CU and SPI duties, so I'm not getting much of an understanding of the disagreement from the section above. I will say this, though: if dynamic IP addresses haven't been used recently, they will not be blocked because a) it is unlikely that the user will have that address again and b) some unrelated person may want to edit from that address. All of the IPv6 addresses listed in the case fall in this category, and the UCSF range is almost certainly shared by numerous faculty, staff, and/or students. If there are non-shared, static IP addresses being used, that's another story, but none of the IPs in the archived cases are actionable as far as I can see. The IP you mention above is a semi-static address, but it hasn't edited in almost a month. However, if you have evidence of multiple accounts being used, please let us know, because I don't see any of them listed (besides the renamed account, of course). ​—DoRD (talk)​ 03:29, 7 January 2016 (UTC)

DoRD: Yes, I "have evidence of multiple accounts being used". They are not listed. Why should I let you know? In other words, what part of "The evidence is very strong; if an admin is willing to take decisive action to contain the sockpuppetry, even though the sock accounts I've found haven't been used recently, I'll lay it all out." do you not understand?

You say "and the UCSF range is almost certainly shared" - but do you have ANY evidence that the active IPs within the UCSF range are shared by IP editors? All the evidence points to them being used here only by this user.

Do you have ANY evidence that the named IPs in the ranges below are shared among multiple IP editors? All the evidence points to them being used only by this user. And that's not just my opinion. In closing the SPI, User:Berean Hunter wrote,

169.230.155.0/24 <=== This whole range is him
2601:643:8100:8AF4::/64 <=== This whole range is him

73.162.132.47 was used from Oct to Dec.

In contrast, with regard to another IPv6 rage, he wrote, "There is a handful of distinct editors using this range anonymously..." so I get not blocking that range.

I can also present lots of evidence that the user's claim (here) of "ignorance of the rules [against sockpuppetry]" is not credible. The user frequently cites the rules and has been here since at least 2011.

All potential actors: Given all the socking, and even assuming y'all accept the evidence of multiple accounts, y'all still won't block even the IPs that thus far seem to have only been used by this one editor to edit wikipedia, even the ones that were used over a long period, because of DoRD's a) and b), above? It's clear to me that this editor is not going to stay away; based on past behavior, it's very likely he's resumed editing under accounts and/or IPs not yet linked to these.

The only reason for that that I see is that y'all like the user's edits enough to want him to be able to edit, despite all the rule breaking. There was, after all, heavy stonewalling before even the limited action that has been taken was taken, given the evidence presented at the time. In most cases, clerks --Elvey^(t•c) 23:37, 7 January 2016 (UTC)

Okay, let's try this again.

I am not your adversary, here. I am an experienced sockpuppetry investigator who is trying to understand what you're asking for, so responses like, Yes, I "have evidence of multiple accounts being used". They are not listed. Why should I let you know? aren't going to further your goals. Why should you let me know? Because, how else am I to investigate your complaint? I can't do anything about accounts I'm not aware of.

As for your specific points:

• The UCSF range, Special:Contributions/169.230.155.0/24: The latest edit was made on December 6.

I'm frustrated. Your pointing out that obvious fact seems a continuation of your comments so far, which have been mostly mentioning hurdles that my comments thus far indicate I'm obviously already aware of, rather than something positive. And you are no answering my question. AGAIN: Do you have ANY evidence that the named IPs in the range are shared among multiple IP editors? All the evidence points to them being used only by this user. See longer comment below.--Elvey^(t•c) 23:38, 9 January 2016 (UTC)

• Special:Contributions/73.162.132.47: The latest edit was made on December 8.

Ditto. AGAIN: Do you have ANY evidence that the named IPs in the range are shared among multiple IP editors? All the evidence points to them being used only by this user. --Elvey^(t•c) 23:38, 9 January 2016 (UTC)

• 2601:643:8100:8AF4::/64: Unfortunately, as far as I'm aware, there is no IPv6 range contribution tool, so I don't know when the last edit was. However, that range belongs to Verizon Wireless, and the range is much, much larger than just /64, and no user can be limited to just that range. Also, as a mobile data range, IP address changes are inevitable, frequent, and transparent to the end user.

It's not so hard to click toggle all here. The latest edit was made on December 8. AGAIN: Do you have ANY evidence that the named IPs in the range are shared among multiple IP editors? All the evidence points to them being used only by this user. Also, technically you're wrong/misspoke: 2601:643:8100:8AF4::/64 is a /64. It's not larger than a /64. It's part of a larger range, 2600:1010:b060::/44. If you have any evidence that "no user can be limited to just that range" please offer it; that would surely be valuable not just to me, but generally, and to whomever ID'd it. Verizon certainly can break it up and do different things with different portions of the /44, just as they do with their IPv4 blocks; if you're saying otherwise, I'm very skeptical. --Elvey^(t•c) 23:38, 9 January 2016 (UTC)

Since blocks are meant to prevent ongoing abuse or other disruptive behavior, the IPv4 address and range are stale for blocking purposes, and it would almost certainly cause too much collateral damage (preventing other users from editing) to block a wide swath of Verizon Wireless. Unless the user resumes editing from them, and unless the evidence of sockpuppetry is clear, no blocks will be issued. And again, there's nothing we can do about accounts we're not aware of.

It's clear to me that this editor is not going to stay away; based on past behavior, it's very likely he's resumed editing under accounts and/or IPs not yet linked to these. Alright, if this is the case, if these accounts or IP addresses are discovered, then come back and make a report that we can investigate.

Well, of course I will, but the purpose of SPIs is SUPPOSED to be for tracking, but my (and now SlimVirgin's) efforts at using it for that are being - well - frequently interfered with in a way that some might call sabotage. --Elvey^(t•c) 23:38, 9 January 2016 (UTC)

Look, I don't know anything about this user's editing. I gather that they are editing pharmaceutical-related articles, but other than that, I wouldn't know one of their edits if I tripped over it, so your claims of bias toward the user are insulting. I know that I am trying to follow policy here, and if that gives you the impression that I'm protecting someone, then it's doubtful that we're ever going to see eye-to-eye in this case. If you understand that I'm (we are) trying to follow policy, and trying to do my (our) job the best I (we) can, then we can work together to prevent damage to the project. ​—DoRD (talk)​ 14:07, 8 January 2016 (UTC)

You respond as if you have a guilty conscience, DoRD. Anything critical of behavior in my comment was addressed specifically NOT to you, but rather to y'all. Look, I had what reason to think you were here to investigate impartially and had what reason to think that you intend to do a better job than the other investigators who have participated so far? For all I know, y'all are coordinating your responses on one of those infamous cabal listservs like wpinvestigations-l or some private IRC channel. I've got more than one editor hounding me. So your little lecture is a bit much. But because I AGF, I made sure that anything critical in my comment was addressed specifically NOT to you, but rather to y'all. Give me some credit for that, willya? And when y'all say the IPs are stale for blocking purposes, that rightfully pisses me off, because when I raised the issue of this sock, the IPs were not stale AT ALL. They had just ******* been used. And I see no definition of 'stale' other than the 90 day definition, written into policy, which hasn't come close to being reached, so calling 'em stale seems arbitrary. Do you wish y'all's actions to seem arbitrary; shouldn't stale be defined? You claim that WP:BLOCK says such IPs are stale for blocking purposes, but it says no such thing! If they're stale, it's cuz y'all didn't act in a timely manner. --Elvey^(t•c) 23:38, 9 January 2016 (UTC)

You say. "I am an experienced sockpuppetry investigator who is trying to understand what you're asking for." What portions of the presented evidence have you read in order to do that? What you have NOT done is said that you're what I'm seeking/looking/waiting for - "an admin willing to take decisive action to contain the sockpuppetry, even though the sock accounts I've found haven't been used recently," if the evidence is not weaker than I say it is. --Elvey^(t•c) 23:38, 9 January 2016 (UTC)

Elvey, I pinged you when I left a comment on the SPI page and again below. I don't know whether the pings aren't working.

Re: IP addresses, we're not supposed to block IPs for a long period in case they're not static. Even when they are static, the blocks tend to be short because people can easily change IPs and the new people using those IPs would find themselves unable to edit.

I do agree that this is a case of avoiding scrutiny. The same user has twice been challenged because of inaccurate or poorly presented material made with an account; subsequently abandoned those accounts; then returned to the same articles with IPs. See my post to the SPI page. SarahSV ^(talk) 23:56, 9 January 2016 (UTC)

• @Elvey: I now officially ask you to stop participating in WP:SPI. You are not welcome here any more. Your comments are full of insults towards other users who just wanted to understand you and to help. This is a huge waste of time. Vanjagenije (talk) 01:42, 10 January 2016 (UTC)

Query

Vanjagenije, I see you reverted my comment. [1] Where do you suggest I post it instead? It's not a new SPI, it's a comment that belongs in the most recent one. Mike V archived it on 23 December. Should it be unarchived? Pinging Elvey too. SarahSV ^(talk) 19:43, 8 January 2016 (UTC)

@SlimVirgin: Thank you for trying to help here. It is not allowed to edit archives for obvious reasons, but you can comment here. I am aware of all the information you written and am monitoring the situation. It seams to me that there is no ongoing disruption by this user. We will see how the situation develops. If you have any new information, feel free to post it here, or to open a new investigation on this user. Vanjagenije (talk) 01:49, 10 January 2016 (UTC)

Vanjagenije, thanks for the reply. I don't have new information that would require opening a new SPI, but perhaps the previous one ought to be unarchived, unless you feel that discussion here is sufficient. (I don't know what the rules are about that; the issue is making sure people in future will be able to find this.)

This user violates WP:SCRUTINY, editing in the interests of drug companies and switching names and IPs so that his edits can't be watched. He has acknowledged unplugging his modem to obtain new IPs, but the IP ranges and ISPs change too. His edits often involve removing negative material; this edit to Merck & Co is illustrative, as is this to Paroxetine. He also buries criticism within laboured, often technical, text. If reverted, he returns to make the same or similar edits months later as a different account/IP. If challenged about the IP/name switch, he says he was being harassed.

Some of the accounts/IPs I'm aware of (plus the IPv6s listed by Berean Hunter):

• Alfred Bertheim (Oct 2011 – March 2013)
• A Bertheim (Oct – Dec 2012)
• 98.155.21.76 (Oct 2013 – Jan 2014)
• Formerly 98 (Jan 2014 – May 2015

• (moved in May 2015 to Renamed user 51g7z61hz5af2azs6k6)

• 98.115.169.20 (March 2014)
• 50.113.65.200 (July 2014 – Sept 2015)
• 73.162.132.47 (Oct – Dec 2015)
• 169.230.155.132 (Oct – Nov 2015)
• 169.230.155.123 (Nov – Dec 2015)

Consideration ought to be given to reversing the vanishing, given that he continued to edit – anyone clicking on Formerly 98's contributions finds nothing, unless they know to click on the talk page. Pinging Xeno, who did the rename, and others who have commented: Berean Hunter, EllenCT, BoboMeowCat. SarahSV ^(talk) 05:32, 11 January 2016 (UTC)

@SlimVirgin: Can you provide a diff where he "has acknowledged unplugging his modem to obtain new IPs"? Vanjagenije (talk) 09:09, 11 January 2016 (UTC)

I'll post it here if I come across it. SarahSV ^(talk) 00:25, 12 January 2016 (UTC)

• @SlimVirgin: since the user is no longer using accounts to edit, does it matter if their previous account resides at Renamed user 51g7z61hz5af2azs6k6 instead of "Formerly 98"? When would anyone need to click special:Contributions/Formerly 98? If there are live links to that special page, couldn't they be updated to link to "Renamed user 51g7z61hz5af2azs6k6"? Since renames are now global, renames must be carefully considered. I'm not yet sure renaming an account that hasn't been used for over half a year is strictly necessary in this case. –xeno^talk 17:52, 11 January 2016 (UTC)

• @Xeno: would that not apply to everyone who vanishes and returns? Wikipedia:Courtesy vanishing: "If the user returns, the 'vanishing' will likely be fully reversed ..." He used the account a few days ago to say that, if he edits again, it will be with that account, then he asked that the posts be deleted; see his deleted user page. I don't know about the global aspect. The account was active only here that I can see. [2] SarahSV ^(talk) 00:37, 12 January 2016 (UTC)

• @Xeno: Actually, the user is now back. He re-registered his old username Formerly 98, so that now we have two accounts: Formerly 98 and Renamed user 51g7z61hz5af2azs6k6. I don't know why he's done that. Vanjagenije (talk) 00:46, 12 January 2016 (UTC)

• He re-created the account on 7 January 2016. [3] SarahSV ^(talk) 00:50, 12 January 2016 (UTC)

Break 1

I contacted Formerly 98/Renamed user 51g7z61hz5af2azs6k6 to see if they want to account to be renamed back and they advised me they no longer intend to edit. So I am disinclined to undo the rename, especially since it would now require at least two renames. Performing the rename doesn't seem like it would help to prevent any disruption (perceived or otherwise), and it would add stress onto the job queue as the former account has over 6000 edits. –xeno^talk 19:17, 13 January 2016 (UTC)

Xeno and Vanjagenije, this is a user with a history of contentious editing, suspicions of COI editing, and lots of conflict, much of it initiated by him as he sought to cause problems for other editors. Wikipedia:Courtesy vanishing says:

[Courtesy vanishing] is not intended to be temporary. It is not a way to avoid scrutiny or sanctions. It is not a fresh start and does not guarantee anonymity. Any of the deleted pages may be undeleted after a community discussion. If the user returns, the "vanishing" will likely be fully reversed, the old and new accounts will be linked, and any outstanding sanctions or restrictions will be resumed.

F98 continued to edit seamlessly after Xeno renamed him on 29 May 2015, turning up at the same articles to revert to material that had been opposed when he was F98. This is the very definition of avoiding scrutiny: "Using alternative accounts that are not fully and openly disclosed to split your editing history means that other editors may not be able to detect patterns in your contributions."

There are BLP issues too. Steven Nissen, for example, is a cardiologist who exposed some problems with Avandia, a GlaxoSmithKline (GSK) diabetes drug. F98 made clear with his edits that he favours the drug companies and the FDA (when the FDA is not acting in opposition to the companies). He edited that section of the GSK article in May 2014, adding inaccurate material and declining to supply a source when requested. After the rename, he returned to edit that section again as an IP. In November 2015 he went to Steven Nissen as 73.162.132.47 and gave the last word about the Avandia issue to the FDA. [4] That edit wasn't spotted because he has split his contributions.

He implied on 5 December 2015 that he was a new/unregistered user. When Elvey suggested he was avoiding scrutiny, he wrote as 169.230.155.123 (emphasis added): [5]

As for the IP addresses, I acknowledge responsibility for the 73, 169, and 2600 accounts. I am not a registered user (nor do the rules here require me to do so), so my edits will show up as whatever IP address I am at when I enter them. I have not attempted to deceive anyone or pretend to be multiple users.

The statement "I am not a registered user" was not correct. He had at least three registered accounts, and the Formerly 98 account was known as a contentious one. That statement alone was a violation of WP:SOCK. SarahSV ^(talk) 21:50, 14 January 2016 (UTC)

@SlimVirgin:

1. Please explain what do you think we should do with this user?
2. Please explain why did you remove overt the half of this page's content [6]? Vanjagenije (talk) 22:00, 14 January 2016 (UTC)

Vanjagenije, I've restored the page; I was section-editing (or thought I was).

As for what should happen now, the courtesy vanishing should be reversed, and he should be asked to stick to one account. He is a user who makes contentious edits; he didn't vanish but continued editing without even a break; he told another user that he had no registered account when he did; he recently re-created the vanished account; and he will almost certainly continue to edit in a way that avoids scrutiny. SarahSV ^(talk) 22:16, 14 January 2016 (UTC)

Nothing has vanished. Some edits were re-attributed at a user's request. The edits are still available for scrutinty and you haven't provided any reason why these edits need to be re-attributed against the user's desire. If they are violating editing guidelines, then seek administrative sanctions. Renames are now on a global scale and our outdated "courtesy vanishing" info page does not trump the global rename policy. If you can convince another bureaucrat this is necessary, then they can carry out this rename but I'm not prepared to do so against their will. –xeno^talk 01:47, 15 January 2016 (UTC)

Xeno, this would normally be an obvious case of socking and WP:SCRUTINY violations. Elvey gained the impression that the user is being protected in some way.

How does the global rename policy affect WP:VANISH? (If the latter is outdated, it should be fixed.) F98 only edited enwiki that I can see. The global rename policy permits a rename so long as:

*The old name is duly and visibly linked to the new name on any wiki where the user is active, or has a history of conflict or blocks.

*The user is not seeking the rename to conceal or obfuscate bad conduct.

When you renamed the F98 account, the user continued to be active, but the old and new accounts weren't linked. That's not to mention the history of conflict.

After Elvey opened the SPI, F98 re-registered his account, on 7 January 2016, and posted on his user page that he had been asked by an admin to list his accounts and IP addresses, and that he would again edit as F98 from now on. So someone, I assume Vanjagenije, did take Elvey's report seriously.

But F98 immediately asked that the page be deleted, so the information and his commitment to stick to one account have gone. Therefore, we are back to a situation where anyone wanting to search for his edits to fix the bias will have difficulty finding them, unless they know to look here. When people click on his contributions, they will find no edits and no indication that he has been renamed. How do you suggest we fix that, if not by reversing the rename? SarahSV ^(talk) 02:18, 15 January 2016 (UTC)

Who are these concerned users clicking that contributions page? All the edits are attributed to the new user name, complete with links to special:Contributions/Renamed user 51g7z61hz5af2azs6k6. Any patterns, etc. can be picked out from there. Is the user still editing? If there ongoing disruption? –xeno^talk 02:51, 15 January 2016 (UTC)

@SlimVirgin: This went unanswered. As far as I know, this individual is no longer editing the project. So ongoing discussion here seems a waste of time. –xeno^talk 17:07, 18 January 2016 (UTC)

WP:VANISH does need to be updated, probably marked historical. It was made a guideline one day (by you) without any discussion to do so as far as I can tell. See Wikipedia:Bureaucrats' noticeboard#About "courtesy vanishing" and unvanishing for more. I decline to rename the user against their will as is my right to not be compelled to use my toolset, especially one I hold not here but on meta. –xeno^talk 02:24, 15 January 2016 (UTC)

SV, the user requested the rename for privacy concerns, could we keep the specifics here and not a high traffic noticeboard? You can request independent review of this by emailing the crats mailing list or the Stewards. As I said, if someone else wants to pin their name to the "unvanish", I won't object. –xeno^talk 02:40, 15 January 2016 (UTC)

Xeno, I can't see what difference it makes where it is discussed. You were the one who raised the issue of WP:VANISH there.

I think F98 has perhaps persuaded you that he is being harassed, but I have seen him make these claims several times, and when you track down what he's referring to, it's just someone challenging his edits. I wonder whether you've become too close to this. I'm sorry to say that, but what is happening here is very time-consuming. SarahSV ^(talk) 02:52, 15 January 2016 (UTC)

Yes, so we can have a general discussion about this issue. Specifics are not required for a general discussion and I welcome your thoughts in general at BN. You have to understand that my ability to rename comes from meta, so I cannot push the rename button if I feel it is against the global rename policy. Which is why I think courtesy vanishing is out of date. –xeno^talk 02:56, 15 January 2016 (UTC)

I asked you above how this was against the global rename policy, but you didn't respond. Can you explain how? SarahSV ^(talk) 02:57, 15 January 2016 (UTC)

Because the policy does not allow for us to just go making renames on our own volition. They need to be on user request. –xeno^talk 02:58, 15 January 2016 (UTC)

But the request here is that you reverse a local rename, under VANISH. If the policy you did this under was the global rename policy, it has been violated. It says (repeated from above):

*The old name is duly and visibly linked to the new name on any wiki where the user is active, or has a history of conflict or blocks.

*The user is not seeking the rename to conceal or obfuscate bad conduct.

Even if you disagree about the second, the first did not pertain, and that's why I'm raising it. The user continued to be active, and recently re-registered his account. So what can you do to make sure "[t]he old name is duly and visibly linked to the new name"? SarahSV ^(talk) 03:04, 15 January 2016 (UTC)

Local renames no longer exist, all renames are global. There is a redirect from the old user talk page to the new one. They are linked. I could not have known the user would continue editing despite the guidance they do not. –xeno^talk 03:07, 15 January 2016 (UTC)

Xeno, you could have discovered the history of conflict, and you know now that they continued editing until a few days ago. Just because all renames are done in a different way technically doesn't mean that local guidelines don't apply. WP:VANISH is a strongly supported guideline so far as I know.

I don't want to give you the impression that I'm trying to force adherence to a rule for the sake of it. Your description on the noticeboard of reversing a rename to "punish" someone for not leavig assumes bad faith. The issue is that this user has whitewashed articles about drug companies. Please look at these edits: this edit to Merck & Co; this to Paroxetine. He removes lawsuits; removes and downplays adverse events; removes complaints; and undermines physicians who have made complaints to or about companies.

Because he has used several names and lots of IPs, the edits are not easy to find. They're also not easy to rectify because the issues are sometimes technical and require careful reading of the sources. Making his edits harder to find means fewer eyes on his work and therefore less chance of it ever being fixed. SarahSV ^(talk) 03:30, 15 January 2016 (UTC)

I asked for advise on crats and global renamers mailing lists. Usernames are now global, we cannot guarantee local control of usernames. Scrutiny may have to be achieved by pointing users at the new name. –xeno^talk 03:55, 15 January 2016 (UTC)

Xeno, thank you asking others for advice. Jytdog has posted below that F98 was outed, and if that's true, then of course I don't want to make difficulties for him. But against that, there are the issues I've outlined above and the likelihood that he'll continue to edit, so it all needs to be weighed up somehow. I realize that it isn't easy. SarahSV ^(talk) 04:19, 15 January 2016 (UTC)

So far two different Stewards have noted that because the names are still linked, forced renaming is not really warranted. You could email the stewards mailing list if you want to solicit further opinions. –xeno^talk 23:21, 15 January 2016 (UTC)

Break 2

For what it's worth, I've blocked the new Formerly 98 account. ​—DoRD (talk)​ 03:32, 15 January 2016 (UTC)

DoRD, thank you. That does help, because at least anyone looking at his contribs now will see something. SarahSV ^(talk) 03:41, 15 January 2016 (UTC)

• Since just sarah and elvey are weighing in here i will add my voice. Sarah has a different perspective on drugs and the pharmaceutical industry than the editor under discussion did. He almost single handedly rescued a bunch of drug articles from the very unNPOV spin that advocates had put on them. He was eventually outed off-wiki in a very ugly way by one of those advocates and his efforts to deal with that - some in-process and some out-of-process - have not gone well. I understand that he has been in email communication with some 'crats here. Sarah's disbelief of those 'crats representation of those discussions is a breach of AGF with regard to those 'crats and should be taken as such. I understand the validity of blocking the Formerly 98 account (which should not have been recreated in my view) but the claim that this is all urgent b/c Formerly's edits need to be "fixed" is... meh. Jytdog (talk) 04:01, 15 January 2016 (UTC)

• Jytdog and Formerly 98 worked very closely together. This is not simply a question of "different perspective." I've given two examples above (03:30, 15 January 2016) of the kind of edits I'm referring to, and there are hundreds more like them. Jytdog, how would you defend those two edits?

I'm sorry to hear that Formerly was outed, if that happened. But it obviously didn't bother him enough to stay away, or not to re-create his account. And it's a separate issue from the edits, many of which really were problematic by any standard. SarahSV ^(talk) 04:11, 15 January 2016 (UTC)

Sarah I could cherrypick any number of your edits and hold them up as being problematic. I think I made it clear that i think Formerly did a lot of great work. Nobody is perfect - not him, not you, not me. Yes some of his edits (and yours and mine) are questionable. Yes, we worked closely together on some articles but we each did our own thing here and had our own interests. And yes, my view on drugs and pharma is more like Formerly's than like yours, and you too have expressed "concerns" that i am shill and you have in the past, and continue today, to allow people to vilify me on your own Talk page.

Sarah - again - he was in a very awkward situation being outed off-Wiki, that Wikipedia is not well equipped to handle. Something I would think you in particular would be sympathetic to, having been through something similar yourself. Instead you are on a full-court press here. Btw, please do provide a diff that he bragged about changing IPs or strike that. You cannot make those kinds of claims here and wave off requests from 'crats for diffs. Jytdog (talk) 14:38, 15 January 2016 (UTC)

• Just an outside point of view from someone who does a lot of RTVs. The local policy on WP:VANISH is now fairly redundant, as renaming is global and affects every project. There's even a "Global" right to vanish policy meta:Right to vanish, which is the policy that any global renamer should be following when doing a RTV today. More than this though, because renaming is global, the new way things are handled are at a clerical level globally and an administrative level locally. To draw a parallel, locally, we have a policy that you cannot have a business name as an account name, whereas globally, there is no such policy and on some projects (Wikivoyage, I think?) it is actively encouraged. In that case, global renamers will allow a business name, and expect local administrators to deal with it (i.e. block) if the new name violates the local policy.
  I'm afraid Xeno's position is going to be fairly standard across global renamers - that a rename should not be done in this case - against the wishes of the user in question. Instead, it should be handled at an administrative level locally. If the individual is editting while logged out, thereby evading scrutiny, that should be handled as it would any other user doing so. Worm^TT(talk) 11:29, 15 January 2016 (UTC)

Break 3

@Worm That Turned: there are separate issues here: the policy and the sustained advocacy.SarahSV ^(talk) 23:36, 15 January 2016 (UTC)

Renaming policy

I can't see any indication that meta:Right to vanish (created in 2005) is a policy or that it has superceded WP:VANISH. The policy is meta:Global rename policy. It says that accounts may be renamed so long as (a) the "old name is duly and visibly linked to the new name on any wiki where the user is active, or has a history of conflict or blocks," and (b) the user "is not seeking the rename to conceal or obfuscate bad conduct."

Both conditions were arguably violated in this case. When it became known that the user was still active, the accounts should have been linked. And the history of conflict was easy to find.

So, two points:

(a) To what extent does the global policy supercede and clash with VANISH, and (if it clashes) what kind of local consensus is required in relation to VANISH's status?; and

(b) Xeno says the global policy won't allow renames to be reversed without the consent of the user. But the implication of listing conditions on the policy page would surely include that, if the conditions are breached, the rename can be reversed.

Local consensus would be required to decide that vanishings can't be undone from now on, even if the user returns with the same behaviour to the same articles. SarahSV ^(talk) 23:36, 15 January 2016 (UTC)

This is indeed the key issue for this board. The situation is awkward and I hope that the community can figure out a reasonable way to deal with the issues that: a) a user was outed off-wiki and so sought protection via a rename/vanish whatever was possible here (I don't know that he fully understood the options... I really don't know); b) that same user wanted to continue editing in the same topics (otherwise the jerks who outed him "win"); c) that same user edited while logged out, not hiding that he was editing from different IP addresses; d) that same user has antagonists here in WP who feel the need to "track" him and argue about things; e) somehow in the midst of all this the old account was re-created (it has now been blocked which I ~think~ is good). All that is very messy. Again, unclear to me what the right out come here is. But as far as I know there is no reason to think that he was trying to evade scrutiny within WP; he dealt with objections to his edits as they came, before he was outed off-wiki, as far as I know. Jytdog (talk) 23:53, 15 January 2016 (UTC)

I'll add that in the dif that Sarah cites below, and in that whole thread, the user is clearly trying to figure out what the best way forward is, and is not hiding what he has been doing. Jytdog (talk) 00:05, 16 January 2016 (UTC)

I don't think so. On 5 December 2015 he wrote, as an IP: "I am not a registered user (nor do the rules here require me to do so) ..." [7] But at that point he had three known accounts. SarahSV ^(talk) 00:15, 16 January 2016 (UTC)

Wow. When I said he was "not trying to evade scrutiny within WP" I meant "not hiding that he was the same person editing from different IP addresses." He was clearly trying to avoid any connection to Formerly or the Renamed account in his edits due to the off-wiki outing. (Again, before he was outed I am unaware of him ever editing from an IP address) But in that dif he clearly denies that he has an account; I didn't know that he had ever come out and said something like that and I reckon that that dif is a violation of SOCK at minimum. But this all starts with him trying to deal with being outed off-wiki and not dealing well (at all) with WP PAG about accounts and editing. A quick note - above you noted the following dates:

Formerly 98 (Jan 2014 – May 2015

(moved in May 2015 to Renamed user 51g7z61hz5af2azs6k6)

If I look at Special:Contributions/Renamed_user_51g7z61hz5af2azs6k6 that account shows no contribs after May 26 2015. If I look at Special:Contributions/Formerly_98 there are no contributions. It appears that the "renamed" account was still "live" in December but he just stopped using it in May- had abandoned it. So that is one account. I don't know what third account you might be referencing. Jytdog (talk) 00:54, 16 January 2016 (UTC)

• What happened here is pretty clear. The questions are (outside of the clear SOCK violation above):
  • If a user is outed off-wiki, is it OK for that user to abandon their account and continue editing as they were before, un-logged in?

One could say "hell no" as that ends up being SOCKing within Wikipedia, and other editors can become very concerned about avoiding scrutiny as happened here.... and especially so if the person explicitly denies a connection to the old account.

One could also say that WP can accommodate a person walking away from their account, in these circumstances, even though it will be messy going forward.

• • if the answer is "no" and I see why it should be, what to do?

One answer would be to indef the Renamed account with standard provisions, and if Formerly wants to come back he would have to petition at the Admin notice board, and any future IP edits could be reverted per REVERTBAN.

The other would be for the 'crats to make Formerly a final clarification - if he wants to edit in his former subject matter he needs to do it logged in and have him promise to stop editing from IP addresses - the latter is not a viable option. From that day on, editing under an IP address would be indef-able.

In my view the second is most humane but the judgement is not mine to make.

• • If the answer is "yes" then I don't know what that means. That would be a strange WP world but this place has many strange corners. I reckon at a minimum there would need to be a note left on the Renamed account user page saying that the account has been abandoned and the editor is now editing under an IP address for privacy reasons and that would have to be signed by a 'crat. And the editor editing from the IP address would have to not lie about never having had an account. There would be many complications going down this road. I don't know that it is really viable. Jytdog (talk) 01:23, 16 January 2016 (UTC)

If a person has been outed, how does it help them to have an account renamed; to continue editing logged out (thereby exposing several IP addresses); to return to the same articles with the same kinds of edits; then recreate the renamed account and post the IPs on the user page? That is making no sense to me. SarahSV ^(talk) 01:25, 16 January 2016 (UTC)

It would have been fine if it hadn't been for you and elvey going full court press out of bad faith paranoia. The assholes who outed him win - there is no good way to resolve this situation in the face of what you and elvey have been doing - you have left no room to accomodate and have framed Formerly like some of the really crazy and deleterious people who have come through WP.. Formerly is probably just going to walk away and stop contributing. (and by the way, Steven Nissen who is one of the great medical whistleblowers of our day, said in Dec 2015 that Valsartan/sacubitril clinical results were the 2015 research that had the greatest impact on clinical practice, and called the drug "a truly a breakthrough approach." But i guess you know better than even him.) I am done here Jytdog (talk) 01:53, 16 January 2016 (UTC)

Advocacy

Jytdog accuses me above of cherry-picking. It is worth looking at Valsartan/sacubitril, which is the article that brought the socking to Elvey's attention. This is a new drug developed by Novartis to treat heart failure, and all the edits are fairly recent, so this is not digging into ancient history.

F98 edited the article and talk page in 2014 as Formerly 98, then after the May 2015 rename as 50.113.65.200, 2600:1010:b043:ec75:efad:9d0c:d710:2720 (and others in the range), 169.230.155.123, and 73.162.132.47.

He gave the impression that he had never registered an account. On 5 December 2015 he wrote as 169.230.155.123 on Talk:Valsartan/sacubitril: "I am not a registered user (nor do the rules here require me to do so) ...". [8] Three days later during the SPI, before Elvey realized that the IPs were F98, Vanjagenije suggested to 73.162.132.47 that he open an account. He replied: "I am curious as to the conditions that would pertain if I were to register," as though he had never had an account. [9]

Nbauman complained in 2014 that the article was too promotional. For an example of what transpired there, Nbauman added text in September 2014 about an article by a physician in the BMJ. The physician complained that a Novartis clinical trial that appeared to show positive results for the drug "is a perfect example of everything that is wrong with heart failure trials." He argued that the clinical trial had been designed and conducted to produce a more positive result. (That drug companies do this is a widely acknowledged problem in medicine.)

Nbauman added that text to the article. [10] Formerly 98 reverted 11 minutes later. [11] It was not until December 2015 that Elvey was able to restore the BMJ text to the article. [12] (This is just one example of what happened there.)

Because Nbauman was expressing concern that the article was promotional, Jytdog arrived at Nbauman's page to complain about him. The exchange is here and is worth reading in its entirety.

Vanjagenije, would you consider allowing Elvey to post here again? I tried to reply to Xeno at the BN, so that we could involve others, but Xeno reverted. [13] Elvey has done the legwork to uncover this, so it seems unfair that he can't comment. We could ask him not to discuss blocking IP addresses if that would help. SarahSV ^(talk) 23:36, 15 January 2016 (UTC)

@Jytdog: Absolutely not. Elvey was very disruptive and I am sure that his participation would only make things worse. Vanjagenije (talk) 01:52, 16 January 2016 (UTC)

Vanjagenije it was sarah who asked that, not me. Jytdog (talk) 01:59, 16 January 2016 (UTC)

Sorry, pinging @SlimVirgin:. Vanjagenije (talk) 02:01, 16 January 2016 (UTC)

I am not going to litigate your and Nbauman's anti-drug POV pushing here. I just wanted to make sure the 'crats working here understood that what you are saying is your POV and try to focus things on the issues at hand about vanishing etc. Jytdog (talk) 23:48, 15 January 2016 (UTC)

Jytdog and F98 regularly accused people who challenged them of anti-drug advocacy. Anyone examining the history of Valsartan/sacubitril and its talk page (and the discussions about it elsewhere) will see that it's not true. Nbauman's concern was that the article was promotional. He wrote on talk in September 2014 "don't be too promotional" and to F98 "... this is unacceptable. You're blanking out all the criticism." The article history shows F98 doing just that.

This article is just one example of a situation that affected a large number of articles about the pharmaceutical industry, which is why allowing F98 to vanish, but not really, is troubling. SarahSV ^(talk) 00:10, 16 January 2016 (UTC)

I am anyone and I saw F98 correcting POV-pushing. But this is all a distraction. You have made it clear that you want to be able to track Formerly, and everybody gets that. It is a dead horse by now. Jytdog (talk) 00:13, 16 January 2016 (UTC)

Extra note here: F98 wrote the following in this note: " am particularly concerned about this article because it is a drug that has been shown to extend life by a year or more, and if we present an unrealistically negative view of it, some may read the article and stop their medication. I believe the material in the Controversy section in particular mis-represents the conclusions of the study cited, and I'd really appreciate it if you would give the source a careful read before reverting me again. According to the Page summary here http://stats.grok.se/en/latest/Valsartan/sacubitril, over 150 people a day view this article, and I believe that our work here has real consequences in people's lives." That is where he was coming from, and he wrote that kind of thing many times. There is a valid argument, good faith argument that is very different from conspiratorial shilling for the pharma industry. Jytdog (talk) 00:30, 16 January 2016 (UTC)

@Jytdog and SlimVirgin: This discussion seems to be heading well off-topic. If you wish to discuss anything other than the Formerly 98 SPI, please do so elsewhere. Thank you. ​—DoRD (talk)​ 02:34, 16 January 2016 (UTC)

I agree DoRD. Here is SlimVirgin attempting to attract a like-minded pharma-skeptical editor to this discussion and trying to amplify yet more, the off-topic discussion. Jytdog (talk) 20:48, 17 January 2016 (UTC)

@Jytdog, "attempting to attract a like-minded pharma-skeptical editor" - where did you get this idea? What do you mean? I have no idea. But if Formerly is a sock, we've argued plenty of times and I'd like to know it. That seems fair to me. Gandydancer (talk) 16:34, 18 January 2016 (UTC)

I got that idea from what you wrote and what SlimVirgin wrote back to you, which flies in the face of the admonition above. This case is about Formerly's abandonment of his named accounts and moving to editing as an IP. He did that due to being outed off-wiki in a forum that he believes puts him and his family in danger. I will say no more about that on-wiki. He was not socking while he was editing as Formerly as far as I know and no diffs have been brought to show that. (he did however have 2 older accounts that he had used and abandoned as Slim notes away above. As far as I know he did not use any of those three accounts simultaneously) None of his accounts was ever blocked - there was no trying to evade scrutiny as far as I can see. He did make one overt statement recently as an IP that he had no account, that he told me is based on an understanding of VANISH that he now knows was incorrect. But the statement is not OK per VANISH and for that he is pretty much dead meat SOCK wise now, unless the community cuts him some slack. But Slim has him in a corner especially due to that statement, and is pushing her advantage as hard as she can; she is very adept at wiki in-fighting. It is a shame that the assholes who outed him are succeeding in driving him off Wikipedia - it is clear in PAG that you cannot abandon an account and deny you had one if you are asked directly, and so there is no way he can be present here in a way that he can cut ties with his old identity for people looking in from the outside who might want to harm him, and at the same time be consistent for editors he interacts with on-wiki. I am not sure why I answered you, as you will probably cite this response and twist it somehow as you have done to me in the past as i tried to discuss with you here. But I give you the basic courtesy of an answer, yet again. Jytdog (talk) 16:51, 18 January 2016 (UTC)

Oh brother. Once again Jytdog so nice and Gandy such a meanie. Must you always stoop to this sort of drama. I have no interest in all this background and just wondered if he was socking. Gandydancer (talk) 03:18, 19 January 2016 (UTC)

btw none of this matters going forward; he told me he intends not to edit anymore as there is no way he can do that in compliance with PAG and be safe with regard to the outing. Jytdog (talk) 21:57, 18 January 2016 (UTC)

I disagree that none of this matters. What bothers me about allowing F98 to change his name over and over is that for me, there was no way to make good on my promise to him. I promised to bring this evidence (bullet points in top section) to the proper venue in order to address his pro-pharma advocacy. F98 will remember that in one of the last ANI's he participated in as F98, he ordered me to discontinue objecting to his bias, unless I took my complaints to a formal noticeboard. I promised him that I would, but then he disappeared, as far as I knew. I added this detail in case the admins wanted to look at how this system is, or is not, operating. Thanks, petrarchan47คุก 05:09, 19 January 2016 (UTC)

Elvey's tagging and case creation

Vanjagenije, above you wrote to Elvey: "I now officially ask you to stop participating in WP:SPI. You are not welcome here any more. Your comments are full of insults towards other users who just wanted to understand you and to help. This is a huge waste of time."

Since then, related to this case, Elvey -

• placed Sock templates or notes as follows
  • Formerly 98/Renamed placed a Sock template on the user page and templated the Renamed talk page
  • A Bernheim account templated the user page and left a note on the Talk page
• created an SPI case for Formerly 98 somehow without going through the main page, see here and the creation of the Talk page here

Additionally I don't know if any of this in-process or out-of-process. Jytdog (talk) 15:51, 17 January 2016 (UTC)

@Jytdog: Thanks, I reverted most of those edits, they are really disruptive. He created SPI case for Formerly 98 as a redirect to this case, so of course it was not shown on the main page, it does not show redirects. What was the purpose of that redirect is a mystery to me, so I deleted it. Vanjagenije (talk) 17:40, 17 January 2016 (UTC)