Wikipedia talk:Sockpuppet investigations/SPI/CheckUser criteria

Review of letter codes

With SPI coming online shortly, if the letter codes can be improved this would be an ideal time to do it. Some of the old codes could possibly be improved, for example having 2 codes for evasion depending whose ban was evaded, and no code for long term suspected disruptive conduct might be improved. The changes are

• Removed: IP check (redundant under SPI)
• Updated: 3RR violation with socks, becomes 3RR or any other policy
• Updated: Arb remedies are either closed or temporary injunctions
• Merged: All types of restrictions, bans, etc
• Added: Long term pattern of abusive or disruptive editing
• Added: Ongoing pattern of editing as account and also logged out, defeating scrutiny
• Added: Likelihood of additional undetected issues in a serious case

Possible new schema:

When it might be appropriate to request Checkuser CURRENT

When it might be appropriate to request Checkuser PROPOSED

A - redundant under SPI B - Evasion of bans or other remedies issued by the arbitration committee (closed cases only) C - Ongoing, serious pattern vandalism involving dozens of incidents D - Vote fraud for a closed vote where the possible sockpuppet votes affect the outcome E - 3RR violation using socks F - Evasion of community-based bans or blocks G - Request doesn't fit any of the criteria but you believe a check is warranted anyway

A - Long term pattern of abusive or disruptive editing using socks (stacking discussions, edit warring, etc) B - Evasion of block, bans, and other formal editing restrictions. (For Arbitration Committee sanctions, this must be a closed case or a passed temporary injunction only) C - Evasion of 3RR or other requirements imposed by policies and guidelines, using sock-puppets D - Ongoing, serious vandalism involving dozens of incidents or multiple socks E - Ongoing pattern of editing as an account and also logged out, reducing scrutiny F - Vote fraud for a closed vote where the possible sockpuppet votes affect the outcome G - Likelihood of additional undetected issues in a serious SPI case H - Request doesn't fit any of the criteria but you believe a check is warranted anyway

Thoughts? FT2 ^{(Talk | email)} 18:50, 12 January 2009 (UTC)

Firstly, a couple of wording changes. If you don't like "evading" in E, "avoiding" or "attempting to avoid" is better, I think, than "reducing". In G, it needs to be clear what "case" means -- it should be unambiguously a reference to an SPI case.

Secondly, I don't understand the rationale for the change from "dozens of incidents" in the old C to "dozens of incidents or multiple socks" in the new D. Would this alter practice in any way, and, if not, what is the purpose of the change?

Thirdly, in the new C, it needs to be clear that a reasonable suspicion of sockpuppetry must be present to justify a check -- the current wording could suggest that someone breaking WP:NPA, for instance, is open to a checkuser inquiry. What policies do you envision being cited under this code?

Otherwise, your changes are definitely good ones. [[Sam Korn]] ^(smoddy) 19:52, 12 January 2009 (UTC)

I agree with Sam about G. One other thing is that it looks like several of the letters now thematically match the reason (A for Abuse, F for vote Fraud, and D for Dozens of incidents (that's a bit more of a stretch)). I would suggest make ALL the letters mnemonic, and don't worry about keeping them A-H... just use whichever letters fit best and don't worry about gaps. That is, for example make the current D be "V" for Vandalism, and so on. ++Lar: t/c 21:14, 12 January 2009 (UTC)

Quick comments:

1/ I hadn't spotted the mnemonics. And "B" for bans and blocks as well? Looks good. 2/ The reason for "reducing" is AGF - we don't know they are trying to evade, we do know they keep editing logged out and its a problem for scrutiny and may be evasive. Hesitant to assume. On that basis can you suggest a better wording? ("Apparent/possible evasion"?). 3/ As for other policies, not sure, but if any policy says "don't do X" and they use socks so they can get away with "X", that's what that one would be for. 3RR is the main example, I'm sure there could be others though. This one might need rewording to stop it being overused. Ideas? 4/ "Or multiple socks", ongoing serious vandalism being 10 incidents with 5 different socks isn't "dozens of incidents", but I'd say CU might well be called for. Once they're using 3 or more socks then the odds might be larger they will use others, there's a definite pattern of sock use. (Change to "...or at least 3 socks..."? Or "vandalism... with a confirmed pattern of sock use"?) 5/ Wording fixes added to G and C.

FT2 ^{(Talk | email)} 21:27, 12 January 2009 (UTC)

1) Mnemonics would help me -- the main reason I don't look at the code letter is that it inevitably means I have to go to the top of the page to get a reminder of what they mean! I think they are important as they make people ask what the justification for the check really is, forcing them to spell it out properly.

2) AGF would mean going to the user concerned and asking them directly. If they deny it, then you can genuinely say they are attempting to evade scrutiny. It's not crucial, so I'm happy with "reducing" if you think it's valuable.

3) I think most policy violations would be covered under A -- 3RR seems like a specific example that can be mentioned separately because it's likely to come up fairly often. I don't think this is a necessary change -- but if it is I think it would more happily fit with A.

4) I like "Ongoing, serious vandalism involving multiple sock-puppets" -- I agree that demanding "dozens" of incidents is unnecessary, but I think it is less confusing if we just ask for evidence of significant numbers of accounts. In fact, that might be a decent wording, "ongoing, serious vandalism involving a significant number of accounts".

[[Sam Korn]] ^(smoddy) 00:05, 13 January 2009 (UTC)

2) Unsure best wording, will think. How about "Ongoing pattern of editing as an account and also logged out, in a manner impeding scrutiny; previously warned or asked to edit logged-in by an admin."? The reason for the last part being that they have been asked to stop and still seem to be continuing, so now it's likely a valid reason for formally checking (eg prior to action or WP:DR).

3) Reworded to "Evasion of 3RR or other requirements imposed by policies and guidelines, using sock-puppets" - any better? What about "...or other bright lines imposed by..." or "...other forbidden behaviors imposed by..."

4) "...or IPs"?

What about harassment and canvassing? FT2 ^{(Talk | email)} 01:33, 13 January 2009 (UTC)

Why are we still using this silly system? Code letters make us look more ridiculous than usual, frankly. "Quick, he's socking and I think it's a code E!!1" Is there some sort of detriment to plain English that I'm missing? --MZMcBride (talk) 17:29, 17 January 2009 (UTC)

It forces someone asking for a CU to be run to think about why it needs to be run and what evidence they need to provide. Specific categories are useful (even while we acknowledge that they are not comprehensive) to help us to avoid tagging every other request with  Additional information needed or  Declined. Whether it needs to be a code letter, I for one couldn't care less. The existence of categories, however, is for me quite an important thing. [[Sam Korn]] ^(smoddy) 17:46, 17 January 2009 (UTC)

Another cut

Taking the above comments on board, here's another cut at the code letters

When it might be appropriate to request Checkuser PROPOSED v.2

A - ABUSE - Long term pattern of (A)busive or disruptive editing using socks (stacking discussions, edit warring, etc) B - BLOCK/BAN/RESTRICTION - Evasion of (B)locks, bans, and other formal editing restrictions. (For Arbitration Committee sanctions, this must be a closed case or a passed temporary injunction only) C - CLOSED !VOTES - Socking of RFA, AFD, or other (C)losed votes and similar formal consensus seeking, that may have affected the final outcome. (Once the vote has been closed) P - POLICY EVASION - using sock-puppets for 3RR, attacks on other editors, and other serious or persistent violations of (P)olicies and guidelines S - SCRUTINY - Ongoing pattern of editing as an account and also logged out, despite admin warning, or "good hand, bad hand" editing, reducing (S)crutiny U - UNDECTECTED ISSUES - Likelihood of additional (U)ndetected issues in a serious SPI case V - VANDALISM - Ongoing, serious (V)andalism involving multiple (3+) socks ? or X - Request doesn't fit any of the criteria, but you believe a check is warranted anyway (MUST explain why)

This is just quick/dirty, please feel free to refactor/edit as needed of course. ++Lar: t/c 18:45, 13 January 2009 (UTC)

Note - updated - FT2 ^{(Talk | email)} 05:18, 17 January 2009 (UTC)

I'd suggest 'Z' instead of 'M', if only because we're unlikely to ever come up with another reason for checkuser that uses 'Z', but its plausible we'll come up with another 'M' reason in the future. A 'Z' also sticks out as a special sort of case, as it's such an uncommon letter otherwise. Other than this very minor thing, the above list looks pretty good! Lankiveil ^{(speak to me)} 02:51, 17 January 2009 (UTC).

• I was thinking "?" (since 'letter' doesn't have to be an actual alphabetic character), or "O" (Other), or "X" (if "O" confuses with zero).
• I'd change the 3rd to "P - POLICY EVASION - using sock-puppets for 3RR, ongoing attacks on other editors, and other serious or persistent violations of (P)olicies and guidelines".
• Edit (S): "...and also logged out despite formal warning, reducing scrutiny."

FT2 ^{(Talk | email)} 03:32, 17 January 2009 (UTC)

'?' or 'X' would probably be okay, but 'O', as you said, looks a little too much like a zero. Lankiveil ^{(speak to me)} 04:07, 17 January 2009 (UTC).

Current proposal

Updated for these. Thoughts now? FT2 ^{(Talk | email)} 05:18, 17 January 2009 (UTC)

When it might be appropriate to request Checkuser (including code letters) v.2
Code letter		Situation	Notes	Evidence required Show why they are probably the same user, and...
A	ABUSE	Long term pattern of likely (A)busive or disruptive editing, using socks.	Stacking editor discussions, edit warring, pov warring, "gaming the system", frustrating consensus and other communal processes, etc, using socks.	Relevant diffs showing the behavior.
B	BLOCK/BAN/ RESTRICTION	Evasion of (B)locks, bans, and other formal editing restrictions.	For Arbitration Committee sanctions, this must be a closed case or a passed temporary injunction only.	Link to the case or other formal notice, and for restrictions only, evidence of breach.
C	CLOSED !VOTES	Socking of RFA, AFD, or other (C)losed votes and other formal consensus seeking exercises, that may have affected the final outcome.	Only after the vote has been closed. (For most votes in progress, communal discussion on the relevant talk page is usually more appropriate.)	Link to the closed vote.
P	POLICY EVASION	Using sock-puppets for 3RR, attacks on other editors, and other violations of (P)olicies and guidelines		The policy or guideline evaded and relevant diffs.
S	SCRUTINY	Ongoing pattern of editing as an account and also logged out, despite admin warning, or "good hand, bad hand" editing, reducing (S)crutiny		Relevant diffs.
U	UNDETECTED ISSUES	Likelihood of additional (U)ndetected issues in a serious SPI case		Explanation (provide by email if there is a risk of WP:BEANS)
V	VANDALISM	Ongoing or repeat (V)andalism involving multiple (3+) socks, where revert, block, ignore alone is not likely to be enough	See Wikipedia:Vandalism:- what is vandalism and what is not. Typical uses include: persistent and prolific vandals; serious cases such as "sneaky" vandalism; past use of sleepers; blocking of underlying IP, etc.	Relevant diffs.
X	OTHER	Request doesn't fit any of the criteria, but you believe a check is warranted anyway.		Explanation why Checkuser is applicable, and diffs or other evidence of the problem.

What's the difference between Abuse and Vandalism here? -- lucasbfr ^talk 13:43, 17 January 2009 (UTC)

Vandalism would usually be blatant obvious stuff. A user blanking pages, altering dates, posting "...is gay", whatever. Non-editors vandalizing. Abuse would be more akin to edit warring with socks, suspicions that an editor is routinely skewing content discussions on "their topic" with socks, etc -- "done by an editor who is part of the community but is using socks to get away with bad/disruptive editor conduct" rather than "done by a vandal who apparently isn't part of the community and is just posting junk on articles". See Wikipedia:Vandalism#What is not vandalism.

FT2 ^{(Talk | email)} 14:17, 18 January 2009 (UTC)

Looks fine to me. -- lucasbfr ^talk 14:50, 21 January 2009 (UTC)

Are you guys going to use this new set or what? —— nixeagle^{email me} 14:05, 11 February 2009 (UTC)

I think B for BAN would be better remembered as E for EVASION, as that is the reason for the check. John Vandenberg ^(chat) 09:46, 26 February 2009 (UTC)

I see your point, John, although not everyone is banned - it's probably more correct to state that they're indefinitely blocked + Evading it - Alison ^❤ 03:56, 28 February 2009 (UTC)