User:Scarian/How to catch socks

Advice on how to investigate sock puppetry.

Introduction

Ever since I first came to Wikipedia I've been involved in discovering sockpuppets. Together with Enigmaman, I cleared out handfuls of 40+ case backlogs and uncovered dozens of sock farms. It's one of the most undermanned areas of Wikipedia and is in desperate need of support, which is why I've composed this essay to make it easier for users and admins to become more involved.

Step One

Look for the obvious traits

• Usernames - Example: User:Wiki Alf and User:Wiki alf. You should notice key similarities like these instantly (hopefully, at least, otherwise, see: glasses).
• Content - Do they edit the same articles? Or same topic? Same talk pages? Use this handy tool for a quick look at what pages they've edited in common.
• Edit summaries - Do they use edit summaries? (i.e. There's a big difference between a user that occasionally uses them, in comparison to a user that never uses them)
• Age of account - New account suddenly agreeing with another editor on a talk page? However, be aware that it could be an IP that had been watching the discussion and then decided to make an account.
• Matching edits - Another obvious sign but it needs to fit specific criteria. For example it's not recommended to base suspicions on the fact that both of them revert vandalism. They would need to be identical preference edits (e.g. inserting commas in specific places).

Step Two

Intermediate detections

• Deleted contributions - Any admin should check and compare these as they can be a dead giveaway for specific articles/files/whatever that the socks have edited in tandem.
• Matching edit summaries - If you already have suspicions about a particular user and their alleged sockpuppet is using the same specific edit summaries; then this may give you strong supporting evidence (e.g. both use semi-unique edit summaries such as "oops", "rmvd", "comm.").
• Time zones - Checking this is important. At what times of day do the users in question edit? There are several tools you can use to see when each account generally edits (add a monobook script, for example).

Step Three

Advanced advice

• Dialect/Idiolect - This can be a way to reaffirm already aroused suspicions. More often than not, editors will often bring their colloquial spellings/sayings/whatever from speech to writing.
• Spelling errors/variations - Related to the above; whilst these cannot prove anything definitively, they can still be of immense aid. In the case of the notorious sock master Be Black Hole Sun; he would often make elementary English spelling errors (e.g. "cair" instead of "care") that would give the game away. In the case of nationality, looking at the differences between British English and American English can be helpful i.e. One suspected sock uses British English but the other doesn't?
• Watch for intentional deception - Whilst you must use your intuition for this one, as there is no guaranteed specific way of detecting it, you must always be on your guard. For example, the user claims to not know of a well-known policy (e.g. WP:CIVIL); but is [somehow] aware of a more obscure one (e.g. WP:MOSHEAD)?

At the end of the day...

Your evidence could be strong enough to go ahead and block your suspect socks straight away. If it's just suspicious at best, do not hesitate to contact a check user, or another user, for extra guidance. The last thing you want is a complete miss fire.
A worst case scenario would be if you completely miss and your two (or more) suspects end up being in different countries. This is not a big deal; you've cleared two people of wrongdoing and allowed them to continue contributing to this encyclopaedia.

See also

• Sockpuppet investigations
• SPI instructions