Wikipedia talk:Sockpuppet investigations

Possible sock; unknown sockmaster

I have seen a new account, asking how to edit while blocked. How may I report this, when I don't know the suspected sockmaster? Andy Mabbett (Pigsonthewing); Talk to Andy; Andy's edits 16:25, 25 September 2024 (UTC)

And the account is?--Bbb23 (talk) 16:39, 25 September 2024 (UTC)

Is your answer to my question that the correct way to report this is to post about the account here? Andy Mabbett (Pigsonthewing); Talk to Andy; Andy's edits 16:47, 25 September 2024 (UTC)

Case merge

Please perform a case merge on Wikipedia:Sockpuppet investigations/Vzhodna asirska cerkev SURYOYO SAT with Wikipedia:Sockpuppet investigations/Piermark as it is an obvious duck as well as confirmed on slwiki by a CU. Thanks, A09|(talk) 19:52, 25 September 2024 (UTC)

Minimum requirements

I would like to have a better understanding of the minimum requirements for an SPI report. For example, the SPI page says, "Before opening an investigation, you need good reason to suspect sockpuppetry".

• A. What if the reason to suspect sockpuppetry or ban evasion is an apparent inconsistency between an account's revision count (across all wiki sites) and their experience level?
• B. What if, in addition to A, the account heads straight for a contentious topic area where ban evasion is relatively common?
• C. What if, in addition to A & B, there is evidence of source misrepresentation, bias/POV pushing, features associated with ban evasion, to the extent that the account is reported at AE?

Sean.hoyland (talk) 14:48, 28 September 2024 (UTC)

There's no perfect answer to these questions, but here's my take:

• A: See WP:PRECOCIOUS.
• B: Lots of new people head straight to contentious topics. People edit what they are interested in.
• C: Lots of people involved in editing contentious topics share biases. That doesn't make them socks.

These things are all just clues, and there's no easy way to define an algorithm for how many clues have to line up before your sock-o-meter buzzes. RoySmith (talk) 15:09, 28 September 2024 (UTC)

I agree with your views on B and C. They shouldn't have a significant impact on the sock-o-meter reading because within a contentious topic area those things are not really any more common among socks than non-socks, as far as I can tell anyway. So, let's say it's just A, but with the additional constraint that information provided by the user rules out the caveats in paragraph 2 of WP:PRECOCIOUS, what then? What I'm trying to get a better understanding of is the location of the boundary between reports that will trigger investigation and reports that won't. I know it must exist, it might have a fuzzy border zone, it might be different for every SPI clerk and checkuser, but it recently dawned on me (having filed numerous SPI reports in the past) that I really have no idea where that lower bound actually is. At the same time, I see numerous accounts that I would checkuser without hesitation if I could because the chance that ban evasion is involved is substantially higher than zero. So, I find myself in a kind of no-man's-land between ignoring potential ban evasion and reporting it...somehow, with an intractable cost vs benefit question I don't know how to answer.

Another question I have been thinking about is how best to present article intersection evidence when the objective is to justify a checkuser? Presenting lots of intersections is apparently not enough when accounts have made lots of edits and/or intersections are at non-obscure/popular-ish articles it seems. It should be possible, in principle at least, to write down a function that computes an importance score for each intersection based on...some things. What should they be is the question. I guess the score would be proportional to some things like number of edits at intersecting articles and inversely proportional to other things like user edit count, number of unique articles edited, per article revision counts, pageviews etc...or at least some way to rank the significance of intersections to boost signal over noise for SPI clerks to increase the chance of checkuser usage being approved. Sean.hoyland (talk) 16:22, 28 September 2024 (UTC)

It should be possible, in principle at least, to write down a function that computes an importance score for each intersection based on...some things. This is what machine learning is all about. Lots of very smart (and well-funded) people have been working on the general problem of machine learning for many years. They've made some progress, but it's still an area of active research and lots more to be done. Variation on the "is this a sockpuppet?" question include "Is this email spam?", "Will the price of this stock go up or down?", and "Is this a picture of a cancer cell?" RoySmith (talk) 16:39, 28 September 2024 (UTC)

I don't mean those kinds of high dimensional functions (that you can't write down). I mean a simple function like F = ma that could tell you that intersection A is more significant (more improbable) than intersection B because, for example, article A only has 100 revisions and 5 unique editors whereas intersection B has 20,000 revisions and 500 unique editors. Sean.hoyland (talk) 14:19, 29 September 2024 (UTC)

For example, 11Fox11 (2462 revisions) vs Mvqr (17248 revisions), blocked socks with 22 intersections, the objective would be a simple function that quantifies the fact that the intersection at Jeanne d'Arc (video game) is more significant than the intersection at Ted Nugent so that that intersection would be ranked higher in an evaluation of evidence in an SPI report. Sean.hoyland (talk) 14:58, 29 September 2024 (UTC)

I don't mean to be dismissive, but if it was really that easy, somebody would have written the tool already. What you're talking about here is Feature engineering. You've defined two features:

1. Both users have edited Jeanne d'Arc (video game)
2. Both users have edited Ted Nugent

and hypothesized that the first feature should be weighted higher than the second, based on a sample size of one. So now, run an experiment. Go through all the old SPI reports and find all the pairs of users who have been accused of being socks. Of those, find all the pairs who have edited both of those articles vs all the pairs where only one has edited both of those articles. See how well that correlates with having been declared a confirmed sock.

If you do that experiment, I strongly suspect you'll quickly find that there aren't enough data points to do anything useful. So your next step might be to change the definition of your features to something broader and try again. And pretty soon you'll be deep into reading the machine learning literature to discover what those who have gone down this road before you have learned and see if you can apply their techniques to this data set.

I'm not being at all facetious. It's an interesting area and you can get your feet wet with some ordinary programming skills and some basic understanding of statistics. And even if you don't make any substantial progress towards solving the sockpuppetry problem, you'll learn a bit about about the algorithms which are increasingly running our lives. RoySmith (talk) 15:25, 29 September 2024 (UTC)

In addition to the mentioned indicators and others that raise suspicions of a specific account being a sockpuppet, I have only opened SPIs where I know what other account(s) that specific account links to. That means either the suspicious account matches an existing farm I am familiar with, or I have found multiple accounts that produce the same suspicions. CMD (talk) 08:17, 29 September 2024 (UTC)

I'm not going to read all that, but try this tool if you want to a list of editors who edit the same articles. NinjaRobotPirate (talk) 02:59, 30 September 2024 (UTC)