Wikipedia:Arbitration/Requests/Case/Reversal and reinstatement of Athaenara's block/Evidence

The Evidence phase for this case is closed. Any further edits made to this page may be reverted by an arbitrator or arbitration clerk without discussion. If you need to edit or modify this page, please go here and create an edit request.

Wikipedia Arbitration
About arbitration Talk Arbitration policy (CU/OS) Guide to arbitration Noticeboard + Talk Search archived proceedings Ban appeals Report
Open proceedings All open requests Case requests Clarification and Amendment requests Arbitrator motion requests Enforcement requests
Active sanctions Contentious topics (Log) General sanctions Editor sanctions
Arbitration Committee Discuss + Contact Members Procedures Elections Talk History Clerks + Talk Clerk procedures Conflict of interest reports
Audit Talk Statistics Talk Reports (pre-2016)
Track related changes
v t e

Non-parties are discouraged from submitting evidence that has already been submitted to the Arbitration Committee through the case request process. Any case submissions involving non-public information should be directed to the Arbitration Committee by email to arbcom-enwikimedia.org.

Arbitration case pages exist to assist the Arbitration Committee in arriving at fair, well-informed decisions. This page is not designed for the submission of general reflections on the arbitration process, Wikipedia in general, or other irrelevant and broad issues; and if you submit such content to this page, please expect it to be ignored or removed. General discussion of the case may be opened on the talk page. You must focus on the issues that are important to the dispute and submit diffs which illustrate the nature of the dispute or will be useful to the committee in its deliberations.

Submitting evidence

• Any editor may add evidence to this page, irrespective of whether they are involved in the dispute.
• You must submit evidence in your own section, using the prescribed format.
• Editors who change other users' evidence may be sanctioned by arbitrators or clerks without warning; if you have a concern with or objection to another user's evidence, contact the arbitration clerks by e-mail or on the talk page.
• Additionally, non-parties are discouraged from submitting evidence that has already been submitted to the Arbitration Committee through the case request process.
• Any case submissions involving non-public information should be directed to the Arbitration Committee by email to arbcom-enwikimedia.org.

Word and diff limits

• The standard limits for all evidence submissions are: 1000 words and 100 diffs for users who are parties to this case; or about 500 words and 50 diffs for other users. Detailed but succinct submissions are more useful to the committee.
• If you wish to exceed the prescribed limits on evidence length, you must obtain the written consent of an arbitrator before doing so; you may ask for this on the Evidence talk page.
• Evidence that exceeds the prescribed limits without permission, or that contains inappropriate material or diffs, may be refactored, redacted or removed by a clerk or arbitrator without warning.

Supporting assertions with evidence

• Evidence must include links to the actual page diff in question, or to a short page section; links to the page itself are inadequate. Never link to a page history, an editor's contributions, or a log for all actions of an editor (as those change over time), although a link to a log for a specific article or a specific block log is acceptable.
• Please make sure any page section links are permanent, and read the simple diff and link guide if you are not sure how to create a page diff.

Rebuttals

• The Arbitration Committee expects you to make rebuttals of other evidence submissions in your own section, and for such rebuttals to explain how or why the evidence in question is incorrect; do not engage in tit-for-tat on this page.

Expected standards of behavior

• You are required to act with appropriate decorum during this case. While grievances must often be aired during a case, you are expected to air them without being incivil or engaging in personal attacks, and to respond calmly to allegations against you.
• Accusations of misbehaviour posted in this case must be proven with clear evidence (and otherwise not made at all).

Consequences of inappropriate behavior

• Editors who conduct themselves inappropriately during a case may be sanctioned by an arbitrator or clerk, without warning.
• Sanctions issued by arbitrators or clerks may include being banned from particular case pages or from further participation in the case.
• Editors who ignore sanctions issued by arbitrators or clerks may be blocked from editing.
• Behavior during a case may also be considered by the committee in arriving at a final decision.

Five block/unblock/block modifications were made on account Athaenara on 11OCT/12OCT:

• 2022-10-11T01:21:41 Floquenbeam blocked Athaenara with an expiration time of indefinite (account creation blocked) (hate speech or compromised account) Tag: Twinkle
• 2022-10-12T07:37:30 Lourdes unblocked Athaenara (Not compromised account. The case is in Arbcom to assess whether this is hate speech or not. In my opinion, this is absolute hate speech and there is no place like this on Wikipedia or anywhere. At the same time, you need to allow the case to have representation from Ath... Unblocking likewise.)
• 2022-10-12T09:02:33 TheresNoTime blocked Athaenara talk contribs with an expiration time of indefinite (account creation blocked) (Reinstate block, see Special:Permalink/1115609910#Athaenara unblocked by Lourdes)
• 2022-10-12T13:53:07 Ritchie333 changed block settings for Athaenara with an expiration time of indefinite (account creation blocked, cannot edit own talk page) (Reinstate block, see Special:Permalink/1115609910#Athaenara unblocked by Lourdes)
• 2022-10-12T15:24:24 Floquenbeam changed block settings for Athaenara with an expiration time of indefinite (account creation blocked) (restoring talk pages access, per request from an Arb at the RFAR page. Note that Ritchie specifically said he would undo this if asked, so not even close to wheel warring.)

— xaosflux ^Talk 23:27, 16 October 2022 (UTC)[reply]

Since this case is going to be public, I'll summarize the contents of the email I sent to ArbCom detailing my concerns several days ago.

Several days ago, in the early morning, I was performing an audit of the checkuser log (CU's only) when I noticed a couple checks with an extremely dubious rationale:

• 08:46, 12 October 2022, TheresNoTime (checks by) got IP addresses for Lourdes (talk | contribs | block | checks on) (Compromise/collusion)
• 08:47, 12 October 2022, TheresNoTime (checks by) got IP addresses for Athaenara (talk | contribs | block | checks on) (Compromise/collusion)

It was followed by an IP check that I won't repeat here for privacy reasons, but presumably it was Athaenara's or Lourdes' IP address.

I'm not going to detail the full background, but as we are all aware, Athaenara had posted an intensely personal attack on another user and been (correctly, in my personal opinion) indefinitely blocked for it.

See here. (The summary is: "Not compromised account. The case is in Arbcom to assess whether this is hate speech or not. In my opinion, this is absolute hate speech and there is no place like this on Wikipedia or anywhere. At the same time, you need to allow the case to have representation from Ath... Unblocking likewise.") Obviously, this was under the mistaken impression that Athaenara needed to be unblocked to participate. Poor decision-making, but ultimately a harmless misunderstanding.

See here and here.

TheresNoTime also closed their own reblock proposal and reblocked Athaenara. This is a violation of WP:INVOLVED and possibly wheel warring.

See here. They also opened an ANI discussion 15 minutes later.

GeneralNotability (talk · contribs) had already checked Athaenara's account to verify that it wasn't a malicious third party "hacking" Athaenara's account. Checkusers can verify this in the log.

Fundamentally, there was and is exactly zero evidence that Athaenara had used Lourdes' account or that Lourdes and Athaenara are the same person. I find it very difficult to call this anything other than a retaliatory checkuser on two people TheresNoTime strongly dislikes appears to be WP:INVOLVED with. Even though WP:INVOLVED technically only states "admin actions", it also applies to checkuser actions. More seriously, this is a violation of the local and global checkuser policies, and possibly a violation of the WMF privacy policy. This is an egregious abuse of checkuser.

(Struck portion of my evidence that put words and thoughts in other people's mouths. That was unfair and I apologize to Lourdes and TheresNoTime. Reaper Eternal (talk) 01:05, 18 October 2022 (UTC))[reply]

Checkuser does not and cannot provide evidence for or against off-wiki collusion. Even if someone sends an email through Wikipedia's Special:EmailUser function, the recipient is anonymized in the checkuser results. See WP:NOTFISHING.

TheresNoTime, could you clarify something for me? I might be misunderstanding some of your claims. You mention that you checked Lourdes and Athaenara to look for collusion "Knowing that an alternative explanation for the events as I saw them could well be off-wiki collusion, bearing in mind evidence of such may appear in the CU results (the fact that an email had been sent), and paired with multiple editors still seeming convinced that Athaenara's account was compromised, I checked their account. This check, as explained below, was ancillary to the check of Lourdes." And again "the CU tool can indeed be used to ascertain that an email has been sent from the account checked. If an email was found to have been sent around the time prior to an unblock, it would suggest that a potential collusion would merit further investigation." However, the checks run on Athaenara and Lourdes were "Get IPs", which do not return any email information. Only the "Get Edits" function, which was run on only one IP, returns whether an email was sent. Additionally, this appears to be in contradiction with the claim made here: "On checking Athaenara at :47, I recall seeing globally blocked proxy use, prompting me to make one further check" where you cite proxy use as the reason for checking edits on the IP address.

I can go into more details if needed, but this summary should cover the gist of the issue. Reaper Eternal (talk) 00:24, 17 October 2022 (UTC)[reply]

Added section on collusion. Reaper Eternal (talk) 01:02, 18 October 2022 (UTC)[reply]

Added request for clarification. Reaper Eternal (talk) 15:05, 19 October 2022 (UTC)[reply]

INVOLVED has a reasonable caveat, "In straightforward cases [...] the community has historically endorsed the obvious action of any administrator – even if involved – on the basis that any reasonable administrator would have probably come to the same conclusion."

I ask this question of other administrators. Is it not reasonable for any uninvolved administrator to undertake the same actions that TNT had undertaken with CU use, when faced with such a situation as that passed? I would strongly advocate against even a wrist-slap in this case – as that would have a level of chilling effect on future actions of administrators, who will delay such decisions while other administrators may take time to discuss and deliberate, leaving Wikipedia on a net negative scale.

TNT's quick and timely actions to check my IP, Ath's IP and the third IP are exactly what I would have done as an uninvolved administrator. TNT did this for the good of Wikipedia, not just because they were involved. Why should the Committee choose to even trout an administrator who has taken the exact steps that any administrator would have taken? Honestly, I do not find even one action of TNT to be away from standard process. TNT's check of my IP/ua is not with any "dubious rationale", as suggested by Reaper. Nothing against Reaper, but to say that suspecting collusion is "dubious", is painting it wrongly. Editors do not usually check logs to understand contribution levels of other editors. And my having little contributions before I unblocked Ath, would and should have been checked by any administrator immediately as a suspected act of collusion, predominantly due to my lack of contributions (and if we are supposed to not do that, then we've got something wrong here).

To add to the above, if TNT had out of haste simply re-blocked Ath without undertaking any due process, that would have been egregious. But they did not. They questioned Ath while Ath was unblocked, asking if there was collusion. They messaged me on the talk page and emailed me to respond (look at how TNT is reaching out to undertake a judicious decision). They ran a CU check after Ath refused to admit any collusion. This is not egregious use of tools at all. And then to add to this, TNT went to the noticeboard for approval for a re-block. And then once they obtained consensus, they re-blocked.

What can you say is unreasonable of the actions above? I see a most intelligent and judicious process being carried out by TNT before undertaking their CU use and further gaining consensus before undertaking the re-blocking decision.

This above statement by Reaper (no offense meant Reaper, please don't take it otherwise) is baseless and without evidence. I and Ath are the persons here who have been 'checkused' :) And I as the 'used' party don't feel there has been anything wrong done here. Again, please do not issue any admonishment. Administrators are meant to take such involved decisions for the betterment of Wikipedia. Do not discourage us. Thanks, Lourdes

Although I believe I am just within policy, I am clearly not within the community expectations, and for that I apologise. The more prudent thing to do with all of the below would have just been to wait for others to react — and others certainly would have. This was a significant lapse in judgement for which I have, and will continue to, reflect deeply on. I am disappointed in my actions, yet will attempt to explain my thought process for them now:

• When reviewing the unblock Lourdes made, I saw an admin account which had not edited for a year (bar one edit a few days ago).
• Not checking logs was a significant error on my part, and influenced the rest of my decision-making.
• I knew Lourdes fairly well back when they were more active, and this was an uncharacteristically ill-advised action (as Lourdes acknowledges).

These events, paired with the flawed assumption that a very dormant admin account suddenly had become active to make controversial admin actions, caused me to assume an account compromise.

Knowing that an alternative explanation for the events as I saw them could well be off-wiki collusion, bearing in mind evidence of such may appear in the CU results (the fact that an email had been sent), and paired with multiple editors still seeming convinced that Athaenara's account was compromised, I checked their account. This check, as explained below, was ancillary to the check of Lourdes.

No CU policy, local or global, prevents a checkuser from performing a check just because another CU has recently done so.

The checkuser policy, both local and global, provide for compromise checks through "CheckUser data may be used to investigate, prevent, or respond to [...] disruption (or potential disruption) of any Wikimedia project". An account compromise, especially of an administrator, certainly constitutes (potential) disruption.

Based on the above assertions, I believe my checks to be within policy yet based on a flawed understanding of the situation.

• On checking Lourdes at :46, I recall not seeing any out of the ordinary IP addresses. I made no further checks against Lourdes.
• On checking Athaenara at :47, I recall seeing globally blocked proxy use, prompting me to make one further check. My check of Athaenara was ancillary to the check of Lourdes, though further compounded by repeated statements by editors that they believe the account to be compromised.
• I made no further checks once I had ascertained my suspicions were unfounded. I not much later realised Lourdes' had been fairly active, making logged actions.

No personal data was made available inappropriately.

I've known Lourdes for a long while, and we are fairly friendly. I feel pity for Athaenara, and said as much. My checks were not personal (in fact, hoping to find evidence of account compromise would exonerate Athaenara, would it not?)

WP:WHEELWAR specifically states "once an administrative action has been reverted, it should not be restored without consensus" — I started an ANI discussion where I requested "consensus to reinstate the block".

thus reducing, but certainly not mitigating entirely, concerns of WP:INVOLVED, which specifically states an involved admin may take action "on the basis that any reasonable administrator would have probably come to the same conclusion". It has been proven that any reasonable administrator would have reinstated the block.

As stated in § On collusion.

I thank Reaper Eternal for their evidence, and for participating in the thankless task of check auditing. I wish to respectfully offer a rebuttal to a point they have made.

The local checkuser policy explicitly states "CheckUser data may be used to investigate [...] disruption (or potential disruption) of any Wikimedia project" (emphasis own) — the CU tool can indeed be used to ascertain that an email has been sent from the account checked. If an email was found to have been sent around the time prior to an unblock, it would suggest that a potential collusion would merit further investigation. It obviously would not prove who was emailed, nor that collusion had taken place definitively, and I have not submitted otherwise. A check for this reason, paired with the concern of compromise, is a valid step in investigating potential disruption of a Wikimedia project.

As stated in § Community Consensus is not a Listed Exception to WP:INVOLVED.

I thank Jclemens for their evidence, and wish to respectfully offer a rebuttal to a number of points they have made.

I do not believe that community consensus is an exception to WP:INVOLVED, and have not submitted otherwise. I believe Jclemens may have misread my comments in good faith, as I have referred to (namely, in my assertion § I was required to seek consensus to reinstate the block, and did so) community consensus only in the matter of WP:WHEELWAR, which does indeed mention consensus as a mitigating factor.

This suggestion was stated by Jclemens in § Community Consensus is not a Listed Exception to WP:INVOLVED, and to quote "Thus, despite any claim to seeking consensus or finding emerging consensus, TheresNoTime's access to checkuser data [...]" — I have at no point made reference nor inference to any such belief that seeking consensus to reblock, or finding emerging consensus of such, influenced my decision to conduct a check. This would in fact be impossible, seeing that I made the check prior to seeking consensus for a reblock.

As requested in § Clarification needed.

Thank you for asking Reaper Eternal, I'm happy to clarify.

I'll admit the format of this "evidence with assertions" page didn't lend itself to copy/pasting the email response to ArbCom, nor does it match the (already fairly unclear) "style" in which I write, so I apologise for the difficult to follow statement as a whole.

I can certainly see how reading this section followed by the (later added) section on collusion could confuse matters. I will try to reiterate more clearly below:

• The reason for my check of Lourdes is asserted in this section — namely, I had reasonable suspicion of account compromise for Lourdes.
• The reason for my check of Athaenara is asserted in this section — namely, I suspected collusion. I also mention the ancillary nature of this check in a later section.

You are correct that my check of Lourdes started and ended with a single "get IPs" (ex.) request — once I had ascertained that the list of IPs returned for Lourdes did not suggest potential compromise, I ceased checking.

As I note, my "get IPs" check of Athaenara returned at least one instance of globally blocked proxy use. I performed a "get edits" (ex.) check on the timeframe relevant IP (i.e., the IP which would show evidence of potential compromise or logged actions around the time an email was likely to have been sent).

I do want to stress, Reaper Eternal, that my omission of explicitly listing that as an investigation action in this section is not an attempt at being deceitful. Had I not seen globally blocked proxy usage, I would have worded that section differently.

I am trying my best to be as transparent and open as I am allowed to be.

As requested on this page's talk, in § I am over the word limit & requesting increase.

Many thanks for the question L235, and I hope I can clarify below.

I state above, in § I regret these actions, that "I believe I am just within policy [in taking these actions]", but qualify this with "[my actions are] clearly not within the community expectations" — my current stance is that no, my actions were not prohibited by the letter of WP:INVOLVED, due to the listed exception ("In straightforward cases [...]").

I hope it goes without saying that if I did believe my actions were prohibited at the time of deciding to act, I wouldn't have made them.

The above being said, I believe there's more to WP:INVOLVED — although I can confidently state that I wholeheartedly believe I was acting in good faith, with the interests of the project at heart and within the limits of the listed exception, it is now abundantly clear that these actions fell short of the community expectations placed upon me.

It is apparent that I could, and should, have waited for another person to act. What I saw as a clear-cut, straightforward case would also have been straightforward and clear-cut to the many people watching the events unfold.

As to " I see that your on-wiki submission is somewhat less clear, saying that "I reacted as I would expect any administrator to have [...] thus reducing, but certainly not mitigating entirely, concerns of WP:INVOLVED" ", I believe I was correct in making an assertion in that way? (i.e., I assert it to be correct that my use of the listed exception reduces the concerns of those who would call my actions involved. I assert that this reduction to their concerns may not rise to the level of total mitigation.) — I'm not very good at writing these, so sorry if I got that wrong...

1. On Oct. 12 at 07:37, Lourdes unblocked Athaenara ...to allow the case to have representation from Ath...
2. At 08:35 Athaenara pinged Lourdes ...thanks for the unblock, however long it lasts...
3. While unblocked, Athaenara did not make any statement in the Arbcom case request, but did make other edits/actions (including deleting pages at 08:38, 08:40, and 08:43): Oct. 12 contribs, Oct. 12 logs
4. At Athaenara's user talk page, two editors commented about Athaenara returning to editing, in posts made at 08:49 and 08:54
5. Athaenara replied at 08:56, That's not so much editing as my usual followup after deleting spam...
6. At the ANI discussion posted at 08:31, three editors commented about Athaenara returning to editing, in posts made at 08:55, 08:57, and 08:58.
7. TNT reinstated the block at 09:02 (a fourth comment about Athaenara's return to editing was made at ANI at 09:03).

Athaenara's editing and use of admin tools post-unblock, instead of participating in the Arbcom case request, lent urgency to the situation. Levivich (talk) 20:46, 17 October 2022 (UTC) Edit: updated to add additional diffs. Levivich (talk) 23:57, 17 October 2022 (UTC)[reply]

Contrary to DWF's assertion that Contrary to Levivich's assertion that "urgency" was required to reblock Athaenara, I am not asserting that urgency was required to reblock, or that urgency required a reblock. These issues require a "totality of the circumstances" multi-factorial analysis, there is no one factor that required or prohibited any of the actions at issue. Levivich (talk) 16:58, 23 October 2022 (UTC)[reply]

After Lourdes unblocked Athaenara at 07:37, 12 October 2022, there were no posts by Lourdes prior to Athaenara being unblocked, and Athaenara said there had been no contact with Lourdes. Accordingly, the reason for the unblock was not communicated.

The community has the right to expect the highest standards of conduct in every transaction, from every checkuser, because each checkuser has access to every editor's data. That is, Lourdes' above statement does not settle the matter of whether a check was appropriate.

From meta:ANPDP All Designated Community Members may only use their access rights and the subsequent information they access in accordance with the policies that govern the tools they use to gain such access. For example, community members with access to the CheckUser tool must comply with the global CheckUser Policy, and, unless they are performing a cross-wiki check, they must also comply with the more restrictive local policies applicable to the relevant Site. Emphasis mine.

From meta:Privacy policy

• From section IP Addresses We also use Personal Information in the manner described in the sections of this Policy titled "For Legal Reasons" and "To Protect You, Ourselves & Others."
• From section To Protect You, Ourselves & Others These various user-selected administrative groups have their own privacy and confidentiality guidelines, but all such groups are supposed to agree to follow our Access to Nonpublic Information Policy. (The policy title had not been updated to "data" in this page)

Thus, TheresNoTime's above assertion that no IP address data was shared is presumably true but irrelevant: Accessing the IP address data in violation of the various policies in the first place is a violation of the ANPDP and Privacy Policies. Disclosing it further would be a separate and subsequent violation.

The only possibly relevant exception in WP:INVOLVED is In straightforward cases (e.g., blatant vandalism), the community has historically endorsed the obvious action of any administrator – even if involved – on the basis that any reasonable administrator would have probably come to the same conclusion. But because TheresNoTime's action was based on incorrect assumptions and was, in fact, unwarranted, it would torture the definition of "straightforward cases" to include an incorrect suspicion that an account was compromised as such an exception to INVOLVED.

Thus, despite any claim to seeking consensus or finding emerging consensus, TheresNoTime's access to checkuser data while involved (see Reaper Eternal's evidence, above) was a violation of local checkuser policy, hence a violation of WMF Checkuser, Privacy, and ANPDP policies. Jclemens (talk) 03:30, 18 October 2022 (UTC)[reply]

Thank you for the clarifications, TheresNoTime, that you did not base your checkuser on an assessment of consensus to do so.
To add one further policy quote, from meta:ignore all rules: It is considered policy on the English Wikipedia, and has been the subject of many essays there and here. (again, emphasis mine) Because a checkuser query must comply with both WMF (meta) and local (en.wiki) checkuser policy, an WP:IAR justification for a checkuser query would arguably satisfy the latter, but clearly not the former, as IAR is not WMF policy. Jclemens (talk) 05:33, 19 October 2022 (UTC)[reply]

As Jclemens points out, the only out for INVOLVED actions listed is "straightforward cases (e.g., blatant vandalism)". Athaenara's comments do not meet the threshold of vandalism, and if in fact the case was so straightforward, there remains no reason TNT had to be the one to do so, since there was no shortage of admins aware of the situation. The argument that It has been proven that any reasonable administrator would have reinstated the block. is impossible to actually prove, unless someone can slip to an alternate dimension and know that Athaenara was going to be blocked by another admin in the same amount of time.

There was simply no reason to run the Checkuser on Lourdes (or really on Athaenara at that point). Admins disagreeing does not equal account compromise, and despite TNT's assertion, two admin accounts being compromised simultaneously and being used at the same time is such a vanishingly unlikely possibility that the CU was ultimately absolutely a fishing expedition, leaving aside the question of whether or not they were involved (though they were.)

TNT's actions are not the standard admins should be held to. Lourdes' opinion is irrelevant, as again, admins are beholden to the community writ large, not just those their admin actions directly have affected. We've seen similar claims that prosecuting bad behavior is just going to have a chilling effect (with regards to Bbb23's flagrant misuse of Checkuser, where the Committee rightly said that was hogwash, or in the meatspace world as an argument why police should not be punished for misconduct.) It's a terrible argument with no basis in the higher permissions policies, and should be ignored. Der Wohltemperierte Fuchs ^talk 11:52, 19 October 2022 (UTC)[reply]

Contrary to Levivich's assertion that "urgency" was required to reblock Athaenara, there's nothing in their contributions/logs that demonstrates any ongoing disruption after the block was lifted. They weren't continuing to disrupt the AfD, or vandalizing main space, or anything of the sort. Lourdes shouldn't have boldly unblocked them in the first place (and that's another bit of tool misuse, and ArbCom should decide if that one event can merit a desysop, too,) but editors are also not actually compelled to participate in arbitration regardless and that can't be used as a valid reason to reblock without a consensus, either. Everyone could have afforded to wait more than 30 minutes. Der Wohltemperierte Fuchs ^talk 11:52, 19 October 2022 (UTC)[reply]

GeneralNotability recused from clerking at ARC for discussing and checking Athaenara at 01:37, 11 October 2022 (UTC). TheresNoTime made several posts to ARC that day from 08:31 to 18:37. Though TheresNoTime never discussed the check, several users did and the the clerk note was impossible to miss. RAN1 (talk) 00:30, 20 October 2022 (UTC)[reply]

At 08:31, 12 October 2022 (UTC), TheresNoTime made a post-unblock ANI post which includes the following: Lourdes has decided to unblock Athaenara without discussion, nor even an explanatory comment. TheresNoTime never mentioned the unblock reason, but had faulted it 15 minutes earlier. RAN1 (talk) 00:30, 20 October 2022 (UTC)[reply]

TheresNoTime asked Athaenara if she had been in contact with Lourdes at 08:42, 12 October 2022 (UTC). Athaenara pinged TheresNoTime saying there was no contact four minutes later at 08:46. The Lourdes check has that same timestamp, and the Athaenara and IP checks were 1 minute later. There is a date format that shows seconds, and the pinging edit's timestamp in that format is 2022-10-12T08:46:30. RAN1 (talk) 00:30, 20 October 2022 (UTC)[reply]

Floquenbeam found previous abusive comments by Athaenara and posted the finding to ARC. Between that post and TheresNoTime's first statement, there were 5 statements which explicitly stated a belief or assumption that Athaenara's account had not been compromised: [1][2][3][4][5]. After that, account compromise was only considered a fallback reason for the block/desysop. RAN1 (talk) 13:45, 20 October 2022 (UTC)[reply]

Athaenara's actions between the unblock and the reply to TheresNoTime were to thank Lourdes for the unblock and run PRODs: [1][2][3][4][5][6]. RAN1 (talk) 13:45, 20 October 2022 (UTC)[reply]

Checking by itself does not prevent disruption, and in this case the only way to reduce potential disruption was to revert the unblock. There was no reason to expect that rechecking Athaenara would give actionable evidence for an emergency revert: Account compromise had been ruled out, and sockpuppetry was unlikely. RAN1 (talk) 13:45, 20 October 2022 (UTC)[reply]

RAN1 says above that TheresNoTime was aware that I had checked Athaenara for compromise. I can say without a doubt that they were indeed aware, but I'm not sure what that's supposed to prove – there is no rule preventing multiple checkusers from investigating the same user. In fact, when I ran a check on Athaenara and reported the results at AN/I, I knew that another checkuser had already run the same check a few minutes before. However, they did not announce the results of the check or take any apparent action based on it. I assumed their lack of action was because they did not see evidence of compromise, but I wanted to be able to give a solid answer not based on assumptions, and the only way to do that was to run a check myself and see the technical evidence. The same applies to TNT's actions; if one is to compare accounts, then one needs to run a check on both.

Searching the WP:ANI archives (and intentionally skipping Athaenara's case) in 2022 turns up [1], [2], [3], [4], [5], [6]. In most cases, further examination revealed that this was part of a pattern of behavior and not a compromise.

I'm not sure how to provide evidence that something hasn't happened, but reviewing the list at Wikipedia:Former administrators/reason/compromised and anecdotal recollection, compromised admin accounts end up vandalizing/deleting high-traffic pages rather than interacting with "meta" process like RfA. The big caveat here is that this applies to compromised accounts that we know of. It is entirely possible that admin accounts have been compromised, and the new operator participates in meta areas of the project and we just don't know about it. Legoktm (talk) 00:37, 21 October 2022 (UTC)[reply]

In his evidence above, David Fuchs said The argument that "It has been proven that any reasonable administrator would have reinstated the block." is impossible to actually prove, unless someone can slip to an alternate dimension and know that Athaenara was going to be blocked by another admin in the same amount of time. That is I believe a mistaken statement. We can actually prove that any reasonable administrator would have reinstated the block. Administrator Red Phoenix in his statement to the Athaenara case request said But that's not the case here, and the administrators in question as far as I can tell were simply doing what they felt was right, whether or not there was a WP:BRIGHTLINE. Lourdes admitted she thought Athaenara needed to be unblocked to respond here. There'sNoTime essentially did the same thing to right the mistake, and we can debate the WP:INVOLVED all we want but as an uninvolved administrator I would have done the same thing. (diff:[7]) Emphasis mine. We do not need an an alternate dimension to know that at least one administrator would have made the same re-block that TheresNoTime made.

Additionally, in the closure of the ANI thread about the unblock, administrator Black Kite said Having said that, I think this discussion has run its course as the block has, quite rightly, been reinstated. (diff:[8]) While this is not as direct as Red Phoenix's statement, it is nonetheless overtly supportive of the re-block of Athaenara made by TheresNoTime. I do not think it a stretch to interpret this as a reasonable administrator who would have reinstated the block had TheresNoTime not done so.

Additionally I do believe some weight should be given to Lourdes statement to the same case request, where she said I agree with TNT's actions post my unblock and their reblock after taking community consensus. (diff:[9]) While Lourdes is obviously involved in this due to her actions, it would be a mistake to discount that even as an involved administrator Lourdes also agreed with TheresNoTime's re-block. Sideswipe9th (talk) 22:06, 23 October 2022 (UTC) Added third diff at Sideswipe9th (talk) 22:19, 23 October 2022 (UTC)[reply]

Unblocking Athaenara was a well intentioned error and it was reasonable to reverse it. Whilst it might have been better for TNT to allow some other reasonable Admin to do it, I cannot see reblocking as the wrong thing to do. Having said that, I would urge TNT to detach and disengage, if such a situation should again arise, and let someone else do it to avoid the possible appearance of doing it wrong. Sorry if I did this wrong. Did not expect to join in.-- Deepfriedokra (talk) 22:43, 23 October 2022 (UTC)[reply]

before using the last evidence template, please make a copy for the next person

Place argument and diffs which support your assertion; for example, your first assertion might be "So-and-so engages in edit warring", which should be the title of this section. Here you would show specific edits to specific articles which show So-and-so engaging in edit warring.

Place argument and diffs which support the second assertion; for example, your second assertion might be "So-and-so makes personal attacks", which should be the title of this section. Here you would show specific edits where So-and-so made personal attacks.