Wikipedia:Suspected sock puppets/Fredrick day (2nd)/Evidence

This is a table of edits from Special:Contributions/Fredrick day, Special:Contributions/Fredrick Dayton, plus certain known IP socks of Fredrick day, compared with Special:Contributions/Seddon69, suspected to be a sock of Fredrick day.

Long series of edits from one account, without any edits from another account, are omitted, with the count of omitted edits shown. The data was retrieved, mostly, on April 13, 2008. The complete contributions of each user were compiled, the original spreadsheet is available if needed; it shows as well the articles edited and summaries.

Fredrick day is a user who was a sometimes contentious editor, but who stopped short of falling into trouble; however, in March, 2008, IP edits began to appear, vandalizing certain editor User and Talk pages, engaging in disruption; eventually, Fredrick day slipped and an edit showed that he was the IP editor. He asserted that he did not need the Fredrick day account, and that, though he was blocked, he would continue to edit freely. He has stated that he can access multiple ISPs, and he has shown that he can do this, rapidly changing from one IP to another. He has also stated that he edits with two monitors, it is possible that he is using more than one computer.

Therefore the existence of some degree of interleaving of edits would not be surprising. This is, indeed, found in this evidence, in certain places, but generally, it appears, he did not bother to interleave more than a little. What can be seen here, often, is blocks of uninterrupted edits from one account, a shift to another account, which then edits without interruption for a substantial time. Often one account edits for a full day, then there are a few edits from another, beginning shortly after the first account stops editing.

It is easiest to see this in the early records; at a certain point, it appears that Fredrick day began actively interleaving the accounts.

Caveat: To really show this, the data should be displayed on a time-constant axis, so that a unit of time is a unit of distance on a graph. The presentation here, from a spreadsheet, could exaggerate the apparent connection. If I have erred, this would be where it would be. However, the phenomena that I mentioned, substantial blocks with no interleave, seems unlikely to occur so strongly with unconnected users. I intend to test this method of identifying active socks with other users, including myself. --Abd (talk) 03:52, 15 April 2008 (UTC)[reply]

I would like to note that the following edits could not have been made by me. This is due to the fact i was college at these times. I will go even further back through the edit history if necessary but if we are going to throw WP:AGF completely out of the window then tell me what evidence you need and i will get it for you. I have taken into account the time difference between UTC time and the current BST:

• Edits by 218.56.8.72

14:54, April 7, 2008

11:57, April 7, 2008

• Edits by 82.77.190.85

14:11, April 9, 2008

• Edits by Fredrick day

15:52, April 10, 2008

15:50, April 10, 2008

15:49, April 10, 2008

10:34, April 10, 2008

10:32, April 10, 2008

Seddon69 (talk) 19:34, 15 April 2008 (UTC)[reply]

• I've suggested to Seddon69 that there is not much he can do. The fact is that the edit sequence around this time is indeed anomalous. Problem is, Fredrick day has shown that he can edit from IPs all over the place. Quite simply, with a little fiddling and possibly some finagling, I could log in to Wikipedia from practically anywhere, and I could make it look like two separate accounts could not possibly be the same. Except that it would not fool, I'd think, an experience checkuser. One looks for correlation, not for non-correlation. Two sets of random numbers will seem to coincide in certain ways and not in others. If there is some connection between the sets, i.e., one set is dependent on the other and is not truly random, then there can still be a lot of variation. It's the matches, occurring in increased frequency, that will show the connection.

In this case, we have a moderately sophisticated user, Fredrick day, able to use, for example, open proxies to edit. He uses available wireless networks. He may use libraries and other public machines. It would be quite easy for me to continue to edit from my home computer while I was away. And I also have access to a full server that I can use remotely. And I have shell access on various ISPs. If I wanted to, I could make quite a fuss. But, in the end, it's a hassle. And make one slip, there goes one sock or one method of secret access. There are quite a few ways to make mistakes that will reveal to those looking for it that accounts are connected, and IP evidence is, of course, a big thing. But we know that Fredrick day was quite aware of IP evidence, and would take steps to avoid detection of his serious socks through IP. Fredrick Dayton and Fredrick dayz were obviously not serious socks. They were intended to be discovered, obviously. He bragged that we would not be able to find his important accounts.

Now, as to what is above, that period, which is quite recent, is anomalous. By this time I think that Fredrick day was beginning to take some serious countermeasures against detection. Unfortunately for him, he could not go back and erase the record from periods when he was not so careful. My current hypothesis about this period of April 7-10 is that he was deliberately interleaving edits. It's not difficult to do; as I mentioned, I'll demonstrate it later. It's just a hassle, that's all, which gets in the way of serious editing. He did not normally do it. I have a meeting to go to; my intention, after I come back, is to start to show, in more detail, the patterns I've been talking about, since a number of people have looked at the evidence and apparently did not see it. Briefly, though, it has to do with the timing, how one active session as one editor ends and another session with the other editor immediately starts up. They alternate back and forth, generally with *no* interleaving. Rapid edits with one account that abruptly stop at the same time as the other editor starts up. Which then rapidly edits for a time, stops and immediately the other editor starts up.

With knowledge that this analysis could be done, and an expectation that it would be done, the matter could be confused with interleaving. But there are further techniques, more sophisticated, which I believe could be used to detect this.--Abd (talk) 23:27, 15 April 2008 (UTC)[reply]

Sarcasticidealist reverted out a classic Fredrick day comment from the project base as coming from a blocked user and probably because it was uncivil. But it is relevant here, so I'm bringing it here:

I like how your table has a little line that says "1500 edits omitted" - using evidence like this, I could show that Jimbo was actually Willy on wheels. If Abd persists in those unsourced slurs against a good faith editor such as Seddon69, then he should be blocked. --87.112.92.251 (talk) 09:09, 15 April 2008 (UTC)[reply]

"1500 edits omitted" is a series of 1500 edits uninterrupted by any edits from Seddon69. Essentially, Seddon69 was not active at all for this lengthy period, so the correlation does not exist, and listing all those edits adds nothing but length. I could have cut down the list even further, but I considered that it was useful to show the frequency of edits as well as the transitions. I never broke up an edit session with these elisions (except that a couple of times I left in a single edit from the next edit session to show the large gap -- long enough for a night's sleep -- indicating that the previous session truly ended.) I could have just put up the entire spreadsheet, it is about twice as long. I could have included the article data, which would much more than double it again.

I'm not aware that I have slurred Seddon69 beyond noting the correlation between his account and that of Fredrick day. Let's put it this way. If Fredrick day had acted like Seddon69, all along, he'd never have been blocked. Seddon69 isn't complaining about me. On the other hand, what Fredrick day did, with his IP socks, was say what he'd been thinking all along. He thought other editors were jerks, but he couldn't say that directly. Ah! All he had to do was do it anonymously, and he mostly confined himself to dumping on people who were being scapegoated by the community, and, I think, he found it was easy to get people riled up. Mostly they didn't even notice what he was doing. After all, the problem was this other user, and who cares if an IP account says what I'm thinking? Glad it was him and not me! Not my job to deal with the blatant incivility!

By the way, I put the list in earliest to latest order deliberately. The first edits to look at are the first edits for each user, not the latest. Fredrick day, it appears, became much more careful recently. He may have realized the implications of the mobile phone slip immediately. I have not done a formal study of the change in correlation that did appear at various times. The worry, of course, would be that passing off edit interleaving as evasion, if done too easily, could then cause truly unrelated accounts to appear connected. (Extensive interleaving would be normal when comparing two active accounts on the same edit/whatever/sleep cycle.)--Abd (talk) 23:53, 15 April 2008 (UTC)[reply]

He thought other editors were jerks - don't you notice the pattern of people I go for? people like you who consume resources but think you are too good to get your hands dirty editing articles, people who don't want to edit but want to influence policy, POV pushers who want to make it easier for POV Pushers and their lackies to post all sorts of crap on here. Even blocked, over the last week, I've performed more useful edit to the encyclopaedia than you have in your whole time here. Why on earth would I want to waste my time on nonsense like meditation (Which I see Seddon is quite active in), which is just an process that is set-up to enable POV-pushers and dramaqueens to consume editing time. What I'm really looking forward to is you 'exposing' my other socks - from the evidence shown here, you detective skills are up there with inspector clouseau. Fair warning, Seddon has been rather polite about all this, some of the other "posts from the uk at times most likely for those in the GMT timezone, so therefore must be fredrick day" editors might not be. However I'm sure, your wild accusations will keep us all in shits and giggles until it reaches critical mass and you find yourself unable to stop "there he is!, no wait there he is!" --87.113.43.31 (talk) 18:29, 16 April 2008 (UTC)[reply]