Wikipedia talk:Sockpuppet investigations/Shutterbug

1. Does the account match technical data to other previously blocked socks?
2. Does the account edit from the same locations to checkusers known from technical results of previously blocked socks?
3. Does the account edit from open proxies?
4. Did the account start editing with its first edit or first log-creation of the account, shortly after another sock was blocked?
5. Does the account edit to remove criticism of the Scientology organization?
6. Has the account edited to add promotional material about Scientology to articles?
7. Does the account return to the same articles previously edited by other blocked socks?
8. Has the account edited within forbidden areas of higher-level Scientology material, such as Xenu and Operating Thetan?
9. Has the account edited within areas of discouraged research to Scientology members, such as criticism about the organization, e.g. Scientology controversy?
10. Does the account edit at similar times during the day as previously blocked socks?
11. Was the account created, and then inactive for a prolonged period of time, before editing within the topic of Scientology?

— Preceding unsigned comment added by Cirt (talk • contribs) 21:27, 16 February 2011 (UTC)[reply]

Coincident IP usage of selected Scientology-related editors.

Account	ws.churchofscientology.org	ns1.scientology.org	hostnoc.net IP in PA	IP in Munich	different IP in Munich	IP in Berlin	your-freedom.net	open proxy in Asia
COFS (now Shutterbug)	Confirmed	Confirmed	Confirmed	-	-	-	Confirmed	Confirmed
CSI LA	Confirmed	-	Confirmed	-	-	-	Confirmed	-
Misou	Confirmed	-	Confirmed	Confirmed	Confirmed	Confirmed	Confirmed	-
Makoshack	Confirmed	-	Confirmed	-	-	-	Confirmed	-
Grrrilla	-	Confirmed	-	-	Confirmed	Confirmed	Confirmed	-
Su-Jada	-	Confirmed	-	-	-	-	-	-
Proximodiz	-	Confirmed	-	-	-	-	-	-
TaborG	-	-	-	-	-	-	-	Confirmed
Derflipper	-	-	-	-	-	-	-	Confirmed
Shrampes	-	-	-	-	-	-	Confirmed	-

Evidence confirming above

• Wikipedia:Requests for checkuser/Case/COFS
• Wikipedia:Requests for arbitration/COFS - Evidence presented by Jpgordon

Time line of Shutterbug suspected accounts.

— Preceding unsigned comment added by Cirt (talk • contribs) 18:31, 16 February 2011 (UTC)[reply]

Several of these socks were certainly not the same person. For example, Nishkid64 accurately said that MrSimmonds, Mike Greenwood, Monsignore, and Jimgreensboro have a different sock master from AlexJohnTorres12 and JessaRinaldi. Lumping them altogether is sloppy and makes the term "Shutterbug sock" meaningless. Based on my examination of the logs, the MrSimmonds, et al. socks are not Shutterbug. Cool Hand Luke 18:42, 16 February 2011 (UTC)[reply]

Perhaps. But look at the timeline. The accounts all were created around the same timeframe, often have overlapping edits of similar motivations, and are often WP:SPAs within one particular topic. The edits often involve promotion of one particular organization, and removal of criticism from articles discussing this organization. -- Cirt (talk) 18:42, 16 February 2011 (UTC)[reply]

Is it so inconceivable that more than one person would be an SPA on this topic? They're a clear CU mismatch. Cool Hand Luke 18:46, 16 February 2011 (UTC)[reply]

Easily explainable: It is likely that Shutterbug and all the related accounts were never just one person, but most likely a team of Office of Special Affairs agents operating under direct orders from higher executives, or even the highest executive, within the organization. -- Cirt (talk) 18:47, 16 February 2011 (UTC)[reply]

The fact that they're Scientologists editing about Scientology who started editing at roughly the same time doesn't make them socks, though. They might just be casual Scientologists editing about Scientology... I think you're jumping at shadows here Cirt. The Cavalry (Message me) 18:49, 16 February 2011 (UTC)[reply]

Um, no, not really. Because the Office of Special Affairs has done this, exactly this method, in the past, before Wikipedia was even a working website, in multiple areas on the Internet. -- Cirt (talk) 18:50, 16 February 2011 (UTC)[reply]

Whether not this is all single individual behind all the accounts is dubious, but they are all SPA accounts with the same POV within the topic area. I see it far more likely that it is several individuals working together at some level over the years. Likely CoS socks/meat puppets would be far more accurate title than strictly ShutterBug The Resident Anthropologist (talk) 18:52, 16 February 2011 (UTC)[reply]

More easily explainable with Occam's razor, I'm afraid. If this was a hardware trick or directive from on high, it's never been observed in "Shutterbug" socks before or since.

Without evidence that Shutterbug is an institutional project, is really appropriate to treat multiple individuals as the same sock? I contend it is not. It's certainly outside the bounds of WP:SOCK. Cool Hand Luke 18:53, 16 February 2011 (UTC)[reply]

No, see above comment by ResidentAnthropologist (talk · contribs). It is most certainly, definitely within the bounds of WP:SOCK, specifically Wikipedia:SOCK#Meatpuppetry. Thanks. Cheers, -- Cirt (talk) 18:55, 16 February 2011 (UTC)[reply]

No. I appreciate what you're saying Cirt, and I know you mean well, but you're mistaken. It's much more likely that these are non-staff Scientologists trying to 'fix' Wikipedia from myriad churches and locations all over the US. It's certainly rather tinfoily to assume that David Miscavige has ordered a concerted campaign of poor-quality obvious SPAs with different UAs and IPs. I'm concerned about your tagging this many at once, Cirt - the risk of catching innocent Scientologists in this is pretty high. The Cavalry (Message me) 19:02, 16 February 2011 (UTC)[reply]

That assumption fails to take into account that all members of the organization are forbidden from looking up anything related to either criticism of the organization, or Xenu, unless specifically given permission to do so in the course of Office of Special Affairs duties. -- Cirt (talk) 19:03, 16 February 2011 (UTC)[reply]

Yes, I know as much as you do about the subject. What I also know is that it doesn't apply to the early levels of the organisation. I think it might be better if you left this to the rest of the community - especially the CUs and Arbs - to handle. The Cavalry (Message me) 19:12, 16 February 2011 (UTC)[reply]

It most certainly does apply to all levels of the organization. One example, from The New Yorker, "For one course, she decided to write a paper about discrimination against various religions, including Scientology. “I wanted to see what the opposition was saying, so I went online,” she says. Another student turned her in to the school’s ethics committee. Information that doesn’t correspond to Scientology teachings is termed “entheta”—meaning confused or destructive thinking. Lauren agreed to stop doing research. “It was really easy not to look,” she says. By the time she graduated from high school, at the age of twenty, she had scarcely ever heard anyone speak ill of Scientology." Cheers, -- Cirt (talk) 19:15, 16 February 2011 (UTC)[reply]

"I wanted to see what the opposition was saying, so I went online," - and viewed the Wikipedia page, no doubt... and edited it? This proves she was able to check, and was able to look. It applies to those inside the organisation, but on the periphery it's not very well enforced. The Cavalry (Message me) 19:20, 16 February 2011 (UTC)[reply]

Read the entire quote. She was reported by a peer. And then had to face disciplinary action. This occurs at all levels of the organization. Reading and researching criticism is highly discouraged. It may occur from time to time, yes, but it is not sanctioned or allowed. -- Cirt (talk) 19:21, 16 February 2011 (UTC)[reply]

Luke I appreate the concern but most of these accounts have a consistent behavior pattern that is shared by Shutterbug. I think it at the peak of Scientology dispute before Arbsci we had several individuals operating at with off wiki coordination. since then its gone down one or two acting independently with identical edit patters almost every time. The Resident Anthropologist (talk) 19:27, 16 February 2011 (UTC)[reply]

The problem here is that the net has been cast so wide that almost any editing behaviour is arguably consistent with Shutterbug's.  Roger ^talk 05:16, 18 February 2011 (UTC)[reply]

merely speculating and I agree. As I said Whether not this is all single individual behind all the accounts is dubious, but they are all SPA accounts with the same POV within the topic area. I see it far more likely that it is several individuals working together at some level over the years. Likely CoS socks/meat puppets would be far more accurate title than strictly ShutterBug. This Chart has use for Tracking likely CoS edits but cant all be Shutterbug. Terryeo case is good example of some one who is probably not shutterbug. The Resident Anthropologist (talk) 05:36, 18 February 2011 (UTC)[reply]

Sure but, for example, the last SPI one filed (User:Quantumsilverfish certainly isn't an SPA and there's no reason based on one edit to assume POV-pushing or meatpuppetry.  Roger ^talk 05:47, 18 February 2011 (UTC)[reply]

You got suckered with this back in December too. After which you went casting aspersions on various pages and never bother to clean up afterwards. I thought that experience would have made you wise up. This entire page is just more of the same poisoned chalice nonsense, where Shamanesque techniques are used to denounce imagined JuJu men, and for all the self proclaimed expertise of the author of this page, numerous false positives have been winkled out after the denouncement. John lilburne (talk) 12:19, 18 February 2011 (UTC)[reply]

User:Scientology major has got to be one of the most tenuous sock taggings I've ever seen. It's unclear to me whether the user is even pro- or anti-Scientology. They pipe-linked Scientology with and exclamation point on their user pages, and never edited the topic—or anything else—ever again. Why did you tag this user as a Shutterbug sock? Cool Hand Luke 19:16, 16 February 2011 (UTC)[reply]

Removed it. However, it is possible that Shutterbug has set up sleeper accounts that sit for months or years. -- Cirt (talk) 19:18, 16 February 2011 (UTC)[reply]

Why not tag all the zero-edits accounts as Shutterbug then? Look, I agree that there is one or more prolific sock master in this area—I just think we need a sock definition that's more robust than a POV. Otherwise, we're not really blocking socks, we're blocking editors with a certain POV. Cool Hand Luke 19:21, 16 February 2011 (UTC)[reply]

Thank you for acknowledging, "I agree that there is one or more prolific sock masters in this area". I really appreciate you admitting that in the course of this discussion. It is quite helpful to identify the areas we agree upon. Cheers, -- Cirt (talk) 19:23, 16 February 2011 (UTC)[reply]

Sure. There is at least one prolific sock master with defined characteristics. Some of the accounts you've listed are very unlikely to be this individual given the technical data. I think we should block the sock masters, not the POV. Cool Hand Luke 19:30, 16 February 2011 (UTC)[reply]

I agree that we should block the sockmaster, not the POV. But the POV is one of many different correlations to make between multiple accounts. -- Cirt (talk) 21:09, 16 February 2011 (UTC)[reply]

Actually, that's an interesting question. Why did you tag User:Scientology major as a Shutterbug sock? Are there any other we should know about that were similarly tagged? The Cavalry (Message me) 19:37, 16 February 2011 (UTC)[reply]

User:NestleNW911 needs to be removed to. (S)he has acted so differently from any Shutterbug account that it is unlikely related to them. It was possible on CU and later said here they both from the same large city. So its better off to not include them The Resident Anthropologist (talk) 19:39, 16 February 2011 (UTC)[reply]

Removed. The Cavalry (Message me) 19:53, 16 February 2011 (UTC)[reply]

There is User:Fairyday as well in which there was a lengthy discussion about. The Resident Anthropologist (talk) 19:56, 16 February 2011 (UTC)[reply]

I came to the conclusion that he wasn't a sock, and thus unblocked him. I'm removed him from the list, and I think it was pretty inappropriate for him to be added. Fairyday was an innocent user, chased off Wikipedia by socking allegations - that's why we're so concerned about pages like this springing up. The Cavalry (Message me) 20:13, 16 February 2011 (UTC)[reply]

Fairyday, some analysis and perspective

1. Fairyday (talk · contribs), creates userpage with one-line-turning-page-blue on 7th edit ever to Wikipedia diff
2. On first edit ever to Wikipedia, exhibits signs of prior Wiki-experience, using Reference-coding markup diff
3. Per Checkuser, Fairyday, shares location with Shutterbug based on technical evidence diff
4. Removes material which does not reflect positively on the Scientology organization diff
5. Account created and began editing within same timeframe as other new accounts chart
6. The account became active recently after others were  Confirmed and blocked chart

One of these correlation points, by itself, would simply raise suspicions and might not be enough. But, as with multiple previously blocked socks of Shutterbug, they exhibit many of the same exact types of correlation points, together. -- Cirt (talk) 21:39, 16 February 2011 (UTC)[reply]

Cirt, I know you're trying to help, but all this evidence is circumstantial. Prior experience of Wikipedia is not a crime, neither is addding one line to your userpage. All that Fairday has done wrong is edit articles on Scientology. She added a pro-scientology perspective, rather than the anti-Scientology perspective that's prevalent - which may be breaking the NPOV policy, and may be editing with a COI - but we don't block for either of those. This page is really concerning me, and any investigation of this nature is best carried out by Arbitrators and Checkusers with experience, rather than involved users such as yourself. The Cavalry (Message me) 22:17, 16 February 2011 (UTC)[reply]

I am not carrying out an investigation, just compiling data for others to do so. It becomes quite difficult to explain away all of these correlation points, especially when exhibited, together. -- Cirt (talk) 22:18, 16 February 2011 (UTC)[reply]

User:Chase me ladies, I'm the Cavalry, perhaps you could explain to us when circumstantial evidence would be useful in this case, how many correlation points together would be satisfactory to you, and in what situation you would block socks of community-banned-user Shutterbug? -- Cirt (talk) 22:23, 16 February 2011 (UTC)[reply]

Arbitrary break

You're drawing up a list of 'correlation points', as well as bringing in old accusations against users who have been cleared by checkuser. There's a risk of unconscious bias slipping in. Please; leave this sort of thing to AC and CU - the CUs are more than capable of building up a list like this. As an uninvolved administrator (without my arb hat on), I'm asking you to stop. The Cavalry (Message me) 22:26, 16 February 2011 (UTC)[reply]

Alright, will do. -- Cirt (talk) 22:31, 16 February 2011 (UTC)[reply]

Thanks. I'll send you an email with my arb hat on shortly - a friendly one! The Cavalry (Message me) 22:32, 16 February 2011 (UTC)[reply]

Okay. FWIW, I am no longer watching this page. Cheers, -- Cirt (talk) 22:33, 16 February 2011 (UTC)[reply]

That's a good thing. Cirt, as I've told you before, you really need to step away from all things Scientology. That includes sockhunting. Leave it to others. ++Lar: t/c 12:51, 17 February 2011 (UTC)[reply]

I have stepped back, I will continue to step back, I have removed hundreds of pages from my watchlists. I have removed this page from my watchlist. I will not be active with looking into socking in this area in the future. -- Cirt (talk) 15:49, 18 February 2011 (UTC)[reply]

According to the chart, Fairyday (talk · contribs) started editing around the same time as other  Confirmed socks were blocked. This same pattern holds true for NestleNW911 (talk · contribs). Most interesting to make note of here. Cheers, -- Cirt (talk) 21:06, 16 February 2011 (UTC)[reply]

I agree the pattern look consistent and I am not convinced they arent but lets stick with ones inactive/blocked suspected socks and  Confirmed socks. Two editors that may not CoS be deserve good faith until proven otherwise. The Resident Anthropologist (talk) 21:10, 16 February 2011 (UTC)[reply]

I am just pointing out that this is yet another method to use, and a question to ask, namely — in addition to other factors such as technical data and behavioral evidence - did a suspected sock account start editing, after other sock accounts stopped due to being blocked? -- Cirt (talk) 21:12, 16 February 2011 (UTC)[reply]

I am not disagree with you, the timing is important but through the method of triangulation we need at the least two points of three points to match. You have proven the timing to be suggestive but lacking a secondary verification we have a suspicious coincidence not proof. The Resident Anthropologist (talk) 21:16, 16 February 2011 (UTC)[reply]

Promotion of the organization is a point. Removal of criticism about the organization is a point. I will make a list of possible triangulation points, good idea! ;) -- Cirt (talk) 21:17, 16 February 2011 (UTC)[reply]

Update:  Done, please see Wikipedia_talk:Sockpuppet_investigations/Shutterbug#Correlation_points, above. It would subsequently be possible to create a table asking these questions, and comparing Fairyday (talk · contribs) and NestleNW911 (talk · contribs) to each other, and to previously blocked socks, using these questions as correlation points. ;) Cheers, -- Cirt (talk) 21:45, 16 February 2011 (UTC)[reply]