Login
Login

Wikipedia talk:Suspected sock puppets/Fredrick day (3rd)#What "Likely" means for checkuser

Too much continued discussion on project page, I'm responding here, and, really, a lot ought to be moved over to this Talk page.

What "Likely" means for checkuser

(response to Protonk's question on Project page, [http://en.wikipedia.org/w/index.php?title=Wikipedia%3ASuspected_sock_puppets%2FFredrick_day_(3rd)&diff=226530225&oldid=226529174])

Why don't you ask the checkuser? But I'll tell you what I think it means, though I already know you don't respect what I think. It means,most likely, that the user shares the same dynamic IP range with one known to be used by Fredrick day. (Minor possibility, it's an ISP functioning in the same area as Fd has accessed from, but I somewhat doubt that this would return "likely." He didn't say which IP range, and he won't, probably. Checkusers don't generally reveal specifics about what they find, for good reason. Based on what I've seen, though, and what Fd has known to do -- he uses multiple ISPs, open proxies, and neighborhood unsecured wireless routers, claims to have several he can use any time, "likely" was strong, even stronger than I expected. Do we really need to go to an RFC/U to establish the behavioral similarities? I pointed to rapid "retirement" when faced with checkuser, *before* checkuser is actually done. Fd did that, and the reason is pretty obvious, do I need to spell it out? (I've written about it in numerous places), and Alle did it twice. Now, same dynamic IP range. What are the odds that two random users share the same IP range, which in this case, is most likely 87.112.x.x to 87.115.x.x? If the block addresses were random numbers, it would be 1/65,000 for each of four possibilities, or 1/16,000 roughly. I used a figure of 1/100,000 elsewhere, but seeing this, I'm revising that downward. I am not an expert on this stuff, but if the odds are 1 in 10,000, and I am now revising the behavioral match up to 1/100, we have a net probability of one in a million that it is not Fredrick day. (Do *you* know anyone else like either Fredrick day or Allemandtando, as to behaviors that have been mentioned? Remember, this includes details like timing of his registration and participation -- Fredrick day is known to take a particular interest in me and to track my edits (ironic, eh?). Should you believe me? I'd like to see a checkuser comment on the odds that two random Wikipedia users would match in the manner that the checkuser for this case described as "likely." If it had been an exact IP match, for confirmed use by both master and puppet simultaneously (or within a short time, i.e., between connection resets), it would have been a clear match and would have been reported as such. There is other evidence possible as well which I'd rather not disclose, but I don't think it may have been involved here. In any case, was it just a lucky guess? There is another approach. I used to look through Recent changes for IP from the Fd range described. I'd look at contributions by IP editors. I'd usually see some and, good chance, it was Fredrick day (sometimes the behavior was quite characteristic. It was proven when I reverted some BLP edits of his, removing what he claimed to be unsourced defamatory material, and he squawked to the BLP noticeboard. Those were a trap, deliberately set, though. I won't go into details except to say that what might be defamatory for someone else might not be for a porn star, which these articles were. The material was actually sourced, but, frankly, I didn't want to continue doing the research. Don't want to look at that material, personal reasons.) While Allemandtando was active, that IP activity almost ceased, I'd see an occasional one. Probably not him. Anyway, I just looked, now, after writing this. Last 10,000 IP edits. From the range of interest, more than I'd been seeing, more than double.

I wasn't seeing so many for a while. The .186 edit, I'm going to guess, isn't Fredrick day, I have never seen him vandalizing random articles. The .212 edit is odd, don't know what that editor was doing. The other four probably are an experienced editor, see [http://en.wikipedia.org/w/index.php?title=Michael_Culver&curid=4102891&diff=226531450&oldid=224043457], fixing a template. He's mostly changing dates from, for example, June 16 to 16 June. Same IP did the same in another session, earlier today, which, by the way, about nails it. the .212 edit is not the same as the .242 editor. Understand why? .242 is probably Fredrick day. What about the edits? Well, see WP:DATE, In June 2005, the Arbitration Committee ruled that when either of two styles such as 14 February or February 14 is acceptable, it is inappropriate for an editor to change an article from one style to another unless there is a substantial reason to do so. I presume that our readers may know that the first style would be more common in England, where Fredrick day lives, and the second in the U.S. If I thought it an issue, I could revert those edits, on the grounds of probable sock edits. I've done that before with edits from this IP range. But I don't think I will. Waste of time. Anyway, for our purposes here, we just got a small possible confirmation, new activity in that range showing Fd characteristics. Far, far short of proof, just another straw on the camel's back. Poor camel. Main point is actually that, out of 10,000 edits, three IPS in the range, two or three editors. If, as Allemandtando claimed, I was "just fishing," this was awfully lucky to nail it with one cast. No, he knew what would happen, full well. If he was editing from the same range as Fredrick day, why didn't he just say so at the beginning? I pointed out a month ago that he was looking like Fredrick day. If he wasn't, don't you think he'd have looked at the sock puppet report, seen the IP and the ISP and location -- it's all given there -- and "Oh, my God! I'd better head this one off!" But he didn't, and I'll tell you why. He did not want the attention it would have drawn, he'd have been forced to go through the process of verifying identity a month ago that he attempted yesterday, and some admins and others would have been looking at him with, okay, so maybe he isn't Fredrick day, but, we'd better watch and make sure.

::Thanks for this response. I know you didn't have to do it for my sake (perhaps you didn't do it for my sake). My concern with the "Likely" statement was that the checkuser confirmation was based both on IP results and your behavioral evidence. In that case treating the probability of each being a false positive as independent of each other would have resulted in the erroneous conclusion that the result was more definitive that it really was.

::I probably will ask one of the checkusers for some definition of likely for these purposes. I'm sure what we have now is the most definitive it is going to get (or maybe it isn't), so I'm not sure where to end up thinking about KoC. It's not outside the realm of possibility that he made that account to avoid the block. In that sense it doesn't really matter to me. If he did make it to avoid the block, then we should just block him, but I'm left with the minor consolation that he didn't lie to me. He lied to you and to the project (assuming this SSP is correct), but not directly to me. That is a small consolation, but I'll take it. I'm sure he's watching this so this might spoil the answer I get asking him off wiki, but that doesn't really matter.

::I'm sorry for behaving as combatively as I did earlier on this page and on your talk page. I still feel strongly about your 'evidence' page but I shouldn't have opened or ended that discussion as I did. I should have opened with a real statement of concern and ended with a more civil tone. I don't want to go back and strike it through because it accurately reflects how I felt then. But I shouldn't have reacted the way I did. I don't mean this as a retraction for the factual claims and questions I raised. But I'm chastened by reflection on the subject. I felt that you were chasing a white whale and that your zeal was clouding everything you wrote. True or not, I should have remembered that Ahab's quest for vengeance was spurred by the loss of his leg. Protonk (talk) 02:20, 19 July 2008 (UTC)

About Coldmachine's block and the probably bad checkuser result.

User:Sticky Parkin wrote: ''The most excellent User:Coldmachine was blocked for weeks as a "likely" sock years ago, but later completely exonerated.

Okay, I looked. Not exactly a great example. [http://en.wikipedia.org/w/index.php?title=Special:Log/block&page=User%3AColdmachine block log].

  • 19:18, 5 July 2007 Jimbo Wales (Talk | contribs) unblocked "Coldmachine (Talk | contribs)" ‎ (apparent mistaken identity on checkuser)
  • 17:22, 14 June 2007 Akhilleus (Talk | contribs) blocked "Coldmachine (Talk | contribs)" (account creation blocked) with an expiry time of indefinite ‎ (sockpuppet, see Wikipedia:Requests for checkuser/Case/Emnx)

What had happened? The SSP report: [http://en.wikipedia.org/wiki/Wikipedia:Suspected_sock_puppets/Emnx_(2nd)]

Evidence that Coldmachine was Emnx was practically non-existent. The evidence was that SKRINE2 (reasonably strong evidence) had used the language used by Coldmachine in a previous AfD. Read the SSP report. Here was the conclusion and comments:

Conclusions

* User:SKRINE2 is a fairly obvious sockpuppet, having been created immediately after User:Emnx was blocked and immediately taking up the cause of deleting Mandrake of Oxford. Thus, SKRINE2 has been blocked indefinitely. The block on Emnx has been extended to 3 months for ongoing violations of WP:SOCK. I don't see convincing evidence regarding User:Coldmachine to conclude that he/she is a sockpuppet; the account's been around for awhile and edits a variety of topics. If there is further concern, checkuser may be appropriate. MastCell Talk 15:30, 5 June 2007 (UTC)

He wasn't kidding. I didn't see any evidence there at all, much less convincing evidence. However, the checkuser was done, and did come back "likely." Emnx = Arthana = Coldmachine. Complicating this is that Coldmachine and Arthana used totally spurious arguments against the ID. (But many users would. Just because you don't understand how checkuser works doesn't mean that you're a sock puppet!) Arthana had made an edit in which was typed "I am Coldmachine"[http://en.wikipedia.org/w/index.php?title=User_talk:Voice_of_All&diff=next&oldid=138130959], which may not have helped at all. Except that I'd be unlikely to consider that relevant at all. Arthana and Coldmachine were in the same region and may have had the same IP range, so that is a possibility.

There may have been other evidence floating around; I wouldn't have blocked Coldmachine based solely on the checkuser. For starters, if a user isn't misbehaving in any way, checkusering them is quite problematic. We don't really want to find returned blocked users who have reformed, who are not disruptive. I find it offensive to block someone who has come back, has contributed, isn't making trouble, then somebody finds that the person is a former blocked user.

But was Coldmachine innocent? God Jimbo Wales said so. Must be true, then, right? He also said that Mantanmoreland was innocent. Was he? Probably not. What I'm seeing here, though, is very thin. I don't see any clue that the checkuser was consulted about the unblock.

Wales commented to the blocking admin:

I unblocked Coldmachine because he was able to persuade me that he is not a sockpuppet of Emnx. The checkuser came back "probable" but the rest of the evidence seemed circumstantial. In any event, hopefully all will be well.--Jimbo Wales 19:20, 5 July 2007 (UTC)

I finally found the sock puppet page that was more direct, it was

Wikipedia:Suspected sock puppets/Emnx (3rd)

This is the report that resulted in block. The conclusion was made by Chaser. Very, very thin, essentially a single incident of timing, nothing else. Arthana remains blocked. No behavioral resemblance that I've been able to see.

My conclusion, tentatively: Wales was right. Coldmachine was improperly blocked. It's possible (1) the checkuser simply made a mistake, got confused. No way to tell. (2) lightning struck, they were using the same ISP and IP range. I'm leaning toward the checkuser making a mistake, dealing with several accounts at once, got confused. It's more likely, and there is nothing in the record that I've seen to contradict it.

Now, what does this have to do with Allemandtando? It shows that a checkuser report can improperly connect two editors. However, at "likely" it is quite unlikely, but possible enough that blocking based solely upon that would be problematic. However, the behavioral evidence with Allemandtando is much, much stronger than was present in the Coldmachine case -- which is comparable in power to less than a single element of coincidence that I've described, and I've described quite a few, and more appeared after checkuser was filed: Allemandtando's retirement being quite strong. I find it odd that the same editors, one the one hand, are clearly aware that Allemandtando is an experienced editor, surely are aware that he is pugnacious (that's what some like about him), and yet they behave as if this very aggressive editor was driven off by me saying "Boo!" I have given other reasons to have increased certainty: Allemandtando wasn't naive. He'd have known that IP evidence would look bad. He disclosed being a returned editor, I'm sure, because it was absolutely blatant once noticed. But he didn't volunteer it. Same with IP evidence. As a strong deletionist, he would have surely been quite aware of Fredrick day, and would have followed that. He'd have known that he lived in the same close area, and. If he was legitimate, all he'd have had to do was disclose that at the outset, thus saving the whole trouble of checkuser and forcing the whole thing to rely more on behavioral evidence. --Abd (talk) 02:20, 19 July 2008 (UTC)

::I think we are not going to get anywhere discussing the validity of checkuser. In this case, I could still argue that coldmachine's exoneration represented a rare case in two respects: checkuser was wrong and it was reversed. User:Le_Grand_Roi_des_Citrouilles was blocked for being a sock also (not sure the circumstances but he's got some explanation on his userpage) and later reinstated when the checkuser turned up wrong. We can list examples and counterexamples here but we will be spinning the hampster wheel. In this case I think we need to agree that evidence points toward alle being a sock but it isn't water-tight. I also think that the IP range suggestion is improper. We can't presume knowledge of the suspect then use that presumption to incriminate them--how do we know that alle knows an IP from a ham sandwitch? How do we know that he knew where fred day lived or what his ISP was (assuming they weren't the same person)? If he did know (and again, they weren't the same person) then why would he submit the claim that he was in the same IP range as the suspect. At the point of an SSP, that wouldn't really be an exonerating claim. And I can even reverse it. If FD (and by presumption, alle, if we assume they were the same person) was so sophisticated, wouldn't he have just made the claim (like you said) and obviated a checkuser? He could have done it using the previous FD checkuser info, but again we run square into that previous problem of selective presumption of intelligence/ignorance from the suspect. Protonk (talk) 02:37, 19 July 2008 (UTC)