Steward requests/Checkuser

From Meta, a Wikimedia project coordination wiki
< Steward requests(Redirected from SRCU)
Jump to: navigation, search
Requests and proposals Steward requests (Checkuser) latest archive
Checkuser icons
These indicators are used by CheckUsers and stewards for easier skimming of their notes, actions and comments.
{{Confirmed}}:  Confirmed {{MoreInfo}}: MoreInfo Additional information needed
{{Likely}}: Likely Likely {{Deferred}}: Deferred Deferred to
{{Possible}}: Possible Possible {{Completed}}: Completed Completed
{{Unlikely}}: Unlikely Unlikely {{TakeNote}}: Note Note:
{{Unrelated}}: Unrelated Unrelated {{Doing}}: Symbol wait.svg Doing...
{{Inconclusive}}: Inconclusive Inconclusive {{StaleIP}}: Stale Stale
{{Declined}}: Declined Declined {{Fishing}}: Fishing CheckUser is not for fishing
{{Pixiedust}}: Pixiedust CheckUser is not magic pixie dust {{8ball}}: 8ball The CheckUser Magic 8-Ball says
{{Duck}}:  It looks like a duck to me {{Crystalball}}: Crystalball CheckUser is not a crystal ball

This page is for requesting CheckUser information on a wiki with no local CheckUsers (see also requesting checkuser access). Make sure to follow the following instructions, or your request may not be processed in a timely manner.

Before making a request:

  1. Make sure you have a good reason for the check. It will only be accepted to counter vandalism or disruption to Wikimedia wikis. Valid reasons include needing a block of the underlying IP or IP range, disruptive sockpuppetry, vote-stacking, and similar disruption where the technical evidence from running a check would prevent or reduce further disruption.
  1. Be specific in your reasons. Ambiguous or insufficient reasons will cause delays. Explain the disruption and why you believe the accounts are related, ideally using diff links or other evidence.
  1. Make sure there are no local checkusers or policies.
  2. Please ensure that the check hasn't already been done:

How to make a request

How to make a request:

  • Place your request at the bottom of the section, using the template below (see also {{srcu}} help).
    === Username@xx.project ===
    {{CU request
     |status          = <!--don't change this line-->
     |language code   = 
     |project shortcut= 
     |user name1      = 
     |user name2      = 
     |user name3      = 
    <!-- Max 10 users -->
     |discussion      = [[Example]]<!-- local confirmation link / local policy link -->
     |reason          = Reasons here. ~~~~

    For example:

    === Example@en.wikipedia ===
    {{CU request
     |status          = <!--don't change this line-->
     |language code   = en
     |project shortcut= w
     |user name1      = Example
     |user name2      = Foo
     |user name3      = Bar
    <!-- Max 10 users -->
     |discussion      = [[:w:en:Example]]<!-- local confirmation link / local policy link -->
     |reason          = Reasons here. ~~~~
  • Specify the wiki(s) you want to perform the check on.
Cross-wiki requests
Meta-Wiki requests


Gris med vinger@no.wikipedia[edit]

@4ing: for future reference purposes, please mention "Funkybeatnick" as that is the primary case as has been recorded, and that will save some to'ing and fro'ing over steward involvement. Also please only enter new usernames into the template, we cannot check old accounts and the additions of old usernames becomes noise. The harder that you make the request even experienced stewards will shy away from confusing checkuser requests.
  •  Confirmed socks — Gris med vinger, Jass Viserguttene, Ticqli, Inrej, Illasutl, Jobinkado; very Likely Likely Vanntanke to be aligned with the first, similarly with Trillobrist, and Kevin Cadilac
  •  Confirmed socks — Jkbuer, Øyeren, Nefer1010, Franzzen, Ekspat, Beerbroker (noting that this is a separate sock set, and no evidence associated with the other accounts); Likely Likely Xibatee
 — billinghurst sDrewth 13:46, 21 November 2015 (UTC)
Above you have mentioned some IP addresses editing, publicly available tools will show that those are Norwegian mobile provider operating in the ranges, and Your community may find it useful to approach the provider to ask them for their process to report and have them action abuse and vandalism reports. If your community was to look to place blocks on those ranges, then I would suggest that you start with soft blocks that prevented creation. Any block will have consequences on other users, so a hard block would be a bridge too far. If you went down that track you may also wish to have a process to manage unblock and creation requests. There would be some leg work involved though if, as you indicate, the IP spam/vandalism is coming from that range then it would produce a lessening of your quality problems.  — billinghurst sDrewth 13:57, 21 November 2015 (UTC)
@Billinghurst: Thanks a lot for your advise regarding how to write better CU requests, and also for taking your time to perform this CU. Both sock sets include a couple of username's that I have paid some attention to, and edit patterns clearly indicate that at least the first set should be ragerded as confirmed socks. For the second set I'm less sure. Jkbuer has a couple of edits back in 2007, before taking up edits in October 2015. Based on the user name, I am pretty confident that I can identify the user (at the University of Oslo). Franzzen has editied similar topics as Jkbuer, but might be a fellow. Franzzen and Ekspat have also been editing on a common article. Øyeren and Xibatee participated in the same AfD discussion. However, I strongly doubt that all the accounts in the second set belong to the same person.
I don't think it will be necessary to set up a range block, but it would be helpful if you could confirm whether the first sock set is conntected to the mentioned IP ranges. - 4ing (talk) 18:17, 21 November 2015 (UTC)
@Billinghurst: Just so this is clear; you confirm that Kevin Cadilac, Vanntanke and Trillobrist are all sockpuppets of Sju hav? Where there are several years since Sju hav was active? I want an explicit confirmation on this, and an explicit clarification how this is achieved. — Jeblad 22:45, 21 November 2015 (UTC)
@Jeblad: Checkuser is only sets of data, it cannot identify people, plus there is zero data that I can see for the user Sju hav. If records for the person exist, they will only be in people's personal archives, for example, your previous checkusers. I have no personal knowledge in this area, so there is no such aligning statement from me above. I can only talk about data that I see today, and for the past three months. I am saying that there is definitive (beyond reasonable doubt) information for the first listed set, and likely association (balance of probability) with the following three accounts. I cannot tell you if the English Wikipedia checkusers have definitive proof or likely association on the user though I have privately put some questions to them.

Checkuser data has levels of security, however, for known and persistent vandals there is scope to assist to block, and to assist trusted users to tackle this issue with internet service providers, who ultimately can work with us or explain to their customers why restrictions are in place.  — billinghurst sDrewth 23:52, 21 November 2015 (UTC)

@Billinghurst: Note that 4ing is using this CU as a proof that these users are the user Sju hav. This has been going on for some time, and I've been less and less confident that there are any connection between those users at all. Very few ISPs in Norway provide static IP addresses, and those who do mostly provide this service to companies, schools, colleges and universities. This makes me think that you are simply doing CU against some large school network. — Jeblad 14:21, 22 November 2015 (UTC)
Please don't make false accusations, Jeblad. I have explained to you several times that the blocks are based on studying edit patterns, and CU has only been used as supporting evidence. I know perfectly well that CU is not able to show that a current user is identical to a user blocked seven years ago. It might be that the ~50 SPI cases on en:wp can be used to link accounts over a long period from CU data, but I dont' haven't looked systematically into that. What I have studied, is the edits of 300+ sockpuppets on en:wp and 200+ on no:wp. - 4ing (talk) 20:24, 22 November 2015 (UTC)
Ok, I'll post some entries from the blocklog. The summary reads "Sokkedukke som omgår blokkering: Bruker:Sju hav" ("Sockpuppet that avoids block: User:Sju hav"). — Jeblad 10:52, 25 November 2015 (UTC)
Yes, CU supported the behavioural evidence. - 4ing (talk) 13:59, 25 November 2015 (UTC)

Németek and others[edit]

@DerFussi: For dewikivoyage Would you please link to a policy or discussion that does not allow to multiple accounts on your wiki prior to my publishing any results. Thanks. dewiktionary will need to approach stewards if they have a similar concern, though they will need to again show their policy, but they can join this case if they believe that we have crosswiki issues.  — billinghurst sDrewth 14:49, 21 November 2015 (UTC)
@DerFussi: Rather than start a CU request here, have you considered a direct conversation with the person about your concerns and any relationship between accounts?  — billinghurst sDrewth 14:59, 21 November 2015 (UTC)
I think, we don't have such policy. (Do all other wikis have that?) And no, there is no one at the moment for that discussion you've asked for. The reasons one can find in all the discussions we had over the last months with the named accounts and in our private lifes: We are just a very small group of active admins and we all have been involved in concerns of wikivoyage over years during the migration to the WMF until now. Most of us have to shift their priotities to private life now urgently, and we just want to clarify the situation for a moment, that new admins can take over. But if there are concerns on meta helping us in that situation, so we have to fit in. No idea, what we can do, if Fussis concerns are qualified. Hope they will not become to reality, the elections started yeasterday. Thanks for your time, --Tine (talk) 09:03, 22 November 2015 (UTC)
The policy is stated here: "Ein missbräuchliches Vortäuschen unterschiedlicher Identitäten kann einen schwerwiegenden Regelverstoß darstellen, etwa bei einer Sperrumgehung, bei der Fälschung von Wahlen durch mehrfache Stimmabgabe oder bei Manipulation von Diskussionen durch Vortäuschen von Mehrheiten, und zu befristeten oder unbefristeten Sperren führen."
Translated: An abusive feigning different identities of the same person may be a serious offense, such as a lock bypass, with the falsification of election by multiple voting or manipulation of discussions by feigning of majorities, and lead to temporary or permanent blocking. --Bernello (talk) 09:46, 22 November 2015 (UTC)
Thanks Bernello. Time to change jobs. ;-) --Tine (talk) 14:57, 22 November 2015 (UTC)
Never trust a beautiful woman ;-)
@billinghurst This IP-ranges and the additional user seems to be related to, or the same user(s) above mentioned:
user:De ausputzers , written with a protected space in between (& nbsp ;)
2003:7A:4778:AD41:89B5:6354:49A4:6C4A 20:17, 17. Okt. 2015 (CEST)
2003:7A:4778:AD41:7C89:2762:52A8:FCAD 20:44, 18. Okt. 2015 (CEST)
2003:7A:4778:AD41:C1D9:C7E8:97D4:C67E 20:45, 1. Nov. 2015 (CET)
2003:7A:4778:AD41:2058:3AB5:2B2C:76B1 09:48, 2. Nov. 2015 (CET)
2003:7A:8526:801D:970:B273:4963:EFCF 09:30, 10. Nov. 2015 (CET)
2003:7A:8500:C884:D538:D40E:89A7:2194 21:19, 13. Nov. 2015 (CET)
Maybe this will help your investigations, greetings --Bernello (talk) 17:54, 22 November 2015 (UTC)

See also[edit]