[WikiEN-l] SlimVirgin and CheckUser leaks

[Abd ul-Rahman Lomax]

Well, since something here made me feel like screaming, maybe it's 
time I comment. First, though, yes, there are sensitive issues, and 
this may not be the best place to discuss this *in depth.* However, 
there is also little practical way, without doing a lot of damage, to 
prevent such discussion. So ....

At 04:58 AM 7/20/2008, SlimVirgin wrote:
>I don't feel I'm immune, but I do feel there should be a presumption
>against long-term contributors being checked, unless there are serious
>grounds to suspect abuse.

That's correct. Actually, there *is* a presumption against *anyone* 
being checked, unless there are grounds to suspect abuse. Being a 
long-term contributor is a possible reason to discount such 
suspicion, but, under some circumstances is irrelevant. There may be, 
and indeed I have some reason to suspect that there are, long-term 
contributors who have operated long-term sock accounts, carefully, 
using standard detection evasion methods.

There are four possibilities, first two: main account is not 
disruptive, sock account -- I'll define this as the newer one -- is. 
The reverse happens: main account was disruptive, sock account isn't. 
In both these cases there is some question as to whether or not we 
should bother with sock detection. The argument for detection and 
action is that if we merely deal with an block the disruptive 
account, there is a risk, then, that the other account will take up 
disruptive activity -- or will create a new sock, having learned that 
a disruptive sock can be created -- or a nondisruptive sock 
maintained -- without risk to the editors access. And the argument 
against detection is a common one: "Why are you bothering with this 
SSP report, the account isn't disruptive!" Frankly, I don't see a 
clear reason to prefer one of these arguments over the other, hence 
the circumspection that is described below.

>But I am not complaining about the check against me. I'm complaining
>about the check against the other two. I have their permission to
>explain further.

We cannot prevent this, and maybe its a good thing that it is coming 
out. This is *not* support for SlimVirgin's position, I have no clear 
opinion on that yet. And what I screamed about wasn't SlimVirgin's 
comment, exactly, but the situation that this whole report implies.

>Lar was (he said) contacted privately by Mackan79 [allegedly 
>harassing SlimVirgin] and was asked to
>perform a check on Wikitumnus and Crum375, on the grounds that they
>appeared to be sockpuppets. [on thin evidence according to SlimVirgin]....

Given how hard it's been, sometimes, to get a checkuser request on 
much stronger evidence, I'm a tad worried about this. However:

>It was on this basis that Lar performed a check of Wikitumnus a few
>days later at Mackan's request, later telling Wikitumnus and other
>checkusers and ArbCom members that there were grounds to believe that
>Wikitumnus was Crum. This is a clear fishing expedition, because there
>is *nothing* about that diff that would give rise to a suspicion of
>sockpuppetry. Wikitumnus had never edited the same articles as Crum,
>had never voted with him, had never supported him, had never shown up
>on noticeboards to comment on him, or anything else.

However, unstated here is whether or not Wikitumnus and Crum were 
disruptive editors. And a pattern of disruption could show 
similarities other than what SV mentions. But I have not checked, at 
all. I'm simply reacting to SV's report, at this point. Here is what 
the diff showed: three possibilities: Wikitumnus was watching Crum's 
Talk page, or Wikitumnus picked this up from Recent Changes as 
vandalism, or Wikitumnus saw another abusive edit by the IP, and 
looked at contribs, and saw the edit. Most likely: Wikitumnus was 
watching Crum's Talk, and that establishes a connection (particularly 
significant if the editors have had no obvious on-wiki connection). 
It *is* grounds for *mild* suspicion. By itself, not enough to file 
an RFCU, for sure. But if there were other grounds, that edit might 
indeed be cited as the primary evidence. If I have time, later, I'll 
look and see, there are certain obvious things to check that could 
help discriminate between the three possibilities.


>Personally, I have no problem with allowing checkuser to be used for
>fishing *so long as the policy makes clear that it may be so used*
>because then editors can arrange to use open or closed proxies if they
>don't want their real IPs to become known during random checks. What I
>object to is the policy saying one thing, and checkusers doing
>another.

A reasonable objection when privacy policy is involved, which is 
legally binding, at least in theory.

>When Lar performed his check of Wikitumnus, he discovered that it was
>an established editor who is well known to Lar, and who had abandoned
>their original account for various reasons. He knew *for certain* that
>this person was not Crum375. Yet he went on to peform the check of
>Crum anyway. If you want to say that, once he had checked Crum, he had
>reason to check me, then fine. Ignore the check of me. But his check
>of Wikitumnus was made on the flimsiest of grounds. And his check of
>Crum was made *on no grounds whatsoever*. That the request was made by
>a known troublemaker makes things even worse, but even if you ignore
>that too, you are left with two checks performed for no reason.

Shit happens. People make mistakes. And sometimes people do things 
out of intuition that look like mistakes and aren't.


>Lar compounded the error by telling his wife the real identity of
>Wikitumnus. Lar's wife is another Wikipedian, not someone Wikitumnus
>has had any contact with, and also not someone Wikitumnus would choose
>to reveal their identity to. Wiktumnus was extremely upset about that
>aspect of the incident, and it was a violation of the privacy policy,
>although not one serious enough that the Ombudsman Commission wanted
>to act on.

Sure. And my guess is that the President of the United States 
sometimes, in various presidencies, has told his wife about things 
that were by law confidential. That's a special relationship, and 
Wikipedia editors, including checkusers, are volunteers. They can't 
talk to their spouses? Should they disclose? No. But ... wet noodle 
time, and, if warranted, loss of CU privileges. But that hasn't 
happened, which seems to be why SV is upset. Is it warranted? By the 
way, I've already come to the scream part. I'll repeat it:

>When Lar performed his check of Wikitumnus, he discovered that it was
>an established editor who is well known to Lar, and who had abandoned
>their original account for various reasons.

I just managed to get a sock confirmed, who has claimed that he was 
just such an editor. (Abandoned original account for privacy 
reasons.) But was highly abusive. And I misread this, first reading. 
I've suspected that this particular editor, the one just blocked 
again, was actually a bad hand account for a long-term established 
user. No proof yet, which is why you won't hear much about this 
suspicion. Now, if I find proof, what will I do? File Checkuser? Not 
necessarily. It could be extraordinarily disruptive, and if the 
original account is not being used abusively, what's the harm? 
However, there might be an email or two sent ....!

>The result is that Wikitumnus felt they had to abandon their account.
>I recall an absolute storm when Durova blocked !!, an established
>editor who had abandoned his original account, but who felt his
>identity was compromised by the block. That is exactly the situation
>we have here -- an established editor with a new account is checked
>for no reason, and as a result feels unable to continue with the
>account in case their identity leaks out.

Yes. Bad situation. But something was left out. How did it come to 
pass that it was publicly disclosed what SV has revealed here? That 
part of the story is missing, perhaps it is so well-known that SV 
omitted it. What's the story?

>The question is why Lar is allowed simply to ignore the checkuser
>policy, and why, when he does, other checkusers support him in that.
>If there is no peer pressure on checkusers to conform to the policy,
>and there is no Ombudsman who can look at checkuser policy violations,
>the only protection we have is ArbCom. But (I believe) all ArbCom
>members have checkuser and are on the checkuser mailing list, so they
>could have acted against Lar when the issue was raised there (at my
>request, among others), but they didn't. They're therefore unlikely to
>act when it's brought before them in another venue.

SV is missing a couple of important facets of Wikipedia process. 
First, what ArbComm members do individually (even when communicating 
informally on a list) and what they will do when faced with formal 
deliberative process, evidence and arguments from the community, 
etc.,  are not necessarily the same thing. Second, Wikipedia does not 
punish. It doesn't withdraw privileges to "set an example," or to 
"pressure users to ..." do anything. Rather, it withdraws privileges 
when there is reason to believe that a serious error could be 
repeated. The argument SV is presenting is a continuation of an old 
debate, it's obviously never been resolved completely. Eventually, I 
think, we will deal with it conclusively.

>The bottom line is that editors are left with no realistic way to
>complain about a violation of the checkuser policy, which means that
>it may as well not exist.

Just not true. You can still file an RfC or RfAr, and only if that 
process fails, based on some apparent prejudice, could this be 
reasonably claimed. And, still, the user would have "complained" 
successfully. Further, users can question RFCU policy less 
confrontationally in Talk for the RFCU pages. They can discuss it on 
the Village Pump or AN/I. Or this list. No, users can complain. The 
question is whether or not anyone will listen to them. And there is 
no way to force that, short of cattle prods. What does SV suggest?

Look, I've been "complaining" about certain situations for the better 
part of a year. It's hard to get people to listen. And that is 
actually a good thing (I won't explain why); but it takes patience to 
move around it. I've been establishing my credibility, so that next 
time I bring up something less than obvious, people may look a little 
deeper. Or not. I can't force it, nor should I be able to. 
Ultimately, it's my goal to solve what I see as a structural 
communications problem on Wikipedia, and it would address, very 
effectively, I predict, SlimVirgin's apparent problem. But it isn't 
here yet. And won't be until conditions are ripe.