Wikipedia talk:Sockpuppet investigations/AndresHerutJaim

I've been canvassed twice by email by this same user over Israel related topics yesterday and today. Was surprised it wasn't blocked yet so I thought I report here. AncientWalrus (talk) 08:44, 27 October 2023 (UTC)[reply]

@KevinL I post here as I don't know how to add to the complex SPI in the correct way - on mobile it didn't give me a proper edit option. AncientWalrus (talk) 08:47, 27 October 2023 (UTC)[reply]

@AncientWalrus: Thank you for bringing this to our attention. A lot of disruptive behavior going on here these past few weeks and this needs to be tackled immediately. Could you please specify which articles and discussions you have been asked to participate in?

Also let me know what you wanted to add so I can add it on your behalf. Makeandtoss (talk) 10:22, 27 October 2023 (UTC)[reply]

These are the two emails: AncientWalrus (talk) 10:29, 27 October 2023 (UTC)[reply]

AncientWalrus (talk) 10:29, 27 October 2023 (UTC)[reply]

AncientWalrus (talk) 10:31, 27 October 2023 (UTC)[reply]

@AncientWalrus: Unfortunately the comments you posted are blank. Makeandtoss (talk) 10:38, 27 October 2023 (UTC)[reply]

@GnocchiFan: Thanks for reporting the canvassing email. Honestly this sockmaster is highly unlikely to be the work of one individual, but I don't have proof on that. What I do have proof on is that this sockmaster is highly disruptive to Wikipedia and has been engaging in mass canvassing nonstop for the past few months. This is the third publicized incident of canvassing, and it has affected sensitive move and other discussions across Wikipedia that are related to the conflict.

@HJ Mitchell: Is there anything Arbcom can do about this? I have been thinking about this for months and there are very few solutions, if any. The canvasser has nothing to lose since they can just make new accounts after being banned. The canvassed are not likely to report except in few cases. And the communications between them in emails are private. The only possible solution would be to disable email function for users engaging in ARBPIA3 articles, but I am not sure how this would be technically implemented. This is seriously affecting Wikipedia and it's clear from the army of editors that suddenly appear on a discussion with the same viewpoint. Makeandtoss (talk) 08:51, 22 January 2024 (UTC)[reply]

@Makeandtoss Thanks for sharing your thoughts. I share your concerns. As far as I know, the only thing ArbCom has been able to come up with is working with the WMF to restrict the number or frequency of emails that can be sent but that has obvious downsides and is easily evaded judging by the number of throwaway accounts involved here. HJ Mitchell | Penny for your thoughts? 11:35, 22 January 2024 (UTC)[reply]

@HJ Mitchell: Thanks for answering, I have a few more questions: Is ArbCom working on this from a specific case that was opened, or a more general approach? Was the restriction of email frequency been done across WP, or specific to editors in ARBPIA3? Has disabling the email feature been considered as an option, or mandating that editing in ARBPIA is only allowed if the email feature has been disabled for a specified time period? Honestly, this should be really addressed asap because if contact within this network is established outside of WP to evade these measures, then we will be facing a much larger problem with no solutions possible at all. Makeandtoss (talk) 11:39, 22 January 2024 (UTC)[reply]

I believe (I wasn't on the committee at the time this started) ArbCom got involved when several people started forwarding emails to the committee that they'd received from various AHJ socks (some already known and blocked, some not). I don't know of any technical measure restricting email that could be applied to just one topic, and the drawbacks of doing it sitewide probably outweigh the benefits. As to your last sentence, if the recipients of the emails replied (thus supplying their email address) that could already be happening. HJ Mitchell | Penny for your thoughts? 11:49, 22 January 2024 (UTC)[reply]

@HJ Mitchell: I mean the least that could be done is to limit the damages. Should I file an ARBCOM case, or maybe better even emailing them privately to discuss? Makeandtoss (talk) 11:54, 22 January 2024 (UTC)[reply]

You could raise it at

WT:ACN. Your questions about what we can do to prevent future canvassing would seem to fit nicely alongside discussion of a motion that sanctioned editors for their response to the canvassing. That said, the answer is likely to be that (from a technical perspective) there's not much we can do. HJ Mitchell | Penny for your thoughts? 12:01, 22 January 2024 (UTC)[reply

]

I didn't know what had happened, thank you for pointing me out to it. Hopefully more can be done to deal with this issue. Makeandtoss (talk) 21:07, 22 January 2024 (UTC)[reply]

To editor Makeandtoss: Are there specific things you can describe that lead you to suspect that "this sockmaster is highly unlikely to be the work of one individual"? We don't have great visibility into the actual state of affairs. We are probably missing a lot of non-extendedconfirmed socks judging from the sock creation frequency information we have for blocked socks. But we do have a lot of information about the sockmaster's actions on wiki and they don't seem to exceed the capabilities of an individual as far as I can tell. I could very easily be wrong of course. I'm interested in how he selects people to canvass. He seems to be casting a wide net. Understanding that could be quite useful. It's unfortunate that there isn't information about the full set of recipients for one or more example emails. It would also be useful to know when the canvassing started (I think 2021 is the earliest mention I've noticed) because it might tell us something about the potential side-effects of things like 30/500 requirements. Sean.hoyland (talk) 15:12, 22 January 2024 (UTC)[reply]

@Sean.hoyland: Thank you as well for taking this seriously because this is really disruptive to WP; the amount of discussions that have been distorted is just too large, not to mention the time that has been wasted by both editors and admins on dealing with this issue. As you mentioned, indeed they are casting a wide net. I am not sure either when the canvassing started, but in past two months it has got incredibly disruptive. I have got a few (ambiguously related) things to say about this whole issue so bare with me:

1- AndresHerutJaim has 200 confirmed sockpuppets, and 101 suspected ones! I cannot imagine that a person so obsessive exists; one that creates, maintains and manages hundreds of emails and users over a decade, editing random articles just to reach the ARBPIA 500 edit threshold in each account.

2- As for other suspected sockpuppets, I previously filed an investigation that had overwhelming signs of sockpuppetry, but unforunately led nowhere: [1].

3- The problem is that new users keep popping up in such speed that no one can really keep up. I have noticed now they are putting effort into making their userpages less suspicious, by claiming to be from the UK for example: [2]; this account was made on 16 November 2023, and barely reached 500 edits when they suddenly started editing ARBPIA in a very biased way.

4- I have also previously raised concerns about Dovidroth (now banned due to canvassing and proxy editing) as he is a government employee [3], but unfortunately nothing came out of this either at the time. There are many precedents to very similar disruption to WP : [4]. Makeandtoss (talk) 21:07, 22 January 2024 (UTC)[reply]

To editor Makeandtoss: I'll try to respond with a bit more detail later, but regarding the number of AHJ detected sockpuppets, it really depends on how you count it. One of the problems with the information we have is that it difficult to create a completely clean dataset. Some blocked accounts may have been misassigned to AHJ as sockmaster. There are a number of sets of accounts where I don't have high confidence that the correct sockmaster was assigned. Either way, using various criteria looking at categories and ipblock comments by admins after cu blocks etc, it's more like 930 socks (with the caveat that I'm looking at a replica database that has no 2024 data). Here's a preliminary timeline with links out to the account contributions for interest. Sean.hoyland (talk) 05:12, 23 January 2024 (UTC)[reply]

To editor Makeandtoss:

• Regarding point 3-, I would urge caution, an assume nothing approach. I'm not a fan of the AGF policy personally because I did some analyses years ago that convinced me that it was not the optimum strategy in ARBPIA when the sock population is high. But that was before the 30/500 rule was introduced so I'm not sure whether it is still valid. Either way, AGF is a guideline not policy. It's better to let evidence-based SPI reports speak for themselves.
• On the account you have highlighted, allow me to present a possible counterargument for the defense.
  • Some background first. I'm interested in the notion of "gaming" in the context of the ECP 30/500 restriction. There is a lack of clarity on how to recognize ECP gaming, whether it even matters or is a side-effect of the policy that benefits Wikipedia (for the first 500 edits anyway). There have been several discussions. They haven't really resolved things, leaving admins like @ScottishFinnishRadish: without a community approved heuristic (although maybe that's a good thing). See the Gantuze gaming ECP) discussion for example.
  • Can we distinguish between ECP gaming by socks and ordinary editing? Maybe, sometimes... If, for example, you select 10 accounts active in ARBPIA created after the 30/500 rules were introduced, anonymize them and plot the page byte size change signals for first 600 edits (or less), can you tell which ones were later blocked as socks, who also happen to have first-600-edit signatures that perhaps look like an ECP gaming signal?
  • By the way, for interest, I have included the editor you have reservations about as one of those plots and they are not one that resembles ECP gaming to me. Sean.hoyland (talk) 07:59, 23 January 2024 (UTC)[reply]

@Sean.hoyland: Seems to me the ECP gaming signal is present most probably in 2, 5, 6, and 7. What would you think?

On the other hand, I think there is an important point that is being missed: the idea that socks are learning from their mistakes, and changing their tactics to avoid being identified again. So while these signs are useful, we should not be totally focused on them, and allow ourselves to look with a critical eye towards patterns and behaviors, many of these signs are detailed in the sockpupptery guideline. I've seen it with Dovidroth for years, and now they are topic banned. I've seen it with Homerethegreat, and now they're topic banned. And now as a result of the increased disruption that has been occurring for the past few months, I might be now excessively critical, but that's just a natural reaction. Although WP codes and guidelines are fairly straightforward, it is really unlikely for a user to suddenly pop up, knowing how to edit and cite references, and then suddenly jump to editing ARBPIA topics in a really biased way.

As for the issue of canvassing, I think it's a more pressing problem. There really needs to be disabling of the email function for ARBPIA users, which would prevent canvassing on both sides. Or at least WP could collect information on which users are sending emails to which users, with privacy for the message sent of course. The communication component is the only aspect that could be tackled. I have had the email function enabled for 10 years and I only received one email, so it's not really a special feature (except for the canvassers). Makeandtoss (talk) 10:01, 23 January 2024 (UTC)[reply]

To editor Makeandtoss: Correct. 2, 5, 6, and 7 are all accounts blocked as AHJ/Yaniv socks - LeMamba, Eastern Geek, Shuvam Koleyri and General Blorp. Those are the only socks I included. The remaining plots are all for active accounts. Sean.hoyland (talk) 12:10, 23 January 2024 (UTC)[reply]

Socks are definitely learning from their mistakes, changing their tactics and adding new tools e.g. casting wide canvassing nets to see whether they can catch a few fish. Meanwhile, Wikipedia is not really adding new countermeasures to its toolkit.

• As for pattern recognition, we are too good at it, we hallucinate patterns like large language models hallucinate wrong facts, but we do it with a huge dose of confirmation bias. That's why I favor a more detached technical approach because it's more reliable, is likely to produce better SPI results, and, crucially, it has no dependency on where someone falls of the pro-P to pro-I spectrum editing-wise.
• Countermeasures for canvassing seems like a tough nut to crack. I've always had my email enabled and I've never been canvassed. I would personally prefer better visibility into the canvassing network over disabling email i.e. encouraging people to report it whenever it happens. Either way, it creates a selection pressure to establish networks that not dependent on Wikimedia's messaging systems.
• Given that the canvassing relies on non-extendedconfirmed accounts, I do wonder whether not allowing non-extendedconfirmed editors to watchlist pages under extended confirmed protection would have an impact. If a sockmaster could only use an extendedconfirmed account to monitor changes to ARBPIA related content via a watchlist, it might make their non-EC based part of their operation more complicated and cumbersome because they may not have good visibility into recent changes in the topic area. But that relies on ensuring that extended confirmed restrictions are more fully and consistently implemented across the topic area, and that is another story, measuring the mismatch between
  WP:ARBECR rules and EC restrictions in practice (which is substantial as far as I can tell having looked at a few categories). Sean.hoyland (talk) 12:21, 23 January 2024 (UTC)[reply
  ]

@Sean.hoyland: If I were a sockmaster operating accounts 2, 5, 6 and 7, having seen how easily I get identified due to my editing patterns, then I would naturally begin to game the system by appearing to edit in a consistent manner from the start.

About confirmation point, that's a good point, and you are probably right. Since SPI is a detached technical tool, then we could at least maybe loosen the criteria for a IP check for example.

Also another good point regarding pressure to establish off-wiki networks. So maybe the solution is to monitor these communications; which user sent which user an email and at what time (info only seen by ArbCom) as this would be extremely helpful in quickly identifying canvassing and preventing disruption to discussions.

The watchlist is an interesting solution but note that it isn't very effecitve since they could prioritize a few articles, or actually put all of them bookmarked. But it definitely makes things harder nevertheless without backfire so it is a good idea. Makeandtoss (talk) 12:47, 23 January 2024 (UTC)[reply]

To editor Makeandtoss: Regarding your first point...

• The obviousness of an ECP gaming signal gives me hope for a number of reasons.
  • It's possible to generate those signals at scale, for all editors (of important articles for example) who registered after ECP was introduced. And I really don't know what the results would look like because I haven't tried it yet. It could be interesting, perhaps a way to scale up sock identification. Most of it seems to rely on people's Spidey-sense at the moment.
  • Gaming the system by appearing to edit in a consistent manner from the start and having to think about the shape of that signal could have a high cost for the sockmaster, and it would benefit Wikipedia because the edits are usually constructive. In fact, if it were up to me, if I discovered an ARBPIA related sock that had not yet reached 500 edits, rather than block them, I would prefer to be able to set a database trigger that blocked them once they reached 500 revisions.
  • It's not clear to me yet how much useful information is in these kind of signals. It could be quite a lot. Those plots are just one way of displaying the information, as a signal in what is essentially a compressed time domain in that each edit is just assigned a sequential number. But there are many other domains and ways of representing the information, in the real time domain, the frequency domain, as color-coded bar codes etc. that might be useful. I'm not sure how easy it would be to game it convincingly in all of the domains. The sockmaster risks turning into an actual normal productive editor. Another thing is that these signals look amenable to supervised machine learning to me, although there may not be enough good training data. There is so much more information about editors' actions that could also help, who knows.
• Good point about the bookmarked articles. Another weakness is that it's probably not that difficult to generate a watchlist by other means, via the API for example. Sean.hoyland (talk) 15:12, 23 January 2024 (UTC)[reply]

@Sean.hoyland: Fair points. Anything can be done about the emails thing, like collecting basic information about communications? Makeandtoss (talk) 11:16, 24 January 2024 (UTC)[reply]

@Sean.hoyland: Another possible match? User:פעמי-עליון Makeandtoss (talk) 11:43, 1 May 2024 (UTC)[reply]

Seems unlikely. פעמי-עליון is very active in Hebrew Wikipedia (and Commons). I'm not sure AHJ knows much, if any, Hebrew. Sean.hoyland (talk) 11:50, 1 May 2024 (UTC)[reply]