Misplaced Pages

Revision as of 11:47, 8 September 2024

Icewhiz

Icewhiz (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)

Populated account categories: confirmed · suspected

For archived investigations, see Misplaced Pages:Sockpuppet investigations/Icewhiz/Archive.

27 August 2024

– This SPI case is closed and will be archived shortly by an SPI clerk or checkuser.

Suspected sockpuppets

• O.maximov (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• UnspokenPassion (talk · tag · contribs · deleted contribs · logs · filter log · block user · spi block · block log · CA · CheckUser(log) · investigate · cuwiki)
• Tools: Editor interaction utility · Interaction Timeline · SPI Tools

I've suspected for a while that O.maximov and UnspokenPassion were socks, but I wasn't sure who the master was. When I read Sean.hoyland's recent comment linking to this chart, which lists O.maximov and some IW socks, I checked some IW socks and found similarities.

Mvqr was blocked as an IW sock on Jan 20, 2024. O.maximov was created Feb 8, UnspokenPassion Mar 28.

The timecards of O.maximov and UnspokenPassion match each other, and also match the timecards of some confirmed IW socks, e.g. Mvqr, Hippeus, and Geshem Bracha.

As a sort of baseline example, note the similarity of POV, language, and "drive by" editing pattern of confirmed IW socks Hippeus and Geshem Bracha at Talk:Israel:

• Hippeus ("Already covered sufficiently ... The lede devotes ridiculous amount of space to the conflict while omitting other content.")
• Geshem Bracha ("Already excessively covered. There is too much on the Arab-Israeli conflict in the lead. Much too much. The content needs to be reduced, not increased, as there are many other topics that are missing from the lead.")
• Both of those are votes to exclude criticism of Israel's occupations/annexations from the lead of the article
• That is Hippeus's only edit to the article talk page, no edits to the article itself
• Geshem Bracha has 3 edits to the talk page: the one above, another one about not mentioning settlements, and this one about the Palestinian-Nazi connections; their only article edit was to remove content about illegality of Israeli settlements

O.maximov and UnspokenPassion show the same basic POV, similarity of comments, and "drive-by" habit, as Hippeus and Geshem Bracha. Examples:

• Israel
  • O.maximov ("if the Israeli War of Independence isn't mentioned, then it makes no sense to mention the Nakba")
  • UnspokenPassion ("If we include Nakba, we’d have to bring in more narratives, like the Independence War, as mentioned above.")
  • This is the only edit UnspokenPassion has made to the talk page, no edits to the article; O.maximov has edited both
• Genocide of indigenous peoples
  • O.maximov ("We're looking at two groups, both with historical ties to the land, both claiming indigenity.")
  • UnspokenPassion ("The Israeli-Palestinian conflict is generally understood as a struggle between two ethnic groups, both laying claim to being indigenous.")
  • These are the only edits either account made to that article's talk page. O.maximov made one edit to the article; UnspokenPassion has made no edits to the article.
• Palestinian suicide terrorism - an article created by UnspokenPassion
  • UnspokenPassion ("... the term 'terrorism' is entirely appropriate (for instance, see examples like Islamic terrorism, Jewish extremist terrorism, etc.).")
  • O.maximov ("It is unclear to me why there are calls to remove the term from this article while its usage in the above mentioned articles like Jewish extremist terrorism, Islamic terrorism, and, I will add, Israel and state-sponsored terrorism is accepted.")
  • This is the only edit O.maximov has made to this article or its talk page

FWIW, EIA turned up two articles where Mvqr's only edit was to revert a change, which O.maximov later expanded: Economy of New York City (EIA) and Knowledge economy (EIA)

There are other accounts that I believe are also socks, but O.maximov and UnspokenPassion are the ones where I have the clearest evidence. I don't know if this is enough evidence to warrant further investigation but I figured I'd start here. If this is enough and reviewing admin want to see more, I can post more. If this is not enough then it's probably not even worth me bringing up any other suspicions I have. Thanks for taking a look, Levivich (talk) 19:24, 27 August 2024 (UTC)

Comment by ABHammad

@HJ Mitchell:, I have to say this is one of the weakest sock-puppet blocks I have ever encountered. The block seems to be based only on the fact that two accounts agreed on several topics, worked during similar timeframes (shared by an entire hemisphere), and shared some interests with a third blocked user (in a totally speculative way). If those were valid criteria, we could block half of the active, experienced editors in the ARBPIA area.

To me it is pretty clear that these editors are not the same person, and I don't see any strong connection to Icewhiz's editing either. Their writing styles (compare O.Maximov's and UnspokenPassion's ) and edit summaries differ, and so their main topics of interest. Both have created new articles that look completely different (compare UnspokenPassion's Palestinian suicide bombings and O.Maximov's Video game industry in Israel and Bank of Israel Law).

The circumstances surrounding this complaint are also extremely questionable. The filer, Levivich, has previously expressed strong opinions on the topic ("We are witnessing the last gasps of Zionism") and has recently filed complaints against any editor with fewer than 1,500 edits who disagrees with their views. The last of those was now dismissed as "unconvincing" and escalated to ARBCOM by four admins for a broader discussion on the conduct of all parties involved, including Levivich themselves. The rush to delete this editor's contributions right after the block shows exactly what I'm concerned about, and once I said this block seems wrong, Sean.Hoyland was quick to attack me too with heavy aspersion castings . I think that proves my point well.

If every new editor on this topic is automatically labeled as a sockpuppet by the existing experienced editors and quickly blocked without evidence, the current problematic situation will never improve. If this continues, with new editors being blocked as socks without solid evidence again and again, it might be fair to say that Misplaced Pages is finally ruined. This block should be overturned unless stronger evidence is presented. ABHammad (talk) 07:56, 3 September 2024 (UTC)

Tagging the referring admins: @Red-tailed hawk, @ScottishFinnishRadish, @Barkeep49, @Theleekycauldron. I would appreciate your feedback on this matter. This case appears to be a direct continuation of recent events. ABHammad (talk) 07:59, 3 September 2024 (UTC)

@ABHammad the behavioural evidence was almost "by the way". It's enough to justify a check. What I found when I performed the check was consistent with a sophisticated bad actor. We have several of those and these accounts have been careful to obfuscate their identity so I can't say conclusively that they're Icewhiz but they are very clearly not good-faith new users. HJ Mitchell | Penny for your thoughts? 11:10, 3 September 2024 (UTC)

@HJ Mitchell. As I said above, I am pretty confident these are different editors for the reasons I provided, and I don't see the link to Icewhiz. I'm unsure what else could define someone as a 'sophisticated bad actor,' especially since I haven’t seen any violations from O.Maximov that are worse than what's already occurring in this area (or any violations from UnspokenPassion at all). If we continue removing every new user using a VPN on the slim chance they might be socks, we're only perpetuating the existing issues. At a minimum, I believe the blocks should be overturned until a more thorough review is conducted and stronger evidence is presented. ABHammad (talk) 14:00, 3 September 2024 (UTC)

@HJ Mitchell, I'll appreciate some input here. ABHammad (talk) 11:47, 8 September 2024 (UTC)

Comment by Sean.hoyland

ABHammad, I only asked you whether you used to edit as Tundrabuggy/Stellarkid. It's because I'm looking at results like these that suggest your account is a close match and would like to know whether they are accurate. Are they? Help a brother out. Sean.hoyland (talk) 08:15, 3 September 2024 (UTC)

And by the way, that's not me casting aspersions, that's functions in high dimensional metric spaces casting aspersions, so blame math. Sean.hoyland (talk) 08:30, 3 September 2024 (UTC)

Red-tailed hawk, yes, sorry about that. The plots aren't really built for public consumption. There's a bit of background here as RoySmith asked me about it related to an Irtapil sock case.

• There are legends at the top of each plot, but that probably doesn't help much.
• Each plot has 6 rectangular areas, 2 at the top, 2 at the bottom and the longest 2 in the middle. To keep things simple, you can ignore everything apart from the large middle area on the left.
• That area is made of a series of rows. Each row is a Misplaced Pages account. The area contains information about how much each account resembles the reference account e.g. ABHammad. By 'resembles', I mean how close or similar are vector representations of the accounts in various metric spaces. The closer the color is to the left side of the colorbar of the legend, the closer or more similar the vectors are to each other. The reference user will be pink because it resembles itself.
• Each plot uses a different method to compare vectors.
• The machine decides the details of the colorbar e.g. where it transitions from color to monochrome etc. automatically based on the statistics of the spaces.

So, rows (accounts) with colors towards the left side of the legend colorbar for each plot are the accounts that mostly strongly resemble the reference user.

• There is a bit more going on than that for each row (account) in the plot because they are made up of many cells, and each cell represents a different vector representation of the account, but that is getting into the weeds.
• Let's say, if accounts resemble each other, the colors of the cells in a row will tend to move towards the pink end of the spectrum as you move along the row to the right. So, if you look at the ABHammad row you see that it becomes pinker towards the right. That's it in a nutshell.

The test dataset currently looks at about 320-ish accounts made up of active accounts, blocked accounts, a few admin accounts (for sanity checks). It mostly focuses on accounts with activity in the PIA topic area but there are quite a lot of accounts that don't edit in the topic area too (again for sanity checks).

Caveats

• This is a work in progress out of curiosity, an idea that I thought wouldn't work that maybe/might work to provide pointers or likelihoods to help shrink the search space for sockmasters.
• I have a near zero credence in the results right now because I don't have enough data on resolution or reliability.
• As it has grown, I no longer fully understand what it is doing internally to match accounts e.g. the FourPi to Irtapil sock matches.

Sean.hoyland (talk) 04:15, 4 September 2024 (UTC)

I should add, as there is no limit to my pedantry, that one of the legend titles is a bit misleading. For the one that says cosine similarity I actually use 1 - cosine similarity so that increasing vector resemblance tends towards zero rather than one. Sean.hoyland (talk) 06:04, 4 September 2024 (UTC)

Just wanted to make a quick comment about these 2 accounts being blocked. It seems highly likely that there are several other undetected Icewhiz socks operating in the PIA topic area. If you look at the timeline for the subset of accounts that have been identified and blocked, two things are notable.

• For any given time period, they operate many accounts in parallel. I assume this is common knowledge.
• Many accounts probably remain undetected. Imagine drawing a straight line connecting the account registration dates on the timeline plot. There is a very obvious change of slope for the section between 2021 to present. The slope is much shallower. There are at least 2 explanations, 1. Icewhiz is creating fewer socks or 2. many accounts have not been detected (obviously detection would increase the slope). Option 1 seems highly unlikely. Sean.hoyland (talk) 07:03, 6 September 2024 (UTC)

Comment by Eladkarmel

As I wrote in the discussion about Tombah, it doesn't seem logical to me that any editor who does not align with the anti-Israel views, is accused immediately and blocked almost without discussion and almost without evidence. I myself was wrongly accused of being a sock puppet by some editors here but it was later proven this was wrong. I almost completely left English Misplaced Pages because it is very difficult to be an Israeli who is identified as Israeli here. Please, rethink the blocks, and assume good faith. Eladkarmel (talk) 16:09, 3 September 2024 (UTC)

Clerk, CheckUser, and/or patrolling admin comments

• I'm reluctant to draw definitive conclusions here but the behaviour is consistent with previous IW socks and CU data shows that both of these accounts are unusually sophisticated in obfuscating their IPs. Both are using proxies and are very careful not to overlap. I'm gonna call this  Likely and block both. Input from more experienced CUs would not be unwelcome. HJ Mitchell | Penny for your thoughts? 22:17, 2 September 2024 (UTC)

  @ABHammad: The only one of the four admins you pinged who might be able to take a second look at this is Barkeep49, since he is a checkuser and the block to a good extent appears based also on technical data. The non-CU admins (like myself) are not fit to review this sort of block due to lack of access to the relevant private information used when deciding to make the CU block itself. — Red-tailed sock _{(Red-tailed hawk's nest)} 09:24, 3 September 2024 (UTC)

  I'm actually no longer a checkuser (though I was thinking yesterday of picking it back up since there have been more instances than I had expected where I would have found that I'd have used the tools). That said I do have a fair amount of experience with Icewhiz socks and would be unsurprised that there was sophisticated socking done by Icewhiz that HJ Mitchell was able to find. Barkeep49 (talk) 14:43, 3 September 2024 (UTC)

  My apologies for missing that part. — Red-tailed hawk _(nest) 02:13, 4 September 2024 (UTC)

  I will also note that it is not at all unusual for involved parties to make SPI reports, and this is not a bad thing. The sorts of people who might naturally notice a pattern of editing shared between a sock and master are likely going to be those who have interacted with both at some point. — Red-tailed sock _{(Red-tailed hawk's nest)} 09:26, 3 September 2024 (UTC)

  @Sean.hoyland: Can you explain what the files on google drive are showing? I'm having a bit of trouble interpreting the color without a legend or more understanding of the color/labeling. — Red-tailed hawk _(nest) 02:16, 4 September 2024 (UTC)

  Thank you for the explanation you've given above; it's quite informative. — Red-tailed hawk _(nest) 05:35, 4 September 2024 (UTC)

• Open SPI cases
• SPI cases awaiting archive