< Misplaced Pages:Requests for arbitration | Eastern Europe

This is an old revision of this page, as edited by Newyorkbrad (talk | contribs) at 23:37, 28 August 2007 (→Pet troll grooming by []: typo). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Revision as of 23:37, 28 August 2007 by Newyorkbrad (talk | contribs) (→Pet troll grooming by []: typo)(diff) ← Previous revision | Latest revision (diff) | Newer revision → (diff)

This is a page for working on Arbitration decisions. The Arbitrators, parties to the case, and other editors may draft proposals and post them to this page for review and comments. Proposals may include proposed general principles, findings of fact, remedies, and enforcement provisions—the same format as is used in Arbitration Committee decisions. The bottom of the page may be used for overall analysis of the /Evidence and for general discussion of the case.

Any user may edit this workshop page. Please sign all suggestions and comments. Arbitrators will place proposed items they believe should be part of the final decision on the /Proposed decision page, which only Arbitrators may edit, for voting.

Motions and requests by the parties

Motion: Clarification of parties

1) I supported acceptance of this arbcom case under the impression that the request involved me as a member of accused obscure group "Tartu accounts". At this point I request that ALL accounts considered to be part of this ArbCom be IDENTIFIED and NOTIFIED. Proceeding and making decisions behind peoples back without declaring them parties to this case is not possible. --Alexia Death the Grey 18:47, 26 August 2007 (UTC)

Comment by Arbitrators:

Rolling identification of parties (and their notification as appropriate) is a standard part of the Arbitration process. I would ask Irpen, as with all parties to an Arbitration request, to take care in suggesting users as parties. However, I think it would be ill-advised for us to restrict ourselves to a set of users that happen to be selected in the first 24 hours of the Arbitration request being opened. James F. (talk) 00:32, 27 August 2007 (UTC)

In the spirit of this statement, I think following people should also be considered parties to this case:

Petri Krohn (talk · contribs · deleted contribs · logs · filter log · block user · block log) - as the initiator of the "Korp!Estonia" accusations and the initial sock fisher.
Ghirlandajo (talk · contribs · deleted contribs · logs · filter log · block user · block log) - as repeater of these accusations and the source of much disruption and slurs.
FayssalF (talk · contribs · deleted contribs · logs · filter log · block user · block log) - as maker of dubious hacking claims.

--Alexia Death the Grey 05:25, 27 August 2007 (UTC)

Comment by parties:

Support. Such identification requires an analysis of both checkuser results and editing patterns. Since several of the involved are figures "known in Estonia IT-circles", there is no difficulty to engage in remote IP editing. Most computer-literate persons know how to ssh, rlogin, use X-windows remotely, etc. --Irpen 19:42, 26 August 2007 (UTC)

No, its not hard to edit from another IP. But IP-s cost money and having access to sites that are not open proxies is not a trivial thing. Also doing edit pattern analysis is rather pointless for users that due to sock fishing have forsaken their anonymity and are known individuals like I, Sander Säde and Digwurren(Erik Jesse to a lesser degree). That we are not socks is easily seen with a simple Google search. And once you exclude us who are left? Name them!--Alexia Death the Grey 20:30, 26 August 2007 (UTC)

Comment by others:

Support. It is very unclear to whom we are referring to as parties, that needs to be made clearer, I've added five I saw outright, but as you know, that can be modified at ArbCom's discretion. Cbrown1023 talk 20:45, 26 August 2007 (UTC)

I strongly object to you including Eric Jesse as one of the parties without his consent and you ought to reverse his inclusion unless he agrees. What Irpen appear to be supporting is a fishing expedition. Either Irpen himself should name and notify the parties he believes to be members of this so-called "Tartu based group", or he should withdraw it. His baseless accusations of using ssh, rlogin, use X-windows remotely is an example of attempting to generate hysteria for the purposes of a Witchhunt directed against a group of editors who happen to be ethnic Estonian. These scurrilous accusations could equally be levelled at Irpen and his supporters in this case or anyone for that matter, how can anyone in Misplaced Pages defend themselves from this. That's why this whole "Tartu based accounts" thing is totally wrong: no members explicitly identified, other than being Estonian; no articulation of specific wrong doings, other than alleged membership of a group. Irpen's complaint against Digwuren is one thing, but including this so called "Tartu based accounts" is gaming the arbitration process to unjustifibly harass a group of otherwise uninvolved editors for no other reason that they are ethnic Estonian. Martintg 20:51, 26 August 2007 (UTC)

That is not how it works, users are added as parties and notified. If they wish to be removed, they can make a motion. Furthermore, please wait for the arbitration Committee to clarify the parties as noted in this motion. Cbrown1023 talk 00:13, 27 August 2007 (UTC)

Indeed, why didn't you wait until the arbitration Committee clarified the parties before adding Erik Jesse, just a cursory look at his edit history will reveal he has absolutely no involvement in any of Irpen's allegations Martintg 00:24, 27 August 2007 (UTC)

He was already a part of the case when listed on the given Requests for checkuser cases provided as "Parties". I just clarified it further, the Arbitration Committee can remove or add whom they feel, but not all party members are affected by all decisions and even non-party members may be affected. Cbrown1023 talk 01:11, 28 August 2007 (UTC)

Five? I see only two statements, mine and Erik Jesses moved. I still expect Irpen to set the baseline as to who he is accusing. BTW, DLX is Sander Säde. He took his IRL name after last sockfishing.--Alexia Death the Grey 21:00, 26 August 2007 (UTC)

They were on the checkuser cases listed as outlining the party members. Cbrown1023 talk 00:18, 27 August 2007 (UTC)

Motion for ArbCom to direct FayssalF (talk · contribs)to present the evidence for public scrutiny on the alleged hacking accusation or to withraw the accusation.

2) Accusations without proof are slander, and there is no policy preventing FayssalF (talk · contribs) from releasing details on an attack that did not happen on Misplaced Pages. I have no doubt he had a security incident but I am very doubtful that he manages to prove any reasonable connection to Digwuren. --Alexia Death the Grey 11:42, 27 August 2007 (UTC)

Comment by Arbitrators:

Comment by parties:

Do you want me to make it public so that people in Oceania and Alaska would know about my IP or the Tallinn based IP? It is to the Arbitration Committee that i'd be handing it. At their discretion, they would judge what is the appropriate action to be taken. Be patient please. Thanks -- FayssalF - 22:12, 27 August 2007 (UTC)

P.S It is a Tallinn based IP and there is such a likely possibility that it may be related to anyone editing Misplaced Pages from Tallinn. There aren't hundreds of suspected people. There are only a couple of suspected editors who can edit Misplaced Pages from Tallinn and try to hack someone laptap in or just near Morocco in the same time when Digwuren was blocked. Please wait for the Arbitrators opinion on the matter. -- FayssalF - 22:21, 27 August 2007 (UTC)

Note that you can give us the "evidence" where you replace IP's with "x.x.x.x". However, I must admit that this whole affair starts to smell extremely fishy. You have still failed to tell how Digwuren could get your IP and you insist that you show evidence only to the arbitrators - who may or may not know something about hacking and evidence for it (ie, it would take about five minutes to falsify a log file, ten minutes to do that with a screenshot).

Also, how many "attacks" do you get every day? I get about one port scan every 30 minutes or so - haven't paid attention to them for a long while.

As the good name of an editor can be destroyed by your accusations - and you are almost certainly on a dynamic IP (ie. simple modem reboot will change your IP), I recommend that you either withdraw the accusations or present the evidence for everybody to see and discuss. This is too serious to try to resolve it behind the scenes.

Sander Säde 03:29, 28 August 2007 (UTC)

I've answered 3 people and now it is your time. Not behind the scenes my friend. Who said that? Arbitrators will show it to you. So what is the difference. Who are you again?

Who said many and who said everyday? -- FayssalF - 07:39, 28 August 2007 (UTC)

Comment by others:

I think you are correct in not wanting to release your own IP, for obvious privacy issues. However I don't think there can be an privacy issue involved in releasing the Tallinn based IP address of the alleged attacker, afterall, we see IP addresses every day anonymously editing Misplaced Pages. As I recall, Digwuren is based in Tartu (see the talk page in the checkuser case ), so I don't quite see how you could associate a Tallinn based IP to someone based in Tartu. Martintg 01:08, 28 August 2007 (UTC)

P.S Phrases like in and around or in or just near are common idioms in english, so I wouldn't put much weight in seeing that turn of phrase as some kind of admission that Digwuren some how inappropriately knows you also edit Misplaced Pages in countries next to Morocco. Martintg 01:20, 28 August 2007 (UTC)

Martin, please understand that i am an administrator and that means that i carry the trust of the community and therefore i deprive myself from any would-be irresponsible act which would endanger that trust. Apart from that i am not a legal expert nor an arbitrator in order for me to decide what to do for now. I am waiting for the word of the ArbCom members. If you understand very well what i am saying you'd see that privacy reasons include the Tallinn IP as well.

As for that Digwuren was or is based in Tartu i must say that i have no idea. All i know is that at the time i blocked an editor based in Estonia, i discovered the attempts. He could be at Tartu but how do i know? I have no idea Martin. And sincerely Martin, would you turn your eyes or shrug your shoulders if you discover an intrusion attempt from let's say Colombia exactly at the time you'd have blocked someone from Colombia? I tried not to talk about it but kept the evidence if it would happen again. However, lately i've seen the Tartu IP issue around Misplaced Pages venues and thought that my experience is worth mentioning. Would you have acted differently Martin?

I hope you consider my concerns so i won't be repeating myself by responding to every single request. My position is clear on that matter as expressed several times. -- FayssalF - 01:52, 28 August 2007 (UTC)

P.S Re Morocco or near of it. Martin, i see things and ask questions. They are not random things. I see a connection and i ask questions. Maybe i am wrong and maybe i am right and this is why we are here. If i was accused but really innocent i'd really be calm and won't be impatient. It is not me or you who will judge but the ArbCom. -- FayssalF - 01:56, 28 August 2007 (UTC)

Addendum By the way, divulging only the Tallinn IP doesn't make sense at all. You'd need a scene and a target. So to show the scene and the target i'd be obliged to show my IP. -- FayssalF - 02:01, 28 August 2007 (UTC)

We already know the scene and the target, you and your laptop, so your IP is irrelevant. Divulging the Tallinn IP will allow us to determine the source of the alleged attack. Once we know the source, the only question that needs to be answered is: can we associate this source with Digwuren. Martintg 02:13, 28 August 2007 (UTC)

Would you really consider that evidence? What if i tell you it is X.X.X.X? It doesn't make sense Martin. The evidence is contained in report w/ the attacker and the target IP, the level of the attack (this is important as well), and the time and date. So how is possible for you to accept just the attacker IP as an evidence? Why are you still insisting man? Edwiren or not Edwiren IP. The attack happened at the time of his block from Estonia and as i said several times there aren't millions of people whom we can suspect. If it is not Digwuren it would be User:X who may be Digwuren sock or Digwuren meat or friend or just totally unrelated. Please stop insisting Martin. You are just wasting your time and mine as well. Who are you by the way? Admin, Arbitrator, a legal authority? To whom you deliver evidence in real-life? To the court Martin. So please save us some time. - FayssalF - 02:46, 28 August 2007 (UTC)

I do not understand your refusal to come public. You CAN give out the evidence without compromising your privacy! You can divulge following info.

1) What kind of an attack

2) The attackers IP

3) Your rationale on how Digwuren is supposed to have obtained your IP.

Your continued refusal to do so is a sign that you have no real evidence.--Alexia Death the Grey 04:38, 28 August 2007 (UTC)

P.S As to the trust of community, you have some warped ideas about that. I personally cant trust someone that throws around dubious hacking accusations and refuses to give out any proof.--Alexia Death the Grey 04:47, 28 August 2007 (UTC)

Alexia, may I ask you to tone down this aggressive rhetoric? Nobody is going to discuss his/her IPs on this page. As for "lack of evidence", what's the point of coming up with false allegations against Estonia-based accounts? Do you take Fayssal for another Estonia-basher? Since the country has been trumpeting its recent involvement in what it calls "cyber-warfare" against Russia, it is only reasonable to assume that Estonia-based accounts may be more savvy in these matters than accounts based in other parts of Europe. --Ghirla 23:05, 28 August 2007 (UTC)

Alexia, please make sure i am not joking and stop your nonsense. I refuse to give it to you and obviously the ArbCom would make it public. You are going to see it of course. Do you think i am keeping it for myself or not having anything at all? Your continued refusal to do so is a sign that you have no real evidence. Do you believe i got nothing to do just create a story and come here to waste my time w/ you trying to mislead you or what?. Nonsense. So please stop it. -- FayssalF - 06:57, 28 August 2007 (UTC)

Sorry, but my IT-professionals mind cannot comprehend your obstinacy. You refuse to even give a rationale on how Digwuren is supposed to know your IP... Is the answer to that one that you have none? Because if that is true the whole accusation is smoke and mirrors--Alexia Death the Grey 07:09, 28 August 2007 (UTC)

I have to agree. Present the information or take back your accusations. I am quite sure Digwuren and all any other estonian wikipedia editors, are all quite educated and I bet they wouldn't try to hack your computer. They are definitely older than 12.

I am also interested in evidence because my computers are able to do something which can be considered "intrusion attempt." I have security measures installed which sometimes portscan other computers. Whenever someone tries to attack my computer, it starts logging all information about the event to remote location. During this event, my computer may do portscan, operating system detection and service version detection on the attacker to make sure if the attacker is infected with some sort of worm or has known security vulnerabilities which could be exploited. (Software also has knowledge of known types of worm attacks, so it won't portscan computers which can be identified as zombies right away). If the intrusion is successful to my computer I can use the evidence to present to police, but there is no point in reporting some hacked or infected machines, as the owner of the machine is probably unaware of the event.

Just as I said before, there were some intrusion attempts from Morocco at that time frame. And the computers were counterscanned. Scan results don't show any known vulnerabilities or worms. So your "Intrusion Attempt" might be my computer counterscanning an attacker. But that means you had to attack my computer first. --— Preceding unsigned comment added by Suva (talk • contribs)

Suva. How would you explain to me that among all the IP listed in the software report at that particular day and moment, the one flagged as the highest level of threat is the one i am talking about? Do you have any idea why? I've got others hours before that incident but all of them are from Latin America, US, Canada, etc... They were all flagged as medium and low. This is another question. -- FayssalF - 06:57, 28 August 2007 (UTC)

Do you have a clue what that "highest level threat" means? Is it a portscan? A viral activity? What? Without that info this discussion is pointless.--Alexia Death the Grey 07:40, 28 August 2007 (UTC)

Sounds plausible, being an admin, FayssalF would certainly know your IP address. Do you still have the records of the intrusion attempt from Morocco? Perhaps he was attempting some amateur detective work and was probing Estonia based accounts for some reason, and triggered youf computer to automatically counter-probe? Martintg 06:39, 28 August 2007 (UTC)

Another nonsense and harassment. Who told you that admins know IPs? Please read CheckUser policy and how admin can have access to the tool. -- FayssalF - 06:57, 28 August 2007 (UTC)

No it does not sound plausible, it sounds like something out of X files, a total fantasy flight. But it sounds MORE plausible than the original accusation itself. As to harassment... Thats the name Id give to this whole accusation...--Alexia Death the Grey 07:09, 28 August 2007 (UTC)

Yes I still have the records. But I won't present them here yet. For security reasons and because I am not the one who started the case. If it comes out that the accused "hacker" came from one of my IP addresses I am sure to take it up in ~~FayssalF adminship review. This is clear misuse of administrative powers.~~ That kind of detective work is not only unethical, it is also illegal, atleast in Estonia. Suva 07:06, 28 August 2007 (UTC)

I wasn't aware that admins can't see the IP addresses. But during the BlockFest I was blocked aswell. I was shortly unblocked after an hour, but unblocking administrator forgot to remove the autoblock. So I was ipblocked when I came back. I requested autoblock removal. I just discovered that my IP address was publicly visible until few minutes ago, when I removed the autoblock notice from my talk page. Suva 07:26, 28 August 2007 (UTC)

Motion to recognise Petri Krohn as a party

3) Petri Krohn's rôle was crucial in executing the Template:Big Sock Fishing incident that Irpen used to define the parties, and he has repeatedly made threats that the ArbCom will, in various ways, punish Estonian editors. It's peculiar he is not yet listed as a party in the first large-scale arbcom involving Estonian editors. Digwuren 20:38, 27 August 2007 (UTC)

Comment by Arbitrators:

Comment by parties:

Supported.--Alexia Death the Grey 05:29, 28 August 2007 (UTC)

Comment by others:

I think Petri Krohn's role certainly needs to be examined and how the behaviour of this experienced editor may have influenced the subsequent behaviours of other less experienced editors. Martintg 06:57, 28 August 2007 (UTC)

Template

Comment by Arbitrators:

Comment by parties:

Comment by others:

Motions and requests by others

Motion to strike out a part of Irpen's statement

1) I request that the part of Irpen's statement concerning the so-called "Tartu-based accounts" be struck out. The title of this RfArb has been modified from the original request. Is it now solely about Digwuren, or is Irpen intending to maintain his allegations in regard to the so-called "Tartu-based accounts"? It should be made clear what the actual scope of this arbitration case is to be. Martintg 11:41, 26 August 2007 (UTC)

Comment by Arbitrators:

Comment by parties:

I do not support striking but a clarfication is needed. At this moment it is unclear whether I am a party to this Arbcom or just another person. Since at the core of this are the so called "Tartu accounts" then the name should be adjusted correspondingly and people considered parties NAMED. This kind of obscure class action is unacceptable.--Alexia Death the Grey 15:17, 26 August 2007 (UTC)

Supported. Throwing out blanket accusations covering all Estonian editors is not acceptable. Sander Säde 15:46, 26 August 2007 (UTC)

I won't "strike" anything. Evidence of collective editing seems strong to me and case's name is by no means a definition of anything. ArbCom cases often go far and beyond the original case's scope and certainly beyond the case "name". --Irpen 19:46, 26 August 2007 (UTC)

Comment by others:

This should wait to be passed until "parties" motion is finished. That being made clearer will help all of us understand better. Cbrown1023 talk 20:52, 26 August 2007 (UTC)

The arbitration clerks often, as here, shorten casenames for convenience (a name that's too long is harder to type accurately, messes up the pending cases template, etc.). This has no effect on what the scope of the case is about. Newyorkbrad 13:04, 27 August 2007 (UTC)

Motion to strike 3 Löwi and Klamber from the list of parties

1) 3 Löwi, a long standing editor since July 2005, has been inactive since June 28 and Klamber has been inactive since June 22 . Therefore both could not have caused any disruption in the timeframe described in Irpen's complaint, nor are they likely be aware of this proceeding nor likely contribute to it. Martintg 00:15, 27 August 2007 (UTC)

Comment by Arbitrators:

Comment by parties:

Supported. They have practically no ties to this mess, due to long inactivity cannot be checkuser-ed and were found to be unrelated to rest of us in the last case.--Alexia Death the Grey 04:24, 27 August 2007 (UTC)

I don't see their relation to this mess either. I am not sure why some think they are parties. If they are, they should not be. --Irpen 04:37, 27 August 2007 (UTC)

They are considered as parties to this case because you have not named any parties and they were part of the previous big sock fishing you linked.Now is about time you would make your list of people you as an initiator consider to be the parties.--Alexia Death the Grey 05:16, 27 August 2007 (UTC)

I don't understand your passion towards "being considered a party" issue. ArbCom's rulings frequently concern users who are not initially named as case's parties, and often omit users who are. ArbCom case is not only a judgment but also an investigation and the scope of parties and wrongdoings often shifts as the new revelations are added. The analysis requires the combinations of the checkuser results with the editing patterns since even the checkuser isn't conclusive. Only few Wikipedians have the checkuser access. --Irpen 05:23, 27 August 2007 (UTC)

To make a checkuser case you need a list of "suspects". You have not given any that are not already proven to be individuals. Theres nothing to checkuser or compare at this point!--Alexia Death the Grey 05:39, 27 August 2007 (UTC)

Comment by others:

To Irpen: why don't you add some evidence of the alleged wrong doings of this so-called "Tartu based accounts" to the evidence page, so that ArbCom can have atleast a starting point, and those you accuse can know what it is you are accusing them of. You have already admitted that two of the five checkuser parties 3 Löwi and Klamber should not be parties in this case. Now please articulate in detail for us all what your problem is with the remaining three: Alexia, Sander and Erik. Martintg 05:57, 27 August 2007 (UTC)

I don't see the scope of the case as problematic. In my opinion, the present case should involve every account whose edits have been aimed at minimizing the scale of Holocaust in Estonia or at downplaying the extent of Estonia's collaboration with the Nazis. It's not that much of a secret that the majority of these accounts are based at Tartu and were registered back in May. --Ghirla 23:25, 28 August 2007 (UTC)

Very good point, Martintg, I second that. Cbrown1023 talk 13:41, 27 August 2007 (UTC)

Proposed temporary injunctions

Template

Comment by Arbitrators:

Comment by parties:

Comment by others:

Template

Comment by Arbitrators:

Comment by parties:

Comment by others:

Template

Comment by Arbitrators:

Comment by parties:

Comment by others:

Template

Comment by Arbitrators:

Comment by parties:

Comment by others:

Questions to the parties

Proposed final decision

Comment by Arbitrators:

Comment by parties:

Note: All remedies that refer to a period of time, for example to a ban of X months or a revert parole of Y months, are to run concurrently unless otherwise stated.

Motions and requests by the parties

Motion: Clarification of parties

Motion for ArbCom to direct FayssalF (talk · contribs)to present the evidence for public scrutiny on the alleged hacking accusation or to withraw the accusation.

Motion to recognise Petri Krohn as a party

Template

Motions and requests by others

Motion to strike out a part of Irpen's statement

Motion to strike 3 Löwi and Klamber from the list of parties

Proposed temporary injunctions

Template

Template

Template

Template

Questions to the parties

Proposed final decision

Proposed principles

Promotion of biases

Template

Template

Template

Template

Template

Template

Proposed findings of fact

eSStonia

Smear emanating from FayssalF

Pet troll grooming by Irpen

Template

Template

Template

Template

Template

Proposed remedies

Template

Template

Template

Template

Template

Template

Template

Template

Template

Proposed enforcement

Template

Template

Template

Template

Template

Analysis of evidence

Template

Template

Template

Template

Template

Template

Template

General discussion