Over time, it has become clear that there are many factors and evidence that can actually relate accounts in some specific ways and effectively contribute to the discovery of these malicious users. This blog post pretends to expose the situation and present every major evidence and factors that link sock accounts together in order to catch them with relative ease plus how to deal with every phase of the discovery of a sock puppeter.
What is a Sock Account?
R: Anonymity is both the greatest strentgh of the internet but at the same time it´s greatest weakness. And Sock Puppets, a term who refers to lies and deception, are exactly those who explore this weakness for their own benefit. Sock Puppets are false accounts used to create illusion and deception, normally focusing on the defense, praise and support of the same user who created this account, known as the Puppet Master or their allies or preferences. The Puppet Master is normally considered the first account used, while the others that come after him are known as the infamous Sock Puppets, who just like in the terms, are controlled by the original user simply under different names. A Sock Puppet is used for various reasons, however the most common one is evading blocks and even show themselves vindictive towards those who originally blocked his account or performed any other kind of action against him. Other reasons include posting vandalism, harrass other users or simply create drama and trouble on wiki communities. They can also be used to show support for other accounts the user has in their possession or be used to tip the results of polls and community voting events. But not every account is a sock puppet. You may have other accounts but they are not considered sock puppets if the community knows you are behind them. In this case, you are not pretending to be someone else, which is the main concept of a sock account. It is very common in wikis for users to want "change" and acquire this by creating new accounts, however if they contact the community about this new change by simply using a similar user name, signature or by telling them personally, then this cannot be considered a sock puppet. However if the community does not know that you are behind these accounts and you use them for malicious acts, then you have just created and are used a sock account...
(The Following List was kindly provided by 452 on this blog´s comments)
- What is a Sock Account?
- A secondary account used for malicious purposes, including harassment and vandalism, ect.
- A secondary account used to pretend to be a different person.
- An undisclosed secondary account used to evade a block or a ban (Ban Evasion).
- What isn't a Sock Account?
- A bot account.
- A testing account.
- Any disclosed alternate account.
- An undisclosed alternate account used on other wikis for unrelated purposes.
Creating a sock account and using one are very different things and if you know you just created one and that it´s wrong to do so, you can always disable it. Sock Accounts can be used everywhere, can be used to edit and chat and mainly deceive but there mere creation and use is a crime which can be punished by very long blocks and by even larger penalties (involving other entities such as Staff and the VSTF in some occasions).
How to Catch Sock Puppets?
Thus, I present what I believe to be all the factors and evidence that can actually prove effective in capturing sock accounts and stop them in their tracks. If you have any suspicions about one of your users having in their possession one or more sock accounts, then this blog may hold the key to prove them.
Sock Puppets are not Omnipresent
According to an internet study, 96% of times, sock accounts and their puppet master are not log in at the same time. While editing this factor is less useful but as sock accounts are the same person it would only be natural for them to edit in the same time period which can provide you a clue. On chat however, this can prove to be quite effective. Most of the times, when a sock puppeter decides he wishes to be on chat with another one of his accounts to achieve any of his goals, he must exit chat, log in on his sock account and then make a return with his new account. Most of the times, this comeback is almost instant, taking in some cases, only secnds. So for example, imagine Super Lord Vegeta is a puppet master and Little18 his sock account. This is how things would happen:
Little18 has left the chat.
Super Lord Vegeta has entered the chat.
Most of the times, sock puppets claim it is simply accidental timing or luck however if you have suspicions, then you can see right through their disguise and establish a connection. This happens many times and that is why sock accounts normally refuse to chat with their Puppet Master, because they cannot be on at the same time and are afraid to be discovered. The greatest weapon to use against sock puppets is fear because in truth they are always fearful they will be discovered.
Avatars, User Page, Profile and EditsIn this topic, Avatars may seem stupid however they can also prove to be quite useful. Sock Accounts are normally accounts who don´t have much work in them. With this I mean, they have a small user page and less "decorated" as normal users do. Since these accounts are used only for the benefit of their puppet master, their purpose is only to praise and support him and not to edit or create bonds with the community, resulting in this lack of "substance".
Normally their User Page is small or isn´t even created and this follows to other aspects such as their Profile and their Avatars. While the factor listed above is very common, Avatars are not as common but even so can be useful in tracing a sock. As said before, Sock Accounts don´t usually possess many work and the Avatars may be an extension of this concept. From my encounters with sock puppets, I have seen many who instead of adopting a good avatar, instead adopted one of the Avatars offered by Wikia. This is the case in thousands of users, however if you have suspicions that a user has a sock account, this might be a decisive factor. I mean, why bother in creating a User Page, a Profile and an Avatar when the actually purpose of the sock account is merely to benefit and support the puppet master and not to establish friends, communicate or edit? It is also quite common for the Profile of sock accounts to be similar to each other, making them easier to track.
More experienced sock puppets do choose different avatars, however even they can make a mistake, chosing an avatar that had some sort of connection to the avatar of their previous account. For Example:
Super Lord Vegeta ´s Avatar:
Little18 ´s Avatar:
As for the edits. The Edits and contributions are probably the greatest source of evidence in proving the existence of a sock puppet. Since their purpose would be to support the user, Sock Accounts have most of the times a low number of edits, raging from 0 to 300, however the true key in this matter is that most of their edits are used to in discussions and messages related to any user in particular. If the sock account´s goal is to praise and defend the user, it would only be natural for most of their edits to actually be in contacting the puppet master and comment on his pages with excessive complements and denfeding this user´s articles to the last, plus taking their side and opinion in any kind of discussions and important voting, while other than that remain extremely "unsocial" with other users and discussions that don´t target or involve the puppet master. If this does proves to be their goal, then at least more than 50% of their edits are focused on the puppet master and the support of everything he represents, his ideas, opinion and the articles, blogs, ect he creates and some times never showing any kind of enthusiasm for other users and their work. If used for ban envasion, the sock account may normally question the block of it´s puppet master such as:
Block on Black Keith´s (Admin) Wall
Hi, Black Keith. Nice to meet you. Can you explain why Super Lord Vegeta is blocked? I did some investigation and he didn´t do anything at all, it was a completly unfair ban, you just blocked him out of rage. I´m requesting his unblocking!
This is the use of a sock account in the case of evading a ban, however sock accounts as mentioned before can also be used to post vandalism, create drama and trouble or harrass other users. If this would be the case, normally those who do this are immediantly blocked because while in some cases, sock puppets pretend to act as normal users and seek to remain in the community to help their puppet master, here they simply expose their true colors right away. If this would be the case, normally, sock accounts who are vandals simply have a hate for the wiki for some reason and may target a user/page in special. This is a good clue wh en it comes to discovering if they are a sock or not, as these users who vandalize and harass normally chose a main target who may have been behind their block or has any other kind of connection to them. They harrass him, threat him and many others. Normally after this users are blocked some time after performing these action but if they continue to do so with yet other accounts, then they might send the same type of messages and form an harrassment pattern. Also many times, vandals who create duplicate accounts use them to vandalize the same pages and sections in the same way, creating a vandalism pattern that can be quite useful.
Time never seems to be on our side but here can actually be an advantage. Just as mentioned earlier in the edits, sock acounts, while using different accounts are still the same person and he/she should edit and be on at the same time periods. Plus it would be uncommon for a sock account to actually edit while the puppet master is away or inactive. So if both the sock account and the puppet master are active editors and for some reason the puppet master has to be absent for a few days and the sock account does not edit in that same time period, then you might be on to something...
But one of the most important things about sock puppeting is understanding who is the Master and who is the Puppet. If sock accounts are created to support and praise their puppet master it would be uncommon for the difference in their first edit to be over 4/5 months, let alone a year and if the sock accounts are created for evading bans and cause trouble and vandalism, then the time between their first edit and the block for their puppet master account shouldn´t be too large, a month in the maximum. Special:Log/newusers shows all the accounts that have just been created on the wiki. Sometimes socks are even created on the wiki right after they were banned and this could be a good, quick and effective way to catch them.
When creating an alternative name for their sock account, sock puppets normally create random users names or will often stick to derivates of their original name such as using different words that express the same concept or simply add new digits like numbers and letters to their names if they wish to be discovered. These derivates are familiar to them because they may have a connection with them being their preferences, self-being among others. In the case of harassment and causing drama and trouble, sock puppets may choose to bear almost the equal user name which just some small modifications, a trait I have observed in many wikis. For instances, here is an example: Super Lord Vegeta - Supreme King Vegeta.
However if a sock is designed to actually help and support their puppet master as mentioned above they will likely choose a different user name that doesn´t have any sort of connection to their other original account.
Two Minds Aren´t Better than One
Along with the Edits, this is probably the most useful evidence to find and connect accounts. We shouldn´t forget sock accounts are still the same person writing under a different name. They will quite probably speak in a very similar way, edit the same pages with a particular pattern and may do and write with gestures and words only a few users would use which makes them easy to identify. It is also normal that sock accounts are of the same gender and similar ages and like to discuss the same matters and subjects and particular phenmenons as the puppet master who controls them. This is something no one can´t ever fake. It´s who we are, a new account on the internet won´t change that. Sock accounts may pretend to be another person but everyone makes mistakes and you will soon identify in them a different person then who they were pretending to be, showing the same skills, preferences and opinions, habits and even languages the puppet master did. If you come to the conclusion that if this users´s social level is actually almost identical to that of who you believe to be the puppet master, then your suspicions will grow in level and you´ll acquire some good evidence to state your case.
Here are some useful links regarding this issue:
- Help:Don't feed the trolls
- The Duck Test (Provided by Fuzzy Dice)
- Sockpuppet Investigations (Provided by K6ka)
Any more links you would like to see included in this blog? By all means, share it in the comments so that they can be added.
What to do in this case?
I hope you liked this blog and that these factors actually managed to help you in any kind of way catching and blocking a sock account. I actually believe these are some good tips. I have used them several times while searching for socks and they proved to be every effective. With this solved, there is only one last question to be asked. What to do once you have evidence one of your users is a sock puppet?
- Blocking: The most logical choice would be to block a user however keep in mind these tips and factors only allow you to make assumptions and not the truth. In these types of cases you can´t assume anything, only definitive evidence can actually lead you to block this user. The easiest way to catch a sock puppet is by their IP adress. Sock Accounts can be created by users using the same e-mail adress however even to those who create their account with different e-mail adresses, they will probably still be using the same IP adress. Changing their e-mail adress allows them to avoid certain bots however the server information remains the same and thus makes them vulnerable to a CheckUser, users who have the ability to look and check IP Adresses of multiple accounts. Check Users prove really useful against sock accounts however this right is only available for Wikia Staff and the Volunteer Spam Task Force, more well know as the VSTF. You can contact them both to help you with sock puppeting situations. You can contact Staff using the contact form and the VSTF on their wiki or on their message walls.
If you are really sure (100%) the users are sock accounts by any means, you can block them yourself but you have to be truly sure of your actions. Sock Puppeting is known as one of the greatest crimes in Wikia, being punished with long range blocks (normally described as Sock Puppeting or Abusing Multiple Accounts) and even with global blocks or the disablement of the accounts by members of Staff. The truth is all these factors are just a small fraction of the biggest factor, Sock Accounts are always catched and eventually punished for their actions. The truth is creating sock accounts is not worth the risk. With it you can risk your entire wiki life and your account, simply because of grudges against users and of some support to our own works. I have met multiple sock accounts and one thing I learned is that sock puppets are not responsible for only creating and using sock accounts but also various other crimes in the pursuit of their goals and the punishment received actually equals 10 times the things you have done. Thank you for your time.
Previous Blog: None
Next Blog: How to Gain Advice? (with Admins, Staff, VSTF and more)
I hope you enjoyed the blog and all the information that was provided. Feel free to comment and share your experiences, ideas and opinions. Happy Editing!