Wikipedia talk:Abuse reports/Archive 1

From Wikipedia, the free encyclopedia

Archive This is an archive of past discussions. Do not edit the contents of this page. If you wish to start a new discussion or revive an old one, please do so on the current talk page.

Contents

Subpages

Jesus! Nice work, mate. Image and everything. I reckon that the next thing we need to do is see what the general opinion of this idea is (we could just wait and see what comes up on AN), find a few more people willing to take this on, and then go live. You've done a great job, cheers!

We could rig this so that it runs like WP:AIV and WP:RFCU run now, as in rather than having a load of subpages, like AfD, just having a template at the top of the page explaining the policy and how-to, and then a list below. It seems to me like that'd be a less complicated setup and as more likely to avoid confusion. What do you think? Snoutwood (talk) 22:39, 28 April 2006 (UTC)

My hope is that each case will only have one subpage (I used two for example purposes, so I could have one with just the investigation report and a second with the contact summary); I opted for subpages because it will allow the contact to direct the person they speak with directly to a page with all the information. (My experience is, the person you talk to wants a summary, and linking them to a page like this would be perfect for that.) Some of the stuff could be simplified down; rather than having a /In Contact and /Under Investigation page with all the cases listed, and transcluded into the page, they could just be listed directly. (I'm a big fan of transclusion.) I think WP:AIV works well with everything on one page because it's designed to be quick; list, look, block, move on. As a heavy user of RfCU, I can say that having it all on one page is a big pain to me personally; if I could come up with a good way to use subpages, I'd do it. My experience with RfM and the use of subpages is that it's best to have the initial reporting done directly on the page, with the investigation phase (under investigation and further) put on a subpage. It keeps down the number of subpages while at the same time keeping everything organized. I'm going to do a bit of restructuring to make it a bit easier to follow. Essjay (Talk • Connect) 23:05, 28 April 2006 (UTC)
O.K., that makes good sense. As long as we're not subpage-happy. :) Snoutwood (talk) 00:23, 29 April 2006 (UTC)
Example of case under investigation is more or less identical to Example of case in contact, except that the latter has more information. Is there a reason to have both? It seems to me that we'd be better off deleting the former and using the latter as an example for both incidences.
Corollary: I was going to move the example of how to post a new report (currently at WP:AbRep#New Alerts and WP:AbRep#Open Cases) onto a subpage with a link in the new alerts section to it. Do you think that's a good idea? Snoutwood (tóg) 19:16, 30 April 2006 (UTC)
O.K., I've gone and done the latter. Snoutwood (tóg) 15:43, 3 May 2006 (UTC)

Huzzah! (Wait... I'm not English...) Seriously, as I've run into more than a handful of these, this page just went enthusiastically onto my watchlist. :) RadioKirk talk to me 02:46, 29 April 2006 (UTC)

Title pedantry

Do you think it ought to be lowercased, i.e. Abuse reports? I know that that's a tiny tiny issue, but that seems to be the general style. Snoutwood (talk) 01:11, 29 April 2006 (UTC)

Hmm, yes, probably should have been, but I already moved everything to the capitalized version. If anyone is enough of a pedant to care, they can move it all :-) Essjay (Talk • Connect) 01:26, 29 April 2006 (UTC)
I'll do it. I really am that pedantic. :) Snoutwood (talk) 01:31, 29 April 2006 (UTC)
Done. Snoutwood (talk) 01:37, 29 April 2006 (UTC)

Publicity

There we are. Let's hope I didn't sound underenthusiastic. Snoutwood (talk) 01:23, 29 April 2006 (UTC)

(diff) Snoutwood (talk) 17:16, 30 April 2006 (UTC)

Added us to WP:RFC/POLICIES: (see here). Snoutwood (talk) 16:54, 30 April 2006 (UTC)

WikiEN-l post: [1]. Snoutwood (talk) 17:16, 30 April 2006 (UTC)

Added into WP:VAND: [2]. Snoutwood (tóg) 23:08, 3 May 2006 (UTC)

Participants

Obviously, at some point, we need to begin a list of participants; the question is, do we start a list of investigators and contacts on the main page or on this page, both of which could become crowded if the idea catches on, or do we use a subpage to list them? Essjay (Talk • Connect) 01:26, 29 April 2006 (UTC)

For the time being, we can have them on the main page; if the list gets too long then we can make it a subpage. I've put a section up and added us both (hope that's all right with ya). Snoutwood (talk) 01:30, 29 April 2006 (UTC)

More pedantry

"Contacts"? Isn't a list of contacts a list of folks willing to receive contact? Wouldn't "contactors" be more correct? - UtherSRG (talk) 15:08, 3 May 2006 (UTC)

Yes, you're right. I'm going to go fix that. Snoutwood (tóg) 15:27, 3 May 2006 (UTC)

Outcomes

One thing I'm still not sure on- if the school (etc) says 'please block us' do we do that? Obviously the best outcome is that the institution tracks down the people doing the vandalism and stops them doing it specifically, but I wanted to be clear- if a school says 'we don't want our pupils editing Wikipedia' is it appropriate to block that IP for an extended period of time? Petros471 09:51, 29 April 2006 (UTC)

My thoughts: The school/district/system making such a request should do so on school letterhead and send/fax it (to WP:JIMBO?) so we have something official on record—just in case. RadioKirk talk to me 16:00, 29 April 2006 (UTC)
Yes, we do (as long as it's static, etc.), yes, there is a precedent, and there's an official place on Meta to do it. I'm going to go and find the goods now, and I'll post when I have them. Snoutwood (talk) 16:50, 29 April 2006 (UTC)
O.K. The requests, as I remember, are to be made at m:OTRS so that we can be sure that they're made from an official and all. I can't find the precedent right now, but I'll look again when I have more time. Snoutwood (talk) 16:56, 29 April 2006 (UTC)
Here's the precedent: Wikipedia:Administrators' noticeboard/Archive35#Blocking on request?. I'm working on several blocking message templates that'll deal with the concerns brought up there (namely, that the IP will be reassigned); something along the lines of "if you're not editing from school X, here's how to contact us about the block." I'll post 'em later when they're done. Snoutwood (talk) 17:06, 29 April 2006 (UTC)

Block template

I've created a boilerplate template to use if an IP's blocked here. Comments and changes are welcome. Snoutwood (talk) 16:26, 30 April 2006 (UTC)

It sounds fine to me. --Siva1979Talk to me 19:34, 30 April 2006 (UTC)
Great! Could you also take a look at the e-mail boilerplate that I added? I'm worried that it's too long or somewhat inappropriate, and I'd love your thoughts. Snoutwood (tóg) 20:03, 30 April 2006 (UTC)

Official?

Please make sure the people you contact are aware this is not an official contact from the Wikimedia Foundation, but from a volunteer involved with the project. I suggest that OTRS not be used for this since if the contact is not official since it would give a misleading impression that it is. Angela. 17:31, 30 April 2006 (UTC)

O.K. I'll add that in pronto (in the guide it's already been made explicit that when contact is made the contactor should be clear that they're a volunteer and not an official). Are you saying that OTRS shouldn't be used at all, not even in the case that the sysadmin requests a block of their IPs (see above example)? I'm not questioning your judgement, I'm just wanting to make sure I understand. Snoutwood (talk) 18:18, 30 April 2006 (UTC)
Done. Thanks for pointing that out. Snoutwood (talk) 18:20, 30 April 2006 (UTC)
I suppose the email should be sent to the admin that would carry out the block, and maybe it should be forward to another admin for verification/record in case the blocking admin disappears for whatever reason? Petros471 12:02, 1 May 2006 (UTC)

Sharedip template

Hi. Great project.

I've noticed school vandalism coming from IPs like 209.184.226.126, which is already tagged with Template:Sharedip, and thus listed in Category:Shared IP. That template is worded as if to imply that someone's keeping an eye on it, and contacting the institution in quesiton, a public school in this case. Is this project that "someone"? I can't tell from a first inspection precisely what's being done with that template/category, except that it's used just <2000 times.

Anyway, is this an appropriate situation to fill out a report-thingy on Jenks Public School, and see how it works? -GTBacchus(talk) 18:37, 30 April 2006 (UTC)

Glad you like the idea! Yes, once this project gets onto its feet, it will be exactly who that template is referring to (currently, I believe that such situations are handled by the admins' incident noticeboard). I think that I, at least, would like to let this simmer for a little while longer and let more thoughts float in before we begin to put it to use, though. We're young yet, and I want to be sure that this is a process that the community wants, and that we've it as finely honed as we can before we let it loose. Snoutwood (tóg) 18:53, 30 April 2006 (UTC)
Well, I'll start a list of active school vandals that I run into, in the meanwhile. -GTBacchus(talk) 19:02, 30 April 2006 (UTC)
{{Whois}} is another similar template (I wrote it) intended to be quasi-threatening; I don't suggest using it if you aren't willing to make contact (or report it here, when this goes live), but it was deliberately written to convey a message along the lines of "We know who you are, we know we can report you and you will be found out, continue to vandalize at your own risk." I find it particularly useful when I find an IP via checkuser that is running a sockfarm; once the puppetmaster knows s/he isn't anonymous anymore, problems tend to clear up. Essjay (Talk • Connect) 11:50, 1 May 2006 (UTC)

Real names

When contact is made with an ISP, do you think that it's necessary for the contact to use his real name? I bring this up as it may be strage to recieve an e-mail from someone who signs it as "Snoutwood." I'd personally rather not let my name out of the hat, and was wondering what the thoughts of you lads on this topic are. Snoutwood (tóg) 19:47, 30 April 2006 (UTC)

You can use a real-sounding pseudonym if you like; I have one that I use for such things. Essjay (Talk • Connect) 11:47, 1 May 2006 (UTC)
Do you think we could get away with first name only (especially on emails)? - I don't really have a problem giving that out (you can probably guess it from my username anyway). Essjay's suggestion is good, but I don't think I'd use that (as I've not 'got one' I'd probably just sound stupid by making one up and forgetting it or something!). Petros471 11:56, 1 May 2006 (UTC)
Good idea, thanks. Snoutwood (tóg) 16:47, 1 May 2006 (UTC)

Logged-in users

The North Carolina vandal has been at it for just over a year now, and still continuing almost every day (for instance: [3]). Previously he used anon IPs in 63.19.128.0/17, but nowadays mostly creates throwaway sockpuppets. In fact, he may have started to do so soon after I started crafting customized block messages for range blocks, hoping to get a fellow ISP customer to complain to technical support (eg, contact: +1-800-900-0241 e-mail and report: 63.19.199.225 2006-02-24 21:48 EST; 63.19.131.33 2006-02-21 21:20 EST; 63.19.223.149 2006-02-17 23:11 EST; 63.19.204.105 2006-02-17 22:50 EST).

This suggests a loophole for vandals: their ISP will at worst just give them a warning as a result of action taken under Abuse reports, and then they can just continue with impunity by creating throwaway registered accounts instead. So at some point, there really needs to be a systematic checkuser component for effective followup in some cases. -- Curps 01:00, 5 May 2006 (UTC)

I can't speak to systematic checkusering, but where a single vandal is using a series of accounts to vandalize, the privacy policy allows disclosure of the IP address to target IP blocks and report abuse to ISPs. I have no problem whatsoever with running such checkusers (I do so quite frequently), and blocking the IPs; I've also contacted some providers (usually schools) when I discover them. Essjay (Talk • Connect) 03:59, 5 May 2006 (UTC)
Well, fine then. The North Carolina vandal is one of the most notorious and persistent vandals; his one year anniversary was April 26. If he doesn't merit taking action, I don't know who does. -- Curps 05:24, 6 May 2006 (UTC)
I agree with Curps here, as one who has fought this kid almost every day for more than a year. I've started range-blocking 63.19.128.0/17 again every time I see him, just to shut him up; he makes throwaway account after throwaway account, imitates every other vandal he knows about, and recently has taken to forging messages ([4] -- look at the edit summary). I try not to write about him on AN/I because he thrives on notoriety; indeed recently I've started trimming his sockpuppet lists since I think WP:DENY is a good policy. But if anyone needs to be hunted down via ISP it's this kid. I hoped he'd grow up by now, but I suspect it will be a long wait. Antandrus (talk) 03:09, 7 May 2006 (UTC)

Lists

It occurred to me that it might be useful for us to denote certain things in the list of investigators/contacts, most notably, which users are administrators, so it will be easy to identify them as needed. (I'm thinking of things such as viewing delted edits, which could be useful during an investigation.) Of course, certain other restricted privs would be useful to note; in my case, checkuser, as well as perhaps adminships on other projects (if they are attacking other projects, notifying an admin there would be helpful, etc.) My suggestion would be someting along the lines of:

Or if we included other Adminships:

with (W/M/C/Q) being short for (Wikipedia/Meta/Commons/Wikiquote).

Do others think either system would be helpful? Essjay (Talk • Connect) 05:49, 5 May 2006 (UTC)

Also occurs to me that in the case of contacts, what type of contact they are willing to make would be useful, i.e.:
Could get long, I guess, and might be better suited for a subpage if we draw a lot of volunteers, but at least a thought. Essjay (Talk • Connect) 05:51, 5 May 2006 (UTC)

I think it's a good idea. I was tempted to do that myself at first. I don't mind where the information goes. Perhaps like...

That seems fine to me. I'm not averse to a subpage though. --Lord Deskana Dark Lord of the Sith 07:51, 5 May 2006 (UTC)

Looks fine. I was about to suggest using {{admin}} rather than {{user}} for admins, but I think the above way looks fine. Petros471 08:11, 5 May 2006 (UTC)
Agree with all suggestions. Essjay, you may want to add links to m:Meta:Administrators, commons:Commons:Administrators, etc. as some people might not know what the letters stand for. Snoutwood (talk) 16:12, 5 May 2006 (UTC)
I've added it in. If anyone doesn't like it, feel free to change it around. Snoutwood (talk) 16:22, 5 May 2006 (UTC)

Subpage name change?

I think that it's probably easier to have the names of the subpages be who the IP is assigned to rather than just the IP name, as it's easier to remember that (i.e., Wikipedia:Abuse reports/Guilford County Schools, rather than Wikipedia:Abuse reports/216.79.194.96). Plus, it has the added bonus of the category providing a handy list of all of the ISPs we've contacted. What do you lads think? Snoutwood (talk) 16:17, 14 May 2006 (UTC)

I like it; it would work especially well for the Internet for Learning case.--Shanel § 18:52, 14 May 2006 (UTC)
I was slightly puzzled when I saw you re-name the subpage then post this, it's not exactly official policy to say that you should call the subpage by the IP :) I called the one I'm investigating by name because it coveres more than one IP (and I think most of the reports seem to) so it's better to call them by the 'registered to' name. Petros471 18:56, 14 May 2006 (UTC)
I agree. I'll go through and change them if there's agreeance for a bit longer. I changed it first, then thought that what I'd changed it from was better, and posted. I guess I'm sort a consistency nut, or I would've just changed it back :) Snoutwood (talk) 05:11, 15 May 2006 (UTC)
O.K., I've changed the instructions to acomodate that. Snoutwood (talk) 17:52, 18 May 2006 (UTC)

Policy change?

I'd like to point out that what I've been doing at the Internet for Learning IPs might be interpreted as a change to the blocking policy of Wikipedia. Either there is full concensus support for this, or people just aren't paying attention, which is why I'm bringing it up here. I have no desire to set precedents for unilateral changes to Wikipedia policy. I need to know my actions are accepted and supported.

Up to now the policy has been to block shared IPs, if at all, for as short a time as possible, so as not to prevent legitimate users from contributing. What I'm proposing for the Internet for Learning IPs is to set LONG blocks, possibly even indefinite blocks, and that legit users will have to request an unblock. I think this makes sense in light of the sheer volume of vandalism coming from these IPs, and the ratio of vandalism per solid contribution. However I am well aware that not continuing to give these IPs the benefit of the doubt is in some ways opposed to the spirit of wiki. My defense is that I see this as a temporary solution until a better solution can be found, such as the Wikipedia:Blocking policy proposal mentioned by Hughcharlesparker. But I'm a bit suprised that nobody has raised any objections yet. I've been setting 1 month blocks on each new Internet for Learning IP that pops up on my watchlist with a vandalism warning. I've also been adding my proposed template, which does not caution against long-term blocks. If someone thinks this is wrong, please speak up. --woggly 10:13, 16 May 2006 (UTC)

It seems to me that the blocking policy proposal and your work both face this question. It seems to me that we want to allow as many people as possible to edit, including those who choose not to log in. On the other hand, though, we have to protect ourselves against vandalism, and we have to be very careful not to assume that the people who work so hard against vandalism will continue willingly to do so no matter how bad the problem gets. We have to take what measures we can to stop off the worst sources of vandalism, even if that means that in certain places anonymous users can no longer edit. For my money, you and the WP:BPP are doing the right thing. --Hughcharlesparker 10:30, 16 May 2006 (UTC)
I've added my school IP as it's related (Grid/Internet 4 Learning) Will (E@) T 11:44, 16 May 2006 (UTC)
So you're in the same boat as Celestianpower. It looks like your useful contributions are the main reason this IP has not been permanently blocked. How about you leave it blocked whenever you're not actually working on it, and unblock if you want to edit or if someone else asks for an unblock. It seems to me this is not very different from what you've been doing anyway, except that the default will now be for the IP to remain blocked. And if anyone questions your blocking/unblocking actions, you can direct them to this discussion. Does that strike you as reasonable? --woggly 11:55, 16 May 2006 (UTC)
Yeah, that's reasonable Will (E@) T 13:14, 16 May 2006 (UTC)
This is a problem that Wikipedia has to face at some point, and I think is doing so admirably with WP:BPP. I've talked to Essjay a bit about indef blocks on school IPs here, and I'd suggest reading that brief discussion for some good points on long IP blocks (all made by Essjay, and not me :) ). I think that planting superlong IP blocks (greater than a month) are a bad idea until BPP goes through. Once we have that, we'll be able to block IPs such as this without getting in the way of people like Celestianpower and Sceptre.
Here's my suggestion: fill in the blocking reason with something such as this, with the needed modifications. Block the IP for two, three weeks and have it be recognized that CP and Sceptre are allowed to unblock themselves to avoid these blocks (and these blocks only, of course). Contact the ISP and see what that brings. Once BPP comes through, if the vandalism continues and the contacting hasn't helped any, block the IPs with BPP for six month streches, log the blocks, help out valid users who are caught in the crossfire, and that's that. I don't see a problem with long blocks of majorly vandalising IPs. However, you do need to be available for so that valid editors can talk to you, register accounts, and thus get around the block so they can edit productively. Snoutwood (talk) 18:17, 18 May 2006 (UTC)

Hall Monitor's blocks

Hall_Monitor (talk • contribs • blocks • protects • deletions • moves) has instituted many long-duration blocks against schools & school networks, with block messages saying "have your system administrator contact me." (At least some of them include a link to Special:Emailuser/Hall Monitor, too.) Now he has left the project, so contacting him probably won't do much good. Is it necessary to review his blocks, either to lift them or to change the block message? FreplySpang (talk) 16:41, 19 May 2006 (UTC)

I reckon so. How about changing the block message to simply: "Contact a Wikipedia sysadmin?" Snoutwood (talk) 16:54, 19 May 2006 (UTC)
Hm. It would be great if we could include a link to a handy contact page. WP:ABUSE probably isn't the right one, though. I think it's probably difficult for a system administrator who is unfamiliar with Wikipedia to figure out how to contact a Wikipedia admin. And I don't want to link to a particular individual's contact info (for instance, mine!) because, like Hall Monitor, any one of us could go away. FreplySpang (talk) 21:06, 19 May 2006 (UTC)

I would like to be a contactor

I have lots of free time and a cell phone with minutes that I never use. I found this and I think it would be a good idea for me to try this out.

I have been pointed here to ask how this works and how I would get started. I have read through how I'm supposed to be a concerned user, and not representing the Wikimedia foundation. I'm on the West Coast US. --mboverload@ 22:40, 19 May 2006 (UTC)

Feel free to add yourself then! --Lord Deskana Dark Lord of the Sith 22:41, 19 May 2006 (UTC)
Ok, so what now. I'm on the wikipedia IRC channel now if you want to talk. I need someone to "mentor" me. =) --mboverload@ 22:43, 19 May 2006 (UTC)
Sorry, I went to bed. :-P --Lord Deskana Dark Lord of the Sith 06:40, 20 May 2006 (UTC)
Does that mean you're on now? --mboverload@ 07:37, 20 May 2006 (UTC)
By the time you sent that message, I was at work. And I'm going to bed now! Sorry, maybe I can arrange a time soon. --Lord Deskana Dark Lord of the Sith 22:11, 20 May 2006 (UTC)

O.K., we need to deal with some problems

Mates, it's brainstorming time. We've got two main problems here, and here's what they are as I see it.

  1. We don't really know what to do if the vandalism doesn't stop after contact, if we're ignored, or if we get an unsatisfactory response (basically, anything that doesn't stop the vandalism).
  2. Backlog.

Those are the big ones. As for the first, here's my thought. In the case of unresponsiveness, warn the ISP that if they don't address the problem that they'll be permanently blocked. If that doesn't work, close the case. After the next case of vandalism, six month block. Keep adding the block back on and on ad infinitum, but each time you renew the block, check to make sure that the IP hasn't moved, etc. If you feel comfortable, unblock the IP and see what happens. If it vandalises, put it back in the hole.

There are some major downsides to this, but I don't know of any alternative solutions, and WP will have to deal with this prepetual vandalism problem eventually. The downsides are largely that registered/good faith editors will be unable to contribute. My solution to this is, once WP:BPP goes through, block the IP and allow for account creation and regusers to edit. That's that fixed (well, sort of, anyways). If account creation becomes a problem, disable it for that IP.

The second problem is slightly bigger. First, if you take on a case, please finish it. Don't drop it for someone else. Secondly, one of the things I was thinging of is asking for the reporter to investigate the case himself, and then have investigators flesh the reports out. Naturally, the problem with that is that it discourages reports, however, the thought is there.

Opinions, other ideas, criticism, disagreement, is sorely wanted. Snoutwood (talk) 07:31, 23 May 2006 (UTC)

You can't block IPs for more than a month, per the blocking policy. I don't think this is negotiable. --Lord Deskana Dark Lord of the Sith 09:34, 23 May 2006 (UTC)
A month, then. I've seen that violated a number of times, though, and think that might not be set in stone. Snoutwood (talk) 15:12, 23 May 2006 (UTC)
It's a policy page, it is set in stone. It's probably violated through ignorance, as I have violated it myself before someone pointed it out to me. --Lord Deskana Dark Lord of the Sith 18:21, 23 May 2006 (UTC)
This is a wiki, and few things can truly not be changed through community consensus, including the blocking policy. If we decide to change the blocking policy, then it is changed. That's the way a wiki works. This is the beginning of a discussion about that. Snoutwood (talk) 07:35, 24 May 2006 (UTC)
Of course, I just meant in its current state it cannot be ignored, until a consensus exists to change it, as I am certain you are aware. --Lord Deskana Dark Lord of the Sith 08:00, 24 May 2006 (UTC)
But of course :) Snoutwood (talk) 08:33, 24 May 2006 (UTC)

1) Unsatisfactory response

O.K., look, here's the problem. This page is nice and all, but we have no fucking leverage. If the ISP gets that, they say, "Fuck off, don't waste our time, you can't touch us," or they just don't respond. Then what? Go to the vandal and say, "Keep vandalising, we'll take our volunteer time and waste it turning back your edits happily, giving out short blocks, because we can't do anything about it?"

I think that's a goddamn bad solution, and that's what we're doing now. I want to stomp this. I want to start seeing hard blocks. That's where we get leverage. "Mr. ISP, if you don't respond/deal with this situation/etc., we're going to permanently block this IP. If you'd like to discuss this matter further and help us deal with the problem, you're welcome to contact us later." In the case of good-faith editors they can contact the blocking admin and have him help them create an account. He could create an account for them, even, and have them change the password once he's created it. We can work around this situation, but it's a situation we have to deal with and until we do, every week we'll have another one of these, these, these, or these. Brave boys, it's time for us to deal. Snoutwood (talk) 15:46, 23 May 2006 (UTC)

Let's be careful to keep this focused on this page, WP:ABUSE. More general talk about blocking should probably go elsewhere (such as blocking policy, AN, village pump). We started this page off with the primary focus on schools because there was more chance of a positive response from them. Let's take things one step at a time, and have a go at having an impact in that area first :) Petros471 17:14, 23 May 2006 (UTC)
Point well taken. However, I think that the point of us not knowing what to do if this doesn't work remains valid. Sorry for the cursing, it wasn't out of frustration or anger but out of a hope to get people's attention. I think that long blocks are where we need to move, even for IPs. The blocking policy says, For static IPs, such blocks should initially last 24 hours, but repeat violators may be blocked for a maximum of one month. I disagree with the blocking policy, and would like to change it pending some talks with you fine lads and the fellows over at the blocking policy's talk page. Naturally, I'll respect the consensus on it, but just because it's policy doesn't mean it's perfect. This is germane to this page as if that policy remains the same, then we can't do these long blocks, and there's no point in bringing this up at WP:BP if it turns out that we don't want this solution here. I want to figure out whether or not this is even wanted before chnaging the blocking policy. Snoutwood (talk) 07:35, 24 May 2006 (UTC)

Is the response any better for schools so far, than for ISPs? -GTBacchus(talk) 17:33, 23 May 2006 (UTC)

My only response (this I did outside of WP:ABUSE) was "We can't get in contact with the school, continue to block the IP". Hardly what you'd hope for. --Lord Deskana Dark Lord of the Sith 18:33, 23 May 2006 (UTC)
I thought we would be contacting schools directly. -GTBacchus(talk) 18:36, 23 May 2006 (UTC)
Well I contacted the contact address from the WHOIS, I was unaware at the time that it was a school that was vandalising. --Lord Deskana Dark Lord of the Sith 18:38, 23 May 2006 (UTC)
It depends. I've had (so far) a positive reaction from Bell Sympatico, one of Canada's largest ISPs, and mediocre responses from some schools. My current status is positive responses from 2 out of four contacts (1 postive response out of 3 schools). That is not a good ratio, especially since this page is sort of the last call, currently. We need to be able to do something after this, and that's what I'm trying to figure out now. Snoutwood (talk) 07:35, 24 May 2006 (UTC)

We can't block IPs indef, per the blocking policy. This is non-negotiable. (afterthough: except open proxies, of course) --Lord Deskana Dark Lord of the Sith 18:21, 23 May 2006 (UTC)

The blocking policy is of course negotiable, if we humble editors decide to change it. Why do you think I brought this up in the first place? The answer: to see what you lads think about the idea. This is a proposed policy change, so to say that it's against policy is somewhat tautological. Snoutwood (talk) 07:35, 24 May 2006 (UTC)
I wouldn't vote to change it. I think a month is long enough. If the vandalism stops, which it might well do if users try to vandalise and realise the IP has been blocked for a few weeks, then when the IP reaches the end of the block, we're fine. If it doesn't, another month block. This is of course after several blocks that are shorter, I'm not saying we block for a month standard. --Lord Deskana Dark Lord of the Sith 07:59, 24 May 2006 (UTC)
The problem is that cases that we're accepting generally already have been blocked for a month. Maybe more, in some cases. I'm seeing IPs that are being blocked for months, consecutive week-long blocks, since August 2005. That isn't working. Re-adding a month block as soon as the old one expires is, well, gaming the system, and waiting for the inevitable continuation of vandalism seems to me to be a poor choice when there's already twenty blocks in the log. These long blocks are for vandals who don't stop, won't stop, have had block after block after block, and would have been long since banned if they had a registered user account. I don't see why a static IP shouldn't be subject to the same rules as everyone else. Snoutwood (talk) 08:33, 24 May 2006 (UTC)

2) Backlog

I did think this would be a problem right from when this page started (relatively easy to report + fair amount of work to respond = backlog), so I'd be in favour of asking reporters to do more of the work, by filling doing more of the work. The 'signed up' people can still be around to give a hand were needed. As for that case that's been sitting on my to-do list for quite a while, I can only say I'll get to it ASAP... Petros471 17:14, 23 May 2006 (UTC)

O.K., this is all true. But what do we do about it? Do we have ideas? What do you think of my idea of having the reporter investigate the case? Do we have any other alternatives? We need them. Snoutwood (talk) 07:35, 24 May 2006 (UTC)
People would stop reporting cases. Speaking for myself, I'm not sure I know HOW to investigate. I don't have the technical knowhow, I'm not even sure I'm %100 clear on what is expected from such an investigation...? Also, I need to feel I have community support for my actions. I've been attacked by some of the IPs I've blocked (user page vandalised, multiple change password requests which can be done even from blocked accounts - imagine your email inbox flooded with 100 plus identical automated messages in a few hours); I need to know that what I am doing against these vandals is perceived by the Wikipedia community as necessary defense. Otherwise, I would just not get involved. But when I report an IP, and somebody else investigates, and a third person takes action - that's community involvement.
What I would be willing to do, however, is to help out with some other cases. For instance: I offered to take up contacting Bar-Ilan university - I live in Israel and speak Hebrew, I thought it made sense for me to help - but my offer was ignored here. I think what we need to do is write up a clear procedure, not as policy, but just so we make sure that everyone is one the same page as far as expectations, and so that new people can join in if they like. Right now, honestly, I feel like I've reported a whole bunch of IPs and nobody knows quite what to do with them, and the only one who has taken any action with them is myself. --woggly 08:41, 24 May 2006 (UTC)
Yeah, it's not 100% clear what should be involved in an investigation. I've started a page where I keep track of any school IPs I encounter, and collect some information about them - gradually, I'm sort of developing a more detailed report template, but I'm not sure exactly what a contactor would need to know. I'm happy to do my own investigations, but I'd need some guidelines as to what a contactor needs. -GTBacchus(talk) 19:54, 24 May 2006 (UTC)
Great, this is fantastic feedback. Basically, what's wanted in an investigation are the answers to these questions: Should there be an abuse report, what's the situation, and who do we contact? The answer to question one is, use your discretion, folks. Basically, at least five blocks, preferably way more, evidence of continued vandalism, no chance of stopping. Everything else's failed. That's the first answer.
The second answer is, fill out contact information, examples of the vandalism, block history, who might've perpetrated the vandalism, WHOIS links, contrib and block log links, summary of the vandalism. You want the ISP to be able to look at this page and immediately think, "Wow, I know exactly what's going one, this is a problem, and it's begin handled professionally." Subst in {{AR report}} and build on that. Look at old reports (this one and this one are good examples of what I'm looking for). That's the ideal situation. And remember: Experiment! This is a beta test. We're trying to see if this works or not. If you've got a good idea, try it!
Third: Make sure you have contact info in there, the more the better. Names, e-mail addresses, phone numbers, websites. Google the name of the school and see what you come up with. That's the best.
Does that help? I'll try and add this into the guide sooner rather than later, but if you guys understand what I'm looking for it may help if you could fill in the gaps that I've missed. Please please please add in questions so that I can try to answer them. Since I wrote that page, I'm going to be blind about it in in some ways (I know what I want everything to look like in my head, and I may forget to actually write it down), and I may not see my own holes. Your help in creating that page is invaluable. Thanks again for the feedback. Snoutwood (talk) 21:31, 24 May 2006 (UTC)


Abuse reports vs. Long term abuse

Okay, here's another question. How is the reporting section of this page different from: Wikipedia:Long term abuse#Shared IPs, which I've only now discovered. This looks a little redundant to me. --woggly 09:51, 25 May 2006 (UTC)

Long term abuse is for tracking of individual vandals: Willy on Wheels, Mr. Treason, Wikipedia is Communism, for the purpose of making it easier to handle thier vandalism on Wikipedia. Abuse reports is for investigating abuse by IPs from a given provider (a single school, or a university, or a company) in order to make an abuse complaint to the provider. LTA is internal; it organizes by vandal and helps other Wikipedians respond. ABUSE is external; it organizes by provider, and helps to get the provider to respond. Essjay (Talk • Connect) 09:57, 25 May 2006 (UTC)
Let me clarify: I was referring specifically to the section of Long term abuse which is dedicated to shared IPs (down by the bottom). I see a lot of schools, universities and companies listed there. --woggly 10:21, 25 May 2006 (UTC)
The fundimental difference is in the purpose: LTA is not intended to have any outside use. Abuse Reports is specifically intended to formulate an outside abuse report; if it can't be reasonablly expected to produce a result when the provider is contacted, then it doesn't belong at Abuse. LTA is inteneded to organize information for Wikipedia use, whether that be tracking of a single vandal or a problematic ISP, without any expectation that anyone will ever use the information to contact anyone outside Wikipedia; Abuse is only for cases that are going to have external contact. It's like the difference between having a personal notebook on the number of times the kids in your neighborhood have egged your house, and filing a police report. Essjay (Talk • Connect) 10:27, 25 May 2006 (UTC)

Newcomer question

How bad and prolonged does vandalism have to be before someone contacts the ISP? Should all those contacts be through the abuse report system described in this article? Take a look at User talk:142.227.221.1 -- should someone go ahead and do something now? I'm happy to send your template e-mail on my own, but I don't want to screw something up. Thanks,--A. B. 15:27, 9 June 2006 (UTC)

For the most part, abuse complaints should be reserved for longstanding situations where other means have failed. If we can solve a problem with a block, or with temporary page protection, there is no need to contact an ISP; if we begin flooding ISPs with complaints about minor cases, they will very quickly begin ignoring us, and we will have no recourse for serious situations. Until something rises to the level that the only way to stop it is to contact the ISP, it should be handled by on-wiki means. Essjay (Talk • Connect) 22:14, 9 June 2006 (UTC)

Question about reporting in the summer

I have a question about whether or not to report a school since it's stopped for the summer. 72.10.122.69 (talk • contribs • deleted contribs • WHOIS • RDNS • trace • RBLs • http • block user • block log) has been blocked 6 times since 14 Dec 2005. It's registered to a middle school in Connecticut [5]. The last contribution of it was 9 June 2006, so I can only presume that's because the school is closed for the summer now. Would it make sense to report this now or wait for the IP to start vandalizing again in August/September? Metros232 14:08, 17 July 2006 (UTC)

Stupid question

This may sound like a stupid question, but do you need to be approved or anything to do contact work, or can you just add your name to the list of users doing contact and just contact cases that need it, or what happens with that? Do you need to be an administrator or what? Rgenung 06:07, 30 July 2006 (UTC)

Schools

Why not just block schools anon. only and have them create accounts, without needing to contact them all, considering there are many problematic schools and there is a long backlog here? —Centrx→talk • 18:26, 15 October 2006 (UTC)

That is usually what ends up happening anyway. What I have been doing is anon. only but without account creation with a block message like "If you would like to contribute to this encyclopedia, you may create an account at home and use it at school." That at least gets rid of most of the study hall pranksters while allowing anyone to legitimately contribute. —Centrx→talk • 18:34, 15 October 2006 (UTC)

investigators

I'd be willing to help out here, as it looks like there are a few cases that aren't being looked at, is this a closed group or is help invited? ST47Talk 19:06, 20 October 2006 (UTC)

When I cleared it out a few days ago, there were reports from May still around and it looked like nothing had been done whatsoever since early September.

I don't think we should be doing as much investigation as it seemed was done before and how the page was intended. Instead, if there is an recurring problem, I just blocked the IP anon. only with a summary informing anyone using it that they can create an account elsewhere ("at home") and use it at school. Many school administrators end up just asking that the school's IP just be blocked from editing entirely anyway (and there are old indef blocks to that end that should be cleared). The blocks I did recently expired February 2007.

This is much less work, and solves the problem well. We don't need to spend hours on these to get some kid sent to detention. Other IPs or other kinds of vandalism may warrant investigation and contacting, but schools are the vast majority of the load and are all very similar common junk vandalism. —Centrx→talk • 01:52, 21 October 2006 (UTC)

I agree with this idea: I had given up on the original idea as a failed concept that takes too much effort to actually work. I personally feel that now that bugzilla:550 is implemented, this project should be abandoned, slapped with {{historical}}, and that future IP addresses with repaeated vandalism that WHOIS as schools should be indef blocked as IP only. Snoutwood (talk) 21:06, 19 November 2006 (UTC)
There is also Wikipedia:Requests for investigation, which it might be better to consolidate. However, it would good to have a system for reporting disruptive people to their ISPs, the question is if an ISP rather than a school will do anything about it. —Centrx→talk • 22:46, 28 November 2006 (UTC)

Volunteering to be a contactor

I work for a number of ISPs in the United States and in Canada--my company provides a turnkey ISP solution for a specific communication medium--and I am very familiar with dealing with abuse issues. I am very much capable of discussing with ISPs over the phone and through e-mail of what the issue at hand is. I hope that I can provide a certain level of support for you all! :: Colin Keigher 03:50, 26 October 2006 (UTC)

Proactive approach to schools

FreplySprang suggested I post this here: I've tried an approach that garnered some interest from other editors at Wikipedia:Village_pump_(policy)#I_just_don.27t_get_it. For problem school IP vandalism I've started contacting the school. Early response has been excellent. Durova 22:37, 4 November 2006 (UTC)

Transclusion

I've setup the page in a similair fashion to RfA, purely to allow requests to be easier moved around for investigators, contactors or Wikignomes if refusing to investigate further. I'm also trying to keep the page nice and short so it's easier to understand and use for less experienced users. Also, information already in a subpage should be a little easier on investigators, removing the need for subpage creation when starting an investigation. If there's any probs with transcluding new alerts, we can easily just go with {{IPvandal}} approach although I favour the reporter rather than the investgator creating the subpage. Kind Regards - Heligoland | Talk | Contribs 02:35, 18 November 2006 (UTC)

All right, if you have an idea, run with it, I think it looks a little cluttered personally, but I'm sure you have a plan ST47Talk 02:47, 18 November 2006 (UTC)
It's still quite cluttered despite my best attempts to tidy it up. I'm loath to remove any more information from the page though, but I think the page is a little top heavy, the actual IP section is. Any thoughts. I was aiming for something like AfD or RfA. Kind Regards - Heligoland | Talk | Contribs 13:16, 18 November 2006 (UTC)

Subpage creation in the wrong location

I'm seeing subpages created at /wiki/IP rather than wiki/Wikipedia:Abuse reports/IP. Not sure if its just my configuration or if something has changed on the server. (I'm running Safari 2.0.4 on Mac OS X 10.4.8). Javascript was turned off, but I enabled it and tried again. Perhaps its still not enabled though after just a reload of the page. If anyone else can reproduce this please confirm below. --HardConcrete 18:49, 24 December 2006 (UTC)

Official v Unofficial

The Abuse Report system does not act in any official capacity of the foundation, the owners of this website. Yes, editors are involved as are some administrators but as we're not technically approved by the foundation in the same way as ArbCom is, we lack the ability to ban any user, and as most of us are not administrators, we cannot even take remedial action to block an IP address or range of IP addresses engaged in vandalising the site. This information needs to be prominent before reports and especially requests for bans are logged. --Kind Regards - Heligoland (Talk) (Contribs) 23:13, 10 January 2007 (UTC)

First, there isn't any consensus for your view, so please don't say such, as you did in your edit summary. Second, I, as an admin, can block without consulting the Foundation so long as I act within the scope of WP:BP. Third, this project operates within the scope of parameters laid out in said blocking policy. Thus, your statement that we cannot block IP addresses or rages through this system is false. No one has claimed that we are a Foundation system, nor is that necessary. Reverting. Snoutwood 23:21, 10 January 2007 (UTC)
To put this another way, WP:AIV doesn't have "foundation approval," and that doesn't prevent it from blocking tons of vandals. You don't need the Foundation's blessing to block a vandal, and we never have. I'm somewhat confused by your edits. Snoutwood 23:24, 10 January 2007 (UTC)
Yes, this is nonsense. It could be appropriate to put a disclaimer at the bottom of e-mails sent to ISPs that you are not an official representative of the Wikimedia Foundation, a standard sort of legal disclaimer, but we are perfectly able to block IPs here, and that is exactly what has always been done for abusive IPs, and if a representative of a school, etc. requests it. —Centrx→talk • 05:12, 11 January 2007 (UTC)

How do you become a contacter?

I want to help out. Do you need to apply? Arbiteroftruth 02:15, 23 January 2007 (UTC)

No. As long as you have read the guidelines at the top of the actual page, feel free to add yourself. Please do be sure to mention that you are not officially endorsed by the Wikimedia Foundation in your e-mails though, I forgot to mention this myself once or twice. --Deskana (request backup) 02:56, 23 January 2007 (UTC)
Even though I'm sure the foundation appreciates it :). Yuser31415 04:19, 23 January 2007 (UTC)

Case of difficult address to blacklist on spam

Hey guys, I have a very difficult address to blacklist on spam. Could I get someone to contact the main company that's been doing all the spamming: it involves *.ibtimes.com. It's hard to blacklist, because it's a legit site (with currently about 10 links), but they've been spamming us for months with hundreds of links every time a new articles comes out, and I'm sick of cleaning up after the guy. I might just see it blacklisted anyway. The list of sockpuppets (and IP addresses associated therein) is: [[6]]. Someone please help out with this. I'm so sick of this clean up. Patstuarttalk|edits 03:20, 25 January 2007 (UTC)

reporting someone

how do you report someone for abuse? this guy "Rebelguys2". all he does is revert articles —The preceding unsigned comment was added by 217.43.250.76 (talk) 21:05, 8 February 2007 (UTC).


Persistent vandalism by anonymous user using different Monash University ID's

With utmost regret I am compelled to report this!This user had used multiple ID's the talk page of all leading to Monash University.He has been warned umpteen times and because of vandalism was blocked for 3 months.The vandalism has persited for over 2 years!Lately he continues to vandalise over half a dozen pages like Sony and John Funder.(Vr 06:17, 12 February 2007 (UTC))

Help

Can someone please block, ban, or warn User:Darrenss, he is new and just continues to delete links and claims on the article Potter's House Christian Fellowship. I tire of reverting the article. It is not just a newbe mistake either, his sole purpose to be on wikipedia is to create problems with the article. I have told him over and over to seek mediation, but now he is warning me to stop vandalising (reverting). Sheesh! Cheers. Potters house 20:07, 5 March 2007 (UTC)

Sukecchi

the user:Sukecchi removed my edit when it had everything to do with pokemon! Please tell that person to get his facts right! The info i put was of an incedent that happend during an episode of pokemon! --Akemi2.0 12:38, 13 March 2007 (UTC)

This user posted information on the Pokemon Collaboration Project and Anime and Manga project pages that didn't belong there. They were posts of a forum nature. Besides, the incident the user was trying to tell us about is already discussed on the main Pokemon article and the Banned episodes of Pokemon article. -Sukecchi 13:01, 13 March 2007 (UTC)
That did belong! I know the rules....sort of.

Here is the event:

  • Date:12/14/97
  • location:japan
  • event: During an episode of pokemon the main pokemon, pikachu shot lightning because someone tossed a bomb at him! At that moment something happened, Wide spread reports of kids haveing Epileptic Seizures while watching TV! All were at the same timespan all where watching pokemon and...thats it. But due to this the company,shogakukan shutdown project:pokemon for 4 months to investagate the unusal event! Thats all i know! IF THAT AINT WHAT WIKI IS LOOKING FOR THAT WE NEED TO FIX THE RULES BUSTER! So dont tell me it aint wikiable!--Akemi2.0 16:14, 13 March 2007 (UTC) P.S. Dont EVEN think about useing that event in anything!ba-da!

Cleanup of new requests

Earlier today I did a bit of cleanup, rejecting 15 requests here that were obviously not related to what this page is meant to accomplish. Since most of them were intended for WP:AIV, I added a sentence near the top of the page to reflect that. There were some other requests that don't fit the criteria, but I only took out the most clear cases. Dekimasuよ! 08:49, 5 April 2007 (UTC)

Possible archival bot

I have thought of the idea of having an automatic archival bot, possibly ExtranetBot, on this Wikipedia page. As it is widely used here, it will definately require one in the future, but I have thought this through and should be actioned now. For this bot to work, WP:ABUSE will have to create a new process of actioning on abuse requests when they need archiving, using template messages (similar to WP:ACC) that the bot can read and then take action on. I am currently in the process of creating an archival template for the page and should be complete soon. I believe this is a great initiative and will definately help those tired people to stop archiving. Let us know what you think as my bot, ExtranetBot is nearly ready if we can reach a clear consensus here. Extranet talk 06:17, 16 May 2007 (UTC)

Probably a good idea, but how exactly would you think the process would have to be changed? JodyB talk 21:05, 16 May 2007 (UTC)
The person that is actioning on the particular report would have to add a template (either declined, etc.) to the request and it will then be read by the bot and archived to the correct place. Could someone also note what templates I would have to make and what is the process of actioning and archiving at the moment? Cheers! Extranet talk 21:55, 16 May 2007 (UTC)
That being the case I would think it useful. Only speaking for myself, I usually complete the case in one swoop. Others more experienced should probably give you a fuller answer. JodyB talk 02:40, 17 May 2007 (UTC)
  • Sounds good. I've done work here before, and it would probably be useful for separating all the clutter. Agreeing with JodyB, I usually complete a case in a matter of 10 minutes or so. Cool Bluetalk to me 20:58, 20 May 2007 (UTC)
    • I have just finished creating a template system (so that the bot knows what to do). You can see it at {{ARA}}, with all documentation on the page. I will start to create the bot code now, probably done by the end of the week. Extranet is now E talk 21:06, 20 May 2007 (UTC)

Improper reports

If a report lists an IP with no or with very few blocks, should it just be removed? Is there a process for removal? JodyB talk 13:27, 15 May 2007 (UTC)

Best list them at Wikipedia:Abuse reports/Rejected as well, but apart from that I think you can just remove them. There's such a backlog, we need to be selective. Petros471 15:02, 15 May 2007 (UTC)