Effectiveness of checkuser Options

[Peter Damian]

I'm working on a document that is a detailed and point by point comment on WMUK's submission to the charity commission, July and September 2011. Note this is not public yet, as 'dogbiscuit' got access to a copy privately via FOI. The document (which I strongly believe was written by our friend 'Fae') contains many misleading or downright inaccurate claims.

Section 13.3.8 of the submission says ""There is also “CheckUser” software that enables a small number of selected and vetted volunteers to establish, in many cases, whether two editors are from the same ISP, and often where that ISP is located. This information is mostly used to detect blocked editors who try to return under a different account name. "

My experience of checkuser is that it is almost completely ineffective as a control over determined, intelligent users, and that evaders are usually caught out by stupidity or carelessness, rather than by the software itself. Examples are the easily availability of dynamic IPs (such as my own service provider, who kindly change my IP daily), the availability of 'hot spots' (public wifi networks), internet cafes, use of proxies.

Any other ideas to contribute to this section? I would be particularly interested in narratives or stories from experienced evaders.

As always, my email is edward at logicmuseum.com.

This post has been edited by Peter Damian: Sat 31st December 2011, 3:35pm

[thekohser]

It sounds like you've about got it covered, honestly.

You might want to add that CheckUser produces many false positives (when a dynamic IP happens to get assigned to another customer of your same ISP, or when a public wi-fi node is used by different Wikipedians). And (in WP's defense), the CheckUser also produces "user agent info" that can help to very clearly confirm that the same computer hardware is being used by multiple accounts.

[Peter Damian]

It sounds like you've about got it covered, honestly.

You might want to add that CheckUser produces many false positives (when a dynamic IP happens to get assigned to another customer of your same ISP, or when a public wi-fi node is used by different Wikipedians). And (in WP's defense), the CheckUser also produces "user agent info" that can help to very clearly confirm that the same computer hardware is being used by multiple accounts.

Thanks ! I've also mentioned that the user agent info (as far as I know) is a javascript add-on that is easily disabled. Anyone know about this?

I also need to add that dynamic IPs can sometimes be disabled using 'range blocks', but that this means thousands or tens of thousands of other users are also prevented from using Wikipedia effectively.

This post has been edited by Peter Damian: Sat 31st December 2011, 3:50pm

[melloden]

It sounds like you've about got it covered, honestly.

You might want to add that CheckUser produces many false positives (when a dynamic IP happens to get assigned to another customer of your same ISP, or when a public wi-fi node is used by different Wikipedians). And (in WP's defense), the CheckUser also produces "user agent info" that can help to very clearly confirm that the same computer hardware is being used by multiple accounts.

Thanks ! I've also mentioned that the user agent info (as far as I know) is a javascript add-on that is easily disabled. Anyone know about this?

I also need to add that dynamic IPs can sometimes be disabled using 'range blocks', but that this means thousands or tens of thousands of other users are also prevented from using Wikipedia effectively.

I believe there is a Firefox add-on called user agent switcher. I haven't tested whether it can fool checkuser, but I will do that sometime. Also, I think the Google Toolbar can affect the user agent.

Peter, have you ever played around with the checkuser interface? It's not very exciting, but it'll tell you everything you need to know about it.

[Peter Damian]

It sounds like you've about got it covered, honestly.

You might want to add that CheckUser produces many false positives (when a dynamic IP happens to get assigned to another customer of your same ISP, or when a public wi-fi node is used by different Wikipedians). And (in WP's defense), the CheckUser also produces "user agent info" that can help to very clearly confirm that the same computer hardware is being used by multiple accounts.

Thanks ! I've also mentioned that the user agent info (as far as I know) is a javascript add-on that is easily disabled. Anyone know about this?

I also need to add that dynamic IPs can sometimes be disabled using 'range blocks', but that this means thousands or tens of thousands of other users are also prevented from using Wikipedia effectively.

I believe there is a Firefox add-on called user agent switcher. I haven't tested whether it can fool checkuser, but I will do that sometime. Also, I think the Google Toolbar can affect the user agent.

Peter, have you ever played around with the checkuser interface? It's not very exciting, but it'll tell you everything you need to know about it.

Yes please. See email address above.

[Vigilant]

I'm working on a document that is a detailed and point by point comment on WMUK's submission to the charity commission, July and September 2011. Note this is not public yet, as 'dogbiscuit' got access to a copy privately via FOI. The document (which I strongly believe was written by our friend 'Fae') contains many misleading or downright inaccurate claims.

Section 13.3.8 of the submission says ""There is also “CheckUser” software that enables a small number of selected and vetted volunteers to establish, in many cases, whether two editors are from the same ISP, and often where that ISP is located. This information is mostly used to detect blocked editors who try to return under a different account name. "

My experience of checkuser is that it is almost completely ineffective as a control over determined, intelligent users, and that evaders are usually caught out by stupidity or carelessness, rather than by the software itself. Examples are the easily availability of dynamic IPs (such as my own service provider, who kindly change my IP daily), the availability of 'hot spots' (public wifi networks), internet cafes, use of proxies.

Any other ideas to contribute to this section? I would be particularly interested in narratives or stories from experienced evaders.

As always, my email is edward at logicmuseum.com.

There are many, many devices that allow for easy IP switching. Linux based routers, tethered smart phones, 3G to wifi local hotspots. There are many classes of device that allow you to change your IP immediately. If you combine these and either use different browsers or use a plugin that allows for browser string spoofing, there is literally no way for the checkuser tools to find you.

[Peter Damian]

There are many, many devices that allow for easy IP switching. Linux based routers, tethered smart phones, 3G to wifi local hotspots. There are many classes of device that allow you to change your IP immediately. If you combine these and either use different browsers or use a plugin that allows for browser string spoofing, there is literally no way for the checkuser tools to find you.

If I may quote you almost verbatim on that? It has a nice authentic ring to it (tho' I have no idea what it means).

[Kelly Martin]

The way British ISPs operate makes it difficult to geolocate users within Great Britain. This is partially because many ISPs service the entire country and so their IP pools may be allocated to locations anywhere in the entire country (and even in some cases outside the country). There are also "British" ISPs whose principal Internet point of presence is outside the UK and quite a few Brits who avail themselves of German, French, and Italian ISPs, all for various reasons. Also, UK hotspots provided by someone like, e.g., Starbucks, may end up appearing to be in the United States. It's well-known that all AOL users, including AOL UK users, will appear to be in Herndon, Virginia. So while IP information will sometimes be able to tell you where someone is, it's also the case that sometimes it will not even be able to tell you what continent they're on. And figuring out which often requires advanced knowledge of how the Internet works, something that very few checkusers have.

Checkuser can and will catch naive attempts to conceal identity. It catches most such attempts only because most people who try to do this are ignorant or stupid. Against those who know how to use proxy services, cache spoofing, and browser ID spoofing, the checkuser tool is virtually useless. Fortunately, there are fairly few people in this latter category.

Years ago, I caught one such person, who was running a large sockfarm to push a particular political point of view. He used a large network of proxies located literally all over the world, but mostly in Eastern Europe and Asia. I only caught him because he made mistakes; if he had been more careful at ensuring that sock A only used IP B (and so forth) I would never have caught him.

[Vigilant]

There are many, many devices that allow for easy IP switching. Linux based routers, tethered smart phones, 3G to wifi local hotspots. There are many classes of device that allow you to change your IP immediately. If you combine these and either use different browsers or use a plugin that allows for browser string spoofing, there is literally no way for the checkuser tools to find you.

If I may quote you almost verbatim on that? It has a nice authentic ring to it (tho' I have no idea what it means).

Feel free.

To expound:
* There are many classes of device where you can force a change of your IP. Anywhere a device acquires an IP address through DHCP (typically wirelessly). A wifi hotspot at Starbucks that sees your computer come into range will assign your computer a local IP address and wikipedia will see that particular Starbucks IP address (or one of their IP addresses) as the originator. Cross the street to another Starbucks and wikipedia will see a different IP.

* With 3G/4G (cellphone carrier) <--> PC (USB/Ethernet/Wifi) the situation gets better/worse. If you're using a 3G to Wifi hotspot (http://gizmodo.com/5256825/verizon-mifi-2200-3g-portable-wi+fi-hotspot-review (first hit on google)), then every time you power cycle the 3G router, you are given a new IP address.

* If you are tethering a smart phone, then power cycling will give you a new IP address.

* Agent spoofing is trivial. Firefox has plugins, there are dozens of ways to do this.
https://www.google.com/search?q=user+agent+spoofing

* To avoid exposing yourself if you're running sockpuppets, use a VM (VirtualBox, VMWare). You can install dozens of virtual machines, each running a differnet OS/Browser combination. Make a single account per VM and check the remember me button on wikipedia.

In summation, checkuser is feeble and the people who use it and expect results are even worse. They only catch the most lazy and incompetent sockpuppeteers. Or those who don't give a shit.

[Peter Damian]

There are many, many devices that allow for easy IP switching. Linux based routers, tethered smart phones, 3G to wifi local hotspots. There are many classes of device that allow you to change your IP immediately. If you combine these and either use different browsers or use a plugin that allows for browser string spoofing, there is literally no way for the checkuser tools to find you.

If I may quote you almost verbatim on that? It has a nice authentic ring to it (tho' I have no idea what it means).

Feel free.

To expound:
* There are many classes of device where you can force a change of your IP. Anywhere a device acquires an IP address through DHCP (typically wirelessly). A wifi hotspot at Starbucks that sees your computer come into range will assign your computer a local IP address and wikipedia will see that particular Starbucks IP address (or one of their IP addresses) as the originator. Cross the street to another Starbucks and wikipedia will see a different IP.

* With 3G/4G (cellphone carrier) <--> PC (USB/Ethernet/Wifi) the situation gets better/worse. If you're using a 3G to Wifi hotspot (http://gizmodo.com/5256825/verizon-mifi-2200-3g-portable-wi+fi-hotspot-review (first hit on google)), then every time you power cycle the 3G router, you are given a new IP address.

* If you are tethering a smart phone, then power cycling will give you a new IP address.

* Agent spoofing is trivial. Firefox has plugins, there are dozens of ways to do this.
https://www.google.com/search?q=user+agent+spoofing

* To avoid exposing yourself if you're running sockpuppets, use a VM (VirtualBox, VMWare). You can install dozens of virtual machines, each running a differnet OS/Browser combination. Make a single account per VM and check the remember me button on wikipedia.

In summation, checkuser is feeble and the people who use it and expect results are even worse. They only catch the most lazy and incompetent sockpuppeteers. Or those who don't give a shit.

Thanks. There are actually two bits of information for UKCC here. One is that it is easy to evade controls. Two is that there are real people out there, actively doing it.

[Vigilant]

There are many, many devices that allow for easy IP switching. Linux based routers, tethered smart phones, 3G to wifi local hotspots. There are many classes of device that allow you to change your IP immediately. If you combine these and either use different browsers or use a plugin that allows for browser string spoofing, there is literally no way for the checkuser tools to find you.

If I may quote you almost verbatim on that? It has a nice authentic ring to it (tho' I have no idea what it means).

Feel free.

To expound:
* There are many classes of device where you can force a change of your IP. Anywhere a device acquires an IP address through DHCP (typically wirelessly). A wifi hotspot at Starbucks that sees your computer come into range will assign your computer a local IP address and wikipedia will see that particular Starbucks IP address (or one of their IP addresses) as the originator. Cross the street to another Starbucks and wikipedia will see a different IP.

* With 3G/4G (cellphone carrier) <--> PC (USB/Ethernet/Wifi) the situation gets better/worse. If you're using a 3G to Wifi hotspot (http://gizmodo.com/5256825/verizon-mifi-2200-3g-portable-wi+fi-hotspot-review (first hit on google)), then every time you power cycle the 3G router, you are given a new IP address.

* If you are tethering a smart phone, then power cycling will give you a new IP address.

* Agent spoofing is trivial. Firefox has plugins, there are dozens of ways to do this.
https://www.google.com/search?q=user+agent+spoofing

* To avoid exposing yourself if you're running sockpuppets, use a VM (VirtualBox, VMWare). You can install dozens of virtual machines, each running a differnet OS/Browser combination. Make a single account per VM and check the remember me button on wikipedia.

In summation, checkuser is feeble and the people who use it and expect results are even worse. They only catch the most lazy and incompetent sockpuppeteers. Or those who don't give a shit.

Thanks. There are actually two bits of information for UKCC here. One is that it is easy to evade controls. Two is that there are real people out there, actively doing it.

I hope you're referring to Kelly's catch because I don't do this with wikipedia. I don't care to participate in the approved manner. I'm a mere sniper on the sidelines.

Another topic you could explore is the ease with which wikipedia could be corrupted.

[Peter Damian]

I hope you're referring to Kelly's catch because I don't do this with wikipedia. I don't care to participate in the approved manner. I'm a mere sniper on the sidelines.

Another topic you could explore is the ease with which wikipedia could be corrupted.

Of course

This post has been edited by Peter Damian: Sat 31st December 2011, 6:52pm

[dogbiscuit]

Don't get too excited about this. The CC will not be interested in the effectiveness of controls - that is not really their (political) problem, it is sufficient that they have enquired of them and been told that they are adequate - they have covered themselves. There would be a presumption that if they were deemed to be inadequate for the purpose then the controlling bodies will fix them over time. I very much doubt that CC would be interested in proof that a minority of malicious individuals could circumvent the controls.

So I don't think this is anything but a minor supporting argument. The real issues are about the public harm of wilfully inaccurate information (thinks, we have something where Wikipedia has taken a position on Scientology haven't we? Is it neutral or has it established an anti-Scientology position?).

Another issue was animal welfare where SlimVirgin sought to create a bias in a wide range of farming articles to show that animal farming was cruel - including deliberate blurring of the lines between factory farming and other practices to allow normal farming practices to be treated as inappropriate. I just looked and sure enough the Factory farming article is tagged. A good example of a battleground article, not tainted with sexual arguments, but potentially quite damaging as it is not a neutral overview of a controversial subject. For example, it associates BSE with factory farming, whereas it was poor feeding practice, not specifically factory farming. Quite importantly, and deliberately, misleading, scaremongering (not that I approve of factory farming). This was also an example of Verifiability not Truth as SlimVirgin used summary BBC News articles against things like the Government Inquiry which specifically concluded Factory Farming was not a factor - this was deemed to be a primary source, so could be excluded, even though it was clearly a very high quality source indeed. (Still grumpy about this after 4 years!!!).

[Peter Damian]

Don't get too excited about this. The CC will not be interested in the effectiveness of controls - that is not really their (political) problem, it is sufficient that they have enquired of them and been told that they are adequate - they have covered themselves. There would be a presumption that if they were deemed to be inadequate for the purpose then the controlling bodies will fix them over time. I very much doubt that CC would be interested in proof that a minority of malicious individuals could circumvent the controls.

So I don't think this is anything but a minor supporting argument. The real issues are about the public harm of wilfully inaccurate information (thinks, we have something where Wikipedia has taken a position on Scientology haven't we? Is it neutral or has it established an anti-Scientology position?).

Another issue was animal welfare where SlimVirgin sought to create a bias in a wide range of farming articles to show that animal farming was cruel - including deliberate blurring of the lines between factory farming and other practices to allow normal farming practices to be treated as inappropriate. I just looked and sure enough the Factory farming article is tagged. A good example of a battleground article, not tainted with sexual arguments, but potentially quite damaging as it is not a neutral overview of a controversial subject. For example, it associates BSE with factory farming, whereas it was poor feeding practice, not specifically factory farming. Quite importantly, and deliberately, misleading, scaremongering (not that I approve of factory farming). This was also an example of Verifiability not Truth as SlimVirgin used summary BBC News articles against things like the Government Inquiry which specifically concluded Factory Farming was not a factor - this was deemed to be a primary source, so could be excluded, even though it was clearly a very high quality source indeed. (Still grumpy about this after 4 years!!!).

Oh well. I am merely playing a small part, a cog in the machine. If I can show that they misled the UKCC in the application, that is one small step.

However, I have covered many of the things you mention above, such as the overall bias, the ineffectiveness of their controls in correcting bias, etc. The document plus appendices is now 12 pages. The checkuser part is one small paragraph.

You say "it is sufficient that they have enquired of them and been told that they are adequate - they have covered themselves. " A good bureaucrat proceeds on the principle of utmost good faith. They can't check everything, indeed they can rarely check anything, and place the utmost reliance on the good faith and honesty of declarations.

Also, it is difficult to question judgments they have made on the basis of available evidence. If, by contrast, it can be shown that the available evidence was flawed, they (the bureaucrats) have a nice get out of jail card.

Let's see.

This post has been edited by Peter Damian: Sat 31st December 2011, 7:14pm

[Kelly Martin]

Indeed, I would argue that checkuser is actually overused and misused more often than not. In fact, its main use (other than to identify and interdict serial vandals, a purpose that really cannot be argued as anything other than legitimate) is to identify and punish those who attempt to game its internal political system. This is of no concern to the UKCC; the UKCC is not particularly interested in, nor charged with resolving, internal political disputes within the charities it regulates. Only when such disputes are so endemically severe that they threaten the ability of the charity to effectively self-regulate does the UKCC have an interest.

[gomi]

There have been many, many discussions here on WR about checkuser over the years. Here are a few of them:

How effective is checkuser?
CheckUser Safety Tips, Part XIV
Checkuser data retention
Checkuser statistics
Privacy violations by a Checkuser in the block log, a permanent record
Checkuser abuse

[Peter Damian]

This is of no concern to the UKCC;

Yes it is. Section 13.3.8 of the WMUK submission claimed it was an effective control, replying to concerns from UKCC about 'scope for abuse'. Therefore it is a concern for the UKCC. Obviously they couldn't care less about what it actually is. Trust me.

[Vigilant]

This is of no concern to the UKCC;

Yes it is. Section 13.3.8 of the WMUK submission claimed it was an effective control, replying to concerns from UKCC about 'scope for abuse'. Therefore it is a concern for the UKCC. Obviously they couldn't care less about what it actually is. Trust me.

It would be trivial to outline a scenario that would allow for rampant abuse (of whatever flavor) on wikipedia.
It would also be trivial to show that there exist safeguards that would completely prevent the abuse that are not being used by wikipedia.

It's very clear that they like things the way they are even when vastly better alternatives exist.

[melloden]

It sounds like you've about got it covered, honestly.

You might want to add that CheckUser produces many false positives (when a dynamic IP happens to get assigned to another customer of your same ISP, or when a public wi-fi node is used by different Wikipedians). And (in WP's defense), the CheckUser also produces "user agent info" that can help to very clearly confirm that the same computer hardware is being used by multiple accounts.

Thanks ! I've also mentioned that the user agent info (as far as I know) is a javascript add-on that is easily disabled. Anyone know about this?

I also need to add that dynamic IPs can sometimes be disabled using 'range blocks', but that this means thousands or tens of thousands of other users are also prevented from using Wikipedia effectively.

I believe there is a Firefox add-on called user agent switcher. I haven't tested whether it can fool checkuser, but I will do that sometime. Also, I think the Google Toolbar can affect the user agent.

Peter, have you ever played around with the checkuser interface? It's not very exciting, but it'll tell you everything you need to know about it.

Yes please. See email address above.

Yes please what?

[EricBarbour]

Don't forget the time Arbcom yanked away David Gerard's checkuser/oversight powers.
The original discussion on the Arbcom noticeboard was deleted and oversighted, because
Gerard claimed it was "potentially libelous", and managed to talk one of his buddies into
making it disappear.

Which resulted in this even-longer argument. Complete with Mike Godwin bitching certain people out.

David demanded a full retraction and apology, or oversight, and he demanded it in a hurry because Cade Metz was sniffing around. Arbcom doesn't do hurry under the best of circumstances, and here there were significant disagreements about whether or not a retraction was even deserved, much less how to word it. So the comments were oversighted instead. Thatcher 20:55, 2 December 2009 (UTC)

Gerard and Aussie political blogger Andrew Landeryou had apparently hated each other for years.
But the "fun" was triggered by this.

WR thread. Note that virtually all the Wikipedia traces of this situation have been oversighted by now.
Gerard, like Jayjg and Durova before, was quite happy to abuse checkuser.

If you ever need a good example of Wikipedia being used to defame, try Andrew Landeryou (T-H-L-K-D).
Looking for evidence of David Gerard socking? Try the history of that article.

Stupidity and incompetence, that's what Arbcom is all about. And checkuser is just completely useless.