This page explains the most common procedures for administrators patrolling the sockpuppet investigations (SPI) pages. SPI is where users can bring concerns that an individual may be misusing accounts or IP editing in violation of Wikipedia's sock puppetry policy, for example to breach sanctions, blocks, or agreements, to bias content and discussions, to attack other users, or to disrupt, deliberately mislead, or vandalize.

SPI is a delicate area; patrollers should keep in mind that there are legitimate uses of multiple accounts, and that improbable things can happen by chance. Unfairly blocking someone as a sockpuppet is a harm not easily undone.

For details on what patrollers can do to help at SPI, and how to get involved, and background on how SPI works, see the clerks page, and more specifically the section of that page about patrolling and getting involved.

Decisions and case control at SPI are routinely managed by any admin. While Checkusers add evidence, and Checkusers and Clerks may take action, any admin can make decisions on cases and their management (as with any dispute) within the norms of SPI. With more administrators patrolling, SPI cases will have more watchers, be updated faster, and have a greater chance of being reviewed independently. Admin patrollers are warmly welcomed!

The easiest cases for admins new to the area are the ones in the beige-colored "Open" category. The green "CU completed" cases tend to be a bit more challenging, but that category also tends to need the most help.

• "Strike out usernames that have been blocked" from Special:Preferences#mw-prefsection-gadgets (formerly User:NuclearWarfare/Mark-blocked script.js), which indicates if an account has been blocked already, either for a set period of time or indefinitely.
• Editor Interaction Analyzer, which shows the common pages that two or more editors have both edited, sorted by minimum time between edits by the users.
• Interaction Timeline, primarily designed to combat harassment but potentially useful in other situations, too
• Intertwined Contributions
• Intersect Contribs, faster than the Editor Interaction Analyzer but without as much detailed information
• Special:CentralAuth, quick and easy way to determine edit count and cross-wiki footprint (much faster than XTools or the Global Contributions tool)
• User:GeneralNotability/spihelper, a script which is primarily for clerks, checkusers and patrolling administrators (but can be used by other users). It gives a menu of options which help those users deal with sockpuppet cases and case pages.

To open an SPI case, please follow the instructions by opening the section "How to open an investigation" at Wikipedia:Sockpuppet investigations, making sure you have read and understood the SPI case guidelines at the top of that page. For a quick CheckUser request, please follow the instructions at Wikipedia:Sockpuppet investigations#Quick CheckUser requests, making sure you have read and understood when and when not to request CheckUser. CheckUser attention on other pages can be requested with {{Checkuser needed}}. Please use this judiciously, as it causes the Bat-Signal to go off.

Any uninvolved administrator at any time may block any account that has violated the sock puppetry policy based on behavioral and/or technical evidence. Behavioral evidence consists of editing behaviors and patterns from suspected sock puppets as well as having similar usernames or IP addresses. Technical evidence consists of evidence provided by CheckUsers, in which the details are not shown to the public per the Wikimedia Foundation's privacy policy. Administrators are the primary people who hand out blocks in most SPI cases. Non-admin clerks may request that an administrator block an account or IP address. These cases will usually be labeled as "administrator attention requested". If the request seems reasonable, act on it.

If the patrolling administrator (or any user) feels CheckUser is appropriate and necessary they may request it; see below.

In usual SPI cases, where CheckUser is not requested, admins should look carefully and neutrally at the evidence and determine whether the behavioral and other evidence shown makes it very likely that sock puppetry is occurring. In many cases, sock puppetry can be determined just by behavioral evidence and without the need for technical evidence. Many admins normally apply what is colloquially called the duck test – if it looks like a duck, swims like a duck and quacks like a duck, it's probably a duck.

When blocking accounts, follow the procedures under the Blocking and tagging section and make a note of the blocks under the "Clerk, patrolling admin and checkuser comments" section of the SPI case page. If evidence has not shown that sock puppetry has occurred, likewise make a note of that in the same section. Notes can be prefaced using the {{Admin-note}} template. For example:

{{Admin-note}} Foo has been indefinitely blocked, 192.168.0.1 blocked for three weeks. ~~~~

In cases where there has been minimal disruption or which could have occurred as a result of a good-faith misunderstanding of policy, consider a warning.

Cases endorsed for CheckUser attention are identical in every way to non-CheckUser cases, except that a CheckUser will first add the results of their technical investigation to the case, and may have already taken some actions on the spot when abuse is found, before patrolling admins review the case.

CheckUsers will have posted their results under the "Clerk, patrolling admin and checkuser comments" section. The possible templates they could use include but are not limited to in order of most likely the same editor to unlikely the same editor:

•  Confirmed
•  Likely
•  Possible
•  Unlikely
•  Unrelated
•  Inconclusive – in other words can't depend on the results

Once Checkuser results have been added, any admin may re-assess and decide the issue.

Patrolling admins should check that any CheckUser-confirmed accounts have been blocked and tagged. Those accounts that have been  confirmed by CheckUser are normally blocked, but they should be double-checked to make sure that they are. If they have not been blocked, follow the blocking procedures found in the Blocking and tagging section. For any accounts or IP addresses that have not been blocked, follow the same instructions for a non-CheckUser case, keeping in mind any evidence or advice posted by CheckUsers.

If CheckUser has not been requested, you can request CheckUser assistance by changing {{SPI case status}} on the top of the page to {{SPI case status|curequest}}.

This does not guarantee that a CheckUser will run a check, but it will alert the SPI clerks and CheckUsers that a request may be needed. Normally, an SPI clerk or CheckUser will either  endorse the case for CheckUser attention or  decline the case. Ultimately the decision is down to the responding CheckUser.

Any user can add this request to a case at any time, if appropriate. The most common reasons are:

• The behavioral evidence is not clear, and you cannot figure out all the socks
• There may be other hidden socks, or an unknown previous history of socking, and help is needed to find the sock-master or "sleepers"
• The underlying IP needs blocking, or more thorough investigation is required (eg in the case of an ongoing problem, confirming suspected block or ban evasion, suspected hidden problems, or serious repeated vandalism)

(Full list)

If the case is declined, then the patrolling administrator must make that determination as to whether sock puppetry is going on and subsequently block all violating accounts. If the case is endorsed, then a CheckUser will add technical evidence and notes to the case first; this may take a while.

If the case is complete, all accounts have been looked at and any issues dealt with, and the case has run its course with no further action needing to be taken, the clerks can be asked to review and archive the case. To request that the case be archived, change the parameter of the {{SPI case status}} template on the top of the page to close along with adding a note in the "Clerk, CheckUser, and/or patrolling admins" section, confirming the final resolution and that all accounts have been addressed. For example,

======<span style="font-size:150%"> Clerk, patrolling admin and checkuser comments </span>======
{{Admin-note}} All accounts blocked and tagged. ~~~~

----

The tagging will alert the SPI clerks and CheckUsers, who will do a final review before archiving the case.

Follow these instructions to block sockmasters and sockpuppets.

If the sockmaster has not already been blocked and tagged, then do the following:

If a registered account has been shown to be engaging in sock puppetry and is not the sockmaster, then perform the following tasks:

If an IP address has been shown to be engaging in sock puppetry, then perform the following tasks: