User:CyclePat/ATST

ATST means Administrator Troll and Sock Theory. One might believe this will talk about the potential of an administrator being a troll and sock but in fact it is a quick analysis of users possibly impersonating an "administrator".

Summary

Don't do it! We know! However here is what to do when encountering abnormal edits, impersonation, fake signatures, changes to the name of a heading (which I will call category in this research) and even a suspected troll, here are a couple things to do:

• Prior to jumping the boat, check the [user's history], that allegly signed the post (Special:Contributions/<user name>), to see if he added the content.
• Check page history, search, with "ctrl-f", for edit within the "sub-category" title.
  • If you can't arrive to the first postes, or if there is a change that occured that is not within the category edits, or something else is suspicious then follow the next step.
• Check page history, for edits that are not "sub-categorized." (from the main page)
  • The only ways the change the title category heading is by going up to the higher one.
• If confirmed, report to WP:AN/I incident board for indefinit blocking.

Reasoning

After reading through a post by user JzG,[1] I suddenly wondered; “is there a flaw in the way we post at AN/I board?” What would happen if someone creates another account or posted anonymously, purposely impersonating an administrator? For example, let's take my friend JzG. If I user:CyclePat decided to start a new thread called User is Sockpuppeteering and needs block or Test WP:AN/I theory, as I’ve done on my user_talk page. Then impersonated my friend by signing at the end his name like this: >>>Guy (Help!) 15:08, 11 January 2007 (UTC)<<<<.

I then made a small edit to the comment adding some more content. [2] In the history of the page this is revealed like:

Example 1

10:53, 11 January 2007 CyclePat (Talk | contribs) (→’’’Test WP:AN/I theory’’’ - clarification)

You will notice in bold, in the above example, that every edit is categorized.

Now I changed the name of the section. But you will notice that instead of editing it from it’s subheading “edit” I did so by viewing/editing the entire page. The history will only reveal an edit according to “whatever it was called within the edit summary” and will not be shown within the category ’’’Test WP:AN/I theory’’’.

Example 2

11:15, 11 January 2007 CyclePat (Talk | contribs) (minor edit to name of title)

Furthermore, the history will keep, the old name in log. So then, how, can one then know what the original title was? Well, I’m no expert but, the only way someone can edit the name of a category is by going up to a “higher one”. In this case it was the main page on my user’s talk. In the hypothetical case of JzG, (I say hypothetical case because there is nothing that has happened that I know about), JzG began a thread on WP:AN/I with a simple comment the name of the sub-category “Unblock Request.” The only thing that appear weard about this edit is that someone also at the same time added material above it but with different time (appearing to come from JzG).[3]

Conclusion

Administrators that are to look for vandalism of this type (impersonation) via the edits "the category" (but doing a find the name of the category) but also by searching edits made to the entire article (or discussion) page. These are edits that are not “sub-categorized” like Example 2.

In fact, if we take a scenario where someone was to fraudulently sign the name of JzG, but by editing the entire document it may be less obvious. So how do you overcome the burden of searching through these edit? I think profiling is one thing… any other suggestions? --CyclePat 16:55, 11 January 2007 (UTC)