Wikipedia talk:Counter-Vandalism Unit/Subtle Vandalism Taskforce

Style

"Task force" is usually written as two words. Maurreen (talk) 08:06, 11 May 2010 (UTC)

BEANS

While appreciating the concept, per WP:BEANS, is it really helpful to develop a list of bad ideas? Johnuniq (talk) 08:31, 11 May 2010 (UTC)

I certainly hope it wouldn't develop that way. None of these "techniques" are very advanced, and there's no way we can develop strategies to prevent these attacks in private. Most of these vandals fall somewhere in between "your mom" vandals and persistent sock puppet vandals. I don't worry about these categories of vandals understanding our response anymore than I do another vandal stumbling upon WP:CVU. Shadowjams (talk) 08:38, 11 May 2010 (UTC)

I'd say that caution is appropriate. While we aren't revealing state secrets to note that some are making small changes to heights or population etc. there are other possibilities which,well, I won't list.I agree we should exercise care discussing very subtle vandalism.SPhilbrickT 21:53, 11 May 2010 (UTC)

Agreed. We certainly don't want to start discussing methods of doing the vandalizing in depth, especially if it includes ways of gaming diffs and templates, etc. Shadowjams (talk) 02:25, 12 May 2010 (UTC)

Here to report subtle vandalism

I decided that it might help to tell everyone else about the subtle vandalism i've noticed. It might not even be such, but both of them can't be right.

Dan Henderson: I've seen his height fluctuate between the extremes of 5'10" and 6'2". Since the reference links to his website, which utterly foiled me in finding anything about his height, i'm not sure what his correct height is.

Ana Ivanović: I've seen her individual game scores and overall game scores for tournaments changed and I have no idea if they are correct or not, so I don't take any action.

Gillingham F.C.: Same as with Ana, scores have changed here and there.

And that's what i've noticed so far. Silverseren^C 18:53, 11 May 2010 (UTC)

Candace Parker: here Someone changed her height to 6' 9" then back again, so it wasn't wrong for long, but maybe it was a test run.SPhilbrickT 21:49, 11 May 2010 (UTC)

I thought about coming up with an example section, but I decided against it for both the reason raised in the thread above, and because we don't want to give a forum to those sorts of edits. I'll start some non-meta discussions on the article page, but I'd encourage others to start them there too. (Ultimately I imagine I'll create that as a separate page, transclude it to there, and set up autoarchiving on it... but it's too soon for that.) Shadowjams (talk) 02:24, 12 May 2010 (UTC)

Some just play with numbers [1] - at least this one is more or less conspicuous (year in brackets), but had they changed page numbers ?? East of Borschov (talk) 05:33, 12 May 2010 (UTC)

That's almost borderline blatant (although I think we should consider that subtle vandalism). Here's a good example of an extreme version: User:58.107.139.19 (Still active); Here's another good one: User:67.174.134.116. Shadowjams (talk) 05:42, 12 May 2010 (UTC)

• FBI Ten Most Wanted Fugitives: I forgot to add this one before. It gets dates, names, and other small information changed here and there, such as this. While that example is rather blatant, there has been some harder to catch changes as well on there. Silverseren^C 07:12, 16 May 2010 (UTC)

75.134.113.189 (talk · contribs) -- multiple articles: Please take a look at this IP's edits to Desmoscolecida‎, Vejle, and others; they appear to be intentionally replacing lowercase L's (ells -- as in "Lima") with uppercase I's (eyes -- as in "India"). Sans-serif fonts make it very difficult to see the distinguish an "l" from an "I" (view this in Arial and you'll see what I mean). My gut tells me that many Recent Changes Patrollers are already letting this pass by without realizing what it is. Heavens to Murgatroyd, can you imagine the damage something like this would do if it were done on a large scale? An edit filter might be the only hope for catching this, but how on earth would you code it? Can anyone suggest a way to research this to see what may be out there now? -- Bgpaulus (talk) 22:56, 16 July 2010 (UTC)

Fascinating. There are some programming restrictions on what edit filter can do. The main problem is that the edit filter variables don't indicate blackline changes like the html does when you use a browser. This is similar in nature to this: IDN homograph attack. There are really two ways to attack this thing. One is to look for the changes as they come in, and the other is to crawl an offline dump looking for substitutions like that because one would expect them to persist. That pretty much will require a dictionary, but once you have the page text that kind of analysis should be doable, if a little intensive. Great find. Shadowjams (talk) 04:41, 17 July 2010 (UTC)

Tools

A tool that may be applicable to this discussion is CheMoBot. Dirk Beetstra operates CheMoBot to monitor certain fields in infoboxes. Discussions of its development are in BRFA here and here. The principle is that the bot can be told to monitor certain fields in certain infoboxes, and it then logs changes. It can also be told the revid of a page which holds known-good values so the bot can report bad changes. I believe it does not attempt to revert bad changes. Johnuniq (talk) 08:52, 12 May 2010 (UTC)

Thank you for that. I've dropped a note at Dirk's talk to inform him and let him weigh in on how his bot works / fits in. Shadowjams (talk) 09:00, 12 May 2010 (UTC)

Well, Johnuniq says it quite well. In a way, this project seems (partially) to have as an aim to follow the type of vandalism which CheMoBot was designed to follow.

The bot monitors changes to {{Chembox}}-values (see the bot's mainspace edits for examples). The bot is set up to either add parameters to the template, or to change 'verification'-parameters, which can then be used by the template to show values, or to categorise the article. Most, if not all, of the required settings can be set in User:CheMoBot/Settings by admins, though I think that it is good that there is a group of editors (WikiProject) involved in a specific infobox that is made 'responsible' for what the bot is doing to the template in mainspace before setting those. I will watch this space, if there are questions, don't hesitate. --Dirk Beetstra ^{T C} 10:25, 12 May 2010 (UTC)

Userboxes

We needs them. :P Silverseren^C 07:12, 16 May 2010 (UTC)

I thought about that. Anyone who's up let me know. Otherwise I might do a very bad one. My only request is it fits the standard userbox size. Shadowjams (talk) 07:19, 16 May 2010 (UTC)

I created a userbox request here. Silverseren^C 07:31, 16 May 2010 (UTC)

Userboxes

{{User:Forenti/Userboxes/SubtleVandalismTaskforce}}

This user is a member of the Subtle Vandalism Taskforce.

We has them. :) Silverseren^C 09:14, 16 May 2010 (UTC)

• I like the idea of this project, I help if I can meanwhile I'll do some supporting. =)

{{User:Monkeyblue/boxes/SVT}}

This user supports the SVT

－ Cy21 ➜ discuss 20:15, 20 May 2010 (UTC)

PS: Also added Category － Cy21 ➜ discuss 20:27, 20 May 2010 (UTC)

I've moved copies of these to the mainpage. Thank you again. Shadowjams (talk) 07:39, 25 May 2010 (UTC)

Project ideas

Again, thank you to everyone who's joined up. I'd like to hear if anyone has comments on the ideas here or has any to add. Shadowjams (talk) 21:28, 20 May 2010 (UTC)

OK, it's pretty obvious by now that I'm a n00b; after (mis)reading the above call for comments, I promptly posted mine to actual SVT subpage, instead of this talk page. Sorry about that (insert sound of hand smacking forhead here). I've reverted that edit and am now re-posting them here -- along with their original timestamps. Best regards -- Bgpaulus (talk) 23:04, 21 May 2010 (UTC)

• Subtle vandalism noticeboard - I'm wondering if something akin to the Typo Team's lists of common misspellings would be helpful. I've had some success manually searching for strings that might return too many false positives for a Bot to be effective (like this one, for example). They don't necessarily qualify as "typos", so it doesn't seem particularly appropriate to put them under the Typo Team's umbrella. Constructing an effective search string is sometimes a challenge, but I do believe that there are categories of patterns that can be useful in going after some of the subtler stuff. -- Bgpaulus (talk) 23:10, 20 May 2010 (UTC)

• Edit filter - Although, I do have more than a passing knowledge of regular expressions, I don't (yet) have any experience with Edit filter. I've been giving this some thought, however, and (keeping my ignorance of Edit filter in mind) I'm wondering if it's possible (or even practical) to set up something akin to the broadcast delays used by live radio and television programs. In other words, edits that meet certain criteria (for example, an anonymous IP plus no edit summary plus a change of less than X number of characters) would cause the edit to be "held" for, say, 60 seconds. My reasoning for suggesting this is that, along the lines of this essay, many vandals seem to be seeking a certain amount of instant gratification out of sheer boredom; if we can reduce or eliminate the instanteousness of seeing their vandalism, then they just might go elsewhere for their "entertainment fix". -- Bgpaulus (talk) 23:10, 20 May 2010 (UTC)

• Project awareness - This probably applies to "regular" anti-vandalism efforts, too, but when I'm on Recent Changes Patrol, I'll often go back and review a (suspected or confirmed) vandal's other, recent edits in an attempt to ferrett out anything else they might have done that managed to slip throught the RCP"net". I don't have hard numbers to support this, but it feels like I'm successful with that approach about a third of the time. -- Bgpaulus (talk) 23:10, 20 May 2010 (UTC)

---

No problem Bgpaulus. Let me quickly ask a few quick questions. For the typo / regex issue: do you ahve nay specific ones in mind? The problem with the edit filter fix is that edit filter has 3 fields: old version, new version, and diff version. You can run reg-exes on any combination of those, and if you trigger a match on any, you can act/flag it. That's useful for small vandalism changes... like changing a birthday, but a rule that looks for those changes (say in the diff) are also going to probably find if someone say adds a new line (like a tag) to a paragraph. That's because the new paragraph will be seen by the diff engine as a big removal and a big addition... and in that if there's a date... or whatever your regex is looking for, it will trip.

Now, that's my understanding after messing around with it a little bit and after some conversations with the edit filter people. I might be wrong. I think it's possible to look for the (-) and (+) identifiers on those lines, so with some creativity finding lines might be possible, but never elegant.

Even so, if someone made a working edit filter rule, it would be a huge development.

I too often review problem editors other recent contributions. As far as subtle vandalism goes, the question is if we can effectively get editors that don't regularly vandalism patrol to do this. Any ideas about how we might go about raising awareness? Any cross-over editors that are involved in projects but also in vandalism patrol?

Similarly, we have to beware of what edits are legitimate: scores going up (lifetime goals/points go up, not down) and weight changes (in fighting sports especially, changes are fine) compared to height changes (always should be seen as suspect without an explanation). Shadowjams (talk) 03:28, 22 May 2010 (UTC)

If it isn't too complex on the Edit-filter side, I think it would be helpful to tag changed or added <math> tags, since they are rarely in need of change and would benefit from heightened review, cutting down on math vandalism. goose121 (talk) 22:46, 6 January 2017 (UTC)

Additional warning template

I'm considering making a template similar to {{uw-error1}}. My question is if anyone thinks there's too much overlap between the two. I suspect their may be.

Alternatively, there could be a template to indicate a user is engaging in long-term persistent subtle factual errors, with a note about how to proceed if the warnings is used in error (the changes aren't errors). Shadowjams (talk) 20:19, 27 May 2010 (UTC)

Have you seen STiki?

STiki is a vandalism detection tool that should be on your radar and in your arsenal. It works differently than regex tools like edit filter or mere bad-word filters. Instead, it operates on "metadata", information about the i.p./users, their edit history, the time of day, the number of characters changed. It won't do the work of finding old subtle vandalism, but it casts a much broader and more sophisticated net than the currently available tools. Plus, it has a learning algorithm, so as more people use it over time, it will get smarter at identifying likely vandalism. I think you'll find it very helpful. p.s. I had nothing to do with it's creation or coding; I just think it works well. Ocaasi (talk) 09:47, 7 August 2010 (UTC)

Potential vandal - User:Vrghs jacob

I'd ask interested project supporters to check out this ANI: Wikipedia:Administrators'_noticeboard/IncidentArchive632#User:Vrghs_jacob_subtle_vandalism. There's a good amount of evidence on this guy's talk page that he's a subtle vandal. If anyone is interested in sampling through his contribs to see how extensive he's been engaging in it, that may be quite helpful. BigK HeX (talk) 17:46, 18 August 2010 (UTC)

Dan Henderson

I raised a discussion of him above soon after the formation of this taskforce. Since a reference for his height (found here) is now given and known to be six foot one, I would appreciate it if other members of the taskforce could watch the article and help keep IPs and new editors from changing his height. Silverseren^C 18:53, 15 October 2010 (UTC)

Or see here where his height is 5'11". Nick Levine (talk) 12:11, 1 March 2014 (UTC)

Corrections mistaken for vandalism

Not infrequently vandalism or misinformation is observed by non-Wikipedians who try to correct it but find their efforts reverted as vandalism, don't know what to do next and give up. An elaborate hoax article currently at AfD was detected back in April by an IP who blanked it with edit summary "This whole page is a fake"; but he was reverted and the hoax went undetected for another seven months, when another IP wrote on the talk page "Guys, this is all made up... ", and someone emailed OTRS.

Anti-vandalism patrollers should be alerted to consider the possibility that what looks like vandalism may be well-intentioned attempts at correction, looking in particular at edit summaries. I was going to suggest improved instructions for outsiders to report problems, but I see there is already a "Report a problem with an article" link reached by clicking "Contact Wikipedia" on the front page, and that seems pretty good. JohnCD (talk) 15:12, 13 November 2010 (UTC)

Wikipedia_talk:Article_titles#Non-Roman_characters_in_redirects_to_articles

There is currently a policy discussion that may concern this Wikiproject Wikipedia_talk:Article_titles#Non-Roman_characters_in_redirects_to_articles. Handschuh-^{talk to me} 08:09, 19 November 2010 (UTC)

Is the relevant concern here involve ambiguous characters... like l for 1, or the extended ascii/unicode versions of the same thing? We've seen that in a few cases as an issue in articles but I haven't noticed it in redirects. If someone developed a good script to handle the articles then something similar might work well on the title list. I can think of a few ways to do this, and casually worked towards one of my own but never finished it into something useful. Working with titles though could be a lot easier. If anyone has any interest in this there's a whitepaper out there that lists all of the ambigious unicode characters has some other useful info (most of it's associated with the international DNS names). Shadowjams (talk) 08:49, 23 November 2010 (UTC)

This discussion is about the use of non-Roman characters (like Chinese characters) as redirects (and disambiguations) to their English translations. I thought that I should inform this Wikiproject since some editors have raised the issue that this may lead to subtle vandalism in the form of redirects from foreign obscenities to BLPs or similar. Handschuh-^{talk to me} 21:12, 23 November 2010 (UTC)

Warning/notice template for RCP?

A big problem for me doing WP:RCP is that so many number-changing edits by IPs are good-faith, and how difficult it is to know the difference. That explains why number changing vandalism is such a pernicious kind -- blending in with the civilians, they're hard to catch, but we don't want to shoot the bystanders in the crossfire.

It occurred to me that we could help this situation by recruiting the good-faith IPs and explaining to them how to distinguish themselves. Not sure if something like this exists already (which is itself also a problem). Suppose it became common practice to leave a template like this for IPs who change a lot of numbers:

Hello! Welcome to Wikipedia, and thank you for your contributions. At least one of your edits, while it may be in good faith, was difficult to distinguish from vandalism. Please be careful to use an edit summary for all of your contributions so that other editors can understand the reason for the changes. If you continue to make unexplained edits, they may be treated as vandalism. Thank you, ~~~~

Huggle could resolve this as a level 1 warning template so that if the behavior doesn't change, or turns into clear vandalism, we would have a record of prior warnings. causa sui (talk) 19:41, 25 July 2011 (UTC)

I think that's a great idea. Do you know who administers the Twinkle warnings? It'd be simple enough to setup the template itself; incorporating it into the common tools would make it widespread too. Shadowjams (talk) 21:44, 25 July 2011 (UTC)

I don't, actually. It's on the backburner but I'll eventually get around to doing some research into how these things work and see if I can't get it included. causa sui (talk) 16:30, 26 July 2011 (UTC)

Subtle vandalism templates

I created two new warning templates:

• {{uw-subtle1}}
• {{uw-subtle2}}

Discussion is here. causa sui (talk) 19:58, 26 August 2011 (UTC)

'Cikgu Jasmin Airways' vandal

If this project isn't totally dormant, perhaps the discussion at Wikipedia talk:WikiProject Airports#Cikgu Jasmin Airways may be of interest. This seems to be a long term campaign (since September 2010) of adding deliberately erroneous information to airport and sometimes TV station pages by an IP editor using IPs that geolocate from "QATAR, AD DAWHAH, DOHA" through "QATAR TELECOM (QTEL)". Often adding no-existent Cikgu Jasmin Airways etc. to pages. Regards, 220 of ^Borg 09:27, 13 January 2012 (UTC)

Common traits

I'm sure some of you have noticed this by now, but I didn't see it written anywhere and I thought it would be worth posting just so it's actually recorded. I find that a lot of these vandals seem to target figures in templates. Common targets would include Template:convert and Template:dts, for example. This indicates to me that there is some form of automation or possibly a tool that is being used to make these edits. A possible solution might be to use a filter to check for abnormally high levels of alterations to the content of these templates by a single user.

I also find that a lot of the edits target childrens TV programming. This may be an attempt to target low-traffic articles or it may be an attempt to blend in with inexperienced IP editors (namely actual children editing in errors in goodfaith)

Has anyone else noticed any common traits? -Thibbs (talk) 17:54, 5 September 2012 (UTC)

The TV programming one you're referring to may actually be the work of one particularly active sock. See if this rings any bells. The convert template is sysop protected I believe, dts is only semi. It would be a good idea to watchlist templates like that, because they're propagated widely and there's rarely a need to change them. Shadowjams (talk) 18:55, 5 September 2012 (UTC)

Hmm. Some of what I was noticing looks like it could be this guy, but other accounts seem to be very robotic - never responding to talk page notes and only altering dates over and over again. Anyway I'll keep monitoring the situation in my limited free time. It's a pain verifying all of the changes over and over again. The only really good way I can see of monitoring these is to become an expert in the dates of a handful of the commonly vandalized articles and then use that as "bait" and examine the edits of all editors that alter the figures you've verified to be correct. If the editor has a very high percentage of date-change edits then chances are it's a vandal. -Thibbs (talk) 16:04, 6 September 2012 (UTC)

Discussion about merging project with WP:CVU

I started a discussion at Wikipedia talk:Counter-Vandalism Unit#SVT a couple of weeks ago, and should've left a notification here earlier. Mojoworker (talk) 14:45, 16 September 2012 (UTC)

I commented there. I'm all for it so long as CVU has a section with resources (ideally a noticeboard) to help fill in the goals of SVT. Shadowjams (talk) 20:01, 17 September 2012 (UTC)

A really Subtle edit

It took me some time to work out what was going on at Space exposure when I noticed that 2 whole subheadings and about 5 lines of text, that I could see in the editing window, were simply not being displayed on preview.

Compare this version with this version . You need to click on the links to display the whole page to see the difference, and perhaps display them side by side, or 'flip' between the 2 pages.
See what a difference one missing character can make? (If you can't spot it, see here). I only found it when I went back over the edit history and looked at the last edit before mine.

Interestingly this is the only edit that 2A02:2F02:8025:F007:0:0:BC18:6BF8 (talk · contribs) has made, which makes me a little suspicious, >:-/ and wondering how many articles have similar 'hidden' sections? - 220 of ^Borg 08:27, 24 September 2012 (UTC)

Suggestions for tools for fighting subtle vandalism

The subtle vandalism 'unit' has come to my attention recently, and I've kept the page on my watchlist as I find subtle vandalism really annoying, principally because if it isn't spotted when it's committed, it can lie unnoticed for years, so some practical tools to minimise it happening are really needed. A couple of suggestions:

• 1) A simple and obvious noticeboard for posting up edits/editors of concern. I encountered a serial subtle vandaliser recently, but wasn't sure where to flag it up - I suppose this page is the place, but it isn't clear.
• 2) Suggestion for a bot: would it be practical to create a bot that can flag up uncited changes to numerals, in the same way as page blanking etc. is flagged? Seeing as changes to numerals should be cited, uncited changes (which include subtle vandalism) could perhaps be made more prominent to regular editors, so they (hopefully) scrutinise it a bit more ?

Comments? PaleCloudedWhite (talk) 22:42, 24 September 2012 (UTC)

A noticeboard is a great idea. I'm all for setting one up. The only thing we need to be careful of is some discretion, because unlike standard vandalism, these vandals are often more likely to be versed in wikipedia policy, and may be trying to escape detection, so we don't want to provide a template for a would-be vandal to do that work. But that's a problem faced by all noticeboards and it's dealt with easily I think.

There is some limited tagging of some changes, such as Special:AbuseFilter/391 which looks for height changes. I think I tried to do one for date changes once too, but abandoned it. Maybe I'll have another go. I don't have AbuseFilter privileges, but I think I would get them if I asked, or if I or anyone made a good filter, it could be added in. You need some strong regex skills though and there's some additional edit filter syntax. I may look into that.

Edit filter is much more efficient than a bot because it runs on the server, but it is more limited than a bot in what kind of analysis it can do. Shadowjams (talk) 07:34, 25 September 2012 (UTC)

If edit filters are the way to proceed, I think several will be needed, if their individual scope is limited. My recent vandal was changing population figures both within infoboxes and in the main text, and I've previously encountered changes to birthdates/ages. There are many possible permutations of this kind of vandalism, so many filters should match them. Unfortunately I'm not knowledgeable about how to go about creating bots and filters, so can only make suggestions and comments. But if such changes - most particularly when they're uncited - can be flagged, so that regular editors scrutinise them much more when they appear on their watchlists, I think more of this kind of vandalism might be nipped in the bud.

On the issue of discretion, this is also something I had considered. Normally subjects of noticeboard discussions are informed of their being scrutinised, but would it go against general Wikipedia protocol if such practice was waived? Even further exploring this concept, would it be beyond the pale to title this page using an acronym, so it's less easily brought to the attention of vandals who study the contributions of people who post here? I'm guessing such a proposal steers too far away from Wikipedia's general openness to be considered acceptable (and it sounds rather like a sort of secret police, haha....) PaleCloudedWhite (talk) 09:15, 25 September 2012 (UTC)

Well I think all of these editors would be warned with typical vandalism warnings (there's a deliberate factual errors template) before hand, so nothing should happen in secret. I'm talking more about general methods and not wanting to catalog stealthy methods. If anything's particular sensitive it should probably be emailed among collaborating editors. But the noticeboard would be the place to start collaborating.

I'll start a thread below about possible edit filter ideas and I'll take a crack at writing them. Then when we think they cover things, I can bring them to the edit filter boards and see if we can perfect them/implement them. Shadowjams (talk) 22:51, 25 September 2012 (UTC)

Suggestions for edit filter

As discussed, use this to list what kind of edit filters are needed. For example, there's a filter that looks for height changes in infoboxes. Perhaps one that looks for date changes in the same? Or in the lead?

Please post ideas here, and the more specific the better. Not just "look for date changes", but "look for when a number changes in close proximity to a month by an editor with < 500 edits...", etc. Then those of us who have some edit filter experience can take a shot at writing some prototypes to test. Shadowjams (talk) 22:54, 25 September 2012 (UTC)

It's possible these might be too broad in focus, or not feasible for practical reasons, but here are some suggestions for discussion:

• 1) Any edits to numerals that are not adjacent to <ref> tags.
• 2) Any edits that only involve numerals and are not accompanied by an edit summary.
• 3) Any edits that involve changes to 5 or more separate numbers that are all made in a similar direction (i.e. all upwards or all downwards)
• 4) Any edits to population figures that change the figure by more than, say, 50%.

PaleCloudedWhite (talk) 18:38, 26 September 2012 (UTC)

Just briefly, I think 3 and 4 will be very difficult, if not impossible, with edit filter. It doesn't have operators as far as I know, for comparisons like that. Shadowjams (talk) 20:27, 26 September 2012 (UTC)

Anyone here want to take a look at this?

I posted a topic at ANI here about a user I suspect of long-term subtle vandalism. Any feedback would be appreciated, especially help identifying past edits he may have made that substituted wrong information into an article. I honestly have no idea how I can realistically correct errors he may have made.OakRunner (talk) 19:43, 21 January 2013 (UTC)

Another sneaky IP vandal. Someone might be interested in going back through his edits and reverting removing most/all of them. As is typical with these creatures, the claims he's made are hard to verify en masse but most of them appear to be vandalism. Given the balance of the facts it seems like it should be possible to automate blanket reversions of edits made by people like this if/when they are caught. Would such a thing actually be possible or does WP:AGF bar this kind of suggestion? -Thibbs (talk) 00:22, 26 May 2013 (UTC)

Ugh, what a mess. Also, there are some cartoon articles in there... I don't know if that's just coincidence, but there are a few well known vandals of this variety who specalize in that kind of material. Who knows, it could just be one person. Given the sheer volume of their edits, what if you were to audit say a half-dozen or so and see if any were verifiable. The IPs been blocked for a while, and the lack of discussion or any verifiability I think is enough to roll them back, at least the recent block worth.

Most have already had that done, btw, just not quite all. Shadowjams (talk) 00:34, 26 May 2013 (UTC)

I rolledback a small handful, there are some left. Most are to cartoon or other things like that, so I have no clue how one would even verify that. But some are clearly vandalism, like the edits to the NATO alphabet, and x-ray. There are others that are more subtle. Like I said, they've given up their good faith at this point; flooding us with small meaningless edits shouldn't be a way to get around sneaking in small pernicious errors. Shadowjams (talk) 00:42, 26 May 2013 (UTC)

Thanks, Shadowjams. I wish I had time to tackle more of it myself but I'm rather busy just now and I can't really make a study of it right now. But I have also noticed that the children's cartoons are a particular target of these people/this person. These articles seem to be highly prone to incorrect edits (probably primarily goodfaith errors) and they are also under-monitored by other editors. So it's easy for career vandals to establish themselves in this arena before they cautiously move on to other targets. A potentially interesting pattern if it's not just restricted to clone-accounts of a single person. -Thibbs (talk) 12:20, 26 May 2013 (UTC)

• Update: Just fresh back from a 1 month block this guy is back at it again, making up for lost time. He's totally unresponsive to warnings or any talk page comments and he doesn't use edit summaries. Very difficult to assume goodfaith. He seems to be working on the children's cartoons and the linguistic articles again. The linguistics thing is handy because it attracts slightly more attention than the cartoon edits. This guy also seems to have a particular fascination with acronyms. If you compare edits like this to edits like this you can see that the editor's alteration of the same acronym will often have different resulting forms depending on his mood. This strongly suggests that these edits are not based on sources, but are either malicious or at best original research. It also reminds me of some of the cartoon-related date vandalism where the same editor can be seen changing the same date 5 or 6 times over a period of several months in a single article. This guy's propensity for keeping facts unstable is interesting. Most vandals in my experience will corrupt a fact and then leave it alone hoping that nobody will ever notice. This guy seems to return to the scene of the crime over and over again to alter the fact further. Is he hoping to get caught? Or is this a symptom of automated editing? I don't think it's easily explainable behavior for a normal editor. -Thibbs (talk) 18:24, 9 July 2013 (UTC)

I've noticed very similar patterns. I don't know what it is, The pattern seems so specific, but it distributes across IPs and times, I doubt it's one person, and I can't fathom an explanation. I've seen something similar with the date-fiddling in music articles. Shadowjams (talk) 07:04, 13 July 2013 (UTC)

• Blocked by User:Materialscientist for 3 months. Mojoworker (talk) 22:43, 12 July 2013 (UTC)
• Blocked by User:Kralizec! for 6 months, expiring 2014-06-06. Nick Levine (talk) 18:59, 1 February 2014 (UTC)

Yet another new ANI thread about this

FYI, there's another new ANI thread about this kind of vandalism here. Zad68 03:00, 16 October 2013 (UTC)

ITV vandal

For want of a better name, this is what I'm calling the (assumed) single person behind a current (since 2013-10-13) stream of disruptive edits which I've been watching. The pattern is: many small fiddly (hence: hard to verify) changes in a very short period, nasty tangled mess of good and bad changes, lots of page jumping but almost all edits are on pages connected with UK independent television channels and programmes, edit summaries blatantly broken, IP gets blocked but edit pattern resurfaces at another IP shortly after. There's some pattern in the IP addresses themeselves: all but one trace back to btcentralplus.com.

See further details here. Nick Levine (talk) 11:30, 19 January 2014 (UTC)

Please check this user's edits

Endikaq (talk · contribs · deleted contribs · nuke contribs · logs · filter log · block user · block log) - [2]. I reported him here but he was not blocked. --Greenmaven (talk) 03:23, 2 February 2014 (UTC)

• I agree the edits are not constructive in any way! The admin response on AIV was:

User has been incorrectly or insufficiently warned. Re-report if the user resumes vandalising after being warned sufficiently.

They're not saying that Endikaq's edits are OK, just that the user hadn't received the appropriate warnings. In fact, Endikaq stopped making any edits half an hour before the first warning was issued. If they continue to make disruptive edits then warnings #3 and #4 should be issued as appropriate, and if they still persist then someone should make another report to AIV. Nick Levine (talk) 09:20, 2 February 2014 (UTC)

Another single purpose editor

Please check this person's work [3]. --Greenmaven (talk) 03:13, 9 February 2014 (UTC)

I checked (briefly) Daniel Brière. The trouble is, Google at the very least just skims WP for the information it reports on people, and I don't know how prevalent that practice is: in other words, where do you go for a real source for someone's height/weight? I tried looking at the French WP article, and for a moment thought there was a height discrepancy, but then found this edit which is just an unexplained height&weight change, but in French.

I did find 5'9" and 174 here. More reliable? Let's hope so. Which makes two of Nhltruesource's edits OK, albeit still annoying because they give no source and no change reason, which inspires no confidence. Nick Levine (talk) 09:32, 9 February 2014 (UTC)

For most athletes the league is usually a canonical source. Occasionally I'll see instances of disputes over both age and height when both have reliable sources; in those cases, at least on highly trafficked articles, there's usually some page consensus about which is correct. I don't know of an example offhand, but I've seen it a few times. We should also be mindful of the Wikipedia effect--where whatever we have here being repeated and we get into a source loop. However, I'm more concerned that this editor's doing nothing but changing heights and not supplying sources or any explanation. That alone is enough to raise concerns for me. Shadowjams (talk) 16:57, 9 February 2014 (UTC)

Possible script/bot/?

In this edit a user posted a vague edit request: "Edit Programs broadcasted by nickelodeon". They posted a second time here, then their third edit inserted television parental ratings on various subject headers where shows were listed. Subject headers that did not have shows listed weren't touched. User then added unsourced parental ratings en masse here and here so far. Cyphoidbomb (talk) 18:03, 19 February 2014 (UTC)

Do you have any evidence of any of the parental ratings added by Thunder26.99 to List of programs broadcast by TBS being incorrect? Nick Levine (talk) 18:32, 19 February 2014 (UTC)

What, I gotta disprove unsourced contributions now?! (I'm kidding, my friend, I'm kidding...) My main purpose for bringing it here was primarily to get other eyes on the user. Their edits may be legit, I don't know, but it's hard to tell without any sources. I'll look around and see if I can find anything contradictory. "*Daisy Does America. (Section to be continued)" looks a little problematic, but whatevs, minor hiccup. Obviously if they are using a script and their edits are legit, then it's not an issue. Cyphoidbomb (talk) 18:40, 19 February 2014 (UTC)

So the user wound up getting himself blocked for a week for disruptive editing. I tried to ask them about their sources, but they ignored that issue on my talk page twice. I poked around the TBS website and found generally (of the 5-8 eps that I checked) that the parental ratings were close. TBS might say that a show had a TV-14 rating, but user was adding the extra details like "TV-14-DSL", which I did not see. User committed subtle vandalism here (date vandalism), potentially here (formatting vandalism), and obvious vandalism here. Dat's all for now. Cyphoidbomb (talk) 18:27, 20 February 2014 (UTC)

Edit, remove, edit, remove.

Hi all, just something I've spotted twice today: IP 194.81.212.224 (which geolocates to the UK) went through a bunch of articles and added middle names, but then removed the content in a second edit. They did this cycle a number of times in a variety of articles. 86.147.192.198 (which also geolocates to the UK) did a similar thing, going through various articles and adding the string "on the evening of", then removing the content, or sometimes adding three disruptions over three edits. My supposition is that they are hoping that users who don't have rollback will click undo, effectively introducing the disruption unwittingly. This almost happened beginning with this edit. (Fortunately the eagle-eyed Smalljim caught what was happening.) Anyhow, both IPs are blocked, so no action is necessary, just dropping a heads-up for this pattern. Cyphoidbomb (talk) 21:16, 27 February 2014 (UTC)

Thanks. I note that most of 194.81.212.224's edits came in a flurry after their final warning. Question: have you reviewed both IP's edits to check the the bad ones have been reverted? Nick Levine (talk) 11:46, 28 February 2014 (UTC)

Nick Levine Still working on going through 'em. I found another Special:Contributions/IP 92.237.173.38 Only two edits so far, but it's the same MO, down to the edit summary. Cyphoidbomb (talk) 16:54, 28 February 2014 (UTC)

Okay, so I'm done going through the pages. I'm fairly confident that none got through. There are some pages where they have the most recent changes, but neither rollback nor the Twinkle rollback will let me revert those because there is no net change. So far I've noticed three patterns:

1. Bold, revert, repeat. He edits, reverts, then either does it again in the article, or moves to another one. [4][5]
2. Adds phrases like "on the evening of", "on the afternoon of", "on the morning of", typically before dates, and typically in the lead. For example if an article says "Joe Blow died May 23, 2014" the vandal will change this to "Joe Bloe died on the evening of May 23, 2014." Sometimes he even flip-flops his own edit, changing evening to afternoon.[6][7][8] One minor variation was "in the early hours of".[9] But the general idea seems to be to add unsourced specificity before a date, which many people wouldn't think twice about.
3. Adds unsourced causes of death,[10] manipulates causes of death, infers a cause of death,[11] or removes causes of death.[12] The manipulations might be minimal, like adding "illness", changing it to "short illness".("What did he die from, Quincy?" "A short illness!") The causes of death aren't always pulled from whole cloth. For example here, where Erica Boyer actually did die after a car accident, although "car injury" became "car crash" when then had to be fixed by Dismas to "auto accident".

Hope that helps. Cyphoidbomb (talk) 17:55, 28 February 2014 (UTC)

Cyphoidbomb - since 86.147.* (not the 194.* or 92.* IPs) has been at it for several months now (mostly on BT) and has, AFAICT, shown absolutely no desire to communicate with anyone, I think it's OK to invoke WP:DENY and WP:RBI on him (I assume it's a "he"). Feel free to drop me a line if you're sure you spot him in action again and if I'm around I'll be happy to block quickly – he's had plenty enough warnings and blocks by now (see here for some early discussion). Although some of his edits may be acceptable, they don't add anything new and they are interspersed with the vandalism edits. I don't think it's reasonable to expect editors to continue to waste their time sorting out the wheat from the chaff, so as far as I'm concerned reverting all his edits is now appropriate until he starts talking and indicates a genuine desire to change. Happy to discuss if anyone (even the IP!) disagrees.  —SMALLJIM  18:08, 28 February 2014 (UTC)

Cool, thanks, Smalljim! (PS: What's BT?) Cyphoidbomb (talk) 18:19, 28 February 2014 (UTC)

BT Central Plus,[13] one of the UK's largest dynamic IP address pools.  —SMALLJIM  19:36, 28 February 2014 (UTC)

I'm not entirely sure I needed to be alerted to my accidental involvement in this but whatever. It's fine. I've wondered from time to time why IPs sometimes revert themselves just after making an edit. I had chalked it up to them making an edit, finding that they were incorrect, and then reverting themselves. Now I'm curious as to whether anyone has any proof of the psychological claims made by WP:DENY. It seems like an even more complicated waste of time than playing solitaire. Ah well, thanks for the heads up, Dismas|^(talk) 18:14, 28 February 2014 (UTC)

As a habit of courtesy, if I mention another user, I ping them, but I suppose it's not required that I do that. :) Cyphoidbomb (talk) 18:18, 28 February 2014 (UTC)

Cyphoidbomb - well you got me involved, but no, it's not always necessary. Dismas - I don't know about the psychological basis, but I've found that the process works. But, of course, for it to work one mustn't talk about it - oh damn...  —SMALLJIM  18:23, 28 February 2014 (UTC)

Smalljim: I only saw one day's worth from 86.147.*, not months at all. Are they IP-hopping? Nick Levine (talk) 19:50, 28 February 2014 (UTC)

Yes, using BT dynamic addresses and some other providers - since at least last October (see that link to the early discussion in my first post). Sorry, 86.147.* isn't a very accurate description: BT has a variety of IP ranges, any of which can be used - like your ITV vandal.  —SMALLJIM  20:22, 28 February 2014 (UTC)

BTW, Nick, my offer of a quick block applies to that one too.[14].  —SMALLJIM  14:16, 2 March 2014 (UTC)

Yah, that one too. I was out of town for 24 hours so missed out on it, so thanks to Tbhotch for all the reverts. Nick Levine (talk) 19:16, 2 March 2014 (UTC)

Update: This dude is at it again via 81.132.240.195 example here. In this example, he fleshes out the infobox, which is helpful, but changes "on the morning of" to "on the evening of". In these edits they removed the df=y switch from a template, then added a cite note that doesn't seem to go anywhere. Specificity was added that she died "on the evening of". In this article the user adds "stroke" as the cause of death, though the article says the guy died from complications after a stroke, which is related, but Wikipedia isn't a coroner. This one is obviously wrong--he changes "morning of" to "evening of", though the source clearly indicates the event happened in the morning. On the other hand, sometimes he is correct. ?? Cyphoidbomb (talk) 17:27, 29 March 2014 (UTC)

I blocked him as soon as I could, but he's had a good run today. As I said above (28 Feb), there's little value in his edits and shot through as they are with vandalism, the only reasonable action is to revert the lot. Good-faith editors can't be expected to spend hours verifying every change made by someone who's clearly shown that he has no intention of being part of the community.  —SMALLJIM  19:29, 29 March 2014 (UTC)

Got it. I'll revert on sight and notify for blocking. Tanx Smalljim! Cyphoidbomb (talk) 19:49, 29 March 2014 (UTC)

I've tried one more attempt to get him to talk to us - see User talk:81.132.240.195. Maybe he'll surprise us and respond - if he does I'll let you know.  —SMALLJIM  20:25, 29 March 2014 (UTC)

He's back at 31.51.171.255. I'm gonna start reverting. Cyphoidbomb (talk) 18:58, 17 April 2014 (UTC)

Possibly back as 94.6.144.247 as well. Same M.O., anyway. Nymf (talk) 19:40, 14 May 2014 (UTC)

That's him (duck test). I've blocked 2 weeks. Thanks for the reverts.  —SMALLJIM  19:59, 14 May 2014 (UTC)

Cheers. 86.156.115.149 (talk · contribs) and 78.32.196.49 (talk · contribs) just popped up as well, also quacking. I noticed that the latter one has already been blocked a few times. Nymf (talk) 18:18, 15 May 2014 (UTC)

Hey, I noticed this guy: [15] Similar death-cause edits. Unusual since we've been mostly dealing with IPs, but there are a few death_cause edits, and he's been adding infoboxes and attempting (unsuccessfully) to add/change images, which demonstrates some previous familiarity with Wikipedia. [16][17][18]. Might just be a delightful coincidence. I don't see any "on the afternoon of" edits. Cyphoidbomb (talk) 05:43, 16 May 2014 (UTC)

Centralized "dossier"

Is there an appropriate place to establish profiles of various vandals? I know there are probably concerns about building memorials to these idiots, but it seems that we could benefit from a centralized source of modi operandi (plural?) and IPs used and stuff like that. Like, I just spent a ton of time trying to clean up after one (presumably) Italian-based vandal who replaces infobox content with bogus data. I call him "intersamual" because whatever script he's using occasionally will tack "(intersamual)" after a theme song, for example here. I also wonder if there's any value to appending "Tag: intersamual, Italy" (or similar identifiers) to help other editors figure out who's who. I suppose that's kind of what SPI is for, but anecdotally it seems that SPI isn't used this way for IPs. Cyphoidbomb (talk) 20:43, 7 March 2014 (UTC)

I don't know of such a place, but since it would need to be off-wiki and invite-only, perhaps I haven't done enough to warrant an invite yet :) I don't discuss any AV work that I might be doing on here in any detail, for obvious reasons. I try to follow the principles behind WP:DENY and WP:RBI once a vandal's motives have been made apparent through his actions.

As an aside, when dealing with a possible vandal, I've found that instead of just issuing the standard templated warning, it's useful to simply ask them what their reference source is. A failure to respond speaks volumes because a willingness to engage in discussion is one of the central assumptions of Wikipedia – see pillar 4 of WP:5. Another idea, that involves more work, is to reference the important material in a regularly-vandalised article yourself. Then anything that's changed without a reference can easily be removed as "not in cited ref". See Engie Benjy for example. I guess that similar success could be achieved by adding {{citation needed}} templates too, though I haven't tried that yet.

Going further afield, I've thought for a while now that it's time for Wikipedia to be more insistent on the provision of reliable sources for any edits that add or change facts. It should be acceptable to revert any such changes made without a precise reference – after all, anyone making an edit in good faith must have the source in front of them, so it's not an onerous requirement. We'll have to do this eventually if Wikipedia's reputation is ever to improve. And, yes, I know that it would replace one set of problems for another, but it must be easier to spot unreliable or fake references (especially when one is familiar with a particular area of interest) than it is to scrabble around to find something to verify a change made with no reference at all.

Gone a bit off-topic here, but I hope the rambling is useful or interesting.  —SMALLJIM  11:51, 9 March 2014 (UTC)

I'd been thinking about that too. I think maybe there can be a useful distinction, between relatively new pages where nailing down all the citations is so much work it prevents the article form being written, and on the other hand a mature page where we don't expect much to change - certainly not the facts - and it becomes more reasonable over time to migrate the page over to citations-only. This is a richer set of controls than Smalljim suggested but might get more support.

Also, want to agree about moving some elements of conversation off the wiki (though I have no idea how best to set about this, or how to figure out who is or isn't in on the conversation). Is this talk page itself on thin ice?

Two interesting suggestions. Nick Levine (talk) 14:09, 9 March 2014 (UTC)

There is Long term abuse. The concerns over building memorials, and also sophisticated vandals gaming the system are both the main impediments. I do think that some centralized info sharing on ongoing abuse is a good idea. I do not generally support the idea of doing it off wiki though. If this is to be done it should be done right and with full transparency. Shadowjams (talk) 21:10, 9 March 2014 (UTC)

"Fixed typo"

Anyone noticing a lot more edits with "(Fixed typo)" in the edit summaries when the edit the user performed has nothing to do with fixing typos? I wonder if this is an attempt to circumvent the anti-vandal bots, tagging, and other scrutiny? Some examples from my rounds: [19][20][21][22] and Poo Burger. Cyphoidbomb (talk) 21:56, 30 August 2014 (UTC)

I Have noticed this, and try and remember to add a note on the warning about misleading edit summeries. - McMatter ^(talk)/_(contrib) 02:03, 24 October 2014 (UTC)

Norman Matthew

Hello all be on the look out for the addition for Norman Matthew to articles, I have reverted 10+ additions of this name to various articles over the last 2 days all by different accounts. If you see the addition of this name please ensure it is a valid addition. - McMatter ^(talk)/_(contrib) 02:02, 24 October 2014 (UTC)

Editor randomly changing dates on appointments of politicians.

Hi there, is this the proper channel to address a highly probable vandal? I've been going through this editor's contributions [23] and saw a trend of subtle introduction of wrong dates. Trying to correct them but its tedious. Beyond dropping a warning note to his/her page (its an IP) is there anything else to be done?Zhanzhao (talk) 23:12, 6 January 2016 (UTC)

191.119.50.37

This IP is changing names of songs, names and dates in ways that seem false but are not always obvious, and is not using edit summaries. Tornado chaser (talk) 16:21, 22 May 2017 (UTC)

Number changing

Twister 1287 seems to specialize in changing numbers, at least some of these appear to be false. Tornado chaser (talk) 18:22, 22 May 2017 (UTC)

Same-sex marriage in Denmark

The page has been apparently vandalised. Yeowe (talk) 01:42, 30 November 2017 (UTC)

Yeowe, yes and not very subtly either. Somehow, a picture of a 'sober' Paul Stanley was incorporated in the addition of the category listing, but I have reverted and re-added the category. 'Cheers, Loopy30 (talk) 02:41, 30 November 2017 (UTC)

OK, this is just weird. Now the image does not display when going back in the history to view it. Further, the file on WikiCommons says it is also in use on Stone Age, Freiburg im Breisgau, and Multicellular organism, but it does not display on those articles (or their page histories) either. Loopy30 (talk) 03:22, 30 November 2017 (UTC)

Loopy30, thank you very much. I've tried to edit out the vandalism by myself but I couldn't find where it was hidden. I suspected that it probably was incorporated into either a category or a template, but finding it was beyond my Wikipedia skills. Again, thank you. Yeowe (talk) 04:56, 30 November 2017 (UTC)

Change of name?

I suggest that in "Subtle Vandalism Taskforce" the label subtle is inappropriate and counter-productive. It is inappropriate because most of the instances are not subtle at all. They're just tediously boring to detect. It is counter-productive because the label when known is guaranteed to feed the vandal's ego. (Look at me, I'm subtle! They even had to call in the Subtle Vandalism Task Force!) Can anyone think of an alternative name?Ttocserp (talk) 01:49, 21 April 2019 (UTC)

I think the current name is fine. It's about subtle vandalism, not subtle vandals. It's better than "Sneaky Vandalism Task Force", and "Tediously-boring-to-detect Vandalism Task Force" just doesn't have the same ring to it. - BilCat (talk) 02:08, 21 April 2019 (UTC)

Status / query

1. Is this project still alive and if not should it be revived?

2. I’m looking at a bunch of edits from a /64 IP range and trying to determine whether they’re in good faith or bad. Would someone (preferably not working on a mobile device) care to review it with me?

Many thanks. Nick Levine (talk) 09:50, 19 November 2022 (UTC)

@Nick Levine: Can I be of any help? Lotje (talk) 11:49, 20 November 2022 (UTC)

@Lotje:Yes please. I’ve been looking at the contributions from the IP range 2601:283:C202:5930:0:0:0:0/64. Many of them are link removal; it’s really hard on a mobile device to tell whether these are appropriate or not. Nick Levine (talk) 11:56, 20 November 2022 (UTC)

I see the oldest contribution dates from July 27 2021, with warnings. Lotje (talk) 12:04, 20 November 2022 (UTC)

Thanks. I think maybe I should report to AIV. Nick Levine (talk) 12:10, 20 November 2022 (UTC)

Looking at the contributions on commons. Seems like a strong interest in primates. Lotje (talk) 12:15, 20 November 2022 (UTC)

Yes, I saw that. Anyway have reported and now it’s up to an admin to decide. Thanks again. Nick Levine (talk) 12:17, 20 November 2022 (UTC)

Yep Lotje (talk) 12:22, 20 November 2022 (UTC)

Range blocked for one week. Simply cannot face reviewing hundreds of changes but will come back next month to see if old ways have resumed. Nick Levine (talk) 16:42, 20 November 2022 (UTC)

Okay, I'll be hanging around Lotje (talk) 16:44, 20 November 2022 (UTC)