After the success of the last guide to sockpuppetry, and massive pile of feedback and questions, here’s another one, with more advice and more tips on hunting sockpuppets and how to deal with them, based on common questions asked.
How to deal with a sockpuppet
There are a few types of sockpuppets, based on what kind of sockmaster is operating them, it is generally unhelpful to view all socks as being the same, because the procedure for both finding them and dealing with them can be very different depending on context:
Good faith sockpuppets
Normally extremely obvious, these are socks created either by people who don’t know about the rules on multiple accounts, or believe they are in compliance but are actually not.
For example, a new editor blocked for conflict of interest or point of view warring, may immediately re-register and try again. Policy is clear – this is block evasion and not allowed. Reporting to SPI is not needed on a first offense, inform the admin that blocked their first account. (An exception to this rule is username blocks, where creating a new account is allowed).
Other longstanding editors may simply have accounts made for meetups, teaching, public computers, jokes, etc. These should be reported in private, to the editor themselves, lest you incur the wrath of whoever it was that didn’t fill in the paperwork correctly when you embarrass them in front of a checkuser.
These are socks made especially for vandalism. Often these are just a bored kid, other times someone who recently blocked going on a revenge spree, occasionally LTAs trying to wind people up.
Sockpuppets which are only engaging in non-targeted vandalism should simply be reported to WP:AIV, it is generally pointless filing an SPI unless you have reason to suspect it is in some way targeted (eg harassment or trolling) or large scale, as these may indicate an LTA at work.
Normally LTAs or spammers, report to UAA, make a note on the relevant LTA or SPI page if relevant. If the usernames appear to be targeted abuse at any named person or entity, report in private via email to oversight or if very serious, to the emergency email. Consider requesting a global lock.
LTAs are insane lunatics who are obsessed with Wikipedia, but banned from editing. They have specific patterns of behaviour, based on exactly how they abuse, disrupt, vandalise, and harass.
Generally targeted harassment indicates an LTA, and should be dealt with discreetly.
There is no hard and fast way to deal with LTAs. Generally if you acknowledge their behaviour on-wiki, they will gain empowerment and add you to the list of people they target. Therefore you should avoid this.
Revert, Report, Watch.
Revert whatever crap they just added, as if it is normal vandalism. If it is targeted harassment and or offensive and requires revdel or oversight, then report it in private to the relevant admins or oversight team.
Report the user, either to AIV, UAA, SPI, or to ANI as required, or just to an admin that happens to be there. Avoid making to much fuss, deny recognition. ANI is not the right place to report most LTAs because it is the wiki equivalent of writing your message on a 50ft billboard. It is normally a good idea to collect the LTA accounts and report them to the stewards to be globally locked, either via IRC, SRG, or email. Only do this if the LTA works cross-wiki, but do it even if the accounts are already blocked.
Watch for more accounts, LTAs often use proxies and IP hopping to create large organized attacks, so watch for further disruption after dealing with LTA accounts. Of course the LTAs have to eat and sleep (reportedly they are human) so there’s no point watching for excess.