2011-04-16 10:13:57Great Poptech's Ghost!
Daniel Bailey
Daniel Bailey
yooper49855@hotmail...
97.83.150.37

Discussed this with John Cook; he said to put it here as an FYI:

 


The ghost of Poptech may have surfaced in the threads, first on the Zebra thread, where reader Adam posted nearly 30 off-topic messages in as many hours before we could get him to at least switch to a more appropriate thread to discuss his convolutions.  I touched upon the initial furor here, in a thread initiated by Rob H. to discuss general moderation issues on the general forum.

Adam's most recent contribution is here.  Much earlier in the thread, Albatross and muoncounter nearly simultaneously raised the possibility that Adam might BE Poptech.  Upon checking (using this tool), I found that Poptech used primarily 3 IP addresses, 206.137.1.198 (under which he signed up on 4-25-2008), 68.56.32.82 and 68.83.112.211; all from New Jersey here in the United States.  However, there was also a user with the name of poptech (all lower case) who had signed up on 3-7-2010, with an IP address of 60.240.238.148.  3 things I note on this other poptech:

 

  1. same name, only all lower case instead of caps & lower case
  2. login password: test
  3. I can find no comments that were ever posted here at SkS under that rendition of poptech.


So I reported back to those speculating that:

  • Adam was posting from England
  • Poptech's IP addresses and accounts were from New Jersey and Western Australia.


This is where it got real interesting:  Regular contributor Alec Cowan posted this comment:
"Please, Daniel Bailey, check my IP for this message and my previous message. "

Intrigued, I did so & then responded back to him:

Response: [DB] Nice teaching moment.  Since this is clearly a demonstration, Alec has changed his IP address from his home country in South America to this:


IP Address Location
IP Address    122.85.40.120
City    Beijing
State or Region    Beijing
Country    China
ISP    China Tietong Telecommunications Corporation.
Latitude & Longitude    39.900000   116.413000   MapG  MapV
Domain    CHINATIETONG.COM



So the moral is this: 

If it acts like, Poptech, sounds like Poptech and argues like Poptech, it could be Poptech.  I will confer with John on this.


-----------------------------------------------------------------------------------------------------------------------------------
So now we have the spectre of a banned troll coming back to roost, along with the issue that the methods I've normally used to help ID the offender seem to be circumventible.

I hate to give in to paranoia, but indulge me in my speculation here:
Given Alec's demonstration that disguising one's IP is not only possible, but actionable, could Adam BE Poptech?  Adam's account was initiated about 1 week before Poptech was banned, on March 14, 2011.  Given the existence of the other poptech account, with the "test" logon password (created on March 7, 2010), I hypothesize (hear me out) this:

  1. Poptech creates a stir some time ago, is warned by you to stop it.
  2. Being computer literate, Poptech creates a dummy account with a dummy IP address to see if an undetectable alter ego is feasible.
  3. In the latter stages of the Denominator thread, Poptech creates "Adam", a viable online "alter ego" with IP addresses in England.
  4. Having finally worn out his welcome, he is banned from SkS, but only under his Poptech persona.
  5. Undeterred, he saddles up & goes live with "Adam"


Sounds wacko, I know.  But Alec demonstrated it IS possible.  And Poptech/Adam share many similarities in style & sources used (he even linked to Poptech's materiel).  And others trolling here may have multiple ID's as well.


Thoughts, concerns?

2011-04-16 11:20:17
logicman

logicman_alf@yahoo.co...
86.145.235.170

Daniel:  the 'walks like a duck' test is sound.  Sockpuppets tend to show habits of target selection and writing styles which reveal them as clones.  Another test is cut-and-paste testing.  If trolls A and B are sharing identical text, including formatting, then that is strong evidence that A==B.

 

This wikipedia talk page may be helpful:

http://en.wikipedia.org/wiki/Wikipedia_talk:Suspected_sock_puppets

2011-04-16 21:50:52Any systematic ways to test for sock puppets?
John Cook

john@skepticalscience...
60.231.60.165
Sometimes IP ranges can be identified as part of IP spoofing ranges. I wonder if there are tactics or strategies to identify sock puppets. Note to mods - if you'd like me to program up a user report page - where you search for a username, then it displays the user's IP details, IPs of their latest login sessions, comments, etc plus all their latest comments - just sing out and I'll whip up a page.
2011-04-17 00:00:21
Daniel Bailey
Daniel Bailey
yooper49855@hotmail...
97.83.150.37

Yes, please,John.  While you're at it, is it possible to set up a query to find out if the same IP is being used to support more than one User ID?  Similarly, if the same email address supports more than one User ID (independent of IP addresses)?

Obviously, the point is to better discern systematic trollers.

Thanks!

2011-04-17 00:30:50
BaerbelW

baerbel-for-350@email...
93.231.171.60

Yes, a page like that would be useful as it might make "patterns" visible which you can't really see without having enough entries quckly available. On another forum I help to moderate we for example use the IP-address of newly registered user-IDs to check if they have been flagged as spammers elsewhere (with the help of http://stopforumspam.com/). If they have, the UserID gets deleted immediately. I've even kept tabs on the UserIDs, Email- and IP-addresses used to highlight things like email-domains most likely to be associated with spammers. If patterns emerge, email-domains might be put on a blacklist and can no longer be used to register. Spammers are of course not the same as trolls, but the information could be used for that purpose as well.