How to discern a case of illegal sockpuppetry from a group of people legally contributing from the same workplace?

Question

Cases of (not too well concealed) sockpuppetry can often be characterized by different accounts using the same IP and more or less massively upvoting each other in shorter or longer periods of time.

However, the same pattern of activities can arise, when a group of people working at the same place for example contributes to an online community, as for example whole universities may use a single IP, people may show each other and talk about their contributions in the real world, etc ...

How can one discern cases of illegal sockpupettry from a (small) group of people legally contributing while working together at the same workplace (company, university, etc)?

What complicates the issue in our community is the fact, that pseudonymous contributions are intentionally allowed and supported, such that it is generally not possible to map each contributing member to a real name.

What can be done to allow and support people contributing from a common workplace who potentially share a single IP, while discouraging and preventing sockpuppetry?

Answer 1

I'll see if I can answer from a Stack Exchange perspective without giving any privileged information away.

If you can tell if a bunch of accounts are coming from the same IP and voting for each other, in the first instance if you can't really tell if they are sock-puppet accounts or co-workers/class mates. So rather than diving straight in with bans or account deletion you could send the participants a "targeted votes" message. Explain that they should be voting on the content not the user and they should be voting on content as they come across it on the site. If you can, invalidate the votes and annotate the accounts to explain to the next moderator what you've done.

If the behaviour continues, then issue suspensions and account deletions.

There are other things you can do to see if two or more accounts are being run by the same people, for example, textual analysis of their posts. If they are different people their posts will use different words and phrases. It's very hard to change your writing style so this is hard to fool.

However, it's probably not worth going to this level of analysis.

Answer 2

Don't.

Sockpuppets, meat puppets and collaborating cliques can all result in the same harmful effects. So there's not a lot of value in trying to differentiate between them, since you'll need to mitigate the effects of all of them.

Which is what you should be doing in the first place: mitigating the negative effects. Look for patterns in behavior that are far outside the norm and squelch them. You can use things like IPs/networks, timestamps, names, etc. as input into this, but only as a way of strengthening signals that've already been identified as problematic.

Also be aware that a truly determined puppeteer can work around just about any measures you put in place. A puppet that looks and behaves identically to a well-behaving user on your system will be extremely hard to suss out...

Answer 3

I have come across this scenario in a forum I run. Typically someone posts the first post asking for opinion on a new product, etc. Then they register multiple other accounts (same Ip, emails which are obviously related), etc.

As was mentioned by ChrisF, its impossible to build a perfect automated solution to detect this with certainty.

Since we can't automate it, our solution was to develop tests which spotted patterns based on some pre-defined indicators (e.g. business rules), and insert the topic into a queue for moderator manual review.

If new patterns are found during the manual review, we have them added to the set of pre-defined indicators. So this way, the system theoretically becomes more efficient over time.