Talk:Access to nonpublic personal data policy/Noticeboard/Archives/2022

Renamed user

@JSutherland (WMF) and NahidSultan (WMF): Hi, please note that User:L736E was renamed to User:Superspritz. I ping also @RadiX: for private wiki stuff, thanks :) --Superpes15 (talk) 18:35, 11 March 2022 (UTC)

Done. Thanks. --– NahidSultan (WMF) (talk) 18:52, 11 March 2022 (UTC)

Renamed. Thanks, RadiX∞ 20:07, 11 March 2022 (UTC)

Thanks both. --Superpes15 (talk) 20:21, 11 March 2022 (UTC)

This section was archived on a request by: --Superpes15 (talk) 20:21, 11 March 2022 (UTC)

Noting removal of আফতাবুজ্জামান per Ombuds Commission recommendation

On the recommendation of the Ombuds Commission, the Trust & Safety Team of the Wikimedia Foundation, on direction of the General Counsel, has revoked access of User:আফতাবুজ্জামান to non-public information or tools that may be used to access non-public information, previously granted under the NDA. We have also been directed to request that the Stewards remove আফতাবুজ্জামান's Checkuser user right on Bengali Wikipedia. These revocations are permanent. --Kbrown (WMF) (talk) 15:58, 6 April 2022 (UTC)

@Kbrown (WMF): I just noticed this. Is that it? Has @আফতাবুজ্জামান lost CU access because of a single mistake they did over a year ago? If that's the case I have a few other questions. Was the user educated/warned at any time before they did that mistake? Was the user ever contacted by the OC or WMF to hear what they had to say about the incident? And more importantly, why are the revocations permanent? Sakretsu (炸裂) 13:14, 8 April 2022 (UTC)

@Sakretsu: As these are all questions about the Ombuds Commission's internal procedures and decisions, they are questions OC would need to answer rather than me, because my involvement was in the implementation, not the investigation or the decision-making. I would recommend contacting the commission at cu-ombuds-lwikimediaorg with your questions. Kbrown (WMF) (talk) 13:19, 8 April 2022 (UTC)

Noting removal of Alraunenstern per Ombuds Commission recommendation

On the recommendation of the Ombuds Commission, the Trust & Safety Team of the Wikimedia Foundation, on direction of the General Counsel, has revoked access of User:Alraunenstern to non-public information or tools that may be used to access non-public information, previously granted under the NDA for a period of one year. We have also been directed to request that the Stewards remove Alraunenstern's Checkuser user right on German Wikipedia for one year, after which Alraunenstern may re-request the right from the local community through its usual process. --Kbrown (WMF) (talk) 13:44, 6 April 2022 (UTC)

@Kbrown (WMF): I'm one of the remaining four CUs on de. It would be nice next time to inform us about such a decision. Esp. the "only one year" part is hidden here on meta. It took quite some time to find the additonal info here. Have a nice day. Der-Wir-Ing ("DWI") talk 20:14, 6 April 2022 (UTC)

Moin, Alraunenstern is ill. She had an accident on Saturday and was in Hospital till today. She was operated on Monday. I dont think it is fine to take action whitout informing and talking with the people. Have a nice day. Regads --Itti (talk) 20:24, 6 April 2022 (UTC)

@Kbrown (WMF): There are discussions regarding this unique process and unexplained removal of rights in German Wikipedia. To quote one user [1]:

CU users are elected by the community, so there must be important reasons for the WMF to intervene against the will of the community. And precisely because it is an elective function, I think the voters have a right to know the reasons. Otherwise, that opens the door for the WMF to overrule the will of the community just because they don't like the holder of an elective office for whatever reason.

The community has given the CU users their trust in the election and Alraunenstern has held this office for almost 6 1/2 years, so she has been re-elected several times. The WMF should lay the cards open if they let someone who obviously has so much trust and support in the community have their rights withdrawn. The comment "by the WMF legal department on the recommendation of the ombuds commission" opens the floodgates to speculation and can almost be seen as damage to one's reputation.

Was there an abuse of rights or not? -- Toni Müller (talk) 09:05, 7 April 2022 (UTC)

So it's just the usual procedure between the Foundation and the local communities: The community with its voluntary contributors is allowed to generate content and funds for the WMF squires to get paid, but is at their mercy to shut up and submit when it comes to decisions and inferences by the Foundation. I feel very appreciated, but don't expect anything to change, as it is always the same since fifteen years. You should be ashamed of yourself. —viciarg⁴¹⁴ 11:39, 7 April 2022 (UTC)

Hi all, and thank you for sharing your thoughts. OC, Legal, and I have all been very sad to hear about Alraunenstern's injury; the fact that this removal coincided with her hospitalization was a complete coincidence and we regret that we accidentally brought hurt to her while she was already hurt. I wanted to let you know that the Ombuds Commission has made a public statement about this rights removal here, which I hope answers many of the questions that people have asked. I will try to answer a few more here:

• Is this the WMF acting on its own judgment without input from the community? No, this is the WMF enacting a recommendation made by the Ombuds Commission, which is a group made up entirely of volunteers. Typically the way it works is that the Ombuds Commission receives a complaint and investigates to see if there has been a policy violation; if there has been, they report that to the WMF and make a recommendation to us about what should happen next. WMF Legal then reviews that recommendation and, if they determine that it is consistent with our legal policy, instructs T&S to implement the recommendation.
• Why didn't the WMF notify the de.WP community directly? Typically, we don't locally announce things like this because we don't want to make a show of "everyone look, this person is in trouble!". But I believe that in cases like this, especially because of the time-sensitive component of this case, we should have let the local community, or at least the Checkusers, know. We are currently in the process of refining our workflow for implementing OC recommendations, and I am going to note "notification to the local community" as something we should consider adding.
• What offense did Alraunenstern allegedly commit? We cannot discuss the specifics of Ombuds Commission cases, as they involve private and personally identifying information about users. What I can say is that the Ombuds Commission investigates violations of and enforces the global Checkuser, Oversight, Access to Nonpublic data, and Privacy policies. So if the Ombuds Commission takes an action, it is safe to assume that there has been a violation of one or more of those policies.

I hope this information helps. I will continue reading this page in case there are other questions, though please keep in mind that I cannot discuss specifics of this or any other Ombuds Commission case. Kbrown (WMF) (talk) 13:01, 7 April 2022 (UTC)

"We cannot discuss the specifics of Ombuds Commission cases, as they involve private and personally identifying information about users." – You can simply leave out any private or personally identifying informations and disclose the general nature of the alleged offense. At the moment the community doesn't even know if there has been a breach of private informations, if it has been an accident or intentional and what has been done to avoid the alleged offense in the future. Any information that could be used to decide after twelve months whether Alraunenstern will be appropriate as a CU for deWP has been withheld from the german Wikipedia community. Also note that the WMF as a US institution has a very different understanding of "private information" from EU and especially the german community in that US institutions use the term very liberally when it comes to hiding informations from the public, but very restricted when it comes to collecting informations in furthering their own goals. —viciarg⁴¹⁴ 13:57, 7 April 2022 (UTC)

Thanks for your statement @Kbrown (WMF). I understand you cannot give specific details, but at least informing the other Checkusers seems essential to me. The deWP community is usually very critical about data protection and privacy which makes it surprising that the other Checkusers didn't notice a violation of the CU/privacy policy.

A possible explanation would be, that all of our Checkusers have a different understanding of the policies than WMF & Ombuds Commission have. If that's the case, some guidance for our Checkusers might be helpful in order to prevent another case like this. -- Johannnes89 (talk) 14:32, 7 April 2022 (UTC)

@Kbrown (WMF) to be precise, the WMF is enacting a recommendation made by the OC which is a group of users selected by the WMF itself. The community is not properly involved in this process, but the good news is that we want to :-) Would you help us figure out how? Yesterday I asked for more information on Alraunenstern's case in the stewards' mailing list but my email was seemingly overlooked. Sakretsu (炸裂) 19:38, 7 April 2022 (UTC)

@Sakretsu: You are correct, the Ombuds Commission is appointed by the WMF. One of my goals for this year is to find ways to get the community, or at least trusted representatives of the community like Stewards, more involved in the appointment process, because the community may have perspectives or knowledge that the Foundation does not know about. You should see more about this in the coming months. Kbrown (WMF) (talk) 13:24, 8 April 2022 (UTC)

I apologize for writing in German, possibly someone may translate:

• In dieser Angelegenheit sind einige Punkte doch sehr unklar. Zunächst mal wurde Alraunenstern offenbar nicht über die Vorgänge informiert. Gab es eine Information über das Problem und über mögliche Konsequenzen?
• Dass sie einen Unfall hatte, krank ist, geht seit dem 2. April eindeutig aus ihrer Benutzerdiskussionsseite hervor. Jeder konnte das sehen, auch die Ombudskommission, wenn sie versucht hätte Kontakt aufzunehmen, auch die WMF, wenn sie versucht hätte, Kontakt aufzunehmen, auch ein von der WMF bezahlter Anwalt, wenn sich diese Person interessiert hätte. Offenbar gab es somit keinerlei Interesse und kein Versuch einer Kommunikationsaufnahme, denn wenn jemand nicht antwortet schaut man sich für gewöhnlich ja mal die Aktivitäten und die Diskussionsseite desjenigen an. Hier wurde sehr schäbig mit einer hochverdienten, engagierten Wikipedianerin umgegangen. Die momentan zudem nicht mal die Möglichkeit hat, sie selbst irgendwie zu Wort zu melden.
• In der Diskussion auf der Checkuserdiskussionsseite in dewiki wurde angedeutet, dass es öfter vorkommt, dass die Ombudskommission sich Fälle ansieht. Warum wird das nicht offen kommuniziert? Warum wird das nicht auf den Fallseiten vermerkt? Warum gibt es dazu keine transparente Kommunikation, selbstverständlich unter Wahrung von Persönlichkeitsrechten, usw.?
• Die Andeutungen, was ggf. falsch/nicht gut gelaufen sein könnte, sind derartig schwammig, dass überhaupt nicht klar ist, wo das Problem liegt. Geht das nicht auch gerade hinsichtlich einer möglichen Vermeidung zukünftiger Probleme etwas klarer? Wenn hier wiederum Informationen nicht zu zu breit gestreut werden sollen, dann zumindest in dem Personenkreis der davon betroffenen, also der Checkuser, oder ggf. der Oversighter und Stewards?
• Es gibt zwei mögliche Problembereiche, wenn man sich die Fälle ansieht, die Alraunenstern in der Zeit bearbeitet hat, die hier fraglich ist, das ist ein Fall von "Coronaschwurblern" und "Verschwörungsmysthikern" und Fälle von undeklariertem bezahlten Schreiben, mehrer extrem missbräuchlich und gegen die Vorgaben der WMF verstoßender Sockenzoos, die teilweise ihr missbräuchliches Verhalten in diversen Sprachversionen betrieben haben. Der Rückschluss, der hier nun entsteht ist, die WMF schützt entweder "Coronaschwurbler und Verschwörungsmysthiker" oder gewissenlose Geschäftemacher, die die Wikipedia massiv kommerziell missbrauchen.
• Ich hätte dazu sehr gerne eine Information, denn wenn das so ist, stellt sich die Frage, wohin möchte sich Wikipedia entwickeln und kann ich das mit meinem Gewissen vereinbaren. Diese Frage stelle im übrigen nicht nur ich mir, sondern die wird seit einiger Zeit auch in der Presse gestellt und da sollte Wikipedia, hier die WMF, auch vermeiden in einem sehr schlechten Licht gerückt zu werden, gerade auch hinsichtlich der Desinformationskampangen die durch den Krieg in der Ukraine entstehen. Menschen gehen für eine neutrale und saubere, eine ehrliche, unmanipulierte Wikipedia sogar ins Gefängnis und hier scheint eine gute und integere Checkuserin für ihre Arbeit zugunsten von Missbrauch geofpert zu werden.

Viele Grüße --Itti (talk) 10:07, 9 April 2022 (UTC)

English translation (far from perfect, feel free to edit and improve):

• In this matter some points are nevertheless very unclear. First of all, Alraunenstern was apparently not informed about the events. Was there any information about the problem and about possible consequences?
• That she had an accident and that she is sick, is clear from her user discussion page since April 2. Everyone could see that, including the Ombuds Commission if they had tried to contact, including WMF if they had tried to contact, including a lawyer paid by WMF if that person had been interested. Obviously, there was no interest and no attempt to establish communication, because if someone does not answer, one usually looks at the activities and the discussion page of the person. A highly deserving, committed Wikipedian was treated very shabbily here. Who, moreover, does not even have the opportunity at the moment to somehow get her own word in edgewise.
• In the discussion on the Checkuserdiskussionsseite in dewiki it was suggested that it happens more often that the ombuds commission looks at cases. Why is this not openly communicated? Why isn't this noted on the case pages? Why is there no transparent communication about this, of course with respect for personal rights, etc.?
• The hints as to what might have gone wrong/not well are so vague that it is not at all clear where the problem lies. Can't this be made a little clearer, especially with regard to the possible avoidance of future problems? If information is not to be spread too widely here, then at least in the circle of people affected by it, i.e. the check users, or possibly the oversighters and stewards?
• There are two possible problem areas, if one looks at the cases, which Alraunenstern has worked on in the time, which is questionable here, that is a case of "corona swearers" and "conspiracy mystics" and cases of undeclared paid writing, several extremely abusive and against the specifications of the WMF violating sock puppet zoos, which have partly operated their abusive behavior in various language versions. The conclusion, which arises here now, is, the WMF protects either "corona swearers and conspiracy mystics" or unscrupulous profiteers, who abuse the Wikipedia massively commercially.
• I would very much like to have information about this, because if this is so, the question arises, where does Wikipedia want to go and can I reconcile this with my conscience. By the way, I am not the only one asking this question, but it has also been asked in the press for some time now, and Wikipedia, in this case the WMF, should also avoid being cast in a very bad light, especially with regard to the disinformation campaigns caused by the war in Ukraine. People go for a neutral and clean, an honest, unmanipulated Wikipedia even in prison and here a good and integer checkuser seems to be sacrificed for her work in favor of abuse.

--Zabe (talk) 11:51, 9 April 2022 (UTC)

Further information about last week's rights removals

Hi all, and thanks for expressing your thoughts and concerns about last week's rights removals. I want to assure you that I continue to read this page and take note of people's opinions and suggestions about ways we can improve how this is done in the future. In that vein, I got permission from the Legal department to share a bit more information about what led to last week's rights removals: both cases actioned last week involved situations where a Checkuser publicly connected one or more IP addresses to one or more accounts.

I also want to note that I am looking into whether and how the WMF can include that level of detail - a general statement of "what went wrong" without giving specifics that could lead to the discovery of PII - when implementing future Ombuds-related actions so the community is able to get a better idea of what is going on in these cases. Kbrown (WMF) (talk) 12:21, 11 April 2022 (UTC)

Hi @Kbrown (WMF), thx for your answer but in both cases is the question why such a hard punishment when there is in both cases just a "little" mistake. Why was there no communication with the CU? Explain the error to those authorized to use the CU, tell them that not doing it again would not have been enough for less serious problems? They are volunteers who do their best in their free time and they are belittled by you. It took months to clear the cases, so they couldn't have been that clear. I think that is disproportionate and not a good way to deal with volunteers. Regards --Itti (talk) 13:45, 11 April 2022 (UTC)

Thank you @Kbrown! I appreciate the effort to make things clearer. But this means that both Alraunenstern and আফতাবুজ্জামান made a good-faith mistake that is relatively common. Previous members of the ombuds commission were well aware of this confusion around the policies, and sent a clarification email in 2019 which regretfully wasn't publicized enough. In these cases, I expect ombuds to issue a friendly warning, make sure the respondent reads and understands, and recommend revoking access only as a last resort. Considering what I've read so far, I suspect this is not how things went, and since both situations involved the same mistake now I've also questions about the reason behind the difference in sanctions Sakretsu (炸裂) 14:19, 11 April 2022 (UTC)

@Kbrown (WMF) If two cases are of the same (as you say), so why did they get a two-term sentence? What is the criteria for sentencing? --MdsShakil (talk) 09:01, 12 April 2022 (UTC)

@MdsShakil: The "sentence" for each case was set by the Ombuds Commission, not the Wikimedia Foundation, so I can't answer that question. I'm not sure even the OC could answer it publicly, anyway, though; we really need to avoid getting into the specifics of individual cases, lest we lay a trail of breadcrumbs that could lead to PII. They probably could give you some information about how they generally determine what sanctions to give when they give sanctions; you could try posting that question to Talk:Ombuds commission or emailing it to cu-ombuds-llistswikimediaorg. Kbrown (WMF) (talk) 13:22, 12 April 2022 (UTC)

• I don't know about other Wikipedia, but on ENWIKI, it's been made very clear for years that CU's do not reveal PII or connect IP's with users. It's drilled into them before they apply for the bit. It's in the CU policies on ENWIKI, and on Meta at CheckUser policy. I don't know how y'all can make it plainer-- except to make it plainer and remove the bit when it is misused.. --Deepfriedokra (talk) 13:09, 12 April 2022 (UTC)

  @Deepfriedokra: metawiki:CheckUser policy states „do not reveal IPs“. My understanding so far was, that this does not include simply confirming an IP that was already public and under suspicion of belonging to sockpuppet accounts. Apparently that was wrong, but a common misunderstanding in many projects. Johannnes89 (talk) 14:23, 12 April 2022 (UTC)

  @Deepfriedokra I don't think WMF wants to remove the bit straight away on the basis that things have been made very clear on another project. That'd be tragic. WMF should reinstate the two checkusers and work to ensure that things become very clear on all projects instead. That'd be a reasonable solution from which all can benefit in the long run Sakretsu (炸裂) 14:56, 12 April 2022 (UTC)

  en:Wikipedia:CheckUser#IP_information_disclosure This policy encourages English Wikipedia checkusers' not to allow such connections to be made from their results, but the global privacy policy allows them to do so in the case of serious disruption, and this policy allows checkusers to prioritise compliance with Wikipedia policy over the personal privacy of a user who has abusively edited the encyclopedia. If the Omb was from en, then that would explain why it was so obvious for him, but not for other projects. Esp. when Deepfriedokra is right with " It's drilled into them". Der-Wir-Ing ("DWI") talk 15:05, 12 April 2022 (UTC)

  very briefly, the most I can say is that although both cases effectively did the same thing there are circumstances around it taken into account. Hence the severity of the breach of policy is considered. I cannot be specific on either case. Just note that when two people effectively breach the same rule one may have done so far worse than the other. I agree with others here that it should be "driled" into new CUs that "this IP is this user" or any variation of that do not write it on a public page. Please. Also those wiki's with local policies you are expected to know the global policy also, as it takes precedence over the local one. When we deal with requests to investigate breaches of the CU, OS or Privacy policies it will always be the one on Meta you are held to. Your local policies should be considered living documents, from time to time they should be examined to see if they have kept up with changing times and needs. Be prepared to update them as needed, of course that is a local matter and should be done locally by the usual means of updating policies. I am happy to explain any of our processes or methods feel free to ask, I just cannot talk about specific cases particularly here on a public page, as that would breach my NDA and several other policies. Cheers Scott Thomson (Faendalimas) ^talk 23:18, 12 April 2022 (UTC) Chair Ombuds Commission

  @Faendalimas thanks for your comment. As I pointed out above, this might be our misunderstanding of the global policy, as it says do not reveal IPs, which many understood did not prohibit confirming IP – Account connections already drawn by non-Checkusers due to very similar edit behaviour.

  Apparently this was wrong, but that's why at least the other Checkusers need some level of detail in order to not repeat the same mistake. In my opinion, one of the most important tasks of the ombuds commission might be educating CU / OS about proper understanding of the global policies. -- Johannnes89 (talk) 08:36, 13 April 2022 (UTC)

  @Faendalimas very well, let us see what these circumstances are then. The OC already sent full reports of their cases to the stewards' mailing list in the past. At the very least this should be possible again so that someone not involved in the investigation can examine what else Alraunenstern and আফতাবুজ্জামান did and what the criteria for the different sanctions was. Sakretsu (炸裂) 13:32, 13 April 2022 (UTC)

  @Faendalimas it's been a month since I emailed the OC per Kbrown's instructions and asked you to send the reports here. No reply whatsoever. How can the OC educate and mediate when this episode shows a worrying lack of communication? Sakretsu (炸裂) 19:22, 11 May 2022 (UTC)

@Sakretsu: as your email coincided with a meeting between the Stewards and the OC over this issue I assumed it would be dealt with by this meeting. I have asked about this now and will get back to you. My apologies for the delay. Cheers Scott Thomson (Faendalimas) ^talk 17:03, 17 May 2022 (UTC)

@Faendalimas there was no meeting over my requests, and I don't see how an unrelated meeting that I haven't attended like almost all stewards (and perhaps ombuds too?) could deal with this issue. All I can see is six more days to get this reply and ten additional days of waiting in vain. Whom have you asked about this? Legal? Sakretsu (炸裂) 08:59, 27 May 2022 (UTC)

Renaming user

@JSutherland (WMF) and NahidSultan (WMF):, user QuiteUnusual has been renamed to MarcGarver, I don't know if I can change it on noticeboard myself, so I'm writing here. Mykola ^talk 03:58, 1 July 2022 (UTC)

I've now updated the noticeboard. Thanks. – NahidSultan (WMF) (talk) 06:34, 1 July 2022 (UTC)

This section was archived on a request by: Superpes15 (talk) 17:42, 8 July 2022 (UTC)

Renamed user

@JSutherland (WMF) and NahidSultan (WMF): Please note that User:和平奮鬥救地球 was renamed to User:Peacearth! Thanks :) Superpes15 (talk) 13:37, 8 July 2022 (UTC)

Thanks for the flag! I changed this on the board. Joe Sutherland (Wikimedia Foundation) (talk) 17:24, 8 July 2022 (UTC)

This section was archived on a request by: Superpes15 (talk) 17:42, 8 July 2022 (UTC)

Renamed user

@JSutherland (WMF): Please note that User:Defender was just renamed to User:Elton. Thanks. Superpes15 (talk) 00:52, 26 December 2022 (UTC)

Uhm, just noticed that the noticeboard hasn't been updated yet. Re-pinging JSutherland (WMF), who probably missed the ping (pinging also NahidSultan (WMF)). Thanks Superpes15 (talk) 16:07, 16 January 2023 (UTC)

@Superpes15 I processed this, as it was only a rename with a local log; we've occasionally done these in the past. The current notice says not to 'add users', and I don't consider a rename an 'addition'. T&S staff if you'd rather we never do this, please comment here and we'll note it in the edit notice/banner. Best regards, — xaosflux ^Talk 16:34, 16 January 2023 (UTC)

@Xaosflux: Many thanks, I've avoided since it's a page managed by WMF and therefore I didn't want to create problems, even if these are sporadic and minor edits, but if it's allowed in the case of renaming, next time I'll proceed by myself! Best :) Superpes15 (talk) 17:04, 16 January 2023 (UTC)

I'm sorry, I did indeed miss the ping :( For the record I think it is fine if trusted users would like to make updates like this. Joe Sutherland (Wikimedia Foundation) (talk) 18:30, 16 January 2023 (UTC)