Wikipedia talk:Confidential evidence

message: From discussion at WT:BLOCK. Merits its own page rather than a section in WP:BLOCK, if the communal sense is that this is likely to recur and a policy to prevent abuse is required.
Draft only - comments and improvements welcomed. FT2 (Talk | email) 19:45, 20 November 2007 (UTC)

message: I would suggest that the person assembling the secret evidence not be the one who issues the block. The blocking administrator should be a person not involved in any dispute with the editor being blocked not should they have been involved in assembling the information. To do otherwise is to create the appearance of being the prosecutor, judge and jury. JodyB talk 21:07, 20 November 2007 (UTC)
replies: text: Concur, see below. FT2 (Talk | email) 21:14, 20 November 2007 (UTC)
thread_title:  Blocks only by uninvolved persons 

message: After the block is placed, a notice naming the person assembling the evidence and the persons reviewing and approving the block are to be listed under their own signatures. JodyB talk 21:08, 20 November 2007 (UTC)
replies: text: Concur, see below. FT2 (Talk | email) 21:14, 20 November 2007 (UTC)
thread_title:  Transparency 

message: Considered:
:* Wikipedia:Evidence presented in secret (long; may never have been "presented")
:* Wikipedia:Evidence in secret (better)
:* Wikipedia:Secret evidence (short but "secret" carries negative overtones?)
:* Wikipedia:Confidential evidence (neutral but less intuitive?)
:* Wikipedia:Sensitive evidence (I like this one most I think)   —Preceding unsigned comment added by FT2 (talk • contribs) 21:48, 20 November 2007 (UTC)
replies: text: Update - "secret" as in "secret evidence" carries a pejorative tone, tending to imply drama, rather than simply a need for privacy or other concerns. FT2 (Talk | email) 21:59, 20 November 2007 (UTC)
replies: text: I think "Sensitive evidence" best describes the reasoning for keeping such evidence secret. It is secret because it could cause vulnerabilities in someone, ie sensitive. 1 != 2 22:21, 20 November 2007 (UTC)
replies: text: I like confindential evidence.  though sensitive is ok, also.  --Rocksanddirt (talk) 00:18, 21 November 2007 (UTC)
thread_title: Name

message: One fairly basic point that appears to have been missed in at least one case recently.  When evidence is circulated cofidentially, agreement of reviewers has to be evidenced by them actually commenting in agreement.  Absence of comment does not indicate agreement or disagreement, it may very well indicate that the recipient of the circulated evidence has either not yet read it or not yet investigated themselves and come to a conclusion.  GRBerry 22:10, 20 November 2007 (UTC)
replies: text: Agreed. That's why we suggest each reviewer adding themselves to the block notice to evidence that review. Since the person assembling the evidence would not do the blocking, someone else would have to have reviewed, blocked and accepted responsibility for doing so. JodyB talk 00:27, 21 November 2007 (UTC)
thread_title:  Demonstrating review 

message: This proposed policy is poorly worded and full of loopholes. It contains much wording such as "They are expected to use -- and expected to be able to demonstrate -- independent advice was sought and reasonable good faith employed, in case of review." Such awkward phrases mean nothing as they require nothing. Instead policy should avoid all such ambiguity -- use wording instead like "must use" and "must demonstrate." The entire document should be retooled with an eye to avoiding such gaping loopholes. The proposal also contains too much expository text which can be wikilawyered. Maybe if a succint policy is given in bold and for any accompanying expository text it is made clear that it is elucidation rather than the policy itself. Quatloo (talk) 22:38, 20 November 2007 (UTC)
replies: text: An expectation isn't necessarily a loophole. The significance is that failure may be considered a lack of judgement, or one more in a series of lack of judgement, and lack of confidence in their judgement may be ultimately, a problem for an administrator. The issue here isn't that they must do this without fail; it's that they are expected to, and if they slipped up without a good basis or thought, then their judgement is called into question, which is actually the underlying concern. That's why it's drafted that way. Good question though. FT2 (Talk | email) 22:53, 20 November 2007 (UTC)

text: This proposal is an excellent beginning towards a good guideline. Removing the guidance so it can be turned into a policy would ruin it. WAS 4.250 (talk) 23:17, 20 November 2007 (UTC)
replies: text:  Even policies have explanatory text and guidance comments - WP:NPOV is the canonical example, but see also: WP:CONSENSUS and WP:COPYRIGHT for other examples. The level of comment here is also fairly comparable to many policies (WP:BLOCK for example). So no need to worry. FT2 (Talk | email) 00:21, 21 November 2007 (UTC)
replies: text: Quatloo, this is all of about three or four hours old. Of course it needs work and retooling. There is no problem making it more succinct. However, explanation of some degree is evident in every policy and while some can probably be dropped, some needs to stay. JodyB talk 00:31, 21 November 2007 (UTC)
thread_title:  Entire proposal needs retooling 

message: Perhaps we could make clear what exactly the words "acted upon", in the nutshell (Evidence that is not publicly available can be presented, and acted upon, in certain unusual cases), or in the proposed guideline itself?  Perhaps something like "blocking or otherwise restricting the actions of an editor"? Otherwise (particularly when the "background" box is removed, as I assume it will be eventually) this guideline is a bit mystifying to those unfamiliar with Wikipedia. ("Confidential information" for lawsuits? Firing an employee? Reverting all of an editor's prior edits?)
I realize that experienced editors know that there isn't much that Wikipedia can do to an editor other than revoke sysop privileges, restrict editing and/or block or ban an editor, but I'm hoping it's possible to spell things out a bit for less experienced editors who happen on this (not to mention trolls who want to cite the guideline as enabling Wikipedia to do anything to anyone on the basis of information that isn't made public.  -- John Broughton   (♫♫) 02:22, 21 November 2007 (UTC)
replies: text: A "what actions or approaches might be relevant" note, that explains what can happen? Maybe as part of background? FT2 (Talk | email) 03:16, 21 November 2007 (UTC)
thread_title:  "Acted upon" to do what? 

message: Would just like to add that I put in a negative vote for this proposed policy. If it can't be an open process then it can't be presented. There are many people in jail today (Jonathan Pollard being one of them) who are rotting due to "confidential evidence". I abhor this. Thus, I veto it (for whatever it's worth). Bstone (talk) 02:47, 21 November 2007 (UTC)
replies: text: Maybe I'm misreading it, but I believe the proposal seeks to establish standards for how confidential evidence is used so as to minimize the chance of its misuse.  Confidential evidence is already used in some arbitration cases, without any standard in place to govern its use.  Arbcom will continue to make use of confidential evidence whether or not this proposal exists.--Father Goose (talk) 03:09, 21 November 2007 (UTC)

text: My reaction is the same as Goose's (if I interpret it correctly). We definitely don't want to disallow confidential evidence entirely. Do you feel that the standards outlined in the current revision of the proposal are too stringent? If that's a yay, stick around so we can balance it out better. =] — xDanielx T/C\R 04:28, 21 November 2007 (UTC)
replies: text: I believe that if the evidence is too confidential to discuss in ArbCom then it's inadmissible. Jonathan Pollard's lawyer is not even allowed to see this "confidential evidence", but it is the crux of the Gov't claim against him. It would be wrong of me to abhor the use of such evidence in his case but not speak out against it here. Just my opinion and it looks like this evidence will already be used. Bstone (talk) 16:34, 21 November 2007 (UTC)
replies: text: The issue is with evidence that would reveal personal information about a user. A recent ArbCom involved an email sent from one user to another which involved alleged threats. The email included personal information about the target of that threat. Should such a message simply be thrown out if the target does not want this personal information revealed? Would you support redacting the personal info? Finally, how would you reconcile the fact that an email (for instance) can't readily be verified "on-Wiki"? This is an instance where evidence would be considered by the ArbCom members, but not necessarily placed in the open for the community to view, due to privacy issues. -- Kesh (talk) 13:03, 22 November 2007 (UTC)
replies: text: This was a private email sent from one person to another, both of whom who happen to be editors on wikipedia? In my opinion the only evidence which can be accepted is that which happens on wikipedia. Private emails are not sent through wikipedia. Thus, the email which you discuss is inadmissible. If threats are made, then it should be referred to the proper legal authorities. Bstone (talk) 04:03, 23 November 2007 (UTC)
thread_title: Veto

message: Now and again I've seen cases where condiential evidence is mentioned, and it mystifies me as to why it needs to be kept confidential.  One of the things I'd like to see included in the proposal is that a rationale should be offered whenever confidential evidence is used: "to protect <user's> identity" or the like.  Ideally, it ought to be as specific as possible short of defeating the purpose of the condfidentiality; something like "for reasons of privacy" is pointlessly vague.--Father Goose (talk) 03:04, 21 November 2007 (UTC)
replies: text: I think the standards of handling suggested, which include good cause, independent review, good and full communication, factual evidence, minimizing damage, non exaggeration, prompt clearing as able, and publication when possible, cover that rather thoroughly. Other proposals include the need for high quality review before any action can be taken, and the like. I think you'll find this one's going to be well and truly covered in whatever wording comes out. FT2 (Talk | email) 03:12, 21 November 2007 (UTC)

text: I think this is an excellent point that would help mitigate some of the potential harms of confidential evidence. FT2 has a point that it is (somewhat implicitly) covered to some extent within the existing sections. For now, I think I'll add another sentence to the Good and full communication bullet, in an attempt to make the point more clear. Feel free to discuss and/or change this if there's a better alternative. — xDanielx T/C\R 04:35, 21 November 2007 (UTC)
thread_title:  Providing the "reason" should be standard 

message: Rspeer's thoughts here are the same for a lot of people.  This policy proposal makes it "legal" for Durova to keep doing "sleuthing", while retroactively justifying the method used to block !! in the first place.  Therefore, I oppose the creation of this policy as it is essentially gaming the system. Kwsn (Ni!) 12:42, 21 November 2007 (UTC)
replies: text: rather, it is intended to clarify that such practices are authorized, but provide an organized way to guard against possible misuse of them. That's the very opposite of gaming the system: it's intended to prevent such gaming, and it would do so. Incidentally, I would be reluctant to increase the role of arbcom , when overload there is already a problem. The person most often providing  confidential evidence has always offered to show it to any responsible WPedian, and has followed up on this. DGG (talk) 12:46, 21 November 2007 (UTC)
replies: text: Then explain why I have not seen the entire evidence in my email inbox? Kwsn (Ni!) 12:48, 21 November 2007 (UTC)

text: I understand the concerns about secret evidence and sleuthing. But please consider that sleuthing is here and has been here for a while. It's very unlikely that it will go away. Unfortunately, there has been nothing to prevent the creation and secret use of secret evidence. All we are trying to do here is provide some framework where such evidence will be reviewed before a block and to prevent the "sleuther" (if that's a word)from being the one who places the block. This changes the method of the block and under this proposed system what Durova did cannot be done. There is still some work to be done, but this proposal offers a greater level of protection than what we have now. Thanks. JodyB talk 13:01, 21 November 2007 (UTC)
replies: text: The thing is, this policy is going to end up one of two ways.  One allowing secret evidence outside of channels that already use them (arbcom, oversight, and checkuser for the most part), the other banning the use outside of those channels.  Sad thing is, I can also see this becoming a stalemate because there are people on both sides that think they're right and won't move (example: me, I'm not really afraid to admit it). Kwsn (Ni!) 13:12, 21 November 2007 (UTC)

text: The moment you have evidence in a case that you want to claim is important and should be taken into account, but won't show (some involved party, all admins, anyone with a legitimate interest), then you have to jump a load of very rigorous hoops and you're completey responsible if you mess up with it, so these are things you need to check, communicate, and how you're expected to handle such matters if you still want to make a claim that some evidence isn't "public".
Those measure involve some exceptionally stringent requirements for checking, communication, proactive disclosure when possible, and disclosing weakness in evidence not just strength, and advise in fact to say nothing until you've asked someone like an arbcom member, who's got a load of independence and good judgement, what they think. The requirements for a user who feels important evidence can't be publicly presented are fair to all interests... but some of the most demanding of any policy we have.
Better for you? FT2 (Talk | email) 13:20, 21 November 2007 (UTC)

text: Brings me to my second big concern, and probably the biggest one regarding this, what will happen in cases of abuse, it has to be similar to IAR in that it can't be fall back to block people for no publicly justifiable reason or similar (see where I'm going with that?) Kwsn (Ni!) 13:28, 21 November 2007 (UTC)
replies: text: No, I don't see where you're going. I assume you mean the abuse of this guideline? Remember that editors are expected to follow guidelines, and if they consistently fail to abide by them they could potentially be stripped of privileges, blocked, etc. If someone consistently blocks users using confidential evidence without consulting other experienced users, or without considering the faults of the information, or any other instruction included in this guideline, they could be sent to ArbCom and be stripped of administrative privileges, independent of the fact of the validity of the information. This would force them to send any evidence in the future to other neutral admins or the ArbCom for blocking. However, whether this guideline is sufficient to curb the Judge Dredd-type investigations is another issue still being discussed. - Mtmelendez (Talk) 14:30, 21 November 2007 (UTC)

text: I think people are being a little over-dramatic about confidential evidence. Durova has posted some samples of her detailed investigations, and many of us have seen others. The basic technique she uses is a careful lineup of all the contributions from all the possible parties. Her exceptional success in using this,is dues to her exceptional patience in the analysis. Sometimes evidence is truly confidential--anything that comes in my email is necessarily so, as are any details from checkuser, or anything that might disclose a real name. But most of the work is done without this.Let's not exaggerate the problem. 01:48, 22 November 2007 (UTC)
replies: text: Would you mind posting a link to such analysis? So far, the only examples I've seen have been on the ANI sub-thread (or the !! example), which probably isn't the most neutral source. The reason I'm asking is that while I've heard a number of editors who I respect state their confidence in such techniques, I'd like to to examine it for myself (assuming it's posted on-wiki somewhere). Best, --Bfigura (talk) 02:13, 22 November 2007 (UTC)

text: If it's an analysis performed on publicly available information, there's no reason why the analysis itself must be confidential.  Is that the case with Durova's investigations?  I haven't heard any explanation as to why they must be kept confidential.--Father Goose (talk) 04:25, 22 November 2007 (UTC)
replies: text:  Not so. I have a good case in mind. I keep tabs on a well known vandal-warrior (WP:DENY refers). Ive tracked him some years now. He's a habitual reincarnator with several community bans and at least two arbcom bans on his record. He has to be identified without checkuser due to his sock work. I do regularly identify his latest aliases -- about 60 of them so far since 2005. The first thing he'd do with any evidence I or others published would be to use it to prevent us doing so. I do discuss the evidence in depth with other trusted users - typically crats, and those who are also know him well - and I watch till I'm sure, sometimes weeks or months, but no... just because the page is public doesn't mean that how a "bad actor" was detected from it is also public. For this sneaky vandal and reincarnator, that comes under the heading of "not a suicide pact". FT2 (Talk | email) 06:17, 22 November 2007 (UTC)
thread_title:  My concern here 

message: I've been asked to give examples for this discussion.  So I'll start with examples that are already public and work from there.  
The first in-depth investigation I did is documented at User:Durova/Complex vandalism at Joan of Arc.  A single individual had been disrupting articles on the topics of Catholicism, Christianity, homosexuality, and cross-dressing for two years.  Occasionally he had gotten blocked, but he kept shifting accounts and tactics and exploited the untraceability of AOL accounts until that loophole got closed.
The Midnight Syndicate arbitration case is another good example: Wikipedia:Requests_for_arbitration/Midnight_Syndicate/Evidence#Evidence_presented_by_Durova.  That was a business relationship turned bad in a gothic rock band.
The core of my method is to examine Wikipedia site history files.  Most investigations are simple, but some rabbit holes are pretty deep.  I may look through thousands of edits over scores of pages.  Sometimes there's a smoking gun to be found: during the BooyakaDell investigation we had trouble getting a checkuser since the suspected sockmaster had been blocked for too long.  So we looked at edit patterns.  The suspected sockmaster, JB196, had disclosed his real name on his original account and wrote for some online publications.  He liked to link to his articles and so did the new account.  BooyakaDell claimed to be a fan of the real-life JB196.  We spotted BooyakaDell citing the author by name on an article that had no byline.
JB196 has created over 500 sockpuppets.  Obviously he isn't going to cite himself by name for an article that lacks a byline again.  If the wikisleuths disclose every method we use to crack a case, then the people who set out to exploit Wikipedia will just get more skilled at it.  Not a whole lot of people do this work.  Have a look at what we're up against.
Thanks for working out clear parameters in the interests of the site.  I'd like to know where the green zone is so I can respect the community's concerns while I do this work. DurovaCharge! 06:09, 22 November 2007 (UTC)
replies: text: Thank you for being so forthcoming. - Mtmelendez (Talk) 10:35, 22 November 2007 (UTC)

text: I keep tabs on a well known vandal-warrior (WP:DENY refers). Ive tracked him some years now. He's a habitual reincarnator with several community bans and at least two arbcom bans on his record. He has to be identified without checkuser due to his sock work. I do regularly identify his latest aliases -- about 60 of them so far since 2005. And the first thing he'd do with any evidence I or others published would be to use it to prevent us doing so. I do discuss the evidence in depth with other trusted users - typically crats, and the few admins and editors who also know him well - and I watch till I'm sure, sometimes weeks or months, but no... how a "bad actor" was detected is not always public. For this sneaky vandal and reincarnator, that comes under the heading of "not a suicide pact".
Hope this comment helps here, too. FT2 (Talk | email) 02:23, 23 November 2007 (UTC)
thread_title:  Reply to a request: examples 

message: I mentioned this on WT:BP in relation to a small change to the text there, but I think it's worth saying here too: the use of confidential evidence in certain circumstances should not abrogate from the general obligation to provide reasons for making a block. --bainer (talk) 11:46, 22 November 2007 (UTC)
replies: text: I think that's a given. Even if the evidence itself must remain confidential, ArbCom has to explain why they're making a block. It might help to explain that a specific piece of evidence was examined in a confidential manner, though. -- Kesh (talk) 13:16, 22 November 2007 (UTC)
thread_title:  Evidence vs conclusions drawn from evidence 

message: I hope we all agree that there are some investigations for which it is not appropriate for the investigators to disclose every detail to the general public. The reasons are varied, and many are given above so I won't recount them. I hope we also agree that there has to be accountability for actions carried out. To a certain extent these are competing needs. So the practice up to now is that accountability has been achieved in a way that preserves confidentiality, and yet provides the check on rogue behaviour that is needed. The community places trust (or should) in ArbCom to be that check here at en:wp... and project wide, the board has created the m:ombudsman process to add accountability. I hope that this proposed policy, whatever the outcome, preserves these general notions, as they seem appropriate to me. ++Lar: t/c 16:07, 22 November 2007 (UTC)
replies: text: See also Wikipedia:Arbitration_policy#Transparency ++Lar: t/c 16:33, 22 November 2007 (UTC)

text: I think that the arbitration committee is a perfectly satisfactory body to make the final judgment, but it serves best when it is asked to deliberate on evidence rather than undertake an investigation on its own. As such I think that confidential evidence should generally serve as a complement to an ordinary arbitration process rather than as the basis for a secret hearing. Christopher Parham (talk) 00:11, 24 November 2007 (UTC)
thread_title:  Checks and balances 

message: Certainly ARBCOM members would be reliable in my mind. Are there others? JodyB talk 17:01, 22 November 2007 (UTC)
replies: text: Bureaucrats and stewards are possibilities, they have a mandate of trust from the community. Catchpole (talk) 23:03, 23 November 2007 (UTC)
replies: text:  Or people who work with the OTRS as well This is a Secret account 23:08, 23 November 2007 (UTC)
replies: text:  A reliable reviewer is an admin who will actually dig in and get their hands dirty in the evidence, while also looking independently for evidence that the facts are different than what was suspected.  Admins have the necessary level of trust.  Any more trust than that is not needed, what is critical is the serious consideration of all evidence, not just that presented confidentially.  GRBerry 03:33, 24 November 2007 (UTC)
thread_title: Who is a reliable reviewer?

message: I would argue for at least two in addition to the person assembling the evidence. Is that enough? JodyB talk 17:01, 22 November 2007 (UTC)
replies: text: I'm somewhat afraid that if we raise the bar too high then peer review might become too much of a perfunctory process. One could imagine IRC conversations taking the form of "I'm gonna block this sock-troll-SPA, k?" / "Uh ya okay". I think one genuine review would be better than several of those. I think (somewhat tentatively) that 1-2 would be reasonable as a minimum, but would be reluctant to support something higher (again, keeping in mind that this is a minimum). Other thoughts? — xDanielx T/C\R 00:22, 23 November 2007 (UTC)
replies: text: I see what you mean and I do not disagree. But remember, these reviewers will have to sign with the block so, hopefully, people will take the review serious. JodyB talk 00:26, 23 November 2007 (UTC)
replies: text: Aye, hopefully that will help. I just hope that predispositions don't play too big a role -- I've always thought that to be an issue with Template:Unblock. — xDanielx T/C\R 02:09, 23 November 2007 (UTC)

text: Won't it actually being the reviewers imposing the block, if we use the process outlined in the above section? (Where it states that the person accumulating the confid. evidence shouldn't be the person imposing the block). Best, --Bfigura (talk) 05:20, 23 November 2007 (UTC)
replies: text: Oh, yeah. — xDanielx T/C\R 07:44, 23 November 2007 (UTC)

text: Agreed, having a reviewer place the actual block (or take other administrative action) is the best check and balance to ensure a serious review.  GRBerry 03:36, 24 November 2007 (UTC)
thread_title: How many must review?

message: One of the provisions mentioned is "If the evidence is accessible to problem users, disclosing it might give them more insight on how to circumvent identification."  Are we clear that this is really an important concern?  In the most recent circumstance, the only insight I could see that a "problem user" might glean is that new accounts which know wiki-markup and know their way around Wikipedia might raise suspicion that that user has edited before under another username or as an IP.  While I've never attempted to set up a sleeper account, my guess is that anyone who does would probably take this into account.  Have there been other situations where investigative techniques alone (rather than privacy concerns in the evidence) are really so compelling and powerful that the need to keep them secret is more important than the need for transparency? JavaTenor (talk) 00:36, 24 November 2007 (UTC)
replies: text: Well, given the present situation only, I would probably agree. But I envision this proposal as being created to avoid a future situation which we might not foresee at the moment. If there is a situation in which confidential evidence is a part, we will at least have a policy in place to properly deal with it. Regardless of the reason -- privacy or investigative techniques --  we need to be prepared to handle the material well. - JodyB talk 00:44, 24 November 2007 (UTC)

text: I think this should go. There is nothing useful to be gained from keeping techniques for discovering abuse secret, and the potential for abuse and escalation of drama is vast. Zocky | picture popups 03:48, 25 November 2007 (UTC)
replies: text:  See comments above. At least one major sock-vandal who engages in sneaky damage, and probably others, are identified through experience of their previous aposts. The exact evidence is usually compelling. But in such cases security by obscurity is the only means that exists. So yes, as a practical measure I am personally, very clear as to the need and risk. See comment above on this. FT2 (Talk | email) 13:08, 25 November 2007 (UTC)

text: 
Information that would can be released without harming the privacy of members of the community should be available by private email to trusted editors, on request. Trust may be defined by those assembling the evidence. Editors who ask for such information should be prepared to respect the confidentiality of the information, and not distribute it without permission.
This process in no way alleviates the need for a prior review of the evidence by ArbCom before blocks should be issued.
Thoughts? --Bfigura (talk) 02:45, 24 November 2007 (UTC)

text: I can't imagine that we would restrict the dissemination of information that the assembler wishes to make public unless it violates aleady existing restrictions (your class one material). If they wish to divulge their methods then that's sure fine by me. -JodyB talk 02:52, 24 November 2007 (UTC)
replies: text: Right, my concern is that our current Review section implicitly limits reviews to arbcom / checkuser / oversight. While I can certainly imagine cases where that restriction would be necessary, I'm not convinced it would need to be present in all cases. (And I don't think it should be hard to tell whether such restriction is needed, although I could be wrong, since I'm none of the above :) Best, --Bfigura (talk) 05:29, 24 November 2007 (UTC)
replies: text: Jody,as I understand your argument is that there has not yet been any case where disclosure of investigatory methods would actually require confidential information? In that case, what are we discussing? It would seem we have no need for this entire policy, there being no actual situation not covered by checkuser--and we could therefore simply terminate the discussion.   DGG (talk) 06:51, 24 November 2007 (UTC)
replies: text: No DGG, not at all. In the most recent case we had a investigator who wanted a block and wanted to keep her techniques secret. I am sure there have been other such cases too and even more certain others will follow. Without commenting on the need for secrecy in this recent case, I would say we must have something in place to provide guidance should it occur again. I think this proposal, or something akin to it, it necessary. All I am saying to Bfigura above is that the person assembling the evidence can make his techniques public if he wishes. - JodyB talk 13:08, 24 November 2007 (UTC)
thread_title:  Are we confident in the necessity of [[security through obscurity]]? 

message: There also seem to be two classes of confidential information here: information that's truly private (names, identities, checkuser info, etc.), and information we'd like to keep out of the hands of deliberate disrupters. Is there any truly compelling reason that the second class of information needs to be held so close to the chest (i.e., ArbComm)? Couldn't it be emailed on request to individual users that the assembler has some level of trust in? I think this is somewhat close to how things are currently done, and I'd prefer this policy not hint that its okay to restrict pseudo-confidential information to ArbCom, just to keep it out of the hands of vandals. Perhaps some language like: 
::
Information that would can be released without harming the privacy of members of the community should be available by private email to trusted editors, on request. Trust may be defined by those assembling the evidence. Editors who ask for such information should be prepared to respect the confidentiality of the information, and not distribute it without permission.
This process in no way alleviates the need for a prior review of the evidence by ArbCom before blocks should be issued.
Thoughts? --Bfigura (talk) 02:45, 24 November 2007 (UTC)
replies: text: I can't imagine that we would restrict the dissemination of information that the assembler wishes to make public unless it violates aleady existing restrictions (your class one material). If they wish to divulge their methods then that's sure fine by me. -JodyB talk 02:52, 24 November 2007 (UTC)
replies: text: Right, my concern is that our current Review section implicitly limits reviews to arbcom / checkuser / oversight. While I can certainly imagine cases where that restriction would be necessary, I'm not convinced it would need to be present in all cases. (And I don't think it should be hard to tell whether such restriction is needed, although I could be wrong, since I'm none of the above :) Best, --Bfigura (talk) 05:29, 24 November 2007 (UTC)
replies: text: Jody,as I understand your argument is that there has not yet been any case where disclosure of investigatory methods would actually require confidential information? In that case, what are we discussing? It would seem we have no need for this entire policy, there being no actual situation not covered by checkuser--and we could therefore simply terminate the discussion.   DGG (talk) 06:51, 24 November 2007 (UTC)
replies: text: No DGG, not at all. In the most recent case we had a investigator who wanted a block and wanted to keep her techniques secret. I am sure there have been other such cases too and even more certain others will follow. Without commenting on the need for secrecy in this recent case, I would say we must have something in place to provide guidance should it occur again. I think this proposal, or something akin to it, it necessary. All I am saying to Bfigura above is that the person assembling the evidence can make his techniques public if he wishes. - JodyB talk 13:08, 24 November 2007 (UTC)
thread_title: Two Classes of Info

message: For example, users can @ ArbCom instead of posting evidence.... -- Piotr Konieczny aka Prokonsul Piotrus | talk  05:00, 24 November 2007 (UTC)
replies: text: Sure. Such users shouldn't be going around and blocking based on such evidence though, without ArbCom getting involved and doing the block (as we learned from the !!/Durova thing). --Bfigura (talk) 05:26, 24 November 2007 (UTC)
replies: text: Yes, this seems to be the simplest option. If you don't want to share your evidence, send it to ArbCom. Version 3 seems much the best. Tim Vickers (talk) 23:06, 27 November 2007 (UTC)
replies: text: I'm not comfortable with ArbCom handling secret evidence when keeping such evidence secret is unwarranted.  There are certain classes of information that are inherently sensitive (personal information, generally).  I accept keeping such information private and allowing ArbCom to use it if it is pertinent to a case.  But "secret conclusions" drawn from non-secret information are wholly unacceptable, whether they are reviewed by ArbCom or not.  So I endorse Version 3, provided it is not altered or interpreted to allow something other than inherently sensitive information to remain secret.--Father Goose (talk) 23:38, 27 November 2007 (UTC)
thread_title: This already exists

message: I'd propose saying that the only two agencies justified in acting on secret evidence are 1) The Board and 2) The Entirety of the Arbcom.  Secret evidence cannot be reviewed, so this really boils down to: who do we, as a project, trust to the extent that we cede any right whatsoever to review their actions?.  Individual admins, and even fairly large subsets of admins clearly do not meet this criteria.   Honestly, left up to me, I would prefer Arbcom not even be able to act on secret evidence, but that might not be feasible.
Also remember-- if secret evidence is needed to prove a case, than there is no active disruption going on.  There shouldn't be any "emergency need" for immediate action based on secret evidence.  Secret evidence is INCREDIBLY dangerous-- if anyone is going to do this, let it be arbcom and only arbcom. --Alecmconroy (talk) 13:19, 24 November 2007 (UTC)
replies: text: At present, ArbCom does (and has in the past) act on confidential evidence. I'd be happy to continue that trend, and let them be the sole enforcers of confidential evidence. (Hopefully it would be so rarely used that this wouldn't prove a caseload burden). And I agree that if there's an emergency that necessitates immediate action, then a block should be made for disruption using public evidence (since if someone is being that disruptive, then there should be plenty of public evidence by definition). Best, --Bfigura (talk) 21:36, 24 November 2007 (UTC)
thread_title: My suggestion

message: I agree with the need for rules regarding confidential evidence but I disagree with the approach taken here.  I feel that this proposal is far too restrictive on the use of such evidence, and editorializes to an undue degree that such evidence should not be used.  Rather than getting into a dispute over the matter, or making bold edits that are sure to be opposed, I have written an alternate proposal based on this one, at Wikipedia:Confidential evidence/alternate.  
Before actually modifying or getting on the talk page there, could I please get some feedback about whether it's okay to make a fork like this?  It seems to me to be the best thing to do under the circumstances.  Unless there's a convincing objection I'd also like to notice the alternate proposal as well as this one to the village pump, the Durova RfC and ArbCom hearings, and any other appropriate places.  (btw, to any administrator reading this, I initially created the proposal at the wrong place and then moved it to its present location - would you kindly delete that page?)
Thanks, Wikidemo (talk) 14:41, 24 November 2007 (UTC)
replies: text: I would think it would be better to try and keep things in one place. Perhaps create a new section and put your proposals there. Otherwise, we end up chasing our tails over several pages. -JodyB talk 15:41, 24 November 2007 (UTC)
replies: text: My proposal would be that we replace the entire current proposal in favor of the one I wrote, or else reject it because it's unacceptable in its current form.  About 70% of the verbiage would have to be deleted.  I don't see any way to do this incrementally as edits to the current proposal.  Wikidemo (talk) 16:19, 24 November 2007 (UTC)

text: You could, for example put a level 1 heading of "Original proposal" at the top and indent all other existing headings one level.  Then add another level 1 heading of "Alternative #1" with your proposal underneath it.  Think outside the box!  GRBerry 17:24, 24 November 2007 (UTC)
replies: text: I second that. I think it would simplify this whole discussion. In fact, I'm going to go copy it to this page now. --Bfigura (talk) 18:40, 24 November 2007 (UTC)

text: I agree with Wikidemo that Version 1 is currently more wordy then necessary, but I think Daniel's right in that the policy should be strict. We shouldn't sacrifice transparency unless there's a really strong need to. Best, --Bfigura (talk) 21:16, 24 November 2007 (UTC)
replies: text: The new "alternative 3" seems to fit that bill, and it's short and sweet.  I have no objection to that, so long as ArbCom is amenable to the task, has the bandwidth for this new function, and can act quickly (we can't wait the usual 2 weeks for ArbCom to decide if a disruptive sockpuppet should be blocked based on secret evidence).Wikidemo (talk) 00:37, 25 November 2007 (UTC)

text: What existing rules?  (I mean that sincerely, not rhetorically - how would AN/I deal with decisions regarding secret evidence)Wikidemo (talk) 00:37, 25 November 2007 (UTC)
thread_title:  Alternate proposal 

message: The issue here, to drive right to the heart of the matter, is whether Durova's investigative techniques should remain secret.  
I personally must start with the assumption that investigative techniques do not need to be kept secret (unless they are wrongful, at which point any secrecy becomes a cover-up).  The justifications I've seen so far have been that if the vandals knew what behavior got them in trouble, they would avoid it, and be even harder to spot.
Isn't this what we want?  Does it matter if a so-called problem user is out there covertly doing non-problematic things?  Do we need to act at all except when destructive behavior is spotted -- and is there some kind of destructive behavior that is somehow unidentifiable or irreversible unless secret techniques are used?  Why can we not rely on transparent methods of investigation only?  (Note that I consider checkuser an adequately transparent method of evaluating privileged information.)
Convince me that "secret investigations" are not dead, dead wrong.  I don't care if lots of people are in on the secret as some sort of check against abuse.  I have not heard a single convincing reason why they should be secret in the first place.  Convince me.  Convince everyone.--Father Goose (talk) 05:32, 25 November 2007 (UTC)
replies: text: It sounds like you may not want to be convinced.  Actually, there is nothing at all wrong or prohibited with secretly investigating someone.  You do that every time you check their user page, talk page, edit history or log because you think something is fishy or you want to figure out who they are.  You don't exactly tell them in advance that you're poking around or get permission, nor would you ever tell them you suspect them of something before you gather some information privately.  So it's not the investigation, it's whether the information should be used as the basis for a block, ban, etc., and if it is, may it be kept confidential.  Most security systems are not so robust that they can withstand a clever attack by someone who knows the detail of the system.  Every police force has its plainclothes officers and undercover investigations.  If we publicize the exact method used to rule in or out whether a user is the secret sockpuppet of another, it would become simple for someone to create a sockpuppet account that would evade detection.  Wikidemo (talk) 09:38, 25 November 2007 (UTC)

text: Father Goose, this isn't about Durova except that Durova's episode pointed to the need for this proposal. Wikidemo is correct that confidential investigations take place routinely. We can pretend otherwise but it doesn't change that fact. What has happened should scream for the need for guidance. Whether this proposal is the right one I don't know. I think we are headed in a good direction. But as for me, I would prefer to be proactive rather than deluding myself into thinking this won't happen again just because we say so. There is nothing inherently wrong with confidentially studying editing patterns and commonalities to discover the troublemakers. What is wrong is willfully allowing these most recent events, with all the accompanying protestations, to occur and then doing absolutly nothing to prevent it in the future. I'd hope you would reconsider and help us draft a policy that contributes to the growth of Wikipedia. JodyB talk 11:54, 25 November 2007 (UTC)
replies: text:  "...is there some kind of destructive behavior that is somehow unidentifiable or irreversible unless secret techniques are used..." if you allow that secret means "using knowledge that is not going to be explained publicly" then completely and utterly yes. I can confirm this, as can several others. There are indeed a number of destructive sneaky vandals and sock users, who are exceptionally damaging, and who would quickly swap one kind of highly damaging sneaky vandalism for another kind, or act to make their identification harder, if they were advised how their edits were to be identified. FT2 (Talk | email) 13:21, 25 November 2007 (UTC)
replies: text: Now that the RfC and arbitration case are under way, I am satisfied that these specific troubling uses of confidentiality are being questioned on a broad scale.  The earliest versions of this proposal contained the assumption that such uses were acceptible.  It appears that the community at large does not share this assumption.--Father Goose (talk) 21:01, 26 November 2007 (UTC)
thread_title:  Please convince me that this is right 

message: I fully support this proposal (that is the first version), and had recently considered initiating something like this myself. However, I am still a little uncertain of the concerns that users with second or multiple accounts would be gaining material potentially damaging to the project by the mere revealing of evidence because such evidence would enable them better to create a secret second account. I am quite naive as regards the damaging effects of users with second or multiple accounts, though my assumption is that this relates to block voting in order to push a certain point of view. My feeling is that if discussions on Wiki are locked into knowledge, reason and experience rather than tally counting, then we have less reason to fear users with multiple accounts. If a view presented in a discussion makes sense then it would make sense regardless of who presented the information, and that view doesn't get better or worse for being repeated. If a view presented in a discussion doesn't make sense or is harmful, then that view doesn't become less harmful by being reiterated by a handful of different accounts - regardless of who is behind the accounts. I am wondering, perhaps, if we didn't hand out guns then we wouldn't need to hand out bullet proof jackets and bandages. I'd like to see some tightening up of conclusions and decisions reached in discussions so that the incentive to create secret secondary accounts is lessened.  SilkTork *SilkyTalk 10:25, 25 November 2007 (UTC)
replies: text: Voting irregularity is only one of many possible problems arising from abusive sockpuppet accounts.  Please take a look at WP:SOCK and related pages for some others - disruptive editing while avoiding the consequences, gaming article edits, stirring up trouble by trolling, hiding COI editing, etc.  Wikidemo (talk) 12:12, 25 November 2007 (UTC)
thread_title:  Would [[Secure by design]] prevent harm from block voting? 

message: Eh? No. So I've marked rejected for now. If you'd like people to look at it seriously, leave off the tags. :-)
In other news, people think secret evidence is allowed at any time? Well, just don't try to use secret evidence while I'm around... grrr! --Kim Bruning (talk) 01:43, 26 November 2007 (UTC)
replies: text: I'm not sure there's any consensus here, much less to accept or reject. I'm removing the rejected tags. --Bfigura (talk) 01:47, 26 November 2007 (UTC)
replies: text:  For proposals: no consensus == reject.(and the odds of getting a consensus via the proposal method are astronomical). --Kim Bruning (talk) 02:09, 26 November 2007 (UTC)
replies: text: I'd say it is more accurate to describe this as a set of related ideas than a proposal at this time.  Marking as a proposal is more accurate than marking as rejected; marking as "several brainstormed drafts that may become a proposal" would be even better.  Do we have a template tag for that?  GRBerry 04:03, 27 November 2007 (UTC)
replies: text: There is now. =] Feel free to modify it as appropriate. — xDanielx T/C\R 09:50, 28 November 2007 (UTC)
thread_title:  Proposed? 

message: :
(This summarises the process. No need to duplicate explanation and see also's etc)
--Review--
A user who wishes to take action or make a claim, to be justified in part or whole by information that will not be released to public scrutiny, must seek review from one or more reviewers of their choice before doing so, and disclose immediately the action is taken. Valid reviewers for this policy are: 
:Any arbcom member (or arbcom itself), any person with oversight privilege, and (for matters where oversight, office and similar privacy concerns are not an issue) any bureaucrat.
Reviewers must not have a prior involvement in the issue or a connected issue, or prior history with the user against whom action is proposed. Any reviewer who becomes aware they may face a conflict of interest must recuse. 
--Process--
:* A user who may wish to take action to be justified in part or whole by information they are not prepared to release publicly, must not rely upon confidential information to support their decision, until they have approval of a reviewer to do so.
:* The user emails a reviewer of their choice with the evidence and (relevant parts of) the proposed case, and proposed action(s), and discusses the matter until the reviewer is able to give an opinion whether the information the user wishes to treat confidentially supports the points and action(s) the user wishes to draw from it. An above average certainty should be expected.
:*  The reviewer sends the user a formal review of the case, as follows:
:::
Thoughts on this one? FT2 (Talk | email) 05:22, 26 November 2007 (UTC)
replies: text: Don't we need to specify that the block is placed by a reviewer and that the person assembling the evidence along with the reviewer are named in the block announcement? JodyB talk 17:27, 26 November 2007 (UTC)
replies: text: On reflection whats missing is a "this is the proposed sort of sanction" and the reviewer's comment on if it's okay or (if not) what would be. Provided the user doesn't get to choose an arbitrary sanction, that process is better. Policy proposal updated x 2. Nice "catch". FT2 (Talk | email) 08:18, 27 November 2007 (UTC)

text: Looks plausible.  To Miscellaneous point #1 I'd add that later reviewers should receive a copy of the prior review.  For requests prior to receipt, disclosure is sufficient, if feedback has been received then that feedback is also important for later reviewers.  GRBerry 03:59, 27 November 2007 (UTC)
replies: text:  Shouldn't be needed. Suppose the user wants independent advice? The 2 reviewers (or the later one at least) knows of the other and has permission to discuss with them if they wish, without needing to ask# further. That should cover it, if they want to ask what advice was given, or confer, for example. FT2 (Talk | email) 08:21, 27 November 2007 (UTC)
replies: text: In light of recent developments elsewhere, I wonder if it might be possible to add a clause to the effect that reviewers could include "any other person (not including admins) who are viewed as being knowledgable about either the procedures involved, or, less favored but still acceptable, the history of the content in question." I add this clause because it could be possible that for one or the other criteria selected above, it might be the case that the uninvolved party who would be possibly the first choice as a reviewer might be someone like, for instance, User:Yomangani, who seems to be trying to withdraw sysop priveleges, someone who has explicitly chosen not to be an admin but is otherwise trusted anyway, or any number of other reasons. They might be the best potential choices in cases where the actions in question deal with a particular subject, and the person most knowledgable about that subject is highly respected but isn't currently an admin for whatever reason, as an example. The involvement of such an individual generally shouldn't be seen as meaning an admin or two shouldn't also be contacted, though. John Carter (talk) 16:09, 27 November 2007 (UTC)
thread_title:  Proposed draft

message: I'm not clear on the exact meaning of the Factual evidence paragraph of the Careful handling and judgment section. Wording: Factual evidence. The matters confidentially disclosed should be factual, based on evidence or strong likelihood, with flaws and questions disclosed as the matter progresses. Is this saying: Factual evidence. Any material that is not presented should be factual, based on evidence or strong likelihood rather than interpretation.? And if so, shouldn't this be saying: Factual evidence. Any material should be factual, based on evidence or strong likelihood rather than interpretation., regardless of the fact that the material is being withheld or presented. Or is the suggestion that speculation is acceptable as long as it is out in the open for people to openly discuss, but when the material is withheld that speculative evidence is not acceptable? SilkTork *SilkyTalk 13:23, 26 November 2007 (UTC)
thread_title:  Factual evidence 

message: This article focuses entirely on Confidential evidence in Wikipedia-related matters. When reading this on WP:CENT, I immediately thought of something else: whistleblowers. People with access to sensitive information they do not want associated with their name, but do want to be available to the public. Usually, these people go to the news media. However, as Wikipedia's name spreads and the number of readers increases, one could very well be contacting a Wikipedia editor in the future. What to do then?
Though the above question is the main question I think this page needs to answer, I want to point out that the above is not entirely distinct from what the page currently answers. Whistleblowing, or, more specifically, the use of confidential sources in the article space, is most likely to occur in Wikipedia-related matters. For example, thinks like the Essjay controversy could very well have presented difficult problems with confidential evidence. User:Krator (t c) 23:21, 26 November 2007 (UTC)
replies: text: I don't see that as being an issue. Wikipedia:Verifiability is a core policy. Unless the material can be attributed to a reliable published source we don't use it - or remove it (oversighting if needed) if it does get put into an article. WP is not a newspaper looking for a scoop - we'd wait for the media to publish the story, and then - if notable enough - we could create a suitably sourced article on the topic. SilkTork *SilkyTalk 08:13, 27 November 2007 (UTC)
thread_title:  For consideration: Sources 

message: Based on a principle coming out of the arbcom case that started all this, I'm wondering if this proposed policy has been made moot. From one of the proposed (and certain to pass) principles:Users are responsible for the editorial and administrative actions they undertake, and must be willing and prepared to discuss the reasons for their actions in a timely manner. If a user feels that they cannot justify their actions in public, they are obliged to refrain from that action altogether or to bring the matter before the Arbitration Committee. This does not apply to users carrying out official tasks as authorized by the Foundation or the Committee (including, but not limited to, CheckUser, OverSight, and OTRS activity)So, is there more to discuss here? In my reading, the arbcom ruling would seem to state that confidential evidence must go through arbcom (barring checkuser / oversight). Thought / criticisms / beatings? :) --Bfigura (talk) 03:34, 28 November 2007 (UTC)
replies: text: I think it's a wonderfully calm, even-handed decision.  I am a little useasy that they have in effect legislated policy in a way that trumps consensus, although the outcome itself is cleaner and a lot simpler than we could have reached here.  So I'll make the proposal, below.  Wikidemo (talk) 10:48, 28 November 2007 (UTC)
replies: text: It's difficult to predict the future, but fairly or unfairly arbcom is already under a cloud in the whole affair due to so far unsubstantiated insinuations from the blocking admin that arbs had supported the action before it was taken.  There is no reason at all anymore maintain any secrecy about this affair except to protect those involved in the whole hair-brained scheme from accountability, and the silence is further corroding the relationship between admins and nonadmins.  One of the consequences of these "secret" doings is the erosion of confidence in arbcom.  With this kind of trust must come full accountability, but there's understandable reluctance to hold admins fully accountable for mishandling that trust. Professor marginalia (talk) 13:11, 28 November 2007 (UTC)
thread_title:  Is this now moot? 

message: I recommend that the primary editors of this proposed policy review the content of WP:PRIVATE, another proposed policy that overlaps this one and provides different instructions for the provision of confidential information to the Arbcom.  I suggest that consideration be given to a single policy, if a policy is required at all.  Risker 23:25, 3 December 2007 (UTC)
replies: text: Makes good sense. At the moment we're figuring out this one aspect -- would it be sensible to defer a merge until we see how it works out? FT2 (Talk | email) 03:21, 6 December 2007 (UTC)
thread_title:  You need to be aware of [[WP:PRIVATE]] 

message: As an occasional editor who just happens to have filled a spare hour starting at the history of Wikipedia and reading up on the Durova/!! fiasco before ending up here, I'd like to support FatherGoose, JavaTenor and Bstone with a simple plea: remember the cost-benefit analysis of what you're proposing. The potential damage caused by instituting a policy which fundamentally undermines your entire principle of openness is surely greater than the potential damage caused by "disclosing investigative techniques or raw results [which] might give [bad actors] an unacceptable level of insight into how to circumvent detection". As a completely archetypal joe average Wikipedian with little to no knowledge of internal processes, arbitration, etc., I am unconvinced by this debate that there is any reason at all to allow users to be blocked without the evidence against them being made public. I know Wikipedia is not a democracy, and that's fine - as long as the actions of the undemocratic cabal can be clearly and openly scrutinised, by anyone. Magnate (talk) 15:03, 7 December 2007 (UTC)
replies: text: For an occasional editor, you are fairly insightful, Magnate. --Kim Bruning (talk) 01:47, 8 December 2007 (UTC)
thread_title:  View from the plebs 

message: Neither here nor at WP:Private correspondence have I seen any discussion of principles of natural justice (maybe I haven't read closely enough). It appears to me to be relevant to thinking on this issue. Paul foord (talk) 15:05, 27 December 2007 (UTC)
replies: text: I didn't say it in as many words, but I do believe that the idea of allowing confidential evidence flies in the face of the modern principles of justice.  Wikipedia is obviously not a courtroom, but I do believe many of those concepts do apply to our dispute resolution process.  It's one thing to keep personal information (i.e. names, contact information, etc.) out of it, but a person accused should have the right to view and respond to the evidence against them.  WP:BEANS just isn't a good enough justification. Sχeptomaniacχαιρετε 00:03, 4 January 2008 (UTC)
thread_title:  Natural justice considerations