Trust and Safety Product/IP Info/Updates
: Functionality changes and graduating the feature out of beta
editIP info became available on all wikis as a beta feature in 2022. Since then, it has gone through a lot of changes:
- Spur as an additional data source. Initially, data about IP addresses was mostly coming from Maxmind, and was supplemented by our own on-wiki data. In the previous update from May 2022, we mentioned that we were contacting Spur, another source of information about IP addresses. Since then, we have integrated their data into IP Info, and currently, our feature uses Maxmind, Spur, and on-wiki information. For a detailed description on what data comes from which source, see T341395.
- A lot of development was part of our broader work on temporary accounts (T340895). Here is an overview of the most important changes:
- Full or no information. There have been two levels of access to the IP Info data: Basic and Advanced. We have decided to align this with the settings making it possible for experienced users to see IP addresses of temporary accounts. Everyone meeting the requirements defined in the Access to Temporary Account IP Addresses Policy will have full access to the IP Info data, and those not meeting the requirements will simply not have access to IP info. (T375086)
- Special:IPInfo. Many IP addresses may be associated with a given temporary account. We are building a new special page to address this. It will show tabulated IP data for a temporary user where each row will display information for an IP address. This page will be linked from the the Contributions page. (T349534)
- IP Info on Special:Contributions for temporary accounts. When viewing Special:Contributions for a temporary account, users with access to IP Info data will have information about the IP address used most recently by the temporary account. (T349715)
- The IP Info popup is displayed next to IP addresses. On wikis with temporary accounts enabled, the IP Info popup will be displayed also next to temporary account names. (T349716) In the popup, a help link will be displayed to help users understand better what the feature is and what it offers exactly. Most likely, the project page will be linked there. (T375090)
- Graduating out of beta. We no longer need to keep IP Info as a beta feature and have decided to make it a regular part of the interface. It will be useful for all logged-in users checking IP address data to moderate and maintain the wiki. (T356660)
Older updates
edit
Today, IP Info feature has been deployed to all wikis as a Beta Feature.
After our initial run on testwiki we received a good amount of feedback. I will summarize the key pieces below:
- The biggest and most important feedback was about the data quality of MaxMind. MaxMind's data quality, especially about proxy data, is not great. We have reached out to Maxmind about this and are also actively talking to Spur to get their data feed. Once we are able to obtain Spur's data feed we will be able to integrate it into the feature and show information from multiple data sources.
- We heard about the interface being unclear about what information is available and what isn't. We are working on improving the labels and providing better guidance about the information displayed.
- We heard a request about expanding the tool to include global information and also include information about IPs that have not made any edits on the given wiki. We will be looking more into both of these requests. We have done some prior investigation into showing global information.
We would love to hear more comments. Please leave them as you use the tool. Your opinions will help improve it.
The IP Info feature has now been deployed to testwiki as a Beta Feature. The plan is to run initial testing on testwiki until mid-April after which, if we don’t discover any major issues, the feature will be available on all projects. It will continue to be in the Beta Feature phase.
Below are some key things to note as you try out the tool.
Basic versus Advanced information
There are two levels of access to IP information. Users with Autoconfirmed will be able to access the Basic information. Users with advanced privileges (admin, sysop, bureaucrat, checkuser) will be able to access the Advanced information. Advanced information includes City, State, ISP, Organization + Basic. Everything else displayed in the above screenshot will be available in Basic.
If you want to try the advanced information mode on testwiki, please request for temporary admin privileges on the discussion page.
Access
In order to activate IP Info the user will need to agree to a disclaimer stating that this information is being accessed for anti-vandalism purposes only. Once activated, the user will be able to access both the IP Info popup (on log, history and recent changes pages) and the IP Info infobox (on contributions page). There will be a log to keep track of how IP information is being accessed. This is purely for Legal purposes. Only WMF Trust & Safety staff will have access to this log for the time being.
Popup & Infobox
There are two places to access this information: the popup and the infobox. The popup is intended to be a quick way to access specific IP details which can help while patrolling on the recent changes, log or history pages. The full infobox will be available on Special:Contributions. Clicking on the popup will lead to the infobox.
Feedback
When the tool is available on all projects there will be a link to provide feedback directly through the feature itself. This will allow for structured feedback to be collected in multiple languages. In the meantime, please reach out to us on the talk page and provide feedback.
We want to hear from you about:
- What did you like about this tool?
- What did you find confusing or missing?
- How else can we improve this feature?
Future
There are a couple of potential future feature improvements that we have in mind:
- Identifying and incorporating new streams of information into the feature. This can include sources like Spur that we have discussed in the past. This will also help us get better coverage for IPs in different parts of the world.
- Bringing this information into CheckUser. Checkusers will benefit from having this key information at their fingertips.
We don’t have a firm timeline for when we will be working on these. We want to ensure the tool is useful in its current state before adding new features. Our top priority is to build a feature that patrollers across different projects use and find helpful.
The Anti-Harassment Tools team has recently wrapped up its work on delivering key changes to SecurePoll and assisting with the Wikimedia Foundation Board of Trustees elections 2021. We are back to working on IP Info and hopefully this page will see many more updates in the near future. Since we were gone, here's the big updates on this project:
- We received MaxMind access. It took longer than anticipated but we finally have access to all the key data we needed.
- We are currently working on delivering on the mocks we referred to in our last update. One key addition to the data has been the inclusion of a data point indicating whether the IP address is v4 or v6.
IP Info product development is well underway. We wanted to take this opportunity to tell you about where we are at and get your feedback on the direction.
- User interviews & task model
We conducted user interviews to understand how editors currently patrol IPs. This gave us a rough understanding of the IP patrolling process, information required and tools used. Based on this research we came up with a model of how the task of IP patrolling is usually conducted. After a few rounds of feedback from design, engineers, research and T&S folks here is what we came up with:
As we understand it now, the IP patrolling process usually starts from RecentChanges, an editor’s Watchlist or from a page that the editor knows gets vandalized often. When looking at the edits of such a page the patroller first looks for clear red flags like edit flooding, lack of edit summary, large deletions etc. They then look for more specific on-wiki information like if the IP has a talk page, if it has ever been blocked in the past, its global and local contributions, and in the case of English Wikipedia, if there is a mention of the IP on the LTA page.
Based on this initial research they decide if an IP is worth looking into further. If it is, they use external tools to find more information about the IP, like: location, proxy usage and organization that the IP might be linked to. This process is not completely accurate since different databases have different information on the same IP. Oftentimes, based on the location of the IP and the location of the IP tool, the information given might be very different.
Finally, based on the information collected they decide which action would be most appropriate. Again, this decision takes into account various factors like the policies of that wiki, the scale of the collateral damage caused by a range block, consistency in editing patterns etc.
- Mock-ups
Based on feedback from the first round of user interviews, we have settled on the following product approach.
-
Popup shown on IP addresses, showing on-wiki information about the IP. -
Accordion box on top of Special:Contributions that shows both IP and on-wiki information.
| IP Info | Minimum required user right |
|---|---|
| Location | Admin / CheckUser |
| ISP/Domain | Admin / CheckUser |
| ASN | Admin / CheckUser |
| Organization | Admin / CheckUser |
| Connection type | Autoconfirmed |
| User type | Autoconfirmed |
| Proxy info | Autoconfirmed |
| Static / Dynamic | Autoconfirmed |
| Number of users on IP | Autoconfirmed |
Since the patrollers need on-wiki information about the IP before they decide to investigate it we are going to add a popup that shows block and contribution information. The popup would be accessible by clicking an information icon next to the IP address on pages like RecentChanges, Watchlist and History.
If the patroller decides to dig deeper into an IP address by going to their Contributions page, they'll be able to see a collapsible box that shows more IP related information.
- Access to information and risk to anonymous editors
By making the IP information so readily available we hope to remove some of the barriers that our non-technical patrollers might be facing in reliably getting this information. At the same time, we hope this streamlines the process for users who are currently relying on external tools. We also recognize that easy access to this information might be putting our anonymous editors at risk, especially because some of the IP information, like location and organization, can easily help in identifying a person.
We need to balance the concerns of ease of use and risk to anonymous editors. To do this we plotted the different pieces of IP information on a graph with Risk on the Y axis and Usefulness to patrolling on the X axis:
This exercise wasn't completely scientific and was based on the learnings from research and estimates of the team (please see the questions below if you'd like to contribute). Two possible clusters appeared, the high risk one mostly containing information that could reveal an editor’s location.
We are planning to show all on-wiki information to all editors that are auto-confirmed and above. Auto-confirmed and above editors will also have access to IP information that doesn't reveal possibly personal information about anonymous editors. This would include things like proxy and static/dynamic-ness of the IP. Finally, Admins and Checkusers will have access to more IP information like location, organization and domain.
- Questions
- Is there any other information you look at before deciding to investigate an IP?
- When investigating an IP what kinds of information do you look for? Which page are you likely on when looking for this information?
- What kinds of IP information do you find most useful?
- What kinds of IP information when shared, do you think could put our anonymous editors at risk?
The project is currently under backend development as we are looking into sources to pull IP Information from and what kind of information we should display and to whom.
Here's a tentative mockup for the feature. We are currently planning to place the information box containing IP address information on the Contributions page of the IP address. We are also planning to break down the information that's visible to the users based on their permissions. All autoconfirmed users and above would be able to access this. This would mean more sensitive information would be accessible to users with advanced permissions like Admins, Checkusers etc.
As you look at this mockup, I'd invite you to think about the following:
- When do you seek more information about IP addresses?
- What information is important for you to know?
- Where do you need to see this information?
- How do you use this information? What actions do you take based on this information?
Please leave your thoughts on the talk page. It will be very valuable as we plan our work.
- We have done an initial technical investigation into this project. Follow along on phab:T248525.
- We are currently looking into the various services that provide information about IP addresses. Follow along on phab:T251933.