Bbb23 chastised by Arbcom, quits Wikipedia (on April Fool's Day)

[Vigilant]

You guys are approaching the Giraffe Stapler Event Horizon.

[Poetlister]

"Did you use the checkuser tool against policy?"

"Son, we live in a world that has walls. And those walls have to be guarded by men with guns. Who's gonna do it? You? I have a greater responsibility than you can possibly fathom. You weep for these sockpuppets and you curse the checkusers. You have that luxury. You have the luxury of not knowing what I know: that these policy-violating checkuser actions, while unfortunate, probably saved the encyclopedia. And my existence, while grotesque and incomprehensible to you, saves the encyclopedia. You don't want the truth. Because deep down, in places you don't talk about at parties, you want me on that wall. You need me there."

"I have neither the time nor the inclination to explain myself to a man who edits under the blanket of the very freedom from sockpuppets that I provide and then questions the manner in which I provide it."

[Sendo]

I used to think that Beyond My Ken is a sensible human and I felt bad for him when I read his story, this SPI archive and how his wiki career was almost terminated because of CU checks.

Looks like his account got hacked, I think it's worth checking. Our fishing-loving CU is now temporarily "retired" so the remaining sensible CUs may hesitate to check; but an otherwise sensible account going bonkers like this is a valid reason for check IMO.

[Starke Hathaway]

Petition to change BMK from "Beyond My Ken" to "Big Mad, Kiddo."

[Osborne]

I used to think that Beyond My Ken is a sensible human and I felt bad for him when I read his story, this SPI archive and how his wiki career was almost terminated because of CU checks.

That's interesting, the 2 accounts in the SPI are wiped clean:
H Debussy-Jones
Ed Fitzgerald
Were these renamed to the admitted sock accounts?
Before_My_Ken (T-C-L)
Between_My_Ken (T-C-L)

[No Ledge]

Yes.

Before: link

Between: link

[Pudeo]

That's interesting, the 2 accounts in the SPI are wiped clean:
H Debussy-Jones
Ed Fitzgerald
Were these renamed to the admitted sock accounts?
Before_My_Ken (T-C-L)
Between_My_Ken (T-C-L)

Exactly so. And his block for socking was overturned in this AN thread, because the editing did not overlap even if he got several blocks with one alt-account:
Wikipedia:Administrators'_noticeboard/Archive208#Ed_Fitzgerald_and_his_sockpuppets (T-H-L)

The account "Ed Fitzgerald" or "Before My Ken" has that block log, so he has 13 blocks for edit-warring in total.

[DexterPointy]

2 quick lookups
- 1'st for User:Ed Fitzgerald
- 2'nd for User:H Debussy-Jones
The 2'nd one is really weird, because "H Debussy-Jones" was renamed to "Between My Ken" on 21.Sep.2011, but then on 21.Jan.2012 (4 months later), the "H Debussy-Jones" account was created. Maybe it's simply because the WP-platform is so fucking stupid as to use UserNames as UserIDs, and allow recycling them. (Grief: Not allowing for people to delete their accounts, claiming it's important for revision/audit/tracing-history, all while not technically preventing one person from taking over another persons persona, though such a renaming loophole)

[No Ledge]

Something curious just happened. Just minutes after my post here, I started getting "database errors" upon trying to view any version of Egerton Ryerson (T-H-L) other than the current version.

Hey, the history of that bio is working again; I guess we just write that off as a coincidental momentary glitch in the software.

So I believe this explains that. A Wikidata "virus" infected the main 'pedia but its immune system fended it off after about 20 minutes. When you allow live data into your wet knowledge market, you're taking the risk of these sorts of infections transferring from the data to your 'pedia occasionally. I apologise if anyone saw me miscasting aspersions earlier.

[Poetlister]

The 2'nd one is really weird, because "H Debussy-Jones" was renamed to "Between My Ken" on 21.Sep.2011, but then on 21.Jan.2012 (4 months later), the "H Debussy-Jones" account was created. Maybe it's simply because the WP-platform is so fucking stupid as to use UserNames as UserIDs, and allow recycling them. (Grief: Not allowing for people to delete their accounts, claiming it's important for revision/audit/tracing-history, all while not technically preventing one person from taking over another persons persona, though such a renaming loophole)

There used to be a thing called usurpation, where you could ask for an account with a name you wanted to be renamed so you could use tha name. I don't know if that's still allowed.

[DexterPointy]

Well, the 21.Jan.2012 created "H Debussy-Jones" account, has never been used for anything at all, so one guess might be that BMK did that account-creation to prevent it from ever be re-animated & used by anyone else.

[Giraffe Stapler]

Well, the 21.Jan.2012 created "H Debussy-Jones" account, has never been used for anything at all, so one guess might be that BMK did that account-creation to prevent it from ever be re-animated & used by anyone else.

Never been used at all except for 2,078 edits.

[Osborne]

Well, the 21.Jan.2012 created "H Debussy-Jones" account, has never been used for anything at all, so one guess might be that BMK did that account-creation to prevent it from ever be re-animated & used by anyone else.

Never been used at all except for 2,078 edits.

That was the previous account with the same name, which got renamed.

[Giraffe Stapler]

Well, the 21.Jan.2012 created "H Debussy-Jones" account, has never been used for anything at all, so one guess might be that BMK did that account-creation to prevent it from ever be re-animated & used by anyone else.

Never been used at all except for 2,078 edits.

That was the previous account with the same name, which got renamed.

Ah, you're right. "Created automatically" in 2012. Perhaps as a result of the project to make user names globally managed?

[Poetlister]

It was originally created on Meta on 11 November 2009 and made one edit. It subsequently turned up on various wikis, but has only edited on EN WQ (two edits). link As the original account on EN WP was created on 10 November 2009, it's presumably the same person and only had a local rename on EN WP rather than the global rename it should have had.

[Osborne]

it's presumably the same person and only had a local rename on EN WP rather than the global rename it should have had.

Ah, that explains the "Created automatically" comment.
Back then was it common to do local renames?

[Death To Wikipedia]

Well, nothing illustrates how fucked up Wikipedia is, how in need of complete and total annihilation as an experiment gone wrong, than this sorry episode.

To summarise:

• It was an open secret among the Wikipedia community, including the higher ups with the power and privileges to prevent abuse, that Bbb23 was playing fast and loose with people's private data, and that whenever he was challenged, he would simply brush people off, sometimes very aggressively, evidently confident his standing in the community and hiding behind the very rules he was breaking would protect him. And yet even then, even then with that as the widely known situation of the state of rot in Denmark, it took multiple complaints to the Arbitration Committee from people with presumably no power or privileges but still presumably in possession of hard evidence of abuse, before anyone even conducted a formal investigation to establish the sheer depth and breadth of his violations.
  
  It was a serious breach of policy - Wikipedia only has a handful of serious polices, stuff that has legal implications, handling private data being one of them - and yet despite the fact it was clearly a case of habitual and deliberate offending after clear warnings as regards the limits of CheckUser's discretion, and despite the fact the offender disputed the charges entirely, even after "extended discussion" with ArbCom as to exactly how and why they reached their conclusions, he has not been stripped of his ability to use the tool, nor has he been banned. In context, to call the actual outcome a wrist slap is an insult to the dedicated work of the Department of Wrist Slaps.
  
  What he was doing was so serious, so out of step with the usual level of bending the rules for the greater good that is so often seen in the dark corners of the community where the privilege of making decisions based on confidential information is seen as a means of exerting power and control rather than a huge responsibility with real world consequences, that the entirety of his colleagues in the secret CheckUser bunker, admitted they would not have performed the sort of checks he was performing. And yet not one has been asked to publicly explain, much less been publicly censured for, apparently not performing their primary responsibility - monitoring and reporting their colleagues. We peons are told this happens all the time and we should just trust them, and yet here we are, with the best proof there could have ever been, that it never really happens at all, or if it does, they're doing it wrong.
  
  Little actual detail of Bbb23's serious crimes have been released, and indeed if it were not for his giant ego, if this matter has been dealt with the way ArbCom thought was appropriate, nobody would have known anything about it. And other than the fact he was routinely colouring outside the lines, we still know virtually nothing. Was he routinely falsifying logs, in the hopes his level of trust among his colleagues would hide the scale and severity of his abuse? Or were his colleagues guilty of routinely allowing Bbb23 to get away with not properly justifying each of his checks in the logs? Since it is clear he was not exploiting any known loophole, since it is clear he was simply ignoring policy and being allowed to do it, what was the precise means by which he got away with it? How many of these checks were done off his own back, and how many were for example, requested by friends, friends whose own experience with policy would have surely told them the checks they were requesting were against policy. Was there a pattern, was Bbb23 the goto guy for certain users, users who are perhaps guilty of serious abuses of their own in their use of other privileges? We were not even told how far back the investigation went, and therefore how many abusive checks he might have ran (the nature of this violation of policy being that it is entirely irrelevant whether the checks successfully identified socking or not). The anonymous "Bbb23" is the only known perpetrator or indeed victim in this scandal, and there will seemingly be no follow up, no further investigation, much less any attempt at rectification, even though it is known that the supposed sanctity and infallibility of their CheckUser system is often used by assorted Wikipediaprats as justification for gross breaches of the BLP policy.
  
  Even if we assume good faith that the only thing certain Wikipediaprats knew about the incident was Bbb23's explanation, namely he had been mildly censured for "using my CU privileges in ways that violate policy", they still automatically assumed that he was right, that ArbCom was wrong, and they should be strung up for costing Wikipedia a person whose use of the CheckUser tool was "beyond amazing". ArbCom is a committee of fifteen people elected by the community, CheckUsers are appointed and overseen by that very same committee, and we have not been shown any proof they have discharged their duties incorrectly here, only that they have been late and likely ineffective in how they have done it. To call these protestors traitors to Wikipedia, is an understatement. And yet they face no action, aside from a few wounded comments, ArbCom puts up with their every brickbat, their every tantrum, until it essentially bends over and asks, how hard and for how long would you fine folk like to abuse us? We are at your service, our dear sweet princes. The one time anyone evidently has genuine protected Free Speech on Wikipedia, is for the hurling of ill-informed personal abuse and general spouting of revolutionary hate speech toward the one, indeed the only, example of democratically elected functionaries in their otherwise highly undemocratic community.
  
  The real world identity of Bbb23 is known to the Foundation, and his abuses of policy, pending concrete detail to the contrary from those who investigated it, seem likely to have been illegal acts under the law of California. And yet we have heard nothing in terms of police reports being filed, either from the individuals of ArbCom, or any corporate officer. We do not even know if ArbCom has informed anyone at the Foundation as to the nature of these abuses, even though presumably it is policy that they do so if they reasonably believe a policy with legal implications has been breached in a serious and long term fashion.
  
  Where potential for policy improvements have been identified in this debacle, most notably the fact it might be a good idea that a CheckUser logs the origin of a check (self, private request, SPI) at the same time as they (supposedly) outline their clear and detailed justification for the check, nobody on the Arbitration Committee has taken responsibility for driving that forward.
  
  There are a number of Wikipediaprats who seem to hold the view that this was no big deal, that even if this is technically against policy, it's a crime that is necessary to protect Wikipedia, and as such, Bbb23 should be celebrated and rewarded, not sanctioned or shunned. There has been little to no effort from Wikipedia functionaries to push back against these views and put what he has done into perspective; these people, despite surely knowing better unless their community granted qualifications and level of trust to do and say the right thing is meaningless, seem to treat this as if it were a perfectly legitimate debating point, no different to say, allowing their people to tell vandals to fuck off, and indeed quite a number of functionaries actually seem to actually hold this view themselves, which perhaps explains just why it took so long for these crimes to be uncovered.

It says a lot about the nature of Wikipedia, specifically how seriously they take their legal responsibilities as well as how they self-regulate, that there has been a fraction of the amount of detail released and debated over this issue, than any of the relative trivialities they usually deal in even at this highest level of inquiry. It is unsurprising therefore, and perhaps entirely deliberate, that the outside world, specifically the lecturers and legislators the community is cosying up to in some desperate attempt to reassure the world they're a grown up project with serious people, will never even hear of this scandal, much less appreciate the implications for themselves or society, should they be so stupid as to "collaborate" with them, to legitimize them.

Death To Wikipedia.

[No Ledge]

What California law do you think may have been broken, what does that law specifically say (a hyperlink to the code would be nice), and how do you think it may have been broken?

[Giraffe Stapler]

You are very wordy.

[MrErnie]

Welcome back Crow! I would recognize those commas anywhere.

[Death To Wikipedia]

What California law do you think may have been broken, what does that law specifically say (a hyperlink to the code would be nice), and how do you think it may have been broken?

I'm gonna say this one....BPC22576.

http://leginfo.legislature.ca.gov/faces ... nNum=22576

In short, Wikipedia has a published privacy policy, it dictates how and when CheckUsers may access personally identifying information, and if all the facts were known, I should think it obvious it could be proven that their failure to ensure Bbb23 stuck to the policy, was the result of negligence and had material harm. Shit, publish a few select emails from his buddies, I bet you could even prove it was "knowingly and willfully".

Dude is a straight up fucking criminal, they know what he did, they know his details, they won't release his details to us as concerned citizens, which makes them accessories after the fact, under Penal Code 32PC.

[Vigilant]

Welcome back Crow! I would recognize those commas anywhere.

Good to see you back.

[Midsize Jake]

Welcome back Crow! I would recognize those commas anywhere.

Good to see you back.

I figured we'd use the same protocol as the last time, since you and I have been the main targets over the past few months and neither of us is particularly thin-skinned. (At least I'd like to think so, anyway...)

Still, I wish he'd use a VPN or some other form of proxy, at least when registering, so I'd have a better excuse for denying the registration attempt at the outset. I mean, I've got the mouse poised over the "Activate" button, and I'm like, "I know who this is, what the fuck am I doing, jeez what the fuck, who really knows, there are 270,000 people in that city," *click.* Not really an ideal situation.

[Poetlister]

Surely nobody wants this site to become boring. Crow is always good for a laugh, so let's welcome him.

[No Ledge]

So [hyperlink]https://foundation.wikimedia.org/wiki/P ... icy,Here's the privacy policy[/hyperlink]

Be aware: Our community of volunteer editors and contributors is a self-policing body. Certain administrators of the Wikimedia Sites, who are chosen by the community, use tools that grant them limited access to nonpublic information about recent contributions so they may protect the Wikimedia Sites and enforce policies.

To Protect You, Ourselves & Others We, or particular users with certain administrative rights as described below, may need to share your Personal Information if it is reasonably believed to be necessary to enforce or investigate potential violations of our Terms of Use, this Privacy Policy, or any Wikimedia Foundation or user community-based policies.

Wikimedia Sites are collaborative, with users writing most of the policies and selecting from amongst themselves people to hold certain administrative rights. These rights may include access to limited amounts of otherwise nonpublic information about recent contributions and activity by other users. They use this access to help protect against vandalism and abuse, fight harassment of other users, and generally try to minimize disruptive behavior on the Wikimedia Sites. These various user-selected administrative groups have their own privacy and confidentiality guidelines, but all such groups are supposed to agree to follow our Access to Nonpublic Information Policy. These user-selected administrative groups are accountable to other users through checks and balances: users are selected through a community-driven process and overseen by their peers through a logged history of their actions. However, the legal names of these users are not known to the Wikimedia Foundation.

They claim not to know who Bbb23 is.

[tarantino]

Welcome back Crow! I would recognize those commas anywhere.

Good to see you back.

I figured we'd use the same protocol as the last time, since you and I have been the main targets over the past few months and neither of us is particularly thin-skinned. (At least I'd like to think so, anyway...)

Still, I wish he'd use a VPN or some other form of proxy, at least when registering, so I'd have a better excuse for denying the registration attempt at the outset. I mean, I've got the mouse poised over the "Activate" button, and I'm like, "I know who this is, what the fuck am I doing, jeez what the fuck, who really knows, there are 270,000 people in that city," *click.* Not really an ideal situation.

Is this his fourth or fifth account here? He's catching up with Poetlister.

[Dysklyver]

I for one always enjoy his posts.

[Osborne]

So Here's the privacy policy

... These various user-selected administrative groups have their own privacy and confidentiality guidelines, but all such groups are supposed to agree to follow our Access to Nonpublic Information Policy.

They claim not to know who Bbb23 is.

They have to sign the "Access to Nonpublic Information Policy" (well... digitally) and also identify to the WMF with some official ID, so as far as the WMF is concerned they know the CUs' identity, although that might be a simple photo of some ID card submitted in an email that nobody verifies.

I for one always enjoy his posts.

Yea, within limits I find it entertaining too.

[DHeyward]

What California law do you think may have been broken, what does that law specifically say (a hyperlink to the code would be nice), and how do you think it may have been broken?

I'm gonna say this one....BPC22576.

http://leginfo.legislature.ca.gov/faces ... nNum=22576

In short, Wikipedia has a published privacy policy, it dictates how and when CheckUsers may access personally identifying information, and if all the facts were known, I should think it obvious it could be proven that their failure to ensure Bbb23 stuck to the policy, was the result of negligence and had material harm. Shit, publish a few select emails from his buddies, I bet you could even prove it was "knowingly and willfully".

Dude is a straight up fucking criminal, they know what he did, they know his details, they won't release his details to us as concerned citizens, which makes them accessories after the fact, under Penal Code 32PC.

Not a lawyer but I don't see any of the information checkuser collects in the statute that defines "personally identifiable information." As far as I know chuser doesn't provide the name, address, phone number, email address, SSN or any information that would allow that individual to be contacted. IP address, browser and version aren't listed. Can a checkuser see the email address provided for registered accounts? That seems to be the only information that law protects that Wikipedia collects. They seem to take precautions to guard it as well.

http://leginfo.legislature.ca.gov/faces ... awCode=BPC

[Poetlister]

So Here's the privacy policy

... These various user-selected administrative groups have their own privacy and confidentiality guidelines, but all such groups are supposed to agree to follow our Access to Nonpublic Information Policy.

They claim not to know who Bbb23 is.

They have to sign the "Access to Nonpublic Information Policy" (well... digitally) and also identify to the WMF with some official ID, so as far as the WMF is concerned they know the CUs' identity, although that might be a simple photo of some ID card submitted in an email that nobody verifies.

They used to have a policy that they looked at the ID and then destroyed it, keeping no record of the person's identity. I don't know if that's still the case. Part of the checking is ensuring that people are over 18 or the age of majority in their home country, but of course nothing stops a child from borrowing his father's passport.

[Death To Wikipedia]

Not a lawyer but I don't see any of the information checkuser collects in the statute that defines "personally identifiable information."

http://leginfo.legislature.ca.gov/faces ... awCode=BPC

Well if it isn't defined explicitly, it is in the recently passed Consumer Protection Act, which is broadly similar to the GDPR.

[Giraffe Stapler]

Not a lawyer but I don't see any of the information checkuser collects in the statute that defines "personally identifiable information." As far as I know chuser doesn't provide the name, address, phone number, email address, SSN or any information that would allow that individual to be contacted. IP address, browser and version aren't listed.

Stop being reasonable.

[Randy from Boise]

Welcome back, Crow.

Try to aim the piss stream out of the tent, not inwards.

t

[Poetlister]

Not a lawyer but I don't see any of the information checkuser collects in the statute that defines "personally identifiable information." As far as I know chuser doesn't provide the name, address, phone number, email address, SSN or any information that would allow that individual to be contacted. IP address, browser and version aren't listed. Can a checkuser see the email address provided for registered accounts? That seems to be the only information that law protects that Wikipedia collects. They seem to take precautions to guard it as well.

Quite often, an IP can be identified as belonging to a particular company. Especially if there is other information, that could allow the editor to be identified and contacted.

[Giraffe Stapler]

Not a lawyer but I don't see any of the information checkuser collects in the statute that defines "personally identifiable information." As far as I know chuser doesn't provide the name, address, phone number, email address, SSN or any information that would allow that individual to be contacted. IP address, browser and version aren't listed. Can a checkuser see the email address provided for registered accounts? That seems to be the only information that law protects that Wikipedia collects. They seem to take precautions to guard it as well.

Quite often, an IP can be identified as belonging to a particular company. Especially if there is other information, that could allow the editor to be identified and contacted.

The law pertains to what is collected and stored, not what might be done with IP addresses or any other info offered by the user.

[Poetlister]

Yes, but storing a disclosive IP would presumably be illegal.

[Giraffe Stapler]

Yes, but storing a disclosive IP would presumably be illegal.

Of course it wouldn't. It isn't personally identifying information that has been voluntarily given by a user. It's just an IP address. It is necessarily disclosed as an unavoidable part of the internet protocol in order to access the site.

[Vigilant]

Yes, but storing a disclosive IP would presumably be illegal.

Of course it wouldn't. It isn't personally identifying information that has been voluntarily given by a user. It's just an IP address. It is necessarily disclosed as an unavoidable part of the internet protocol in order to access the site.

Not only that, but I cannot imagine a judicial venue in the US where person voluntarily connected to the website then prevailed in a legal case against the site's owners for mentioning an IP address.

It's ludicrous.

[Beeblebrox]

To address the question asked several posts back: No, CU does not reveal what email address is registered to an account. As far as I am aware the only way any volunteer can see your email address is if you send them an email.

I suppose it's a fair point that you could tie an IP to a company, and an unscrupulous CU could then contact that company and try to report you, which is why they have to sign the agreement. And to be clear, our discussion with Bbb23 was strictly about his use of the tool, and not about revealing or misusing PII.

At my RL job I am subject to a much harsher agreement that ends with me broke and in prison if I break it. Like, if we see a guy pick up a beaker of half-cooked meth and smash it over his wife's head, we can't say anything to anybody, ever, and that's ironclad, we cannot be compelled to testify under any circumstances.

[Death To Wikipedia]

And to be clear, our discussion with Bbb23 was strictly about his use of the tool, and not about revealing or misusing PII.

Come off it. Your discussion with Bbb23 was pretty obviously regarding whether he always had a justifiable reason for viewing user's IP addresses, which if not strictly defined as PII in 2003, has been in the COPA statute, for the very obvious reason that it is information that can be connected to an identifiable person (how much of a ballache it might be to do so is irrelevant to the law). He clearly did not have a justifiable reason, under a published policy written in part with concern for California 2003 privacy law that requires data collectors to have one. And more so, relevant to that law's threshold for criminal behaviour, it was likely persistent, deliberate and malicious, and this was likely common knowledge among those supposedly overseeing the use of the tool, who seemingly did not act upon this knowledge in a timely manner or with sufficient regard to the seriousness of the violation. And moreso, have likely not reported the perpetrator even after they have become aware of their violations and had confirmed what was common knowledge with a well overdue audit and investigation, indeed were evidently of the opinion these matters weren't serious enough to be publicly disclosed at all, despite many in the Wikipedia community having good reason to suspect their personally identifying information has been accessed without justifiable reason by the scumbag who goes by the moniker "Bbb23".

All of the above can be shown in court already using publicly available information, there's unlikely to be anything in your private communications that contradicts it, quite the reverse, so you're all fucked, legally speaking, hence why you don't want anyone knowing who you or "Bbb23" are, legally speaking.

[Beeblebrox]

You need to calm down and think before you speak. Not that I expect that to happen.

By "revealing" I meant revealing PII to persons not permitted to see it, obviously our discussion was about how he was justifying certain checks, that's not any kind of a secret, there's like 50 paragraphs of on-wiki discussion about it.

[Giraffe Stapler]

And to be clear, our discussion with Bbb23 was strictly about his use of the tool, and not about revealing or misusing PII.

Come off it. Your discussion with Bbb23 was pretty obviously regarding whether he always had a justifiable reason for viewing user's IP addresses, which if not strictly defined as PII in 2003, has been in the COPA statute, for the very obvious reason that it is information that can be connected to an identifiable person (how much of a ballache it might be to do so is irrelevant to the law).

I assume when you say "the COPA statute" you aren't talking about COPA but CalOPPA? It really doesn't matter because you are wrong in either case.

[Death To Wikipedia]

You need to calm down and think before you speak. Not that I expect that to happen.

By "revealing" I meant revealing PII to persons not permitted to see it, obviously our discussion was about how he was justifying certain checks, that's not any kind of a secret, there's like 50 paragraphs of on-wiki discussion about it.

You need to ask yourself if that makes any sense. Bbb23 has permission to view only the PII he has justifiable reason to view, he has no blanket authorization, only a blanket user right, by virtue of how the software works. It's not rocket science.

[Midsize Jake]

I assume when you say "the COPA statute" you aren't talking about COPA but CalOPPA? It really doesn't matter because you are wrong in either case.

The text of the COPA statute is here, and I'd have to agree with you on that score, but CalOPPA (here) does contain a kind of "catch-all" in its PII definition that could conceivably work. "IP address" isn't explicitly mentioned, but after a list of the usual items (name, address, SSN) there are these two tacked on at the end:

(6) Any other identifier that permits the physical or online contacting of a specific individual.

(7) Information concerning a user that the Web site or online service collects online from the user and maintains in personally identifiable form in combination with an identifier described in this subdivision.

I suspect these probably would be useless to the average litigant, but who knows, maybe a really, really expensive lawyer could argue the definition of "personally identifiable form" with a sympathetic judge and score some points with it.

I have been wrong about things like this before, however.

[Giraffe Stapler]

An IP address does not permit "the physical or online contacting of a specific individual". An IP address does not identify an individual. It doesn't even identify a particular computer. It is not personally identifying information. Section 7 applies to storing data about a user along with personally identifying information about that user.That isn't what we are discussing here, since checkusers only see IPs and usernames (usernames are not PPI). Don't forget, all users have agreed to Wikipedia's privacy policy and terms of use, so this is a very silly discussion anyway.

But what about CCPA, you ask? Doesn't apply to Wikipedia.

[Death To Wikipedia]

I assume when you say "the COPA statute" you aren't talking about COPA but CalOPPA? It really doesn't matter because you are wrong in either case.

Maybe wait for the answer before drawing the conclusion? As was obvious to anyone reading all the posts, the original law I refer to is CalOPPA, the later one is the CCPA.

Here's an idiots guide that may help certain people understand how easy it would be for a lawyer to make some serious money out of this, even if it never even comes to court.

https://www.termsfeed.com/blog/ccpa-vs-caloppa/

The only wrinkle I can see, is that Wikipedia could wriggle out of liability under both statutes by virtue of being a non-profit, but to be honest, I'll take that as a win if it prevails in court, because most people will be suitably disgusted at seeing headlines that make it clear they can't control their personal data held by Wikipedia simply because of a mere technicality. They will appreciate that for the purposes of these laws, there's no good reason why you wouldn't put a behemoth like Wikipedia under the same controls as Facebook et al. Especially a non-profit like Wikipedia, where the people accessing PII are volunteers, not employees.

But suffice to say, it is obvious IP addresses have been considered PII under Californian law since at least CCPA.

It also makes clear the really big bucks can be made by any lawyer who successfully shows that Bbb23 wasn't just accessing PII he had no cause to, but if he was allowing third parties to see it too. And before anyone suggests that surely Bbb23 wouldn't have been stupid enough to reveal illegally obtained CU data to non-CheckUsers, well, for a start, he seems like the kind of guy who would, but even if he didn't, anyone with half a brain could persuade a judge that the combination of private communications and public logging that typically occurs when one of Bbb23's mates asks him to do a check and he finds socking, constitutes release to a third party. Nudge nudge wink wink, and all that.

[MrErnie]

Here's an idiots guide that may help certain people understand how easy it would be for a lawyer to make some serious money out of this, even if it never even comes to court.

If it is really that easy then surely several smart lawyers would be rushing to do exactly that.

[Poetlister]

Here's an idiots guide that may help certain people understand how easy it would be for a lawyer to make some serious money out of this, even if it never even comes to court.

If it is really that easy then surely several smart lawyers would be rushing to do exactly that.

How do we know that they aren't?

[Death To Wikipedia]

Here's an idiots guide that may help certain people understand how easy it would be for a lawyer to make some serious money out of this, even if it never even comes to court.

If it is really that easy then surely several smart lawyers would be rushing to do exactly that.

You do understand the difference between the ease of trying a case where someone reports the crime and hands in the evidence, and where all parties who have access to the evidence take the view they all have something to lose if even one person reveals what they know to the Feds? All that is discernable publicly, while compelling insofar as showing a probable crime has occurred based on the law and what has likely been revealed by that investigation, surely doesn't rise to the level required for a subpoena. Which is why they're saying nothing to nobody out here in the public realm that would have evidentiary value, not even a denial.

[Moral Hazard]

I for one always enjoy his posts.

We all have our kinks.