Definition

Multiple, fake accounts used to create an illusion of consensus or popularity, such as by liking or reposting content in order to amplify it.

Related Terms

Astroturfing (often employs sock puppets), Fake Account, Coordinated Inauthentic Behaviour (CIB), Sybil Attack.

Background

Sock Puppeting is the use of multiple accounts controlled by a single individual or entity to create a false appearance of widespread support, agreement, or activity. These accounts are designed to mimic genuine, independent users. They might be used to artificially boost the popularity of certain posts (through coordinated likes/boosts), dominate conversations, create a false sense of consensus, harass targets from multiple angles, or circumvent bans.

A significant challenge in the Fediverse is that these sock puppet accounts can be distributed across multiple, independent communities (instances/servers). An individual might create accounts on various instances to make their network of fake personas appear more legitimate, harder to trace to a single origin, and to inject their narratives or manipulations into diverse communities simultaneously. This distributed nature can make detection harder for any single moderation team, as they may only see a fraction of the overall coordinated activity.

Identifying sock puppets can be challenging, as sophisticated users may try to make each account appear distinct. Volunteer moderators might suspect sock puppetry when they observe unusual patterns of coordinated behaviour within their own community, or when they receive information from other communities about suspicious cross-instance activity linked to accounts also present on their service.

Why We Care

Dealing with Sock Puppets is important because their use undermines authentic engagement and misleads community members. It distorts the perception of popularity or consensus, manipulates discussions, and can be used to unfairly promote certain viewpoints or silence others. The presence of sock puppets erodes trust in the authenticity of interactions within the community and can make genuine engagement feel less rewarding.

Preventing or addressing the use of sock puppets helps maintain a fair and transparent environment where genuine voices and organic discussions can flourish.

Spotting Sock Puppets: What to Look For

Identification of sock puppets often involves piecing together various behavioural and content clues that suggest a single entity controls multiple accounts.

Account Traits: Look for multiple new accounts that seem to appear around the same time, often with generic or simplistic profiles. They might have very similar naming conventions, profile pictures (or lack thereof), or biographical details. However, more sophisticated sock puppets may have more developed, distinct-seeming profiles.

Content Characteristics: These accounts consistently agree with each other or a specific “main” account, often using similar phrasing, arguments, or making the same grammatical errors. They might all promote the same links, hashtags, or ideas. Their individual contributions might be superficial or lack original thought, primarily serving to echo or amplify.

Posting Patterns: Observe if these suspected accounts almost exclusively interact with each other’s content (e.g., liking, boosting) or the content of one central account, while having little organic interaction with the wider community. They might all post or become active around the same times or in response to the same events/posts. If one is challenged or suspended, another might quickly take up its “cause.”

Behaviour: The accounts may exhibit an unusual level of coordination in discussions, such as joining a thread in quick succession to support a particular point, or attacking a perceived opponent in a coordinated manner. They might share IP addresses or show other technical similarities (though this information is typically only accessible to Service Administrators).

Key Questions for Assessment:

• “Are these supposedly distinct accounts consistently and almost exclusively agreeing with or amplifying one another, or a specific target account/post?”
• “Do these accounts share notable similarities in timing of posts, language style, common errors, or topics of interest that seem statistically improbable if they were truly independent?”
• “Do these accounts engage broadly and authentically with the community, or primarily focus their interactions within their own suspected cluster?”
• “If these accounts are challenged, do they respond in similar ways, or does one account seem to ‘defend’ the others?”

Before You Act: Common Pitfalls & Nuances

It’s important to avoid wrongly accusing genuine users who simply share similar opinions or happen to interact frequently.

Genuine Agreement/Cliques: Groups of friends or users with shared strong interests will naturally agree and interact a lot. This isn’t sock puppetry unless there’s evidence of deceptive coordination by a single entity using multiple personas.

New Member Enthusiasm: A new user might enthusiastically agree with established popular opinions or accounts to “fit in”.

Single-Issue Posters: Some genuine users focus intensely on one topic. If several such users exist independently, it’s not sock puppetry.

Common Gotchas:

• Assuming any group of agreeing accounts are sock puppets without evidence of single-entity control or clear deceptive coordination.
• Over-reliance on account newness alone. New genuine users join all the time.
• Publicly accusing accounts of being sock puppets without strong evidence and internal team agreement, which can damage reputations.

Key Point: Sock Puppetry is defined by deceptive, coordinated use of multiple accounts by a single entity to feign independent support or consensus. The core is the inauthenticity of the personas and their coordinated action.

Managing Suspected Sock Puppets: Key Steps

When sock puppetry is suspected, especially with potential cross-community activity:

• Observe and Document: Discreetly monitor the suspected accounts within your community. Collect evidence of coordinated posting, similar language, and other indicative patterns. Note if remote accounts are involved.
• Look for a “Main” Account: Often, sock puppets are used to support a primary account. Identify if this pattern exists, even if the main account is on a different instance/domain/community.
• Assess the Impact: Is the suspected sock puppetry minor, or is it significantly disrupting discussions, manipulating consensus, or being used for harassment within your community?
• Discuss with Team (if applicable): Share your findings and evidence with fellow moderators or your Service Administrator. Sock puppet investigations often benefit from multiple perspectives.
• Service Administrator Checks: Your Service Administrator may be able to check for technical links between local accounts. For cross-community activity, direct technical evidence is harder unless there’s admin-to-admin cooperation.
• Inter-Community Communication (Cautiously): If strong behavioural evidence suggests sock puppets are operating from other communities to disrupt yours, your Service Administrator might consider reaching out to the administrators of those communities to share concerns and evidence. This must be done carefully, presenting evidence rather than accusations.
• Apply Community Guidance: If sock puppetry is confirmed (based on strong behavioural evidence for local accounts, or compelling evidence including technical links if available), issue warnings or suspend/ban the involved accounts as per your policies.
• Avoid Public Accusations: Handle investigations and actions discreetly.

Example Community Guidance

• Strike System: “Suspected instances of using one or two additional accounts for self-promotion might receive a warning. More extensive or deceptive use will lead to stricter penalties.”
• General Prohibition: “The use of multiple accounts (“sock puppets”) by a single individual or entity, whether hosted locally or on other communities, to artificially inflate popularity, manipulate discussions, create a false sense of consensus, or circumvent bans within our community is prohibited.”
• Strict Enforcement: “Confirmed, deliberate use of sock puppet accounts to deceive the community, harass users, or systematically manipulate content will result in the banning of all associated accounts active in our community. In cases of cross-community sock puppetry, we may also limit interaction from accounts or instances found to be knowingly harbouring such activity if it persistently targets our community.”