用户:LuciferianThomas/沙盒/Wikipedia:2021年基金会针对中文维基百科的行动

本页面为信息页。

本信息页不是维基百科的方针或指引之一，而是用于阐述维基百科某些方面的规范、惯例、技术细节或实践方法，可能反映了维基社群一部分编者的共识。

快捷方式

WP:OA2021

社群现正进行多项与此案有关的讨论。由于涉及范围较广，讨论现进行分流：

讨论区分流

基金会行动相关及其他讨论
- #近期的基金会行动
本地社群政策讨论
- #基金会行动的后续本地社群治理改善方案
- #基金会行动至未来明朗前的管理人员选拔解决方案
- #关于管理员选举
- #管理员选举暂缓授权声明
中国大陆维基人用户组相关
- #动议：强制解散WMC议案
- #动议：移除WMC于站内所有相关连结、网址
- #动议：在WMC重组之前重启WUGC用户组
- #动议：组建中国大陆的临时用户组
其他相关讨论
- #被永久封锁的管理员权限是否要记录撤销
- #提请临时授予和平君管理员权限
- #提议建立新的QQ群
- #再谈虫虫飞用傀儡的可能性

维基媒体基金会在2021年9月13日世界协调时间约下午四时开始，作出了一连串主要针对中国大陆维基人用户组（WMCUG）核心成员与相关人士之基金会行动。行动中对八名用户实施全域禁制并移除所有权限，当中有七名用户被列入全域禁制列表，另有一人未列入全域禁制列表，未知与本案有何关联。此外，基金会行动中亦对十二名中文维基专案（包括中文维基百科、中文维基学院、中文维基导游及文言文维基百科）管理员被移除管理权限（包括管理员、介面管理员及行政员身份）。

根据基金会的全域禁制方针，被全域禁制的用户被禁止参与或利用任何维基媒体基金会旗下的网站、平台或活动（包括线上和线下活动）；被实施全域禁制的个人不得通过他人间接参与前述网站、平台或活动。不论被禁制个人或他人是否认为这些参与行为有益，这些参与行为都因禁制而被禁止。
现时，包括但不限于中国大陆维基人用户组及其附属刊物《求闻》，以及中文维基百科QQ交流群等组织或平台仍然可能与全域禁制的用户有关联，或受其管辖或控制。根据基金会人员对相关问题的答复，任何其他用户仍可正常参与上述组织、平台和其相关的活动，但用户需注意不能协助或代理被实施全域禁制的个人参与维基媒体相关的活动。

基金会行动中被全域禁制或除权处分的用户列表

用户	日志	WMCUG	原有权限	相关帐号	备注
被全域禁制用户名单（按禁制执行时序排行）
Techyan	m:43203226	是	介管	Techyan-AWB	时任WMCUG联络人
游魂	m:43203246	是	延代巡退	Voodoo Machine
尤里的1994	m:43203246	是	延代	无
ArthurLau1997	m:43203251	是	延代巡退	无
Walter Grassroot	m:43203253	是	延代免退	WalterBot、9bowls
玄客	m:43203255	否	无	无	未知与本案关联
虫虫飞	m:43203256	否	管	无
城市酸儒文人挖坑	m:43203259	是	代	无
被除权处分管理员名单（按除权执行时序排行）
Alexander Misel	m:43203669	是	政管代	—
Nbfreeh	m:43203688	是	政管
Manchiu	m:43203700	否	政管
Stang	m:43203709	是	政管
梦蝶葬花	m:43203743 m:43203750	是	无		学院和导游管理员
瑞丽江的河水	m:43203760	已退出	管
WAN233	m:43203783	是	无		文言文百科临时管理员
Hamish	m:43203797	否	管
DreamLiner	m:43203818	否	管
Lanwi1	m:43203709	否	介管
雾岛圣	m:43203833	是	管
Outlookxp	m:43211689	否	管

维基媒体基金会声明

在基金会开始行动的同时，维基媒体基金会法务部门属下社群稳定及发展组的副主席玛姬·丹尼斯（英语：Maggie Dennis，即User:Mdennis (WMF)）在元维基以及维基媒体邮件列表（Wikimedia-l）中发表有关一系列基金会行动的声明，原文翻译如下（内容复制自meta:Office actions/September 2021 statement/zh）：

“

各位好，

我是维基媒体基金会法务部门的副总玛姬·丹尼斯（Maggie Dennis），目前专门负责社群稳定及发展（Community Resilience & Sustainability）。^[1]此信是为了要向大家说明为了保护全球社群，维基媒体基金会采取的一系列行动。

在此先向各位致歉——这封信内容非常长，且部分内容较为含糊。本信所述之大量议题相当复杂，我会尽量简单总结其中对大家来说可能较不熟悉的资讯。在条件允许的情况下，我会尽量回复相关问题，在数个星期之后我们的部门将会举办公听会，到时我们可以更深入的讨论本案相关议题。具体时间和详细讯息会于跟工作人员协调好之后，尽快公告于Wikimedia-L和元维基。

也许您们之中许多人已经注意到，最近维基媒体基金会修改了保密协议（Non-disclosure agreements，NDA）政策。在元维基上已经有针对这些政策改变的讨论，我不会在此信中复述相关讨论内容。^[2]简而言之，基于潜在威胁的可信资讯，维基媒体基金会改变了个人接受保密协议的相关方针。这些安全威胁是有关于对维基媒体的渗透（infiltration）的资讯，包括对能够接触个人身份资讯以及当选的有影响力人物的职务的威胁。由于担心可能触发我们被警告的相关风险，我们无法预告我们此次的行动——即便是对我们所信任的社群成员（如监管员等）我们也不得不保密。我们立即限制了可能受影响的人士对此类工具的使用权限，并正在与相关用户积极沟通，以核实他们是否确切受到危险。

我想要在此强调我们无意指责因此政策改变而权限受到限制之用户有任何不良企图。上述的渗透有多种渠道。我们既发现有用户为了取得相关权力来刻意试图融入社群——然而他们的最终目的与维基媒体基金会开放知识之目标相左。同时我们也注意到部分受信任的社群成员，可能已成为外部团体利用和伤害的危险目标。这项政策主要为了解决后者，减少相关成员被招募或胁迫的可能性。除了这项政策改变中被除权的用户能获得的个人资讯可能被泄露之外，我们相信这些用户中的部分也可能面临危险。

本日，维基媒体基金会已经推出第二阶段的方案著手处理关于渗透的顾虑。我们在两大受到影响的辖区之一内采取行动。在深入调查未获认可的组织“中国大陆维基人（用户组）”（Wikimedians of Mainland China，以下简称WMC）部分成员之相关行为后，我们决定全域禁制7位用户，并将12位管理人员除权。^[3]同时，我们向部分编辑者告知了拉票以及人肉搜索的相关政策，要求他们改变行为。

通常来说，维基媒体基金会不会对于自身之行动做过多的解释，但此次破例是因为此次受影响范围之大前所未见。为了保护在特定国家，及未受认可之用户组的用户之隐私及安全，我们无法透露过多讯息。我承认这些行动实属激进，然而此决议并非轻易。我们并不想要打击及摧毁那些积极为开放知识奋斗的诚信的包含WMC成员的中国编辑者的努力。我们不希望他们担忧他们的贡献会不受欢迎。可是，我们也不能在明知他们的安全可能遭受威胁的前提下，放任他们暴露在危险之中，而不采取任何保护措施。

在此之前，我们已经限制了对中国大陆地区用户的个人资讯存取，我们知悉到上述的威胁存在于我们的专案之中。我们了解到已有用户因此受到人身伤害。在确认案件真实性后，我们不得不立即采取相应措施。

在我的维基生涯里面，此次的事件是一场挑战，同时是一场胜利——维基百科已从一个受怀疑的非主流网站变成了全球高度信任普遍仰仗的网路百科。我在2007年第一次编辑专案时，就觉得维基媒体有成为世界最伟大的成就之潜力：大众的知识唾手可得。这是全体编辑者伟大的善举。但是我在我开始编辑之后很快地意识到在如何呈现资讯上的角力之激烈，且有人利用该争端来达成其目的。在此，我并不是要说我有先见之明——我相信有许多维基成员在我之前早就意识到了相应的风险。我相信当今天的维基媒体专案备受信任，而外部势力控制维基媒体资讯对他们能带来前所未有的好处的时候，我们面临的风险之大也是前所未有的。

“掌控”社群的威胁是实质存在的。数年来，维基媒体基金会一直知道克罗埃西亚语维基百科（Croatian Wikipedia）有面临相关的挑战——当中的相关档案可以追溯至近十年前。维基媒体基金会近期设置了打击虚假讯息团队，他们在评估相关风险、寻找适当的方式、并已聘雇外部研究人员来审查专案的相关资料，以帮助我们更好地理解在面临相似情况时可以使用怎样的解决方案，以及该情境的起因^[4]。最近，我们也成立了人权团队，专门处理这些因有组织的控制讯息的尝试而造成的紧急人权威胁。我们今天所处理的案件展示了作为一个全球媒体活动，我们多么需要积极地处理面对的威胁，既要保证任何人在任何地方都可以编辑，又要保证这些人免受想让他们噤声的人的伤害。

关于除权，我们希望可以于可见的未来跟国际中文社群作近一步的沟通，探讨我们对于选举制度的计划，以避免相关的维基媒体基金会专案被不合理的控制，并确保人们可以感觉安全并确实安全地编辑维基百科。我们需要确保我们的社群可以举办公正的选举——没有拉票或欺诈的行为。同时，我们希望对于选举制度的改变可以帮助我们恢复（中文维基百科之）使用者查核员（Checkuser）权限。

在本信的结尾，我想要对你们当中被惊扰到人被表达我最真挚的歉意。这些人无疑包括那些担心个人资讯是否已被泄漏的（我们并不认为有这样的问题。我们已经及时采取行动避免了此事。）以及那些担心更多此类的维基媒体基金会行动可能影响他们正常编辑和他们的社区的用户（我们认为我们目前的行动已经在中短期遏止了相关的风险）。我对于受到相关威胁的社群表示抱歉。维基媒体基金会将继续加强建设，以支持所有需要我们支持的社群，我们也仍然在学习如何能做得更好。同时，我们将继续改进我们在这两方面的认知：我们在人权领域的影响以及我们解决相关挑战的能力。您们值得有更好的服务——我们无法马上解决所有的问题，但我们将积极努力专注地提升改进。

在此，我想要对在全球活跃贡献的为五洲四海的读者服务的四千多名中文维基人表达歉意和遗憾。^[5]^[6]我向你们保证，我们将会做得更好。您们向在世界各地的中文维基读者分享知识是非常有意义的善举——我们保证会持续支持您们的付出，为您们提供所需工具，使您们在一个安全、有效的环境心想事成。

在此重申，我会在法务团队及其他相关团队的帮助下，尽力回答你们的问题。我们会在元维基上设立一个专页，以讨论此系列的行动，并于几周之后，我会主持公听会，让我们能更深入的讨论本案相关议题。

致以最诚挚的问候， Maggie Dennis (WMF)（留言） 2021年9月13日 (一) 16:13 (UTC) 玛姬

”

英文原文（内容复制自m:Office actions/September 2021 statement）

“

Hello everyone,

I’m Maggie Dennis, the Wikimedia Foundation’s Vice President of Community Resilience & Sustainability.^[1] I’m reaching out to you today to talk about a series of actions the Foundation has recently taken to protect communities across the globe.

I apologize in advance for the length and the ambiguity in certain areas. These are complicated issues, and I will try to summarize a lot of what may be unfamiliar information to some of you succinctly. I will answer questions to the best of my ability within safety parameters, and I will be hosting an office hour in a few weeks where I can discuss these issues in more depth. We’re currently getting that set up in regards to availability of support staff and will announce it on Wikimedia-L and Meta as soon as that information is prepared.

Many of you are already aware of recent changes that the Foundation has made to its NDA policy. These changes have been discussed on Meta, and I won’t reiterate all of our disclosures there,^[2] but I will briefly summarize that due to credible information of threat, the Foundation has modified its approach to accepting “non-disclosure agreements” from individuals. The security risk relates to information about infiltration of Wikimedia systems, including positions with access to personally identifiable information and elected bodies of influence. We could not pre-announce this action, even to our most trusted community partner groups (like the stewards), without fear of triggering the risk to which we’d been alerted. We restricted access to these tools immediately in the jurisdictions of concern, while working with impacted users to determine if the risk applied to them.

I want to pause to emphasize that we do not mean to accuse any specific individual whose access was restricted by that policy change of bad intent. Infiltration can occur through multiple mechanisms. What we have seen in our own movement includes not only people deliberately seeking to ingratiate themselves with their communities in order to obtain access and advance an agenda contrary to open knowledge goals, but also individuals who have become vulnerable to exploitation and harm by external groups because they are already trusted insiders. This policy primarily served to address the latter risk, to reduce the likelihood of recruitment or (worse) extortion. We believe that some of the individuals impacted by this policy change were also themselves in danger, not only the people whose personal information they could have been forced to access.

Today, the Foundation has rolled out a second phase of addressing infiltration concerns, which has resulted in sweeping actions in one of the two currently affected jurisdictions. We have banned seven users and desysopped a further 12 as a result of long and deep investigations into activities around some members of the unrecognized group Wikimedians of Mainland China.^[3] We have also reached out to a number of other editors with explanations around canvassing guidelines and doxing policies and requests to modify their behaviors.

When it comes to office actions, the Wikimedia Foundation typically defaults to little public communication, but this case is unprecedented in scope and nature. While there remain limits to what we can reveal in order to protect the safety and privacy of users in that country and in that unrecognized group, I want to acknowledge that this action is a radical one and that this decision was not easily made. We struggled with not wanting to discourage and destroy the efforts of good faith users in China who have worked so hard to fight for free and open knowledge, including some of those involved in this group. We do not want them to fear that their contributions are unwelcome. We also could not risk exposing them to danger by doing nothing to protect them after we became aware of credible threats to their safety.

While some time ago we limited the exposure of personal information to users in mainland China, we know that there has been the kind of infiltration we describe above in the project. And we know that some users have been physically harmed as a result. With this confirmed, we have no choice but to act swiftly and appropriately in response.

I take it as both a triumph and a challenge that in the years of my own involvement I have seen Wikimedia go from a suspect non-mainstream website to a highly trusted and widely relied upon source across the world. When I first started editing the projects in about 2007, I already believed Wikimedia had the capacity to be one of the greatest achievements of the world — collective knowledge, at your fingertips. What an amazing gesture of goodwill on the part of all of its many editors. It didn’t take me long after I started editing to realize how entrenched the battles could be over how to present information and how that can be exploited to achieve specific ends. I’m not trying to suggest that I was astonishingly prescient; I think there were many who realized that risk long before I stumbled naively on the scene. I do think that the risk is greater than ever now, when Wikimedia projects are widely trusted, and when the stakes are so high for organized efforts to control the information they share.

Community “capture” is a real and present threat. For years, the movement has been widely aware of challenges in the Croatian Wikipedia, with documentation going back nearly a decade. The Foundation recently set up a disinformation team, which is still finding its footing and assessing the problem, but which began by contracting an external researcher to review that project and the challenges and help us understand potential causes and solutions for such situations.^[4] We have also recently staffed a human rights team to deal with urgent threats to the human rights of communities across the group as a result of such organized efforts to control information. The situation we are dealing with today has shown me how much we need as a movement to grapple with the hard questions of how we remain open to editing by anyone, anywhere, while ensuring that individuals who take us up on that offer are not harmed by those who want to silence them.

With respect to the desysopping, we hope to connect with the international Chinese language community in the near future to talk about approaches to elections that avoid the risk of project capture and ensure that people are and feel safe contributing to the Chinese language Wikipedia. We need to make sure that the community can hold fair elections, without canvassing or fraud. We hope that helping to establish such a fair approach to elections will allow us to reinstate CheckUser rights in time.

I want to close this message by noting that I am personally deeply sorry to those of you for whom this will be a shock. This will undoubtedly include those who wonder if they should fear that their personal information has been exposed (we do not believe so; we believe we acted in time to prevent that) and also those who fear that further such bold action is in the works which may disrupt them and their work and their communities (at this point, with this action, we believe the identified risks have been contained in the short to medium term). I am also truly sorry to those communities who have been uneasy in the shadow of such threats for some time. The Foundation continues to build our capacity to support every community that wants or needs its support - and we are still learning how to do so well when we do. One of the key areas we seek improvement is in our ability to understand our human rights impact and in our ability to address those challenges. You have not had the service you’ve deserved. We can’t fix things immediately, but we are working to improve, actively, intentionally, and with focus.

To the 4,000 active Chinese language Wikimedians distributed across the world and serving readers in multiple continents,^[5]^[6] I would like to communicate my sorrow and regret. I want to assure you that we will do better. The work you do in sharing knowledge to Chinese readers everywhere has great meaning, and we are committed to supporting you in doing this work into the future, with the tools you need to succeed in a safe, secure, and productive environment.

Again, I will answer what questions I can, also relying on the support of others in Legal and perhaps beyond. We’re setting up a page on Meta to talk, and I will be hosting an office hour in coming weeks.

Best regards, Maggie Dennis (WMF) (talk) 16:13, 13 September 2021 (UTC) Maggie

”

后续回应

玛姬·丹尼斯在2021年9月14日 (二) 20:16 (UTC)于元维基声明页的讨论页中发表了一个问答，回应了六条问题。以下采用User:卡达在2021年9月15日 (三) 04:12 (UTC)在互助客栈发布的翻译版本，并有少量修订。

“

基金会是从何时开始意识到这个风险，而这风险又持续了多久？
虽然我们收到了许多志愿者所提出的相关问题、投诉与担忧，但这些投诉、问题与担忧最少可以追溯到2017年，但我们从近一年开始非常认真的调查，因为很明显的，社群成员的初期干预导致无法安全地解决问题。
NDA政策的改变与基金会行动有何关联？
保密协议（NDA）的政策调整停止对住在维基计画途径遭封锁地区志愿者的保密协议承认，理由相信这些用户有关的地址为个人申请者及基金会所知悉。这是由最近世界所引发的事件，这起事件是由可信讯息所引发的，这些事件使得维基媒体社群面临更为集中的安全威胁，并使多名志愿者曝于危险之中。

安全风险与维基媒体系统渗透的讯息有关，包括有权访问个人身份讯息的职位和选举产生影响的组织。这代表著我们无法预先宣布我们的行动，但不必担心触发我们所警示的风险。我们在相关司法管辖区内立即限制对于这些工具的访问，同时对于受影响的使用者采取合作以确定相关风险会否影响到他们。这是由于并非所有该受到政策变化而遭到限制访问的个人都有不良意图。

政策的改变是解决保持社区安全的迫切需求的第一步。第二步是与受影响的用户取得联系，并与监管员合作制定受影响帐户表达的偏好，以响应个人的保密协议。

只有在立即完成填补此安全漏洞的步骤后，我们才会开始去结束对可能参与其中的社群成员的调查。这两者之间在很多方面都有所关连，但不是每个环节都有关连。对于中国的调查是在安全风险的审查与应对之前展开的，因此确实存在超出此范围的问题。
社群成员的个人讯息会否曝光？
我们没有任何证据表明发生了技术性漏洞。关于修正保密协议的第一个行动的主旨是防止那些容易被国家行动的人或是其他从技术上获取其他使用者私人讯息并对其识别、利用或控制而对于讯息控制感到兴趣的人。由于我们的软体会追踪这些讯息被访问的时间，因此我们没有任何理由相信这些信息是以这种方式访问的。始终存在一个问题，即志愿者向其他志愿者透露了多少讯息，包括透过私人电子邮件和聚会。我希望我们生活在一个每个人都可以被视为表面价值和善意可信的世界中，但尽管“善意推定”是维基媒体社群工作的关键方法，但这不会也不应该立即上纲到共享个人讯息。在不久的未来，我希望我们能够加强我们的集体工作，帮助人们更好地了解他们共享的内容、与谁共享的风险以及如何在数位环境中安全地管理他们的私人讯息。与此同时，我鼓励每个关心自身安全的维基媒体人访问元维基上的“Voices under Threat”页面：https://meta.wikimedia.org/wiki/Voices_under_Threat 。此页面收集了一些可能有帮助的资源。
社群是否允许被除权的使用者再次RfA？否需要（强制性）改革RfA机制以举办未来的 RfA，包括但不限于那些被除权的人？
这些个人被除权的原因有许多，诸如有证据表明选举是有偏见的（例如在 QQ 或其他非维基的平台威胁）投票，以及有证据表明滥用站务工具支持该组织某些成员被禁制的活动。这些活动包含肉搜、骚扰、共享帐号和跨维基协调。然而这些人知道或理解该团体的某些成员所做的事情，并非一无所知，并且取消管理权限是根据基金会行动政策的次要基金会行动条款，基金会不反对本地社群可以决定公平地重新选举。考虑到团体活动及对于反对者的人身威胁，我们认为社群应优先改革 RfA 机制，与此同时，我们准备透过以往过去所观察到的选举模式，对任何此类的选举进行复核，以提供支援。
受NDA政策更改影响的用户是否最终能够恢复其帐号？
是的，尽管我不清楚过程是否已经完成。有鉴于威胁的程度，我们认为最好是在我们单独连系他们的同时，关闭他们在伺服器端的访问，以确保社群和使用者自身的安全。所有使用者都可以自行删除访问的权限，有些使用者也已经这样做了。一些使用者希望就撤销其保密协议提出申诉，我们的法律人员一直在Trust & Safety的支持下审查这些申诉，以确定是否可以恢复更高级别的访问权限。使用者帐号已被解锁，是因为他们的访问权限已被正式撤销（通过自我请求或基金会流程）或他们的NDA申诉成功。

考虑到这个问题，我们不打算透露哪些使用者申诉成功。这样做可能会增加这些人的危险。当然，欢迎他们表明自己的身份，但我鼓励他们根据自己的风险状况考虑是否可以安全地这样做。

我也不打算讨论因NDA政策更改而删除访问权限的个人，但要注意的是，这些不是在云端删除的。
WMCUG仍然举办公[开]活动，包括编辑松和新闻服务[。]一些全域封禁的使用者目前控制著WMCUG以及QQ文字频道等线下社交媒体平台。只要这组织仍然遵循全域封禁的控制著这些使用者，是否应该将其根除？
这是一个很难回答的问题，我觉得我难以完美回应，基金会多年来一直从事Trust & Safety行动，但并非所有行动都得到社群普遍的支持。有些行动如此；但有些却引起争议。多年前，面对一个在某个社群引起争议的禁令，基金会采取了一项政策，即基金会对于被封禁的帐号透过“代理”来编辑，亦有可能会对其封禁。通常，我们会警告人们，但这取决于当前情势中固有的风险。

我们目前并不打算取消WMCUG的站内页面，尽管我确实认为我们有必要把集结成一个非正式团体的一些困境视为一场运动。这些都是被允许的，甚至我认为是个好主意。它降低了参与和组织的障碍。然而，如果这些非正式组织透过维基媒体的网站向其他人暗示，他们以他们不被认可和授权的方式而被认可和授权，可能会引起人们对滥用的担忧。

我们希望WMCUG的其馀编辑，包括那些被警告的编辑，注意到这次的行动，并重新考虑他们如何与我们社群中的其他人展开合作。在某些情况之下，我们认为某些使用者可能并未完全了解正在发生的事情。我强烈怀疑某些用户可能需要一段时间来反思这些行动，并确定他们如何最好地实现运动的目的，而不会出现过去的问题。

至于用户组页面，我们将继续观察我们网站上的页面，以了解是否需要就他们可能的对他们扭曲的从属关系或对遭禁制的用户进行代理的行为采取行动。

”

英文原文（经格式修订）

“

When was the Foundation aware of this risk and how long has this lasted?
While we have received related questions, complaints, and concerns from other volunteers dating back to at least 2017, we have been investigating these concerns very seriously for nearly a year, as it became obvious that some early interventions by community members were not going to resolve the issue safely.
What is the connection between the NDA Policy Change and the recent Office Actions?
The non-disclosure agreement (NDA) policy adjustment suspended recognition of NDAs from volunteer applicants who live in jurisdictions that have blocked access to Wikimedia projects and where there was reason to believe that the domicile associated with the user accounts were known to others than the individual applicant(s) and the Foundation. This was necessitated by recent world events triggered by credible information about a more focused security threat to the Wikimedia community that placed multiple volunteers at risk.

The security risk related to information about infiltration of Wikimedia systems, including positions with access to personally identifiable information and elected bodies of influence. This meant that we could not pre-announce our action, without fear of triggering the risk to which we had been alerted. We restricted access to these tools immediately in the jurisdictions of concern, while working with impacted users to determine if the risk applied to them. This is because not all individuals whose access was restricted by that policy change, had bad intent.

The policy change was a first step to address the immediate needs of keeping the community safe. The second step was to get in touch with the impacted users and to work with the Stewards to enact the preferences expressed by impacted accounts in response to individual non-public outreach.

Only after this immediate step to close this security gap was complete did we commence to conclude the investigations into individual community members who may have been involved. The two actions are related in many ways, but not in every point. The Chinese investigation precedes that security risk review and response and does have issues that go beyond it.
Has private information of community members been exposed?
We have no evidence that any technical breach occurred. The first action on changing the NDA policy was intended to prevent technical access to private information about other users by those who could be easily identified, located, and exploited whether by state actors or others with an interest in controlling information. Since our software tracks when such information is accessed, we do not have any reason to believe that this information was accessed in such a manner.

There is always a question of how much information volunteers release themselves to other volunteers, including over private email and in meet-ups. I wish we lived in a world where everyone could be taken at face value and good intentions trusted, but while “assume good faith” is a key approach to working in Wikimedia communities, it does not and should not immediately extend to sharing personal information. In the near future, I hope we will be able to increase our collective work towards helping people better understand the risks of what they share and with whom and how to manage their private information safely in a digital environment. In the meantime, I would encourage every Wikimedian who is concerned about their own security to drop by the Voices Under Threat page on Meta: https://meta.wikimedia.org/wiki/Voices_under_Threat. This page collects some resources that may help.
Is the community allowed to hold RfAs for those removed of their advanced rights? Is reformation of the RfA system required (compulsory) for holding future RFAs, including or at least for those who were desysopped?
The individual desyoppings took place for a number of reasons, including evidence of biased elections where individuals were pressured (sometimes with off-wiki threats on QQ and other platforms) to vote as they did and evidence of misuse of administrative tools to support the aims and activities of some of the banned members of the group. Activities include doxing, harassment, sharing accounts, and off-wiki coordination. However, it is not always clear how much these individuals knew or understood about what some of the members of that group were doing, and the Foundation does not object under the Secondary Office Actions provision of the Office Action Policy, on removal of advanced rights, to the community determining to fairly re-elect them. Considering that evidence evaluated of the groups’ activities includes physical coercion of volunteers who opposed the group, we do believe it would be better for the community to reform the RfA system first, but in the meantime we are prepared to support by reviewing any such elections against the patterns observed in prior elections.
Were users affected by the NDA policy change ultimately able to recover their accounts?
Yes, although I am not sure if that process is fully complete. Given the nature of the threat, we felt it best secured the safety of the communities and the users themselves to shut down their access on the server-side while we contacted them individually. All users were offered the option to remove their access on their own accord, and some did so. Some users wished to request an appeal of the revocation of their NDA, and our Legal staff have been reviewing those appeals with the support of Trust & Safety to determine if higher levels of access could be restored. User accounts have been unlocked as their access has been formally withdrawn (either through self-request or Foundation process) or as their NDA appeal has been successful.

In anticipation of the question, we do not intend to name the users whose appeals were successful. Doing so could increase the jeopardy of these individuals. They are welcome, of course, to identify themselves, but I would encourage them to consider whether they can do so safely, based on their own risk profiles.

I am also not going to discuss the individuals whose access was removed by the NDA policy change except to note that their removal is not under a cloud.
The WMCUG still hosts public events, including editathons and news services as some globally banned user(s) are currently in control of WMCUG along with off-site social media platforms like QQ text channels. Should these organizations be removed from on-site exposure as long as they are still in control of such users to comply with global bans?
This is a hard question, and I suspect I will not answer it perfectly. The Foundation has engaged in trust & safety activities for years, not all of which receive universal community support. Some do; some are very controversial. Years ago, in the face of a ban that was controversial in one community, the Foundation adopted a policy that users who edit by “proxy” on behalf of Foundation banned accounts may also be banned. Typically, we try to warn people, but it depends on the risks inherent in the situation at hand.

It is not our current intention to eliminate the on-site page for WMCUG, although I do believe that it will be necessary for us to consider as a movement some of the hard questions around the formation of informal groups. These are allowed, and in my opinion that is a very good idea. It lowers the barrier to participation and organization. It can, however, raise concerns about misuse if such an informal group uses Wikimedia’s sites to suggest to others that they are recognized and authorized in ways they are not.

It is our hope that the remaining editors of WMCUG, including those warned, will take heed of this action and reconsider how they work with others in our communities collaboratively. In some cases, we believe some users may not have been fully aware of what was going on. I strongly suspect that some users may need a period of time to reflect on these actions and determine how they can best move forward with the goals of the movement without the problems of the past.

As to the user group pages, we will continue to watch the ones on our sites to understand if action is necessary if they seem to misrepresent their affiliation or to be proxying for banned users.

”

用户:LuciferianThomas/沙盒/Wikipedia:2021年基金会针对中文维基百科的行动

目录

基金会行动中被全域禁制或除权处分的用户列表

维基媒体基金会声明

后续回应

相关新闻媒体报道