使用者:LuciferianThomas/沙盒/Wikipedia:2021年基金會針對中文維基百科的行動

本頁面為資訊頁。

本資訊頁不是維基百科的方針或指引之一，而是用於闡述維基百科某些方面的規範、慣例、技術細節或實踐方法，可能反映了維基社群一部分編者的共識。

捷徑

WP:OA2021

社群現正進行多項與此案有關的討論。由於涉及範圍較廣，討論現進行分流：

論壇分流

基金會行動相關及其他討論
- #近期的基金會行動
本地社群政策討論
- #基金會行動的後續本地社群治理改善方案
- #基金會行動至未來明朗前的管理人員選拔解決方案
- #關於管理員選舉
- #管理員選舉暫緩授權聲明
中國大陸維基人使用者群組相關
- #動議：強制解散WMC議案
- #動議：移除WMC於站內所有相關連結、網址
- #動議：在WMC重組之前重啟WUGC使用者群組
- #動議：組建中國大陸的臨時使用者群組
其他相關討論
- #被永久封鎖的管理員權限是否要記錄復原
- #提請臨時授予和平君管理員權限
- #提議建立新的QQ群
- #再談蟲蟲飛用傀儡的可能性

維基媒體基金會在2021年9月13日世界協調時間約下午四時開始，作出了一連串主要針對中國大陸維基人使用者群組（WMCUG）核心成員與相關人士之基金會行動。行動中對八名使用者實施全域禁制並移除所有權限，當中有七名使用者被列入全域禁制列表，另有一人未列入全域禁制列表，未知與本案有何關聯。此外，基金會行動中亦對十二名中文維基專案（包括中文維基百科、中文維基學院、中文維基導遊及文言文維基百科）管理員被移除管理權限（包括管理員、介面管理員及行政員身分）。

根據基金會的全域禁制方針，被全域禁制的使用者被禁止參與或利用任何維基媒體基金會旗下的網站、平台或活動（包括線上和線下活動）；被實施全域禁制的個人不得通過他人間接參與前述網站、平台或活動。不論被禁制個人或他人是否認為這些參與行為有益，這些參與行為都因禁制而被禁止。
現時，包括但不限於中國大陸維基人使用者群組及其附屬刊物《求聞》，以及中文維基百科QQ交流群等組織或平台仍然可能與全域禁制的使用者有關聯，或受其管轄或控制。根據基金會人員對相關問題的答覆，任何其他使用者仍可正常參與上述組織、平台和其相關的活動，但使用者需注意不能協助或代理被實施全域禁制的個人參與維基媒體相關的活動。

基金會行動中被全域禁制或除權處分的使用者列表

使用者	日誌	WMCUG	原有權限	相關帳號	備註
被全域禁制使用者名稱單（按禁制執行時序排行）
Techyan	m:43203226	是	介管	Techyan-AWB	時任WMCUG聯絡人
游魂	m:43203246	是	延代巡退	Voodoo Machine
尤里的1994	m:43203246	是	延代	無
ArthurLau1997	m:43203251	是	延代巡退	無
Walter Grassroot	m:43203253	是	延代免退	WalterBot、9bowls
玄客	m:43203255	否	無	無	未知與本案關聯
蟲蟲飛	m:43203256	否	管	無
城市酸儒文人挖坑	m:43203259	是	代	無
被除權處分管理員名單（按除權執行時序排行）
Alexander Misel	m:43203669	是	政管代	—
Nbfreeh	m:43203688	是	政管
Manchiu	m:43203700	否	政管
Stang	m:43203709	是	政管
夢蝶葬花	m:43203743 m:43203750	是	無		學院和導遊管理員
瑞麗江的河水	m:43203760	已退出	管
WAN233	m:43203783	是	無		文言文百科臨時管理員
Hamish	m:43203797	否	管
DreamLiner	m:43203818	否	管
Lanwi1	m:43203709	否	介管
霧島聖	m:43203833	是	管
Outlookxp	m:43211689	否	管

維基媒體基金會聲明

在基金會開始行動的同時，維基媒體基金會法務部門屬下社群穩定及發展組的副主席瑪姬·丹尼斯（英語：Maggie Dennis，即User:Mdennis (WMF)）在元維基以及維基媒體郵件列表（Wikimedia-l）中發表有關一系列基金會行動的聲明，原文翻譯如下（內容複製自meta:Office actions/September 2021 statement/zh）：

“

各位好，

我是維基媒體基金會法務部門的副總瑪姬·丹尼斯（Maggie Dennis），目前專門負責社群穩定及發展（Community Resilience & Sustainability）。^[1]此信是為了要向大家說明為了保護全球社群，維基媒體基金會採取的一系列行動。

在此先向各位致歉——這封信內容非常長，且部分內容較為含糊。本信所述之大量議題相當複雜，我會儘量簡單總結其中對大家來說可能較不熟悉的資訊。在條件允許的情況下，我會儘量回覆相關問題，在數個星期之後我們的部門將會舉辦公聽會，到時我們可以更深入的討論本案相關議題。具體時間和詳細訊息會於跟工作人員協調好之後，盡快公告於Wikimedia-L和元維基。

也許您們之中許多人已經注意到，最近維基媒體基金會修改了保密協定（Non-disclosure agreements，NDA）政策。在元維基上已經有針對這些政策改變的討論，我不會在此信中複述相關討論內容。^[2]簡而言之，基於潛在威脅的可信資訊，維基媒體基金會改變了個人接受保密協定的相關方針。這些安全威脅是有關於對維基媒體的滲透（infiltration）的資訊，包括對能夠接觸個人身分資訊以及當選的有影響力人物的職務的威脅。由於擔心可能觸發我們被警告的相關風險，我們無法預告我們此次的行動——即便是對我們所信任的社群成員（如監管員等）我們也不得不保密。我們立即限制了可能受影響的人士對此類工具的使用權限，並正在與相關使用者積極溝通，以核實他們是否確切受到危險。

我想要在此強調我們無意指責因此政策改變而權限受到限制之使用者有任何不良企圖。上述的滲透有多種管道。我們既發現有使用者為了取得相關權力來刻意試圖融入社群——然而他們的最終目的與維基媒體基金會開放知識之目標相左。同時我們也注意到部分受信任的社群成員，可能已成為外部團體利用和傷害的危險目標。這項政策主要為了解決後者，減少相關成員被招募或脅迫的可能性。除了這項政策改變中被除權的使用者能獲得的個人資訊可能被洩露之外，我們相信這些使用者中的部分也可能面臨危險。

本日，維基媒體基金會已經推出第二階段的方案著手處理關於滲透的顧慮。我們在兩大受到影響的轄區之一內採取行動。在深入調查未獲認可的組織「中國大陸維基人（使用者群組）」（Wikimedians of Mainland China，以下簡稱WMC）部分成員之相關行為後，我們決定全域禁制7位使用者，並將12位元管理人員除權。^[3]同時，我們向部分編輯者告知了拉票以及人肉搜尋的相關政策，要求他們改變行為。

通常來說，維基媒體基金會不會對於自身之行動做過多的解釋，但此次破例是因為此次受影響範圍之大前所未見。為了保護在特定國家，及未受認可之使用者群組的使用者之隱私及安全，我們無法透露過多訊息。我承認這些行動實屬激進，然而此決議並非輕易。我們並不想要打擊及摧毀那些積極為開放知識奮鬥的誠信的包含WMC成員的中國編輯者的努力。我們不希望他們擔憂他們的貢獻會不受歡迎。可是，我們也不能在明知他們的安全可能遭受威脅的前提下，放任他們暴露在危險之中，而不採取任何保護措施。

在此之前，我們已經限制了對中國大陸地區使用者的個人資訊存取，我們知悉到上述的威脅存在於我們的專案之中。我們了解到已有使用者因此受到人身傷害。在確認案件真實性後，我們不得不立即採取相應措施。

在我的維基生涯裡面，此次的事件是一場挑戰，同時是一場勝利——維基百科已從一個受懷疑的非主流網站變成了全球高度信任普遍仰仗的網路百科。我在2007年第一次編輯專案時，就覺得維基媒體有成為世界最偉大的成就之潛力：大眾的知識唾手可得。這是全體編輯者偉大的善舉。但是我在我開始編輯之後很快地意識到在如何呈現資訊上的角力之激烈，且有人利用該爭端來達成其目的。在此，我並不是要說我有先見之明——我相信有許多維基成員在我之前早就意識到了相應的風險。我相信當今天的維基媒體專案備受信任，而外部勢力控制維基媒體資訊對他們能帶來前所未有的好處的時候，我們面臨的風險之大也是前所未有的。

「掌控」社群的威脅是實質存在的。數年來，維基媒體基金會一直知道克羅埃西亞語維基百科（Croatian Wikipedia）有面臨相關的挑戰——當中的相關檔案可以追溯至近十年前。維基媒體基金會近期設定了打擊虛假訊息團隊，他們在評估相關風險、尋找適當的方式、並已聘僱外部研究人員來審查專案的相關資料，以幫助我們更好地理解在面臨相似情況時可以使用怎樣的解決方案，以及該情境的起因^[4]。最近，我們也成立了人權團隊，專門處理這些因有組織的控制訊息的嘗試而造成的緊急人權威脅。我們今天所處理的案件展示了作為一個全球媒體活動，我們多麼需要積極地處理面對的威脅，既要保證任何人在任何地方都可以編輯，又要保證這些人免受想讓他們噤聲的人的傷害。

關於除權，我們希望可以於可見的未來跟國際中文社群作近一步的溝通，探討我們對於選舉制度的專案，以避免相關的維基媒體基金會專案被不合理的控制，並確保人們可以感覺安全並確實安全地編輯維基百科。我們需要確保我們的社群可以舉辦公正的選舉——沒有拉票或欺詐的行為。同時，我們希望對於選舉制度的改變可以幫助我們恢復（中文維基百科之）使用者查核員（Checkuser）權限。

在本信的結尾，我想要對你們當中被驚擾到人被表達我最真摯的歉意。這些人無疑包括那些擔心個人資訊是否已被洩漏的（我們並不認為有這樣的問題。我們已經及時採取行動避免了此事。）以及那些擔心更多此類的維基媒體基金會行動可能影響他們正常編輯和他們的社群的使用者（我們認為我們目前的行動已經在中短期遏止了相關的風險）。我對於受到相關威脅的社群表示抱歉。維基媒體基金會將繼續加強建設，以支援所有需要我們支援的社群，我們也仍然在學習如何能做得更好。同時，我們將繼續改進我們在這兩方面的認知：我們在人權領域的影響以及我們解決相關挑戰的能力。您們值得有更好的服務——我們無法馬上解決所有的問題，但我們將積極努力專注地提升改進。

在此，我想要對在全球活躍貢獻的為五洲四海的讀者服務的四千多名中文維基人表達歉意和遺憾。^[5]^[6]我向你們保證，我們將會做得更好。您們向在世界各地的中文維基讀者分享知識是非常有意義的善舉——我們保證會持續支援您們的付出，為您們提供所需工具，使您們在一個安全、有效的環境心想事成。

在此重申，我會在法務團隊及其他相關團隊的幫助下，盡力回答你們的問題。我們會在元維基上設立一個專頁，以討論此系列的行動，並於幾週之後，我會主持公聽會，讓我們能更深入的討論本案相關議題。

致以最誠摯的問候， Maggie Dennis (WMF)（留言） 2021年9月13日 (一) 16:13 (UTC) 瑪姬

”

英文原文（內容複製自m:Office actions/September 2021 statement）

“

Hello everyone,

I’m Maggie Dennis, the Wikimedia Foundation’s Vice President of Community Resilience & Sustainability.^[1] I’m reaching out to you today to talk about a series of actions the Foundation has recently taken to protect communities across the globe.

I apologize in advance for the length and the ambiguity in certain areas. These are complicated issues, and I will try to summarize a lot of what may be unfamiliar information to some of you succinctly. I will answer questions to the best of my ability within safety parameters, and I will be hosting an office hour in a few weeks where I can discuss these issues in more depth. We’re currently getting that set up in regards to availability of support staff and will announce it on Wikimedia-L and Meta as soon as that information is prepared.

Many of you are already aware of recent changes that the Foundation has made to its NDA policy. These changes have been discussed on Meta, and I won’t reiterate all of our disclosures there,^[2] but I will briefly summarize that due to credible information of threat, the Foundation has modified its approach to accepting 「non-disclosure agreements」 from individuals. The security risk relates to information about infiltration of Wikimedia systems, including positions with access to personally identifiable information and elected bodies of influence. We could not pre-announce this action, even to our most trusted community partner groups (like the stewards), without fear of triggering the risk to which we’d been alerted. We restricted access to these tools immediately in the jurisdictions of concern, while working with impacted users to determine if the risk applied to them.

I want to pause to emphasize that we do not mean to accuse any specific individual whose access was restricted by that policy change of bad intent. Infiltration can occur through multiple mechanisms. What we have seen in our own movement includes not only people deliberately seeking to ingratiate themselves with their communities in order to obtain access and advance an agenda contrary to open knowledge goals, but also individuals who have become vulnerable to exploitation and harm by external groups because they are already trusted insiders. This policy primarily served to address the latter risk, to reduce the likelihood of recruitment or (worse) extortion. We believe that some of the individuals impacted by this policy change were also themselves in danger, not only the people whose personal information they could have been forced to access.

Today, the Foundation has rolled out a second phase of addressing infiltration concerns, which has resulted in sweeping actions in one of the two currently affected jurisdictions. We have banned seven users and desysopped a further 12 as a result of long and deep investigations into activities around some members of the unrecognized group Wikimedians of Mainland China.^[3] We have also reached out to a number of other editors with explanations around canvassing guidelines and doxing policies and requests to modify their behaviors.

When it comes to office actions, the Wikimedia Foundation typically defaults to little public communication, but this case is unprecedented in scope and nature. While there remain limits to what we can reveal in order to protect the safety and privacy of users in that country and in that unrecognized group, I want to acknowledge that this action is a radical one and that this decision was not easily made. We struggled with not wanting to discourage and destroy the efforts of good faith users in China who have worked so hard to fight for free and open knowledge, including some of those involved in this group. We do not want them to fear that their contributions are unwelcome. We also could not risk exposing them to danger by doing nothing to protect them after we became aware of credible threats to their safety.

While some time ago we limited the exposure of personal information to users in mainland China, we know that there has been the kind of infiltration we describe above in the project. And we know that some users have been physically harmed as a result. With this confirmed, we have no choice but to act swiftly and appropriately in response.

I take it as both a triumph and a challenge that in the years of my own involvement I have seen Wikimedia go from a suspect non-mainstream website to a highly trusted and widely relied upon source across the world. When I first started editing the projects in about 2007, I already believed Wikimedia had the capacity to be one of the greatest achievements of the world — collective knowledge, at your fingertips. What an amazing gesture of goodwill on the part of all of its many editors. It didn’t take me long after I started editing to realize how entrenched the battles could be over how to present information and how that can be exploited to achieve specific ends. I’m not trying to suggest that I was astonishingly prescient; I think there were many who realized that risk long before I stumbled naively on the scene. I do think that the risk is greater than ever now, when Wikimedia projects are widely trusted, and when the stakes are so high for organized efforts to control the information they share.

Community 「capture」 is a real and present threat. For years, the movement has been widely aware of challenges in the Croatian Wikipedia, with documentation going back nearly a decade. The Foundation recently set up a disinformation team, which is still finding its footing and assessing the problem, but which began by contracting an external researcher to review that project and the challenges and help us understand potential causes and solutions for such situations.^[4] We have also recently staffed a human rights team to deal with urgent threats to the human rights of communities across the group as a result of such organized efforts to control information. The situation we are dealing with today has shown me how much we need as a movement to grapple with the hard questions of how we remain open to editing by anyone, anywhere, while ensuring that individuals who take us up on that offer are not harmed by those who want to silence them.

With respect to the desysopping, we hope to connect with the international Chinese language community in the near future to talk about approaches to elections that avoid the risk of project capture and ensure that people are and feel safe contributing to the Chinese language Wikipedia. We need to make sure that the community can hold fair elections, without canvassing or fraud. We hope that helping to establish such a fair approach to elections will allow us to reinstate CheckUser rights in time.

I want to close this message by noting that I am personally deeply sorry to those of you for whom this will be a shock. This will undoubtedly include those who wonder if they should fear that their personal information has been exposed (we do not believe so; we believe we acted in time to prevent that) and also those who fear that further such bold action is in the works which may disrupt them and their work and their communities (at this point, with this action, we believe the identified risks have been contained in the short to medium term). I am also truly sorry to those communities who have been uneasy in the shadow of such threats for some time. The Foundation continues to build our capacity to support every community that wants or needs its support - and we are still learning how to do so well when we do. One of the key areas we seek improvement is in our ability to understand our human rights impact and in our ability to address those challenges. You have not had the service you’ve deserved. We can’t fix things immediately, but we are working to improve, actively, intentionally, and with focus.

To the 4,000 active Chinese language Wikimedians distributed across the world and serving readers in multiple continents,^[5]^[6] I would like to communicate my sorrow and regret. I want to assure you that we will do better. The work you do in sharing knowledge to Chinese readers everywhere has great meaning, and we are committed to supporting you in doing this work into the future, with the tools you need to succeed in a safe, secure, and productive environment.

Again, I will answer what questions I can, also relying on the support of others in Legal and perhaps beyond. We’re setting up a page on Meta to talk, and I will be hosting an office hour in coming weeks.

Best regards, Maggie Dennis (WMF) (talk) 16:13, 13 September 2021 (UTC) Maggie

”

後續回應

瑪姬·丹尼斯在2021年9月14日 (二) 20:16 (UTC)於元維基聲明頁的討論頁中發表了一個問答，回應了六條問題。以下採用User:卡達在2021年9月15日 (三) 04:12 (UTC)在互助客棧發佈的翻譯版本，並有少量修訂。

“

基金會是從何時開始意識到這個風險，而這風險又持續了多久？
雖然我們收到了許多志願者所提出的相關問題、投訴與擔憂，但這些投訴、問題與擔憂最少可以追溯到2017年，但我們從近一年開始非常認真的調查，因為很明顯的，社群成員的初期干預導致無法安全地解決問題。
NDA政策的改變與基金會行動有何關聯？
保密協定（NDA）的政策調整停止對住在維基計畫途徑遭封鎖地區志願者的保密協定承認，理由相信這些使用者有關的位址為個人申請者及基金會所知悉。這是由最近世界所引發的事件，這起事件是由可信訊息所引發的，這些事件使得維基媒體社群面臨更為集中的安全威脅，並使多名志願者曝於危險之中。

安全風險與維基媒體系統滲透的訊息有關，包括有權訪問個人身分訊息的職位和選舉產生影響的組織。這代表著我們無法預先宣布我們的行動，但不必擔心觸發我們所警示的風險。我們在相關司法管轄區內立即限制對於這些工具的訪問，同時對於受影響的使用者採取合作以確定相關風險會否影響到他們。這是由於並非所有該受到政策變化而遭到限制訪問的個人都有不良意圖。

政策的改變是解決保持社區安全的迫切需求的第一步。第二步是與受影響的使用者取得聯繫，並與監管員合作制定受影響帳戶表達的偏好，以響應個人的保密協定。

只有在立即完成填補此安全漏洞的步驟後，我們才會開始去結束對可能參與其中的社群成員的調查。這兩者之間在很多方面都有所關連，但不是每個環節都有關連。對於中國的調查是在安全風險的審查與應對之前展開的，因此確實存在超出此範圍的問題。
社群成員的個人訊息會否曝光？
我們沒有任何證據表明發生了技術性漏洞。關於修正保密協定的第一個行動的主旨是防止那些容易被國家行動的人或是其他從技術上獲取其他使用者私人訊息並對其識別、利用或控制而對於訊息控制感到興趣的人。由於我們的軟體會追蹤這些訊息被訪問的時間，因此我們沒有任何理由相信這些資訊是以這種方式訪問的。始終存在一個問題，即志願者向其他志願者透露了多少訊息，包括透過私人電子郵件和聚會。我希望我們生活在一個每個人都可以被視為表面價值和善意可信的世界中，但儘管「善意推定」是維基媒體社群工作的關鍵方法，但這不會也不應該立即上綱到共享個人訊息。在不久的未來，我希望我們能夠加強我們的集體工作，幫助人們更好地了解他們共享的內容、與誰共享的風險以及如何在數位環境中安全地管理他們的私人訊息。與此同時，我鼓勵每個關心自身安全的維基媒體人訪問元維基上的「Voices under Threat」頁面：https://meta.wikimedia.org/wiki/Voices_under_Threat 。此頁面收集了一些可能有幫助的資源。
社群是否允許被除權的使用者再次RfA？否需要（強制性）改革RfA機制以舉辦未來的 RfA，包括但不限於那些被除權的人？
這些個人被除權的原因有許多，諸如有證據表明選舉是有偏見的（例如在 QQ 或其他非維基的平台威脅）投票，以及有證據表明濫用站務工具支援該組織某些成員被禁制的活動。這些活動包含肉搜、騷擾、共享帳號和跨維基協調。然而這些人知道或理解該團體的某些成員所做的事情，並非一無所知，並且取消管理權限是根據基金會行動政策的次要基金會行動條款，基金會不反對本地社群可以決定公平地重新選舉。考慮到團體活動及對於反對者的人身威脅，我們認為社群應優先改革 RfA 機制，與此同時，我們準備透過以往過去所觀察到的選舉模式，對任何此類的選舉進行覆核，以提供支援。
受NDA政策變更影響的使用者是否最終能夠恢復其帳號？
是的，儘管我不清楚過程是否已經完成。有鑑於威脅的程度，我們認為最好是在我們單獨連繫他們的同時，關閉他們在伺服器端的訪問，以確保社群和使用者自身的安全。所有使用者都可以自行刪除訪問的權限，有些使用者也已經這樣做了。一些使用者希望就復原其保密協定提出申訴，我們的法律人員一直在Trust & Safety的支援下審查這些申訴，以確定是否可以恢復更高級別的訪問權限。使用者帳號已被解鎖，是因為他們的訪問權限已被正式復原（通過自我請求或基金會流程）或他們的NDA申訴成功。

考慮到這個問題，我們不打算透露哪些使用者申訴成功。這樣做可能會增加這些人的危險。當然，歡迎他們表明自己的身分，但我鼓勵他們根據自己的風險狀況考慮是否可以安全地這樣做。

我也不打算討論因NDA政策變更而刪除訪問權限的個人，但要注意的是，這些不是在雲端刪除的。
WMCUG仍然舉辦公[開]活動，包括編輯松和新聞服務[。]一些全域封鎖的使用者目前控制著WMCUG以及QQ文字頻道等線下社群媒體平台。只要這組織仍然遵循全域封鎖的控制著這些使用者，是否應該將其根除？
這是一個很難回答的問題，我覺得我難以完美回應，基金會多年來一直從事Trust & Safety行動，但並非所有行動都得到社群普遍的支援。有些行動如此；但有些卻引起爭議。多年前，面對一個在某個社群引起爭議的禁令，基金會採取了一項政策，即基金會對於被封鎖的帳號透過「代理」來編輯，亦有可能會對其封鎖。通常，我們會警告人們，但這取決於當前情勢中原生的風險。

我們目前並不打算取消WMCUG的站內頁面，儘管我確實認為我們有必要把集結成一個非正式團體的一些困境視為一場運動。這些都是被允許的，甚至我認為是個好主意。它降低了參與和組織的障礙。然而，如果這些非正式組織透過維基媒體的網站向其他人暗示，他們以他們不被認可和授權的方式而被認可和授權，可能會引起人們對濫用的擔憂。

我們希望WMCUG的其餘編輯，包括那些被警告的編輯，注意到這次的行動，並重新考慮他們如何與我們社群中的其他人展開合作。在某些情況之下，我們認為某些使用者可能並未完全了解正在發生的事情。我強烈懷疑某些使用者可能需要一段時間來反思這些行動，並確定他們如何最好地實現運動的目的，而不會出現過去的問題。

至於使用者群組頁面，我們將繼續觀察我們網站上的頁面，以了解是否需要就他們可能的對他們扭曲的從屬關係或對遭禁制的使用者進行代理的行為採取行動。

”

英文原文（經格式修訂）

“

When was the Foundation aware of this risk and how long has this lasted?
While we have received related questions, complaints, and concerns from other volunteers dating back to at least 2017, we have been investigating these concerns very seriously for nearly a year, as it became obvious that some early interventions by community members were not going to resolve the issue safely.
What is the connection between the NDA Policy Change and the recent Office Actions?
The non-disclosure agreement (NDA) policy adjustment suspended recognition of NDAs from volunteer applicants who live in jurisdictions that have blocked access to Wikimedia projects and where there was reason to believe that the domicile associated with the user accounts were known to others than the individual applicant(s) and the Foundation. This was necessitated by recent world events triggered by credible information about a more focused security threat to the Wikimedia community that placed multiple volunteers at risk.

The security risk related to information about infiltration of Wikimedia systems, including positions with access to personally identifiable information and elected bodies of influence. This meant that we could not pre-announce our action, without fear of triggering the risk to which we had been alerted. We restricted access to these tools immediately in the jurisdictions of concern, while working with impacted users to determine if the risk applied to them. This is because not all individuals whose access was restricted by that policy change, had bad intent.

The policy change was a first step to address the immediate needs of keeping the community safe. The second step was to get in touch with the impacted users and to work with the Stewards to enact the preferences expressed by impacted accounts in response to individual non-public outreach.

Only after this immediate step to close this security gap was complete did we commence to conclude the investigations into individual community members who may have been involved. The two actions are related in many ways, but not in every point. The Chinese investigation precedes that security risk review and response and does have issues that go beyond it.
Has private information of community members been exposed?
We have no evidence that any technical breach occurred. The first action on changing the NDA policy was intended to prevent technical access to private information about other users by those who could be easily identified, located, and exploited whether by state actors or others with an interest in controlling information. Since our software tracks when such information is accessed, we do not have any reason to believe that this information was accessed in such a manner.

There is always a question of how much information volunteers release themselves to other volunteers, including over private email and in meet-ups. I wish we lived in a world where everyone could be taken at face value and good intentions trusted, but while 「assume good faith」 is a key approach to working in Wikimedia communities, it does not and should not immediately extend to sharing personal information. In the near future, I hope we will be able to increase our collective work towards helping people better understand the risks of what they share and with whom and how to manage their private information safely in a digital environment. In the meantime, I would encourage every Wikimedian who is concerned about their own security to drop by the Voices Under Threat page on Meta: https://meta.wikimedia.org/wiki/Voices_under_Threat. This page collects some resources that may help.
Is the community allowed to hold RfAs for those removed of their advanced rights? Is reformation of the RfA system required (compulsory) for holding future RFAs, including or at least for those who were desysopped?
The individual desyoppings took place for a number of reasons, including evidence of biased elections where individuals were pressured (sometimes with off-wiki threats on QQ and other platforms) to vote as they did and evidence of misuse of administrative tools to support the aims and activities of some of the banned members of the group. Activities include doxing, harassment, sharing accounts, and off-wiki coordination. However, it is not always clear how much these individuals knew or understood about what some of the members of that group were doing, and the Foundation does not object under the Secondary Office Actions provision of the Office Action Policy, on removal of advanced rights, to the community determining to fairly re-elect them. Considering that evidence evaluated of the groups』 activities includes physical coercion of volunteers who opposed the group, we do believe it would be better for the community to reform the RfA system first, but in the meantime we are prepared to support by reviewing any such elections against the patterns observed in prior elections.
Were users affected by the NDA policy change ultimately able to recover their accounts?
Yes, although I am not sure if that process is fully complete. Given the nature of the threat, we felt it best secured the safety of the communities and the users themselves to shut down their access on the server-side while we contacted them individually. All users were offered the option to remove their access on their own accord, and some did so. Some users wished to request an appeal of the revocation of their NDA, and our Legal staff have been reviewing those appeals with the support of Trust & Safety to determine if higher levels of access could be restored. User accounts have been unlocked as their access has been formally withdrawn (either through self-request or Foundation process) or as their NDA appeal has been successful.

In anticipation of the question, we do not intend to name the users whose appeals were successful. Doing so could increase the jeopardy of these individuals. They are welcome, of course, to identify themselves, but I would encourage them to consider whether they can do so safely, based on their own risk profiles.

I am also not going to discuss the individuals whose access was removed by the NDA policy change except to note that their removal is not under a cloud.
The WMCUG still hosts public events, including editathons and news services as some globally banned user(s) are currently in control of WMCUG along with off-site social media platforms like QQ text channels. Should these organizations be removed from on-site exposure as long as they are still in control of such users to comply with global bans?
This is a hard question, and I suspect I will not answer it perfectly. The Foundation has engaged in trust & safety activities for years, not all of which receive universal community support. Some do; some are very controversial. Years ago, in the face of a ban that was controversial in one community, the Foundation adopted a policy that users who edit by 「proxy」 on behalf of Foundation banned accounts may also be banned. Typically, we try to warn people, but it depends on the risks inherent in the situation at hand.

It is not our current intention to eliminate the on-site page for WMCUG, although I do believe that it will be necessary for us to consider as a movement some of the hard questions around the formation of informal groups. These are allowed, and in my opinion that is a very good idea. It lowers the barrier to participation and organization. It can, however, raise concerns about misuse if such an informal group uses Wikimedia’s sites to suggest to others that they are recognized and authorized in ways they are not.

It is our hope that the remaining editors of WMCUG, including those warned, will take heed of this action and reconsider how they work with others in our communities collaboratively. In some cases, we believe some users may not have been fully aware of what was going on. I strongly suspect that some users may need a period of time to reflect on these actions and determine how they can best move forward with the goals of the movement without the problems of the past.

As to the user group pages, we will continue to watch the ones on our sites to understand if action is necessary if they seem to misrepresent their affiliation or to be proxying for banned users.

”

使用者:LuciferianThomas/沙盒/Wikipedia:2021年基金會針對中文維基百科的行動

目次

基金會行動中被全域禁制或除權處分的使用者列表

維基媒體基金會聲明

後續回應

相關新聞媒體報道