Page 1 of 2

Askamgate Investigation Report

Posted: Sat Jan 09, 2016 7:00 pm
by YSFHQ
The following represents the official YSFlight Headquarters staff response to an incident occurring one week ago on the forum. Our investigation into this incident has concluded. Real IP addresses and email addresses has been redacted to protect the privacy of those involved (per Section 5 of the YSFHQ Terms of Service). Members who do not wish to share their concerns publicly may email admin[at]ysfhq.com with them (anonymous email accepted).

The Events:
At 11pm ET on January 1st Eric was made aware of a series of posts reported by various community members in the thread "Hi Im Askam". The posts contained spamming of a racial slur, which breaks YSFHQ rules. Eric decided the best course of action was to temporarily move the topic to a separate admin forum so that the spam posts could be hidden from the thread. He also discovered the mChat was filled with similar spam and temporarily disabled it to prevent further spam. These actions were reversed at 4:00PM on Saturday, January 2, 2016.

Several posts were in clear violations of spam, appropriate posting, and forum rules. They were permanently deleted.

Three of the reported posts were made by Varren, two by TheJuli, and one by a new member Askam_Chebsey. These same users were causing the spam in the mChat.

Background Information:
Varren was removed a day earlier (30 December, 2015) from the YSFHQ staff through a vote by the community, in which an overwhelming majority voted him off due to various infractions while Staff Chief and Core Staff. Considering these recent turbulent events, the administrative team reviewed this spam incident with due caution and thoroughness.

Admin & Staff Investigation and Actions:
Investigation into the matter was quickly started by several members of the staff team who found the following information (see Timeline). This is also a list in chronological order of the actions taken by staff members during the investigation and while determining the results of it (all times ET): [1/1/16 7:30PM] - Topic created in Personal Messages called, “Hi Im Askam.”
[1/1/16 7:30-10:00PM] - Topic becomes evidence for trolling, spamming, inappropriate posts, and derailing by several members.
[1/2/16 12:00AM] - Eric temporarily moves “Hi Im Askam” to The Dungeon so posts can be hidden from public and properly reviewed by staff.
[1/2/16 12:02-12:08AM] - Eric temporarily removes mChat from forum.
[1/2/16 12:12-12:31AM] - Kujo permanently deletes 6 posts from “Hi Im Askam” (3 by Varren, 2 by TheJuli, 1 by Askam).
[1/2/16 12:29AM] - Eric removes posting and mChat permissions from Varren and TheJuli and grants them “Read Only Access.”
[1/2/16 12:42AM] - Kujo deletes a report on a post in the topic “Hi Im Askam.”
[1/2/16 12:44AM] - Eric creates topic regarding the situation in the admin forum.
[1/2/16 2:39AM] - After discussion between Eric, Kujo, and VNAF, it was brought to the attention that the user account “Askam_Chebsey” was a sockpuppet registered with a proxy IP and temporary email address. With this, a topic was created in the admin forum called “Askam_Chebsey” to post further investigation of the legitimacy of the user and its origin.
[1/2/16 3:29AM] - Eric finds clear evidence of the sockpuppet account and its origins:
Eric wrote:I now have reason to believe this user was created by Nath, not Varren or TheJuli. Evidence is as follows...

EDITOR'S NOTE: Real IP addresses have been replaced with [REDACTED] for this public post.

Exhibit #1: Site access logs (selected entries)

Code: Select all

forum.ysfhq.com:80 [REDACTED] - - [28/Dec/2015:11:51:56 -0500] "GET /viewtopic.php?f=217&p=93844&thanks=93844&to_id=1921&from_id=837 HTTP/1.1" 200 7494 "https://forum.ysfhq.com/viewtopic.php?f=217&t=8275&sid=f26099e16adaa4e972055fa855e16d9f" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36"
forum.ysfhq.com:80 [REDACTED] - - [01/Jan/2016:17:27:50 -0500] "POST /app.php/ucp.php?_=1451687259235&mode=delete_cookies&confirm_key=3DSELDLKMP&confirm_uid=837&sess=0126d83c3018795db3eeb4c6cffc55a9&sid=0126d83c3018795db3eeb4c6cffc55a9 HTTP/1.1" 404 266 "https://forum.ysfhq.com/app.php/chat" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36"
forum.ysfhq.com:80 [REDACTED] - - [01/Jan/2016:17:49:03 -0500] "GET /ucp.php?mode=register HTTP/1.1" 200 5141 "https://forum.ysfhq.com/ucp.php?mode=login" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36"
forum.ysfhq.com:80 31.3.224.69 - - [01/Jan/2016:17:51:39 -0500] "GET /ucp.php?mode=register&coppa=0 HTTP/1.1" 200 8129 "https://forum.ysfhq.com/ucp.php?mode=register" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36"
forum.ysfhq.com:80 31.3.224.69 - - [01/Jan/2016:17:54:26 -0500] "POST /ucp.php?mode=register HTTP/1.1" 200 6562 "https://forum.ysfhq.com/ucp.php?mode=register" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36"
In this exhibit we see the IP address [REDACTED] - the first line shows the user associated with the IP thanking a user for a post. Looking closer, we see the "from_id=837" and that user ID 837 comes back to Nath. The next line, about 25 minutes before this new user shows up, we have another example this is Nath, with "confirm_uid=837", the same user ID. The third line shows a logged out user visiting the register page, with the same IP as Nath. We know they are logged out because previous log entries show that IP visiting the logout page. They do not go any farther with this IP address. About 2 minutes later, a new IP appears, 31.3.224.69, and proceeds to visit the register page. On the final line we see a HTTP POST, indicating the registration form was submitted. This form submission leads to the creation of our user Askam_Chebsey.

Exhibit #2: Teamspeak log from the day of the account registration

Code: Select all

2016-01-01 19:50:30.262723|INFO    |VirtualServerBase|  2| client connected 'Totalement'(id:2797) from [REDACTED]:58958
2016-01-01 21:32:11.631005|INFO    |VirtualServer |  2| file upload to (id:645), '/SATURDAY.mp3' by client 'Askam Chebsey'(id:2797)
2016-01-02 01:32:56.003190|INFO    |VirtualServerBase|  2| client disconnected 'Askam Chebsey'(id:2797) reason 'reasonmsg=Bye.'
In this exhibit we can see a user "Totalement" joining our Teamspeak server with IP [REDACTED]. Over an hour and a half after they join, a file is uploaded to the PAVA Executives channel "id:645", "SATURDAY.mp3" by the user "Askam Chebsey", yet they retain the same user ID of 2797. Almost exactly an hour later, "Totalement" leaves under their new username "Askam Chebsey".

Looking at both of these exhibits, we can see that the IP [REDACTED] is connected to Nath's forum account as well as Totalement's teamspeak user. The teamspeak user leaves the server under the same username we saw register on our forum. Nath seems to have visited the user registration page, realized his real IP would be visible, and decided to use a proxy instead - the proxy server is hosted by redstation.co.uk and paid for by one of their customers.

I think the evidence speaks for itself. Nath is the likely person behind the account Askam_Chebsey, coordinating in some way with Varren and TheJuli.
[1/2/16 3:54PM] - Eric merges the two topics in the admin forum (“Askam_Chebsey” and “Asakam’s Welcome”) together since evidence was converging to the same members.
[1/2/16 3:58PM] - Eric restores mChat to forum Mini-Chat page.
[1/2/16 4:00PM] - mChat restored to Board Index
[1/2/16 4:00PM] - Posting permissions restored to Varren and TheJuli.
[1/2/16 4:16PM] - “Hi Im Askam” topic restored to Personal Messages forum without permanently deleted posts.
[1/2/16 6:32PM] - Eric provides another update on the sockpuppet account evidence
Eric wrote:Update: I can confirm that a proxy was used when the Askam account was registered. They were using the ZenMate service. See attachment for proof - it's the same IP as what we had when they were registering.
Image

Nath's forum email address does have an account on Zenmate, so it is very likely Nath used Zenmate to register Askam_Chebsey.
Image
[1/3/16 4:12AM] - Eric created a poll for elected staff to vote on proposed consequences for those involved.
[1/3/16 4:30PM] - At the request of the Admins, a list of Varren’s YSFHQ history is compiled by Eric.
Eric wrote:Update: here's everything relevant I could dig up with a search of "calum" and then "varren". For purposes of this list, I will refer to Varren by his current username, Varren, from beginning to end. I wrote the description for each link as it pertains to this discussion.
  1. SEPTEMBER 3, 2011: Varren joins YSFHQ viewtopic.php?f=172&t=1755
  2. Varren threatens "hacking" viewtopic.php?f=22&t=2072
  3. permaban announcement by Iceman viewtopic.php?f=167&t=2073
  4. va crackdown, wingz says VAs who allow members to troll should not have a subforum viewtopic.php?f=22&t=2086
  5. let Varren back in? viewtopic.php?f=22&t=2382
  6. "Eventually let Varren back in with restrictions?" viewtopic.php?f=22&t=2510
  7. relevant but not part of rap sheet: Fight the power mentality DISCUSSION viewtopic.php?f=22&t=2821
  8. Gamma, Varren's sockpuppet account viewtopic.php?f=220&t=2907
  9. another sockpuppet account viewtopic.php?f=22&t=3401
  10. Varren returns viewtopic.php?f=172&t=3417
  11. how long has Varren been playing YS? viewtopic.php?f=137&t=2531&p=45075#p45075
  12. name change to Varren from Calum, some posts deleted from thread viewtopic.php?f=220&t=3669
  13. status of Varren on YSFHQ viewtopic.php?f=22&t=4537
  14. YSFHQ hits 2 years viewtopic.php?f=22&t=4761
  15. email sent from YSFHQ Mailchimp by Calum viewtopic.php?f=167&t=4774
  16. Cougar, another Varren sockpuppet account viewtopic.php?f=220&t=4823
  17. another discussion of a ban of Varren viewtopic.php?f=22&t=4828
  18. admin team makes an announcement viewtopic.php?f=167&t=4846
  19. relevant post by VNAF viewtopic.php?f=204&t=4868#p57613
  20. Varren supposedly stalking Dan and Dave viewtopic.php?f=204&t=4885
  21. another sockpuppet account viewtopic.php?f=220&t=5026
  22. Varren does something useful and talks to Soji viewtopic.php?f=204&t=5032
  23. more discussion about Varren and Alpha Star viewtopic.php?f=220&t=5111
  24. Varren writes an apology letter viewtopic.php?f=22&t=5127
  25. Varren listed in disaster recovery plan as mechanic #2 viewtopic.php?f=22&t=5399
  26. Varren helps with Project Kaizen viewtopic.php?f=22&t=5423
  27. civil war breaks out, Varren makes some proposals for a "democratic" HQ viewtopic.php?f=217&t=7982
  28. Varren elected as staff chief viewtopic.php?f=167&t=8004
  29. VNAF removed from HQ, Varren mostly to blame viewtopic.php?f=217&t=8216 and part 2 viewtopic.php?f=217&t=8220
  30. Varren makes hasty decision that YSFan is a sockpuppet viewtopic.php?f=22&t=8274
  31. one topic ID later, vote to forcibly remove Varren from staff viewtopic.php?f=217&t=8275
  32. PRESENT DAY: Varren tests us with another sockpuppet (run by Nath) viewtopic.php?f=172&t=8302
[1/4/16 6:40PM] - A modification to the bans is proposed.
[1/6/16 4:06AM] - Poll ends with a 4 to 1 vote in favor of final proposal of consequences (see Results) by all elected staff.

Please remember that though few names are mentioned above, this investigation and decision took the entire staff team’s collaboration and teamwork to conclude one week after the initial incident took place. Statements made by Varren and others involved consider their actions "testing" the YSFHQ staff.
Eric wrote:
Facebook chat wrote:Varren:
ayy lmao this is the first time the chats gonna be used for its purpose so here goes

Varren:
yesterday I ran a little test, needless to say you guys failed. Removing me for the reasons provided was pretty justifiable, so fair game. But then you went and did the exact same things, please actually at least hold yourselves to the same standard. The rules don't allow you to remove sigs, only resize them and removal is only prohibited when its some illegal shit like that spambot posting links in its sig to dodgy websites. Secondly the entire topic was deleted, and not just posts that were spamming, this is pretty wrong especially considering half the posts were legit. And then to top it all off, we received no communication whatsoever, neither me nor juli have received a PM or anything explaining why they were removed. These are the exact issues you had a go at me for so yes, do hold yourselves to the same standard. Needless to say I could've done a VNAF here and posted this publicly and became one of those annoying bitching cunts but I know how that is, so I'll settle for you guys sorting your shit out.

Varren:
Oh wow, and even posting permissions were removed without due cause or even warning ...
Though many of the above accusations are false, the statement above serves as further evidence to the Staff Team that the situation was deliberate and likely to continue to threaten YSFHQ. The staff determined a course of action that would stop the situation temporarily until it could be properly investigated. Though there were mistakes made by the staff in the process of handling the situation, they were with the intentions of protecting the forum from malicious action. These events have provided the staff with a lesson of how to more appropriately and properly handle similar situations in the future, and mitigate any mistakes made here.

Results:
Despite Varren’s claims, this was not a simple test, but rather a deliberate, coordinated and malicious trolling of the community in an attempt to see how the staff would react. The definition of trolling is to "make a deliberately offensive or provocative online posting with the aim of upsetting someone or eliciting an angry response from them."

At YSFHQ we do not tolerate such actions. YSFHQ's mission statement says, "We strive to enhance the experience of those playing YSFlight by creating a fun, inviting atmosphere. We aim to sustain the growth of the community through promoting YSFlight and demonstrating the potential of the game." The inappropriate actions by Varren and TheJuli did not create an inviting atmosphere for any member, let alone a “new member”. This goes against our mission statement and the very first rule of the forum, “We do not allow any sort of personal attacks, trolling, or anything that involves mockery of members on YSFHQ.”

After doing further research, we also discovered that our “new member” Askam_Chebsey is not really a new member at all, but rather a sockpuppet account. We have strong evidence as shown above that this account was created by Nath. Sockpuppet accounts are forbidden.

After debating what consequences Varren, TheJuli, and Nath should have for their actions, the YSFHQ staff has decided the following:

1. TheJuli will each receive a one month ban for spamming the forum and mChat with racial slurs. As a first-time offender for making racial slurs on the forum and mChat, TheJuli has received a one (1) month ban. This is a clear violation of the very first rule of YSFHQ and is not tolerated.

2. Nath will receive a one month ban for creating a sockpuppet account and engaging in the trolling. As a first-time offender for a sockpuppet account on YSFHQ, Nath has received the standard one (1) month ban for such offences.

3. Varren will receive a sixteen (16) month ban for his actions. This is Varren’s fifth incident involving a sockpuppet. For a first time offence, as mentioned above, the typical consequence has been a one (1) month ban. With a long history of infractions and similar incidents, the staff has decided that each additional infraction should have a ban length that is double the previous ban length. Thus for sockpuppet accounts: 1st offence = 1 month, 2nd = 2 months, 3rd = 4 months, 4th = 8 months, 5th = 16 months.


These bans have been made after full deliberation and investigation by the Admins and with supportive data collection and comments by the Core Staff. The YSFHQ staff does not enjoy banning members of YSFHQ, but given the offences perpetrated by the above named members we believe these bans to be fair and necessary. In the interests of transparency, the evidence collected by the Staff Team has been provided to the community. This message serves as an announcement that the bans have been applied. Should these members wish to appeal their bans they may do so like any other member via this form.


Signed,

Your Staff Team

Bombcat, Elected Staff
VNAF ONE, Elected Staff
decaff_42, Elected Staff
jetskit, Elected Staff
Kujo, Elected Staff
Wingzfan99, Core Staff
Eric, Core Staff

Re: Askamgate Investigation Report

Posted: Sat Jan 09, 2016 7:00 pm
by YSFHQ
Revisions after posting:

3:06PM ET 1/9/2016 - Added Varren's history for timeline item "At the request of the Admins, a list of Varren’s YSFHQ history is compiled by Eric."

Re: Askamgate Investigation Report

Posted: Sat Jan 09, 2016 7:15 pm
by Doggeh1
I agree with the bans, for the spamming and other offences, but is it really a racial slur? Everything I can find seems to be a no, really, but if someone could enlighten me on its origins I would be appreciative.

Re: Askamgate Investigation Report

Posted: Sat Jan 09, 2016 7:29 pm
by Gunny
Seems quite civilized,fair and timely.Although I do question but do not dispute your decision of Varren's consequences in the matter.Seems a bit light to me.I think 16 months with a mandatory re registration would have been more appropriate.Basically having to start from day zero and rebuilding trust of the community and Admins again shedding his Varron persona.

Re: Askamgate Investigation Report

Posted: Sat Jan 09, 2016 7:40 pm
by Eric
Doggeh1 wrote:I agree with the bans, for the spamming and other offences, but is it really a racial slur? Everything I can find seems to be a no, really, but if someone could enlighten me on its origins I would be appreciative.
That's what we started calling it. It may not be a racial slur, but it was a derogatory/inappropriate remark.
Gunny wrote:Seems quite civilized,fair and timely.Although I do question but do not dispute your decision of Varren's consequences in the matter.Seems a bit light to me.I think 16 months with a mandatory re registration would have been more appropriate.Basically having to start from day zero and rebuilding trust of the community and Admins again shedding his Varren persona.
The original vote on consequences asked if a permanent ban of Varren was supported, which got 3 votes yes and 3 votes no.

Regarding re-registration, I don't think that is a good idea because then his previous post history is not tied to the new account. Thus, to any new member, he could be completely clean. However if previous history is attached, trust will need to be earned again as everyone can see his past.

Re: Askamgate Investigation Report

Posted: Sat Jan 09, 2016 7:50 pm
by Gunny
Its one of those situations where the explanation is actully worse than the offence itself Doggeh 1.
@ Eric I see the reasoning thank you.

Re: Askamgate Investigation Report

Posted: Sat Jan 09, 2016 8:31 pm
by Neocon
Doggeh1 wrote:I agree with the bans, for the spamming and other offences, but is it really a racial slur? Everything I can find seems to be a no, really, but if someone could enlighten me on its origins I would be appreciative.
When it first happened, I thought it was a nonsense word combining a man with a wild dog, which is why I referenced ManBearPig in the mChat when it first started. Then I looked it up and found that it apparently refereed to a specific ethnic group in Africa. Now, I would agree that the word alone is not racist, any more than "Cherokee" or "Welsh" are racial slurs. It wasn't just the word, but how it was used. The context was the problem. There were pictures.
Gunny wrote:Its one of those situations where the explanation is actully worse than the offence itself Doggeh 1.
Yep.

Re: Askamgate Investigation Report

Posted: Sat Jan 09, 2016 10:30 pm
by V8-DLA
don't forgot the time when YSFan tried to make a va that was named after the racist slur they used.

Re: Askamgate Investigation Report

Posted: Sat Jan 09, 2016 10:41 pm
by Doomsday
V8-DLA wrote:don't forgot the time when YSFan tried to make a va that was named after the racist word they used.
YSFan most likely didn't know that it was a racist term. I wouldn't worry too much it.

Re: Askamgate Investigation Report

Posted: Sat Jan 09, 2016 10:47 pm
by V8-DLA
Doomsday wrote:YSFan most likely didn't know that it was a racist term
so it's forgivable?

Re: Askamgate Investigation Report

Posted: Sat Jan 09, 2016 10:52 pm
by Nodoka Hanamura
This kind of crap is what I'd expect of Trolls surrounding the GamerGate situation - they're in it for the lulz. It's just Varren's been wise with how many bites to take out of the kek pie, and it seems his last one screwed him over.
V8-DLA wrote:
Doomsday wrote:YSFan most likely didn't know that it was a racist term
so it's forgivable?
YSFan, maybe. I don't see reason to ban him or reprimand him apart from a warning.

Re: Askamgate Investigation Report

Posted: Sat Jan 09, 2016 10:56 pm
by V8-DLA
post removed.

Re: Askamgate Investigation Report

Posted: Sat Jan 09, 2016 11:06 pm
by Capt K
The spread of false information is dangerous viewtopic.php?p=94550#p94550

Re: Askamgate Investigation Report

Posted: Sun Jan 10, 2016 12:26 am
by MD5Ray01
Capt K, this isn't false information. This is a combination of what's been found out and what has happened.

Re: Askamgate Investigation Report

Posted: Sun Jan 10, 2016 12:41 am
by NightRaven
MD5, he's referring to Varren's "reassurance" that they chose Mandingo for the name of the LCC VA out of pure chance, and not referring to this whole thread.

Re: Askamgate Investigation Report

Posted: Sun Jan 10, 2016 12:42 am
by Neocon
And if it was out of pure chance, why were there pictures?

Re: Askamgate Investigation Report

Posted: Sun Jan 10, 2016 5:56 am
by Vic Viper
Excellent work admin team, and thank you for the transparency. We never got this level of openness on YSP.

I didn't even realize how long his rap sheet was, smh

Re: Askamgate Investigation Report

Posted: Sun Jan 10, 2016 6:14 am
by Flake
I applaud all the hard work of all staff involved in resolving these issues. You are definitely making movements in the right directions and you do deserve to be applauded for it.

As a lover of the community here, this site, and the game itself, I can't say thank you enough for what you do.

Re: Askamgate Investigation Report

Posted: Sun Jan 10, 2016 7:36 am
by YSFan
So my lifted permaban was all due to Varren?

Re: Askamgate Investigation Report

Posted: Sun Jan 10, 2016 7:54 am
by NightRaven
Yes. This is a separate incident in which Varren's rash decision making caused him to ban you without complete information. It was also never mentioned in public unlike this case.

Also he claimed to have removed my warning level but it's still there. :lol: