User:MarginalCost/Vandalism detection timeline

//Quite possible someone else has compiled a similar page elsewhere, though I can't find anything.

When a vandal attempts to disrupt an article, what steps are in place to stop them?

Overall, the central tradeoff is reaction time vs. expertise and judgement. In the early stages are automated processes that stop only the most obvious problems, while by the end, those watching the page may have considerable expertise in the area.

I'll refrain from getting too far into WP:BEANS, but I think it's helpful to have an overview of the process.

Stage 0: Semiprotection and The Edit Filter (-0 seconds)

Semiprotection, and its cousins, prevents new and unregistered editors from editing frequently vandalized pages. Simply by raising the level of effort needed to vandalize, and forcing vandals to choose less attractive targets, this can make the critical difference to get a vandal to say "eh, I've got better things to do." It may also have the same effect on constructive contributions, but that's for another day.

The Edit filter prevents the most straightforward vandalism from ever seeing the light of day, in addition to preventing the insertion of Wikipedia:blacklisted sources. A log is kept for each user of any edit attempts they've made rejected by the edit filter.

Drawbacks: Only rejects edits with an extremely high likelihood of problematic vandalism. May encourage vandals to try more subtle approaches. Not well integrated with user talk warning system.

Stage 1: ClueBot_NG (<5 seconds)

User:ClueBot NG quickly reverts obvious vandalism quickly and warns the user - but only once per page.

Why allow these types of edits past the edit filter at all? Bots can't be 100% certain they're vandalism, so this allows human oversight if necessary.

Drawbacks: Can be reverted by vandals, cannot detect subtle vandalism, occasionally goes down.

Stage 2: Recent Change Patrol (<5 minutes)

Though I'm calling this "stage 2", it's not uncommon for the humans to beat the bots to reverts. And though I'm labeling this as the first 5 minutes, most of the action takes place within about 30 seconds.

Here's where the big guns come in. Using the recent changes log or special software, the vast majority of potentially problematic edits get human eyes on them. Though Recent Changes Patrollers can't verify every citation, they have that human judgement for when something looks off that bots (currently) lack, and can do follow up. They can verify that edits to an infobox, image name, or table didn't mess up the intended visual style. They'll spot redlinks in lists. They can look at an editor's contribution history and follow them around to clean up their messes. And they will report the bad apples to WP:AIV.

Drawbacks: RCP isn't magic. Almost all, in one way or another, depends on a series of filters, especially ORES. Most automated tools don't make it easy to verify changes to tables, templates, and other complicated page structures. And RCP volunteers generally don't have expertise in the article they're reviewing, so errors can get through if they don't set off obvious red flags. The daily fluctuation in number of patrollers doesn't always match the number of vandals.

Stage 3: Miscellaneous post-RCP cleanup (5 minutes to 3 hours)

Let's say an edit has survived the first 5 minutes or so, after which it has likely fallen off most RCP's radar. Is all hope lost? Not necessarily.

Some Recent Changes Patrollers will take a look at versions of the recent changes log that show edits with very high ORES vandalism scores (likely bad and very likely bad) that have stuck around past the time the RCP has usually done its thing - though again note the heavy dependence on automated tools. Persistent vandals may get away with something on one page, but then draw attention to themselves on a subsequent edit, and get their earlier handiwork erased. And some pages have Pending changes protection to guarantee edits from new users get a second set of eyes.

Overall, this is probably the area where Wikipedia could probably see the most benefit from beefing up. Though this is more easily said than done.

Stage 4: Watchlists (1 to 5 days)

In most cases, this is the last line of defense for articles. Here is the first time potentially problematic edits will be looked at specifically by someone who has some level of interest in that particular article. Unfortunately, watchlist coverage is spotty, especially as many of the site's original editors have left. And even watchers of a page won't necessarily track down every citation, or may overlook changes that make a page worse - either out of general conflict avoidance, or from a well-intentioned sense of WP:PRESERVE. But overall, the watchlist is the only stage in the process well-suited to catching subtle vandalism.

Stage 5: General Readership (5 days and onward)

May God have mercy on us. If a vandalizing edit has lasted a week or more, almost the only way it will be corrected is if someone stumbles across it while at the article for another reason - either reading or editing. The good news is that the most heavily-trafficked articles will usually have someone spot the problem before long. But the bad news is that the more obscure topics - where there is often a scarcity of available information on the web, and Wikipedia ought be one of the more accessible resources - can languish for years.

The only bright side is that some reader may spot the problem, try to fix it, and get sold on the idea that this really is an encyclopedia that anyone can help improve.