New Admins?

During the mid-July mayhem at forum.susan-boyle.com, members reported seeing new names in the admin control panel.   Here is a screen capture of all those with access at the time it was taken (July 20th, 2010). 

(Click image to enlarge)

Pickled Tink and lchris were supposed to have access.  Citroenlady and Xeno were given temporary access to help lchris try to get the confusing  situation under control. 

But who were the others?  EvaMarie?  kaydaniels?  Looie?  roseym? Those were not names of any staff members.  What were they doing in the admin control panel?

This screen cap (also from 7/20/10)  shows three of the new admins; kaydaniels, Looie and roseym.  It shows join dates for them in August and September of 2009.  Were they existing members who suddenly got promoted to admin?   Hmmm….they don’t have any posts. 

(Click image to enlarge)



Even though the join dates indicate that they joined in 2009, that can be double-checked in other areas of the database.   We can tell when they were created by checking two things, the user number and the password date. 

User numbers are given sequentially and can help determine when the accounts were registered on the forum.  The later you joined, the higher your number.   The first user number assigned in August 2009 was 2208.  The last number assigned in September 2009 was 3962.  If those accounts were created in August or September of 2009, their user numbers would be between 2208 and 3962. 

What were the user numbers of the new admins?  From the user log and admin log, I can establish the following member numbers.  (I have included jayme in the list because that member was used and altered in similar ways to the others.)

User name	User id
EvaMarie	8036
kaydaniels	8101
roseym	8102
kaydaniels	8106
Looie	8108
Jayme	8109

The user numbers indicate  that, in spite of the join dates shown, those were new accounts.   The user numbers are over 8000.  User numbers of 8000 or greater were not given to new members until June 22nd, 2010.   That means that those user accounts must have been established after that date.  Those members joined in June and July of 2010. 

Why did kaydaniels have two user numbers?  Because the first kaydaniels (user id = 8101) was “killed” by EvaMarie (user id = 8036).  To “kill” in vBulletin is to “run code to remove item in database”.  When an account is killed, it is removed from the registered user group.    However, some records still exist in the admin logs.  The admin log shows that the first kaydaniels account was “killed” on July 18th at 8:30 pm.  The IP address used by EvaMarie to perform this action was the same as that used by staff member Danileo.

adminlogid	userid	dateline	script	action	extrainfo	ipaddress
48091	8036	1279503005	user.php	find		6x.xxx.xx.xx7 (Danileo)
48092	8036	1279503005	user.php	edit	user id = 8101	6x.xxx.xx.xx7 (Danileo)
48093	8036	1279503027	user.php	remove	user id = 8101	6x.xxx.xx.xx7 (Danileo)
48094	8036 (EvaMarie)	1279503037 07 /18 /10 @ 8:30:37pm EST	user.php	kill	user id = 8101 (kaydaniels)	6x.xxx.xx.xx7 (Danileo)

The password date can also help confirm when a user account was created.  The password date is the date on which the password was established.  It also shows if a password was later changed.  Both actions are recorded.  (The password code is a series of 32 numbers and letters and is not decipherable.  But in the interest of safety and privacy, I have not shown all the numbers here.)

Let’s take a look at the password history.   EvaMarie was given a password on June 30th.  It was changed on July 17th .  The rest of the accounts were given passwords July 18th and 19th.  Roseym changed her password once on the 18th.   A few other members signed up on that day, also getting user numbers in the 8000s.  Lovin’ Every Minute, larryF  and ClixPix are among them.

userid	password code	passworddate
8036 (EvaMarie)	8(xx)0	2010-06-30
8036 (EvaMarie)	A(xx)d	2010-07-17
8101 (kaydaniels)	8(xx)5	2010-07-18
8102 (roseym)	1(xx)2	2010-07-18
8102 (roseym)	b(xx)c	2010-07-18
8103 (member)	d(xx)9	2010-07-18
8104 (Lovin’ Every Minute)	7(xx)1	2010-07-18
8105 (larryf)	b(xx)c	2010-07-18
8106 (kaydaniels)	5(xx)6	2010-07-18
8107 (ClixPix)	8(xx)d	2010-07-18
8108 (Looie)	c(xx)d	2010-07-18
8109 (jayme)	e(xx)d	2010-07-19

It is clear from both the user numbers and the password dates that the new admin accounts were created in June and July of 2010.  Yet the join dates shown for those new admin accounts were in 2009. 

The record was altered to make it appear that the accounts were not newly created. 

Join dates were not the only thing fake about the new admins.  The IP addresses shown in the user log were also altered.  They did not actually use those IP address for their subsequent actions.  The join dates are all that would be visible to most members of the forum.  Only the staff would be able to check the IP addresses in the user log.  Were those IP addresses intended to fool other staff members who might check?  (Assuming they didn’t recognize the significance of the user numbers.)

The new admin accounts were not the only time that a join date was altered to make it appear that a member was not brand new.  As shown in the password chart above, the account for larryF was also created on July 18.  But the join date shown in his posts was Aug 2009. 

(Click image to enlarge)

Again, the purpose appears to be deception.  The post log shows that the posts by larryF were made from the same IP address as that used by staff member LonniR.  It is legitimate for a staff member to have a second account in order to view the forum as a member would see it.  But there is no legitmate reason for a staff member to create a second account solely for the purpose of confirming her own opinion and spreading misinformation.

postid	threadid	username	userid	dateline	ipaddress
299443	8132	larryF	8105	1279506565 07 /18 /10 @9:29:25pm EST	7x.xxx.xxx.x1 (Lonni)
299454	8132	larryF	8105	1279507032 07 /18 /10 @ 9:37:12pm EST	7x.xxx.xxx.x1 (Lonni)

Did the “investigator” used by the Board examine the records of these new admins?  For those members familiar with the staff of the forum, the names Evamarie, kaydaniels, roseym and Looie appearing in the admin control panel were clearly a sign of a problem.  But did the investigator recognize that those names were suspicious?  Did he even look at the activities recorded in the admin log?  Would he have known who should be shown in that log and who should not?

What did the Board report say about these new admin accounts? 

Lchris also raised concerned that PT had not “authorised” the creation of 2 test admin accounts by Judyokla and Danileo in July however, they had notified PT by email of the creation of these accounts in accordance with lchris's own advice on redundancy. These accounts had no admin permissions attached to them and were fully visible in the admin panel and were never “secret.”

The six accounts above have become “2 test admin accounts” in the report.  And they were supposedly created, on the advice of lchris, for “redundancy”.    If that were true, there would be no need to alter the record to hide when they were created.    The report also claims that the “test accounts” had no admin permissions.   If that were true, would EvaMarie have been able to “kill” the account of kaydaniels (8101)?

Slander and Suspicion, Chaos and Confusion

What happened on the forum last July?  Dyebat asked that Board and staff be able to prove they were real people, rather than anonymous internet identities.  And all hell broke loose.  Staff members began resigning, even those who had already provided identification. 

Waldog and Stevieboy resigned first.  They were followed by Kalua.  Staff told some members that they had planned a “mass exodus”.

Staff members began to make posts falsely accusing a group of people, the DJGers, of trying to take over the fansite.  They claimed that Dyebat and lchris were also involved in the imagined “takeover”.  LonniR sent out the following email to several members.

From: "Lonni Xxxxxxx
        Date: Sun, July 18, 2010 11:23 am 
     
       (Name), I'm letting you know that unless the good members such as yourself and as many friends as you can muster do not post against Chris and Dyebat's actions, the entire staff is prepared to resign today.
        Hard to believe, I know, but they are in league with DJG and his followers, who hate us and have sworn to bring our Forum to its knees. We have long suspected it, but the proof of it is right there on that thread. Notice who keeps constantly defending their actions and attacking us.
        If we don't receive help today we will be gone and they will have it. If you want to save the forum, please get as much help as you can and start posting the truth.

She posted similar allegations on the forum.

LonniR:  It is not this site that is evil, but it is being taken over by those who are.  Look at some of the ani-staff(sic) posts and you will see it.  (07/18/10@ 12:59:04pm EST)

She was joined in those false and slanderous accusations by other staff members.

Truus: I can tell you what is happening here is a planned takeover.
And as much as I admire the efforts of Dyebat, Ichris and Tweek, I can tell you they lead you now the wrong way.
The worst thing is they are not honest to you all, as members.(07/18/10@ 11:03:07pm EST)

Waldog:  Then Dyebat took it upon herself to TAKE OVER the site and the forum and make demands on staff that were not agreed to.  Dyebat is not honest about any of this nor has Ichris been.(07/20/10@ 12:37:15am EST)

None of that was true.  Those who were accused knew that it wasn’t true.  But something was happening.  There were reports of strange occurrences on the forum. 

Access to threads and to the Red Room was changed.  Some members had their PM capacity reduced.  Some threads and posts disappeared.  Some members could not read all the threads.  Here are just a few of the things members reported.

• The page numbers are not working correctly on some of the threads.  You cannot get beyond page one.

• The trolls are in again and have changed the title of the "Chats About Susan" subforum to "The Happy Valley".

• Some hacker was just in the control panel

• those members in the "Red" category have full access to the site, while regular members do not. If you read the newest threads, it's only the "Red" members who can read and post in them.

• When I try and go in to go into the "Transparency" thread that Dyebat started I get this message: (Name), you do not have permission to access this page.

• when I try to post new threads, I get a message that I am not permitted to do so.

• the only forum sections I can currently see are Forum Rules, Forum Announcements, Blog of the Day and Continuous Chats. What happened to all the rest of the topics?

• Somebody was posting today, by the name of "EvaMarie".  It said the account was opened in July 2009 but I think today was the first time there had been any posts.

And most disturbing of all were the reports of unfamiliar names in the admin control panel.

• heads up I am seeing kaydaniels...in the location of the Mod Control Panel...

What was going on?

Unbanned?

Both former members, LEM and Luz, had re-registered for the forum and were able to read the threads.  Word of that got around to some who knew that LEM had been gratuitously banned after her resignation (because it was shown under her name).  An amnesty for banned members had recently been discussed between Kalua, Pickled Tink and Citroenlady.  As a result, some mistakenly thought this meant that the amnesty had been implemented. 

For example, WAMcKinley posted:

LEM was a former mod at this forum. If I recall her story correctly, she resigned and then was banned, for no discernible reason. (Refer to forum history: "Bad Ol' Days") Maybe she was accorded amnesty. If so, it would be justly deserved, IMHO.

So Clix Pix, who had been banned, heard about it and decided to see if she could rejoin.  But her account had not been deleted like LEM and Luz, so she was not able to rejoin using her old name.  Clix Pix (user id = 3614) was still present in the database and shown as “banned”. 

userid	usergroupid	username
3614	8 (banned)	Clix Pix

So she tried registering under a slightly different name; ClixPix (no space).  That user name was accepted and she was given a new user number.  The account was activated at 9:31 PM EST.   Here is a screen cap from July 18 showing the user name and number, ClixPix (user id = 8107). 

When someone is unbanned, the steps shown in the admin log are liftban and doliftban.  None of those actions occurred on July 18.  The admin log shows that not a single ban was lifted on July 18th. 
 

She was never “unbanned” as Clix Pix.  She rejoined as a new member with a similar, but not identical, name.  There is no record of the account ever being approved. No one let her in.

But some questions remain.  Why were staff expecting the return of banned members?  Pickled Tink posted in the staff room on May 16 that “The DJG'ers are already talking about bringing back banned members.” 

Why did she say that?  It was not true. No one at Susahumor had suggested bringing back banned members.  So where did she get that idea?  Were her spies at that forum unreliable?  Inventive?

The timeline is also interesting.

• 3:38 PM EST  Luz activates her account by replying to the welcome email
• 8:18 PM EST LEM activates her account
• 8:59 PM EST UKSusanfanAnn notices LEM reading the thread
• 9:00 PM EST  Hulapig declares that “banned and resigned members are being let back in”
• 9:06 PM EST Hulapig: “A banned member. YOUR staff is not doing this.”
• 9:31 PM EST ClixPix activates her account

Some members recognized LEM, some didn’t.  But Hulapig made it clear that she believed it to be a return of the banned.  Note that Hulapig was posting about the “banned” being re-admitted before ClixPix activated her account. 

Clearly, creating panic about “banned” members was on someone’s agenda.  Why?  Who originated the lies about banned members returning?  And who was spreading them?

Another area of concern are the actions of Pickled Tink, an admin at the forum and Chairperson of the Board.  Tink included a deliberate lie in the official report.  (Had there been a real investigation, they would have found, like I did, that no banned members were re-admitted.)

From the report of the Board, Nov. 14, 2010:

We have explored the issue of the banned members. It seems that in actual fact only one banned member was readmitted, and that one of the temporary admin appointed by Lchris has said she admitted this person as she thought that the amnesty which had been discussed by PT, Kalua, and Lchris towards previously banned members had commenced.

What she wrote was not true.  If this was simply a mistake, it would not be so bad.  But there is reason to believe that at the time the report was written, Pickled Tink knew that Citroenlady had not admitted Clix on July 18th. 

Citroenlady was not a mod at the time Clix Pix rejoined and therefore in no position to admit her.  That fact had been discussed at two meetings in which Pickled Tink participated.  In a chat meeting on July 29, 2010, at 3:35 pm, lchris told her that CL was "let in later".  Tink responded, "yes I checked your log to see what time she was let in".

On August 12, the Tech team had a chat meeting, attended by Pickled Tink, Danileo, JudyOkla, Truus and lchris.  One of the things discussed was the supposed “unbanning”, which took place the 18th.  JudyOkla asked about Citroenlady being the one who had unbanned and lchris replied that her access was not changed until the next day. 

Judy says:  and how do you know it wasn't cl since you gave her admin permissions?

Chris says:  CL's admin permissions were given July 19th...

Pickled Tink was made aware of that fact at least two times, yet she chose to lie about it.  That was foolish because publicly available information (the Transparency thread) could be used to debunk Tink’s claim by showing that no temporary mods were yet on duty at the time.  After that was pointed out, that lie was removed from the report. 

This naturally begs the question of why Tink would write it in the first place.  Why did she think it necessary to smear Citroenlady?  Why does the Board have a person who would do that as its leader?