A ‘sock puppet’ is an online identity assumed by somebody who pretends to be another person. It appears that a group of sock puppets are targeting Wikipedia, creating pages relating to naturalised Brazilians who have played for the East Timor national team. Investigative journalist and documentary maker Jack Kerr has been investigating this issue for some time, and recently reported on the sentencing of individuals for fixing East Timor’s U23 side. In this article, Kerr and Asher Wolf explore how sock puppets have been manipulating online information relation to South East Asian football, the potential reasons why they have been doing this and how most of the posts can be linked back to one person.

“A wave of naturalisations of players of Brazilian origin always sounds suspicious”, warns Antoine Duval, a senior researcher in international sports law at Europe’s Asser Institute. Around twenty naturalised Brazilians soccer players have pulled on the shirt of East Timor – a former Portuguese colony off the north Australian coast – in recent years, and the deeper you dig, the more suspicious it looks.

Why, for example, is a group of online identities obsessively leaking falsified documents about the Timorese national team and its soccer federation, and doctoring multitudes of related Wikipedia accounts? Is it tied to betting? To corruption? To an unsound state of mind? Is it driven by an intense passion for the game? Are they being paid? Or do they simply have too much on their hands?

In 2011, an investigation by Wikipedia administrators uncovered a ring of sock puppets – or fraudulent aliases – being operated, it claimed, on behalf of the Malaysian national team. The discovery revealed that the Malaysian national team’s page is completely riddled with sockpuppetry. Six of the page’s eight leading contributors are, or have been, banned for their hoaxing.

A sock puppet is a fraudulent alias used by an internet user for some kind of underhanded purpose. They may, for example, post references to different material under different names (and perhaps even on various sites), in order to build up credibility for that material. Or in order to make it more attractive to Google’s search algorithm.

They may use various sock puppets to vandalise a Wikipedia page, and then, using their main alias, clean up the mess. That gives them credibility, which can then use to hoax the system more effectively at a later date. Likewise, they may wish to frame a debate, and essentially end up arguing with themselves. Naturally, the winner of the discussion is the alias of the puppet master.

In one example from the Malaysian case, the alias SolTimor would post ‘barnstars’ – the Wikipedia equivalent of a thumbs up – on the pages of other members of this ring, commending them for their work. Around the same time, the contributor Andy4190 left a message with another user to complain about Malaysians vandalising the page of East Timor’s national team. What delicious irony.

Subsequent investigation found that despite SolTimor’s close connections to Malaysian sock puppet ring, it was actually being operated by Andy4190. Andy4190’s fingerprints are all over the pages of teams like Brunei, Cambodia, Laos, Bangladesh, Sri Lanka, Papua New Guinea, Indonesia and the Philippines, where another high profile user has recently been banned for sockpuppeting.

Perhaps most significantly, though, he is the leading contributor to the team page of the East Timor national team, and has created pages for some of its players. One of those is Murilo de Almeida – a Brazilian who is Timor’s leading goalscorer. Around a quarter of the edits on this page, and nearly all of the initial edits, were created by sock puppets. Andy4190 created almost the entire pages for another Brazilian import, Antonio Marcos Sousa. And on it goes.

Andy4190 is also the lead contributor to the page of the US Virgin Islands team – a territory that Newsweek calls ‘A Made-in-America Offshore Tax Haven’ And for a short period during the 2012 election in Timor, he became interested in politics, creating a page for one high-level politician close to the powerful Xanana Gusmao.

Andy4190 was eventually banned for his nefarious activity. The final straw? Spreading a hoax that a town of 16,000 was about to get a shiny new 75,000 seat stadium. Where do your images for it come from?, asked one Wikipedian. ‘It looks like you’ve made it yourself’.

It was a good observation. A blog that Andy4190 frequently references, called Andy1890, contains similar designs and announcements. The blog is a cache of faked leaks and fraudulent documents relating to football in Timor. It has false team sheets and incorrect announcements of kit manufacturers. It even posted an expose falsely claiming FIFA had suspended the president of the local football federation for corruption.

Prior to Timor-Leste’s World Cup qualifier against Palestine last month, a short film showing designs of how the national stadium would look with a refurbishment was repeated on the big screen.

The images looked like something you might see on Andy’s blog. The closing credits credited one man with nearly every piece of the film production. His name? Andy.

Those involved in editing the Timor team page also target the pages of many mid-ranked members of the team. In particular. they focus on player history details: giving them better clubs, more goals and more caps. Frequently, it happens during the transfer windows. Nearly always, the players are linked to clubs in Asia. Since football data from Asia can be hard to come by, it can be very difficult to discern what is fake and what is real.

Looking through the history of Andy4190 on Wikipedia, he is listed as an Indonesian living in Florida. Only higher-ups at Wikipedia can work out the legitimacy of this claim, because his IP address is not publicly available. (An IP address is a string of numbers a website’s user leaves behind, and from this, their location can be established.)

Wikipedia always keeps a contributor’s IP address a secret – unless that contributor has not logged in. Perhaps it’s coincidence, but of the IP addresses displayed on the team’s page, at least four contributors from an area in the northern suburbs of Tampa, Florida.

Shortly after Andy4190 was blocked indefinitely, a user called Wester. Inc appeared. His first contribution involved the national football team of Uzbekistan. It came at 23:01 GMT, and involved him undoing an edit about the team’s uniform. That edit had been made a minute earlier by unregistered user whose IP address traces back to the exact same Tampa location where edits on the Timor page have been made. This user’s only other contributions – done a year earlier – involved a nearby local government area. (He removed Will Smith as a famous resident in one of them.)

Wester. Inc posts on the same topics as Andy4190, at the same hours and with a similar enthusiasm. Perhaps it’s also worth noting that Andy4190 once got in trouble for posting about a seemingly non-existent person called Andrew West. When it was suggested to a senior Wikipedian that Wester. Inc may be Andy4190, they agreed it appeared suspicious. An investigation is underway. Wester. Inc is now third leading contributor to Timorese national team’s page, behind only Andy4190 and Simione001.  

Simione001 is an expert in Australian soccer, who took an intense passion in the Timorese national team at the same time as Andy4190 was under investigation. It is impossible to know if this is coincidence, or whether Simione001 is a ‘meat puppet’ – someone operating as a part-time sock puppet on behalf of Andy4190. There is no evidence of Simione001 and Andy4190 communicating on Wikipedia. They may have meet in chat rooms elsewhere, but who knows.

A look through the page’s other contributors is revealing. The fourth-biggest contributor, Iha9c, is regularly in trouble for doing things like creating players who don’t seem to exist. He frequently references the Andy1890 blog.

The next biggest contributor says he is from Rancagua, Chile. Like Andy, he has a passion for making soccer shirts. Rounding out the top ten contributors are one from Tampa, one from neighbouring Cuba, a sockpuppet of Andy4190, and another from Tampa.

Other IP addresses reveal contributors in places as diverse as Romania, Western Australia, Israel, Hong Kong, Japan, Norway, the Ukraine and a golf course in Queensland. A location in the Brazilian state of Minas Gerais keeps popping up in a battle to replace the team’s crest with a fake one.

One IP address traces back to France’s Commission of Atomic Energy, the South Australian government’s Office of the Chief Information Officer and Delta Airways in Georgia.

The user Glen1480 posts about colleges and high schools in Kentucky, lower-tier English football … and Burger Kings in Timor. Plenty of IP addresses trace back to locations in Java, Sumatra, Singapore and Malaysia.

And users from Timor? They are few and far between. As with so much in Timorese football, it’s hard to know what is going on here.