What should be done about a user who makes a threat?

Question

I have recently come across an answer on one of Stack Exchange's sites (Skeptics) that was quite surprising to me. I have been a part of the Stack Exchange network for a while, and this is the first time I have ever seen someone actually attempt to threaten Stack Exchange itself!

The question is about whether it is worth it to own a handgun. A visitor saw the post, and made a threat (deleted now, but 10k users can see it) against Stack Exchange. They had posted that they would attempt to get as many people as they could to try to start a DDoS attack against Stack Exchange!

I am going to broadcast this question in all it ridiculousness far and wide and you will be hit with every NRA member in the country and then some. Hope your sever can handle it

Now while I highly doubt that they will be successful, action should still be taken against someone who makes a threat like that. I'm not just talking about a user who makes a threat against Stack Exchange, but also about a user who makes a threat against another user (be that digital, or physical).

The user had just created an account, so removing the answer and banning the account is not necessarily enough. I believe further action should be taken to ban the user's IP address from ever using (and possibly even visiting) any of the Stack Exchange site's again. I am not a moderator, nor do I work for Stack Exchange, so I have no authority to do this myself. However, if there are other users who agree with me, or have other ideas about what should be done to such users, please comment, or provide your own answer.

---

Edit: I am not asking this because of an individual post, as he was obviously just a troll, and likely, nothing will come of it. I am creating this because I have noticed that Stack Exchange does not have an existing policy on threats. Wikipedia has one, and I think we should too.

Answer 1

Hope your server can handle it

Bring it.

Answer 2

Fear not, he's just a troll...

Now while I highly doubt that they will be successful, action should still be taken against someone who makes a threat like that.

Nah, not worth the time or the effort. The moderators should just destroy the account, and forget all about it.

The user had just created an account, so removing the answer and banning the account is not necessarily enough.

You're right, that's a problem. Stack Exchange doesn't make it too hard for someone to create an account just to post crap. So far though, the benefits far outweigh the troubles, and although at times it gets a bit tedious for us moderators, let's just concentrate on the positives.

I believe further action should be taken to ban the user's IP address from ever using (and possibly even visiting) any of the Stack Exchange site's again.

IP address bans don't really work, we can never be certain where (s)he's posting from.

I am creating this because I have noticed that Stack Exchange does not have an existing policy on threats. Wikipedia has one, and I think we should too

Well there is a policy:

4. Restrictions

Subscriber is responsible for all of its activity in connection with the Services and accessing the Network. Any fraudulent, abusive, or otherwise illegal activity or any use of the Services or Content in violation of this Agreement may be grounds for termination of Subscriber’s right to Services or to access the Network. Subscriber may not post or transmit, or cause to be posted or transmitted, any communication or solicitation designed or intended to obtain password, account, or private information from any Network or Service user.

(blah blah blah, more legalese)

Answer 3

I am going to broadcast this question in all it ridiculousness far and wide and you will be hit with every NRA member in the country and then some. Hope your sever can handle it

I'm not sure how worried Joel and Shog should be about a bunch of gun-toting rednecks launching a distributed denial of service attack against their network.

As random said, this is just a novice troll.

Appendix A: the SE Sys-Admin team of gun-toting rednecks

Answer 4

From the FAQ on every site:

Civility is required at all times; rudeness will not be tolerated.

This is pretty broad... If someone makes threats against another user, it's hard to argue that's not at least rude.

As others have noted, preemptive IP address bans have issues that make them a bad idea in general. There are other tools for moderators and administrators to use in dealing with troublesome users, with banning IP address ranges being suitable in limited situations only.

And as Nick subtly notes, we're kind of used to dealing with folks abusing the servers. If someone goes beyond threats and actually starts causing problems, we'll handle that regardless of whether or not they have an account on the site.

Answer 5

The rest of the answers have dealt with the main issue here. I'd just like to explain why IP address banning should never be used on Stack Overflow.

IP address bans are a Very Bad Thing

They raise these questions:

• What if he's using a cyber cafe?
• What if he's part of a shared-IP address network? Many workplaces have these where the external IP address is the same (this is called something, but I don't know)
• What if he's at a friends place?
• What if his IP address is dynamic? A WHOIS can tell you this, though.
• What if he's using a proxy? A WHOIS usually tells you this as well, otherwise there are lists of proxies available

They're easy to bypass:

• Switch to a different computer
• If you use a dynamic IP address, renew it.
• Use a proxy. And no, this doesn't mean we should rangeblock all proxies like Wikipedia does.

The other issue is, we need a way to appeal against these. And that means another system.

You mentioned Wikipedia. Well, you're right, Wikipedia employs IP address blocks extensively. But, there are a lot of mechanisms required to appeal against blocks. There are a lot of "collateral damage" cases, where too many others are affected by the blocks. I used to help out at their Account request system (this deals with people who cannot create accounts, due to blocks, rangeblocks, accessibility issues and whatnot). And a lot of its requests are due to the collateral damage of blocks (it surprisingly gets a sizable number of requests per day). There's a separate mailing list monitored by a whole bunch of people for editing-blocks as well. And, blocks can be appealed on the IP address talk page itself (though these appeals are usually a bunch of drama).

Anyway, if we started IP address banning, we'd need a similar system in place to appeal them. I guess emailing [email protected] would work, but that really doesn't cut it when you want to tell apart "someone who's been wrongly affected" and "someone who's been collateral-damaged".

Basically an IP address ban is a whole lot of work for the banner, when it is easily bypassed by the.. uh.. bannee.

So, I say that IP address bans should be reserved for extremely special cases, where they are absolutely necessary. This is not a special case, this is just a troll talking big.

Answer 6

It's fairly simple, he doesn't need any special treatment so don't handle him differently from any other user that posts such trolling crap. Allowing him to participate in the comment thread or stay on the site and cause more posts / comments like these is what needs to be prevented (as it makes your community look bad if he does); so, flag it for moderator attention and they will most likely warn or suspend the user. If he returns multiple times, valued associated can take further actions if required...

---

The Stack Exchange network is prepared against DDoS attacks:

The rate limiting that has been implemented should fend off a good deal of basic crap. The team is obviously on top of their infrastructure as is evidenced by this post on the new Serverfault Blog. Also others on the Stackoverflow blog. The measures in place already should go a fair distance in preventing a DDoS, and with constant monitoring I would expect that an attack would be quickly noticed and addressed. I would wager that their relationship with the Peer1 would be such that they would get some priority assistance in the case that an attack ensues.

Even if it were serious, he surely won't get every NRA member to do a DoS so the amount of people participating will most likely be negligible. Stack Exchange doesn't run SOHO material, so just like most of the other popular sites it should be able to withstand it.

At its best it is an useful stress test for us, at its worst they're just wasting their own bandwidth and time...