A sock puppet is a fictitious online persona maintained for research, OSINT, undercover work, ban evasion, or maintenance of multiple identities for legitimate operational reasons. Distinct from a one-shot throwaway account: a sock puppet has aged accounts, plausible posting history, distinct device fingerprint, separate IP path, and consistent narrative across platforms. Cheap to create badly, expensive to create well.
What it means in practice
A sock puppet that survives scrutiny needs three things consistent over time. First, distinct technical fingerprint: separate device or browser profile, separate IP path (not just a VPN, ideally a different VPN provider or location from the operator’s real-life identity), distinct cookie state and storage. Second, distinct narrative: the persona’s posting history, follow graph, language patterns, time-zone-of-posting all need to add up to a consistent person who is not the operator. Third, age: brand-new accounts trigger platform anti-spam systems and are easier to attribute to a campaign; mature accounts (months to years of plausible activity) are harder to invalidate. The trade-off is the maintenance burden: a deeply convincing sock puppet is a part-time job.
Who uses them, and why
Used by: journalists running undercover online investigations (verifying claims about a community by participating, with editorial supervision and ethical guardrails), OSINT researchers infiltrating closed groups to document activity, harassment researchers tracking coordinated campaigns, security researchers monitoring cybercrime forums (the Krebs on Security archive documents many), and (legitimately) operators with multi-identity operational needs (lawyers running a public-persona account separate from a client-work account, executives with personal vs corporate presences). Misused by: state actors running disinformation campaigns (the Internet Research Agency template), bad-faith trolls evading bans, and influence operations of every flavor.
What you can change today
If your work requires sock puppets, treat each one as an operation with its own threat model and lifecycle. Build separate browser profiles or separate physical devices, each with its own VPN configuration. Age accounts for at least 30 days before active use on each platform. Document (offline, in a notebook or encrypted vault) the persona’s biographical details so you do not contradict yourself across sessions weeks apart. Retire personas that get burned rather than dragging them forward into new operations. For ethical journalism contexts: institutional supervision and clear editorial guardrails are not optional; the sock puppet is a tool with significant misuse potential and the line between investigation and entrapment is real.