diff --git a/memos/memo-vandalism b/memos/memo-vandalism
new file mode 100644
index 0000000000000000000000000000000000000000..57e4f3ad750f4891e60b31764ebff2869d935f0c
--- /dev/null
+++ b/memos/memo-vandalism
@@ -0,0 +1,42 @@
+# Filters targetting vandalism
+
+The vast majority of edit filters on EN Wikipedia could be said to target (different forms of) vandalism.
+Examples herefor are filters for *juvenile* types of vandalism (inserting swear or obscene words or nonsence sequences of characters into articles), for *hoaxing* or for *link spam*.
+In principle, one can open quite a few subcategories here (also check https://en.wikipedia.org/wiki/Wikipedia:Vandalism for a "in-house" classification of vandalism types on Wikipedia).
+Some vandalism types seem to be more severe than others (*sock puppetry* or persistant *long term* vandals).
+For these, often times, the implemented filters are **private**.
+This means, only edit filter editors can view the exact filter pattern or the comments of these.
+Although this clashes with the overall *transparency* of the project (is there a guideline subscribing to this value?), the reasoning here is that otherwise, persistent vandals will be able to check for the pattern of the filter targetting their edits and just find a new way around it.
+There are also private filters targetting personal attack or abuse cases.
+Here, filters are private in order to protect affected person(s).
+
+According to https://en.wikipedia.org/wiki/Wikipedia:Vandalism following (mostly disruptive) behaviours are **not vandalism**:
+- boldly editing
+- copyright violation
+- disruptive editing or stubbornness --> edit warring
+- edit summary omission
+- editing tests by experimenting users: "Such edits, while prohibited, are treated differently from vandalism"
+- harassment or personal attacks: "Personal attacks and harassment are not allowed. While some harassment is also vandalism, such as user page vandalism, or inserting a personal attack into an article, harassment in itself is not vandalism and should be handled differently."
+- Incorrect wiki markup and style
+- lack of understanding of the purpose of wikipedia: "editing it as if it were a different medium—such as a forum or blog—in a way that it appears as unproductive editing or borderline vandalism to experienced users."
+- misinformation, accidental
+- NPOV contraventions (Neutral point of view)
+- nonsense, accidental: "sometimes honest editors may not have expressed themselves correctly (e.g. there may be an error in the syntax, particularly for Wikipedians who use English as a second language)."
+- Policy and guideline pages, good-faith changes to: "If people misjudge consensus, it would not be considered vandalism;"
+- Reversion or removal of unencyclopedic material, or of edits covered under the biographies of living persons policy: "Even factually correct material may not belong on Wikipedia, and removing such content when it is not in line with Wikipedia's standards is not vandalism."
+- Deletion nominations: "Good-faith nominations of articles (or templates, non-article pages, etc) are not vandalism."
+
+Several of these behaviours could actually be conceived as **good faith** edits.
+And, for several of them (as noted in the **good faith memo**), it is not immediately distinguishable whether it's a **good faith** or a **vandalism** edit.
+Ultimately, the "only" difference between the two arises from the motivation/context of the edit.
+
+
+## Properties/Characteristics
+
+- maliciously intended disruptive editing
+
+motivations:
+- seeking attention
+- misusing the encyclopedia for own purposes (self-promotion, seo..)
+- spreading wrong information
+- defacing topics