What is doxing?
Doxing is the practice of posting someone's personal information online without their consent.
The word first emerged in the world of online hackers in the 1990s, where anonymity was deemed
sacred. A feud between hackers might escalate when someone decided to "drop
docs" on somebody else — that is, post documents revealing the legal
name of a person who had only been known by an alias up to that point.
"Docs" became "dox," which in turn lost the "drop" and became a verb by itself.
Modern-day doxers aim to reveal information that can move their conflict with their targets from
the internet to the real world, including home addresses, employers, social security numbers,
private correspondence, and criminal history or otherwise embarrassing personal details.
The goals range from intimidating or humiliating victims, causing a loss of employment or breaking
off of relationships, or making the target a victim of in-person harassment or assault.
Is doxing illegal?
The prospect of someone posting your home address for anyone on the internet to see
is pretty scary to most people, and you may assume that it can't possibly be legal.
Indeed, Federal law restricts the publication of personal information about
certain categories of people, including state or federal employees or officers as well as jurors,
witnesses, or informants in trials or criminal investigations. If the doxing is part of a larger
campaign of harassment, victims who don't fall into those categories may be able to
press charges based on state or federal stalking legislation or file a civil suit for damages.
In many cases, doxers can piece together bits of information that their targets
have posted in public view or hinted at on social media. Collating that information or
drawing people's attention to it isn't illegal, as intrusive as it might feel.
And, if the doxer knows your legal name, a surprising amount of information about you is a
matter of public record: your voter registration, property records, marriage and divorce records,
mug shots, and more. These details aren't necessarily just a Google search away,
but they can be obtained from government agencies readily enough, often at low to no cost.
The quickest route to finding and weaponizing personal information about a target may be to
simply buy it, whether from legal data brokers or from databases passed around on the dark web
derived from the innumerable data breaches that afflict companies large and small. If
a doxer can connect their target's name, email address, or social media handle with a record
in one of those databases, they can get a wealth of information that can then be posted publicly.
There are even paid doxing as a service outfits out there.
Getting legal relief against doxers can be difficult: it's often not clear what laws they're
breaking, and they usually take steps to obscure their own identity even as they expose yours.
The bright spot: Doxing violates the terms of service of most social media platforms.
Reporting tweets or Facebook posts that include your personal information
will generally get them swiftly taken down and the offending user suspended.