Doxer’s Paradise

Images of a Macbook Pro keyboard

Photo by lizdegagner at Morguefile.com

Originally, there was no plan to return to blogging. When I became motivated to produce content once more, I initially opted for YouTube. Due to the nature of my upcoming content, and my awareness of the climate of hostility on the site, I was fully aware that I would be subject to that hostility.

Of course, if a journalist doesn’t get someone mad it’s usually an indicator that they’re not doing their job properly. Nevertheless, I had to take precautions. With that were some considerations.

The first of considerations I made was the phenomenon known as “doxing”(also spelled “doxxing”). For the uninitiated, doxing is the publishing of personally identifiable information. This can include information such as a real name, personal address, phone number, email address, and social security number.

Before I go further, I wish to point out the fact: This is not a substitute for legal advice. I am not a lawyer. I would defer any and all expertise to them should a conflict between interpretations of the law arise. With that out of the way, we can begin properly.

I Send the Swarm

Doxing is often the first stage in a targeted harassment campaign. That access to information gives the initial harasser, as well as those they have exposed the dox to, a way in which further harassment can occur.

Once that information is known to an angry mob, others will attempt to overwhelm the target through volume. In internet slang, this is referred to as “dogpiling”. But often, this is not the point where abuse ends. After all, now there’s information linking the victimizer to that person’s real address. They now an additional avenue of attack.

In some cases, it can allow harassers to send letters and packages to the victim’s home. In others, they can receive prank calls or have pizza or other kinds of food delivered to their house under fraudulent circumstances.

Yet of course, the most egregious impact is when the practice is combined with swatting. Swatting is when someone deceives law enforcement into sending the SWAT team to someone’s house. Usually, this will consist of fabricating high-stakes crimes that demand swift actions, such as planting explosives or holding hostages for ransom.

Sending the SWAT team to someone’s house when such a crime is not taking place is extremely dangerous. It puts both the target and the SWAT team at risk, should the target be armed. Other people, such as friends and family may also be involved. There have been cases where the commotion alerts the target’s dog, and the SWAT team may be prompted to shoot that dog should it behave aggressively in order to protect its owner.

All for the amusement of someone with bad faith intentions. Since the advent of the livestreaming service Twitch, swatting has spiked in popularity. Offering a livestream allows a swatter to view the events as they unfold, making it much more attractive.

Covering Your Tracks

Of course, the best way to deal with doxing is to prevent it in advance. Many times doxers get their target’s personal information from information broker sites. These include databases such as Spokeo, Intellius, WhitePages, and BeenVerified. These brokers gather their information from publicly available records and post that information online, often without knowledge or consent of the person involved.

Privacy Rights maintains a list of nearly three hundred information brokers. Thankfully, some of them have since consolidated or disappeared entirely. Nevertheless, when I was planning on starting my YouTube channel, I knew I had to take every precaution I could.

Finding someone’s dox can take a matter of seconds, getting it removed from these information brokers can take days. Some companies add more hoops for users to jump through. On several occasions, I had to either scan or fax a copy of my driver’s license to the company in question and await a response. One company required a call and I had to speak to a customer representative. Others wouldn’t let me scrub my information from their systems unless I had a police report indicating I was in danger.

Thankfully, I was not on those lists. I can only assume that the reason for that is because it deals with criminal records, which would be important for people to know. Fortunately, I have no criminal record.

It took several days for me to successfully remove that information. Entire days were spent behind the computer, meticulously clicking the “opt out” button.

In the course of setting up my YouTube channel, in spite of the protections I was attempting to use (such as concealing both my name and my face), my friend Lucas expressed concern for my personal safety. Especially since I was going to be focusing on the subject of online harassment in a very intense manner.

I took his advice, closed down my YouTube channel, and decided to resuscitate this blog. The downside is that there’s no built-in audience for my writing, or perhaps a very small one thanks to old remnants from my previous blogging adventures.

It additionally allows me to “pull back the curtain” a little and establish an online presence that I can use later on, should an employer seek an archive of my past work. But the reason I post under my real name and show my face is because I ultimately want to make this a very “human” blog. I want to put a name and face to what I do and say. Not just for accountability, but for also being relatable.

Others don’t necessarily have that luxury. The internet has proven itself hostile to certain demographics, and merely voicing an opinion of any sort becomes grounds for targeted harassment. But of course, the harassers won’t want to face consequences for their actions, and anonymity can shield them from it. Anonymity provides itself to be a double-edged sword, in this case, enabling abusers to carry out their deeds with far less scrutiny while also enabling those who would remain silent offline to speak up online. Ultimately, I think the option to remain anonymous must stay, and social media platforms must become more strict with enforcing their community guidelines and terms of service.

This, of course, segues into a deeper question and reading the terms of service certainly applies.

The Limits of Protection

There is, however, another side to this discussion. It is a nuance that most do not understand. This is, of course, the give and take of information.

If anything and everything were protected, journalists would be out of a job. Especially in the case of public officials. Anonymous sources, while used, are strongly discouraged. Every time I go out to interview, I ask my source to identify themselves. When readers can attach something to a person, it’s much easier to believe.

But what about someone’s online activity?

While there is the statement that we should be careful with the information we disclose on the internet, there is an important tool put in place to limit the amount of protection one can receive.

This snippet of Google’s Terms of Service lays out one specific stipulation:

When you upload, submit, store, send or receive content to or through our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones. This license continues even if you stop using our Services (for example, for a business listing you have added to Google Maps). Some Services may offer you ways to access and remove content that has been provided to that Service. Also, in some of our Services, there are terms or settings that narrow the scope of our use of the content submitted in those Services. Make sure you have the necessary rights to grant us this license for any content that you submit to our Services.

This dictum is commonly adapted for other online platforms, if not in the same exact terminology. In plain English, what this means is that the content you submit through that service is the platform’s property first, and yours second. You maintain basic copyright, meaning that the content is rightly yours in the basic sense. That post, email, or other content is attached to you legally. However, while it is not legally in the public domain, it is given much of the same affordances.

That means that someone can take screenshots of your email and post that information, unedited. While some people edit out information in an email or message as a courtesy, they are not obligated to do so. This applies for Facebook posts as well.

We have legal precedent for this. On his blog, attorney Dana Shultz details the case of Matthew Richard Palmeiri, who lost his industrial security clearance upon the government’s investigation into his activities.

He claimed his Fourth Amendment rights were being violated. Ultimately, the court disagreed. His account was not hacked, nor was Facebook subpoenaed by the government. Instead, Palmeiri was undone by the fact that his Facebook friends voluntarily disclosed that information.

Emails and chats do not carry with them the same expectation of privacy that you would get from a face-to-face conversation or a telephone call. For emails, any expectation of privacy is lost when you hit “send”. Chats are also not obligated to remain private, meaning that someone can screenshot it and spread it over the internet.

While this may sound very chilling, I would also like to point out that without it, victims of harassment would not be able to document their abuse. Nor would communication of any kind be possible. Some information must be unprotected for the sake of communication. Otherwise, others would be forced to remain silent about their experiences.

This, of course, is something that an increasingly technologically connected world needs to know.

Nevertheless, I would not advocate going further that what is absolutely necessary. Nor would I recommend valuing a personal vendetta over someone else’s safety. If it does not fit neatly into the realm of public interest, it is going further than it should be.

While posting screenshots of a nasty Twitter exchange or emails would be well within one’s rights to do, disclosing additional information found on this person elsewhere would not be, unless this person has consented to that disclosure in advance by providing it themselves.

Thrown to the Wolves

I would also be careful when assessing your audience.You may have good intentions. You may have the best of intentions. But what about your audience? Where does a legitimate public outcry end and the wrath of an angry mob begin?

This is why journalists must be careful to verify information beforehand. In the infamous case of Rolling Stone’s running of “A Rape on Campus”, all of the staff involved failed to do basic journalistic duties. They didn’t verify, they didn’t fact-check, they didn’t do their due diligence.

As a result, campus outcry was palpable. There was property damage, suspensions, and goodwill lost. The students who were implicated filed suit against Rolling Stone. While that suit was dismissed, they have in the process damaged the trust of their readers. According to the Federalist, the judge’s decision to dismiss the suit was an error and as of now, there is a consideration to appeal the decision. If that appeal succeeds, it could cost Rolling Stone a significant amount of money.

That’s not even touching on the long term consequences. Due to this story being so visible, survivors of sexual assault will feel even more pressure to keep silent. The public will apply this case to the issue at large. If one person lies, then that means the others must lie too. Even if it’s a statistical rarity, the public at large is already distrustful of those who come forward. Now, they have ammunition to justify that.

The freelance writer of the article, Sabrina Erdely, now has a black mark on her record. She has virtually disappeared off of Twitter, with her last post being a link to Washington Post’s article about her article. Everyone from Poynter to the Columbia Journalism Review has decried her article.

Paradise Lost

But now I wish to talk about the conditions that make doxing attractive. When one does not have a central authority to go to, or if that central authority is weak or apathetic, the users will take the matter into their own hands. If Twitter isn’t going to deal with it, well then it’s the duty of the users.

While some of the more tech-savvy ones will create useful tools to help people filter out harassment, others will resort to the only methods they know how to do. Digging up information is easy, anyone can do it.

In order to address this problem, social media platforms must take steps to enforce the guidelines they have set forth in their terms of service or community guidelines. Otherwise, we will be living in a doxer’s paradise for many, many years.