Sunlight or Stalking? The Legal Ramifications of Doxing

-- By StewartPollock - 09 Mar 2022

Introduction

Doxing, also known as doxxing, is the act of exposing a web user’s identity and other personal information, such as their location or address. Depending on who you ask, doxing is either an especially malicious form of harassment, or a sometimes-justified act of vigilantism, which can prevent bad actors from using the relative anonymity of the web as a shield. This latter view, which could be summarized as the “sunlight is the best disinfectant” approach, has been at the center of a number of high-profile incidents over the last decade, such as the 2012 doxing of a controversial reddit moderator by the late website Gawker, or the 2016 resignation of an editor for the site Politico after he published the home address of white supremacist Richard Spencer.

Doxing frequently exists in a legal grey area—there is no specific state or federal “anti-doxing” statute, but doxing or doxing-esque behavior has been prosecuted under state and federal laws which criminalize harassment, stalking, and intimidation. The relatively limited scope of these prohibitions as they relate to doxing reflects both the relatively new nature of doxing, as well as the fine line between legitimate muckraking and harassment.

Section I: Federal Anti-Doxing Law

The federal law which most closely covers doxing behavior is 18 U.S. Code § 2261A(2), the federal anti-stalking and cyberstalking statute. This statute makes it a crime to, among other things, use the mail or any electronic communication service to engage in a course of conduct with the “intent to kill, injure, harass, or place under surveillance with intent to kill, injure, harass, or intimidate another person.” Although the language of the statute would seem to cover doxing that is intended to harass or intimidate, in practice courts have set a very high threshold for the applicability of the anti-stalking statute to threats based on revealing personal information.

This is because of the specific “course of conduct” language of the statute means that a single threatening post or message is not enough to be prosecutable, even if it contains information that would put the target at risk. As many doxing attacks are coordinated from multiple accounts and users, the language of § 2261A(2) makes holding any individual accountable difficult. Furthermore, federal prosecutors do not have the capacity to utilize § 2261A(2) in the doxing context, because there are more pressing cases concerning drugs and terrorism. language which makes it hard to utilize against a particular individual who is acting as part of a larger group.

Section II: State Anti-Doxing Laws and Problems

Although no state has a specific law targeting doxing, California’s cybercrime law, codified in California Penal Code § 653.2, has been used to prosecute doxing and doxing-like activities. Under this statute, enacted in 2010, this statute makes it a misdemeanor to use electronic communication in order to (1) intentionally cause another person to fear for their safety; (2) to harass, alarm, annoy, terrorize or cause injury to another person without “legitimate purpose”, and (3) to make personally identifiable information viewable or available to download which would be reasonably likely to cause that person or their family harm. This language is broader that the federal statute, however, like the federal law, California’s statute contains “course of conduct” language which makes it hard to utilize against a particular individual who is acting as part of a larger group.

Section III: Kentucky's Approach

Conclusion

• #Set ALLOWTOPICVIEW = TWikiAdminGroup, StewartPollock
• #Set DENYTOPICVIEW = TWikiGuest

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.