Doxing is the act of publicly revealing private information about individuals without their consent and often with malicious intent. It is a slang term for “documents” and also spelled as “doxxing.”

Doxing is a form of cyberbullying and online harassment, akin to shaming someone in a public square. We’re not talking about publicly available data you can find with a quick Google search, though. The act involves releasing information that would make people vulnerable, such as their home addresses, phone numbers, workplace details, private email addresses, financial information, and even names of family members. The goal? To shame, intimidate, threaten, or even incite real-world harm.

Read More about Doxing

Doxing isn’t new, but its prevalence has increased due to the use of the Internet and social media. Learn more about this malicious act in the following sections.

How Does Doxing Work?

Doxing does not always entail some sophisticated hack. More often than not, it just involves a combination of readily available public information and some level of social engineering.

How does doxing work?

Data Gathering

Here are some of the common tactics doxers use.

  • Public record searches: This is a low-hanging fruit. Websites that aggregate public records, such as property deeds, voter registrations, and marriage licenses, can provide a surprising amount of personal information.
  • Social media snooping: You’d be amazed at what people share on their public social media profiles. Birthdays, pet names, alma maters, workplace details, and even geotagged photos. All these seemingly innocent bits of information can be pieced together to build a target profile. Even if your social media profiles are private, shared connections or tagged photos from friends can inadvertently reveal details.
  • WHOIS lookups: If you own a website, your domain registration details (e.g., your name, address, email address, and phone number) can be easily retrieved unless you use a privacy service.
  • Phishing and social engineering: Sometimes, doxers try to trick you into revealing information directly. This could be through fake surveys, imposter emails, or even phone calls disguised as legitimate inquiries.
  • Username tracking: People often use the same usernames or reveal personal details in old forum posts or obscure online communities that they’ve long forgotten about. Doxers will dig deep into Internet archives to find these forgotten crumbs and find other online accounts with the same username.

Data Weaponization

Doxers then weaponize every piece of information they have about your life. Their motivations can vary. Sometimes, it’s about revenge, where someone you’ve wronged wants you to pay.

In other cases, it’s about vigilantism, where people decide someone has committed a perceived injustice and takes it upon themselves to deliver “justice” by exposing them. And there’s also a disturbing side to doxing, where it is used to facilitate harassment, physical threats, and swatting (i.e., falsely reporting a serious crime to trigger a police raid on a victim’s home).

What Are Examples of Doxing?

The history of doxing is, unfortunately, rich. Here are a few notable examples.

GamerGate

Perhaps one of the most infamous examples, the Gamergate controversy saw numerous female journalists and game developers doxxed and subjected to extreme harassment, including death threats and swatting, for their perceived stances on video game journalism and gender issues.

Doxers actively published their home addresses, phone numbers, and other private details, which led to online abuse and real-world threats, including swatting incidents. The coordinated efforts, often organized on platforms like 4chan and Reddit, exemplified how doxing could be weaponized to silence and intimidate.

Boston Marathon Bombing

In the aftermath of the 2013 Boston Marathon bombing, the Internet became a hotbed of online vigilantes attempting to identify the perpetrators. In a horrifying case of mistaken identity and rapid doxing, a student named Sunil Tripathi, who had been missing for weeks prior to the bombing, was falsely identified as a suspect.

Example of doxing

Image source: https://www.nbcnews.com/news/asian-america/wrongly-accused-boston-bombing-sunil-tripathys-story-now-being-told-n373141

Online users quickly propagated his name and photos across social media. His family’s public pleas for his safe return, which included a website and social media presence, inadvertently provided personal details that were then weaponized. His family received several threats and harassment, but Sunil Tripathi was later found deceased, having died by suicide before the bombing.

Is Doxing Illegal?

The real-life examples of doxing above clearly show the harmful effects that harassment can have on victims. But, is it illegal? The short answer is no, since the information released by the doxers is essentially public data retrieved using legal methods.

Still, the legality of doxing depends on the jurisdiction and type of information released. In the U.S., for example, doxing a government employee is considered a federal offense.

That said, no dedicated laws against doxing exist in most countries, although many have existing laws related to harassment, stalking, identity theft, fraud, and privacy violations. Doxing can fall under these laws.

How to Protect against Doxing

While you can’t completely eliminate your digital footprint, you can significantly reduce your doxing risks.

  • Assume everything is public. Treat everything you post online, send in emails, or share via chats as if they’re going to be publicly broadcast. Because, honestly, they may be.
  • Secure your social media accounts. Go through all your social media accounts and maximize the privacy settings, make your profiles private; remove your birthday, phone number, home and work addresses; and other personal details; and disable geotagging of your photos.
  • Use unique and strong passwords. Reusing passwords across multiple sites makes it easier for hackers and doxers, especially if those sites suffer a data breach. Therefore, it’s important to use strong passwords and make sure you use a different one for each of your online accounts.
  • Be wary of phishing. Never click suspicious links or respond to unsolicited emails or messages in any way.
  • Separate your personal and professional online identities. If possible, use different email addresses, usernames, and even browsers for your personal and professional online activities.

—

Doxing is a serious threat, as it can transform online disputes into real-world nightmares. While complete anonymity online is not possible, taking proactive steps to protect your personal information can significantly mitigate risks.

Key Takeaways

  • Doxing is the public revelation of private personal information without consent, often with malicious intent to harass, intimidate, or incite harm.
  • Doxers gather information through various means, including social media snooping, public records, data breaches, and phishing.
  • There are no federal laws against doxing in many jurisdictions but the act can lead to legal repercussions under existing laws related to harassment, stalking, threats, or privacy violations.
  • Individuals can protect themselves by maximizing online privacy settings, using strong and unique passwords, separating their personal and professional identities, and avoiding phishing.

Sources

  • https://www.eff.org/deeplinks/2020/12/doxing-tips-protect-yourself-online-how-minimize-harm
  • https://www.cisa.gov/resources-tools/resources/cisa-insights-mitigating-impacts-doxing-critical-infrastructure