Product Code Database
Doxing or doxxing is the act of publicly providing Personal data about an individual or organization, usually via the Internet and without their consent.
Historically, the term has been used to refer to both the aggregation of this information from public databases and social media websites (like Facebook), and the publication of previously private information obtained through criminal or otherwise fraudulent means (such as hacking and social engineering).
The aggregation and provision of previously published material is generally legal, though it may be subject to laws concerning stalking and intimidation. Doxing may be carried out for reasons such as online shaming, extortion, and vigilante aid to law enforcement.
The term dox derives from the slang "dropping dox", which, according to Wired contributor Mat Honan, was "an old-school revenge tactic that emerged from hacker culture in 1990s". Hackers operating outside the law in that era used the breach of an opponent's anonymity as a means to expose them to harassment or legal repercussions. Consequently, doxing often carries a negative connotation because it can be a means of revenge via the violation of privacy.
Outside of hacker communities, the first prominent examples of doxing took place on internet discussion forums on Usenet in the late 1990s, including users circulating lists of suspected Neo-Nazism, later Racism. Also in the late 1990s, a website called the Neal Horsley had launched, featuring the home addresses of abortion providers and language that implied website visitors should stalk and kill the people listed.
In 2012, when then- Gawker reporter Adrian Chen revealed the identity of Reddit troll Violentacrez as Michael Brutsch, Reddit users accused Chen of doxing Brutsch and declared "war" on Gawker. In the mid-2010s, the events of the Gamergate harassment campaign brought the term into wider public use. Participants in Gamergate became known for releasing sensitive information about their targets to the public, sometimes with the intent of causing the targets in question physical harm. Caroline Sinders, a research fellow at the Center for Democracy and Technology, said that "Gamergate, for a lot of people, for mainstream culture, was the introduction to what doxxing is".
According to The Atlantic, from 2014 to 2020, "the doxxing conversation was dominated by debate around whether unmasking a pseudonymous person with a sizable following was an unnecessary and dangerous invasion of their privacy." In 2014, when Newsweek attempted to search for the developer of Bitcoin, the magazine was accused of doxing by cryptocurrency enthusiasts. In 2016, when an Italy journalist attempted to search for the identity of the pseudonymous Italian novelist Elena Ferrante, the journalist was accused of gendered harassment and Vox referred to the search as "the doxxing of Elena Ferrante." In 2020, when The New York Times indicated that it was planning on publishing the real name of the California psychiatrist running the Slate Star Codex blog, fans of the blog accused the Times of doxing. The person behind the blog accused the Times of threatening his safety and claimed that he started a "major scandal" that resulted in the Times losing hundreds or thousands of subscriptions.
In 2022, BuzzFeed News reporter Katie Notopoulos used public business records to identify the previously pseudonymous founders of the Bored Ape Yacht Club. Greg Solano, one of the founders of the club, claimed that he "got doxxed against his will".
In April 2022, The Washington Post reporter Taylor Lorenz revealed the identity of the person behind the Twitter account Libs of TikTok as Chaya Raichik, who works in real estate. This resulted in Raichik and right-wingers accusing Lorenz of doxing.
Pro-Israel NGOs including the Israel on Campus Coalition and Canary Mission have been accused of doxing Palestinian activists by releasing public dossiers documenting their activism. The Gaza war saw a surge in doxing activities in the United States. Right wing advocacy group Accuracy in Media sent trucks to Yale University and Columbia University, displaying the names and faces of students involved in anti-Israel activism under a banner labeling them "leading antisemites" on campus. Similarly, Canary Mission published the identities and images of Harvard University students involved in the circulation of an open letter, published on October 7th, that held "the Israeli regime entirely responsible for all unfolding violence".
The attack is summarized in the book Malicious Cryptography as follows:
The attack differs from the extortion attack in the following way. In the extortion attack, the victim is denied access to its own valuable information and has to pay to get it back, where in the attack that is presented here the victim retains access to the information but its disclosure is at the discretion of the computer virus.(2025). 9780764549755, Wiley. ISBN 9780764549755
Doxware is the converse of ransomware. In a ransomware attack (originally called cryptoviral extortion), the malware encrypts the victim's data and demands payment to provide the needed decryption key. In the doxware cryptovirology attack, the attacker or malware steals the victim's data and threatens to publish it unless a fee is paid.
A hacker may obtain an individual's dox without making the information public. A hacker may look for this information to extort or coerce a known or unknown target. A hacker may also harvest a victim's information to break into their Internet accounts or take over their social media accounts.
Doxing has also occurred in dating apps. In a survey conducted in 2021, 16% of respondents reported suffering doxing because of them. In a 2018 qualitative study about intimate partner violence, 28 out of 89 participants (both professionals and survivors) reported the exposure of the victim's private information to third parties through digital technologies as a form of humiliation, shaming or harm frequently practiced by abusers, that may include the Revenge porn and impersonation of the victim. (2018). 9781450356206, Association for Computing Machinery. ISBN 9781450356206
Victims may also be shown their details as proof that they have been doxed as a form of intimidation. The perpetrator may use this fear to gain power over victims in order to extort or coerce. Doxing is therefore a standard tactic of online harassment and has been used by people associated with the Gamergate and vaccine controversies.
There are different motivations for doxing. They include doing it to reveal harmful behavior and hold the offender accountable. Others use it to embarrass, scare, threaten, or punish someone. It is also often used for cyberstalking, which could result in making someone fear for their safety. Researchers have pointed out that some instances of doxing can be justified, such as when it reveals harmful behavior, but only if the act of doxing also aligns with the public.
Early in 2025 the War in Court project digitally released a list of names of nearly half a million suspected wartime Nazi collaborators.
Copying the information and obtaining it illegally are separate offences as well.
In practice, however, due to the ambiguous nature of "unlawful collection" of private information in the statute, legal actions are often based upon article 44 from the same act, which prohibits insulting an individual with derogatory or profane language, and defamation of an individual through the dissemination of either misinformation or privileged factual information that may potentially damage an individual's reputation or honor (which often occurs in a doxing incident). This particular clause enforces harsher maximum sentences than a "traditional" defamation statute existing in the Korean criminal code. It was originally enacted partially in response to the rise in celebrity suicides due to cyberbullying.
Those who "disseminate, disclose or transfer" the aforementioned data to third parties face a penalty of two to five prison years (one to three years of prison and fines of twelve to twenty-four months, if not directly involved in their discovery but "with knowledge of its illicit origin"). These offenses are particularly severe if made by the person responsible of the respective files, media, records or archives or through unauthorized use of personal data, if revealing of the ideology, religion, beliefs, health, racial origin or sexual life of the victim, if the victim is underage or Disability abuse, and if it is made for economic profit.
As established by the Criminal Code's reform in 2015, to "disseminate, disclose or transfer to third parties images or audiovisual recordings of the one obtained with their consent in a home or in any other place out of sight of third parties, when the disclosure seriously undermines the personal privacy of that person", without the authorization of the affected person, is also punished per article 197 § 7 to three months to a year in prison and fines of six to twelve months. The offense is particularly severe if the victim is linked to the offender by marriage or an "analogous affective relationship", underage, or disabled.
According to at least one estimate, over three million people are stalked over the internet each year, yet only about three of the attackers are charged under the Interstate Stalking Statute. Accordingly, "this lack of federal enforcement means that the States must step in if doxing is to be reduced."
In late 2023 and early 2024, during a rash of swatting of American politicians, it became widely used as a way of encouraging attacks, as the United States possesses weak laws surrounding data privacy, with its citizens' Personal data often easily accessible online due to various .
|
|
