What is Doxing?

The question is what is doxing and what are the laws? Doxing, which is short for dropping documents, takes place when the malicious actor gathers personally identifiable information and publicly discloses it to annoy, harass, intimidate, or stalk the victim for no legitimate purpose. The malicious actors engage in these types of activities to publicly humiliate or target their victims. For example, they may intentionally identify law enforcement personnel or show off their hacking abilities.

How does doxing work?

The malicious actors utilize different techniques for their doxing activities. They can hack, social engineer, or steal personal and confidential information. They can gain access to the victim’s email account and extract private information from the victim’s account. They can break into web-based accounts such as social media, cloud storage, or bank records. They can also use the same email address and password to gain access to other accounts. There have been incidents where the malicious actors used the victim’s Department of Homeland Security username and password to gain access to its network.

The malicious actors use data brokers to gather and organize information from various sources. The brokers have access to certain public or private information which is ready to be sold for a price. Experts recommend to limit the sharing of information such as pictures and videos on the web. You should not post or share private or sensitive information that can be used to log into your online accounts. For example, web security questions can be guessed if you post your pet’s name or your place of birth on the internet. The experts recommend turning on privacy settings on all websites and social media platforms. There is a possibility to remove your information from data broker’s databases but that’s certainly a time-consuming endeavor.

The doxing victim can face the problem of dealing with the disclosure of his or her personal records (e.g., name, address, employment information, financial records, criminal records) on the internet without permission. These activities are illegal and subject to state or federal law violations. Now, at this point, most, if not all jurisdictions have passed anti-doxing laws to deter these types of violations. For example, in California, Code of Civil Procedure Section 527.6 defines harassment and prohibits activities that are intended to annoy, intimidate, or threaten another person for no legitimate purpose. Penal Code Sections 422 and 646.9 prohibit placing another person in fear through electronic communications.

California Penal Code 422 states that: “Any person who willfully threatens to commit a crime which will result in death or great bodily injury to another person, with the specific intent that the statement, made verbally, in writing, or by means of an electronic communication device, is to be taken as a threat, even if there is no intent of actually carrying it out, which, on its face and under the circumstances in which it is made, is so unequivocal, unconditional, immediate, and specific as to convey to the person threatened, a gravity of purpose and an immediate prospect of execution of the threat, and thereby causes that person reasonably to be in sustained fear for his or her own safety or for his or her immediate family’s safety, shall be punished by imprisonment in the county jail not to exceed one year, or by imprisonment in the state prison.”

California Penal Code 646.9 states that: “Any person who willfully, maliciously, and repeatedly follows or willfully and maliciously harasses another person and who makes a credible threat with the intent to place that person in reasonable fear for his or her safety, or the safety of his or her immediate family is guilty of the crime of stalking, punishable by imprisonment in a county jail for not more than one year, or by a fine of not more than one thousand dollars ($1,000), or by both that fine and imprisonment, or by imprisonment in the state prison.”

Also, cyberbullying laws have been enacted to deter the malicious actors from harming their victims. There has been at least one case where a well-known hacker group has doxed previous Ku Klux Klan members.

Is making “restricted personal information” public illegal?

18 U.S.C. 119 is a federal statute which states in relevant part: Whoever knowingly makes restricted personal information about a “covered person,” or a member of the immediate family of that covered person, publicly available: (1) with the intent to threaten, intimidate, or incite the commission of a crime of violence against that covered person, or a member of the immediate family of that covered person; or (2) with the intent and knowledge that the restricted personal information will be used to threaten, intimidate, or facilitate the commission of a crime of violence against that covered person, or a member of the immediate family of that covered person, shall be fined under this title, imprisoned not more than 5 years, or both. The term “restricted personal information” includes Social Security number, home address, home phone number, mobile phone number, personal email, or home fax number. However, it’s important to note that the statute only applies to officer/employee of the United States, jurors/witnesses, informants/witnesses in a federal criminal investigation, and state or local officers/employees who are assisting a federal criminal investigation.

18 U.S.C. 2261A can apply if the culprit uses the mail, interactive computer service, electronic communication service, or electronic communications for stalking across interstate borders. This statute is applicable to any kind of harassment, intimidation, or surveillance with the intent to kill, injure, harass, or intimidate the victim.

Our internet and technology lawyers have been prosecuting and defending legal actions in state and federal courts and are available to speak with their clients. Our law firm assists clients in matters related to privacy and cybersecurity and the applicable state, federal, and international laws. Please contact our law firm to speak with an internet attorney at your earliest convenience.