Doxing

Doxing (from dox, abbreviation of documents),^[1] or doxxing,^[2][3] is the Internet-based practice of researching and broadcasting private or identifiable information (especially personally identifiable information) about an individual or organization.^{[3][4][5][6][7]}

The methods employed to acquire this information include searching publicly available databases and social media websites (like Facebook), hacking, and social engineering. It is closely related to internet vigilantism and hacktivism.

Doxing may be carried out for various reasons, including to aid law enforcement, business analysis, extortion, coercion, harassment, online shaming, and vigilante justice.^[8][9]

Etymology

Look up dox in Wiktionary, the free dictionary.

"Doxing" is a neologism that has evolved over its brief history. It comes from a spelling alteration of the abbreviation "docs" (for "documents") and refers to "compiling and releasing a dossier of personal information on someone".^[10] Essentially, doxing is openly revealing and publicizing records of an individual, which were previously private or difficult to obtain.

The term dox derives from the slang "dropping dox", which, according to Wired writer Mat Honan, was "an old-school revenge tactic that emerged from hacker culture in 1990s". Hackers operating outside the law in that era used the breach of an opponent's anonymity as a means to expose opponents to harassment or legal repercussions.^[10]

As such, doxing often comes with a negative connotation, because it can be a vehicle for revenge via the violation of privacy.^[11]

Common techniques

Hackers, police officers and amateur detectives alike can harvest the information from the internet about individuals. There is no particular structure in place for doxing, meaning a hacker may seek out any kind of information related to the target.

A basic Web search can yield results. Social media platforms like Facebook, Twitter, Tumblr, and Linkedin offer a wealth of private information, because many users have high levels of self-disclosure (i.e. sharing their photos, place of employment, phone number, email address), but low levels of security. It is also possible to extrapolate a person's name and home address from a cell-phone number, through such services as reverse phone lookup.^[12] Social engineering has been used to extract information from government sources or phone companies.^[13]

In addition to these, a hacker may use other methods to harvest information. These include information search by domain name and location searching based on an individual’s IP address.^[14]

Once people have been exposed through doxing, they may be targeted for harassment through methods such as harassment in person, fake signups for mail and pizza deliveries, or through swatting (dispatching armed police to their house through spoofed tips).

It is important to note that a hacker may obtain an individual’s dox without making the information public. A hacker may harvest a victim’s information in order to break into their internet accounts, or to take over their social media accounts.^[15]

The victim may also be shown their details as proof that they have been doxed in order to intimidate them. Doxing is therefore a standard tactic of online harassment, and has been used by people associated with 4chan, the Gamergate controversy and anti-vaccine activists.^{[16][17][18][19]}

The ethics of doxing by journalists, on matters that they assert are issues of public interest, is an area of much controversy. Many authors have argued that doxing in journalism blurs the line between revealing information in the interest of the public and releasing information about an individual's private life against their wishes.^[20][21][22]

Notable examples

Boston Marathon

Following the 2013 Boston Marathon bombing, vigilantes on Reddit wrongly identified a number of people as suspects.^[23] Notable among misidentified bombing suspects was Sunil Tripathi, a student reported missing before the bombings took place. A body reported to be Sunil's was found in Rhode Island's Providence River on April 25, 2013, as reported by the Rhode Island Health Department. The cause of death was not immediately known, but authorities said they did not suspect foul play.^[24] The family later confirmed Tripathi's death was a result of suicide.^[25] Reddit general manager Martin later issued an apology for this behavior, criticizing the "online witch hunts and dangerous speculation" that took place on the website.^[26]

Anonymous

The term "dox" entered mainstream public awareness through media attention attracted by Anonymous, the Internet-based group of hacktivists and pranksters who make frequent use of doxing,^[27] as well as related groups like AntiSec and LulzSec. The Washington Post has described the consequences for innocent people incorrectly accused of wrongdoing and doxed as "nightmarish".^[28]

In December 2011, Anonymous exposed detailed information of 7,000 members of law enforcement in response to investigations into hacking activities.^[5]

In November 2014, Anonymous began releasing the identities of members of the Ku Klux Klan.^[29] This was in relation to local Klan members in Ferguson, Missouri, making threats to shoot anyone who provoked them while protesting the shooting of Michael Brown. Anonymous also hijacked the group's Twitter page, and this resulted in veiled threats of violence against members of Anonymous.^[30] In November 2015, a major release of information about the KKK was planned. Discredited information was released prematurely and Anonymous denied involvement.^[31] On November 5, 2015 (Guy Fawkes Night) Anonymous released an official list of supposed but currently unverified KKK members and sympathizers.^[32]

Human flesh search engine

The Chinese Internet phenomenon of the "Human flesh search engine" shares much in common with doxing. Specifically, it refers to distributed, sometimes deliberately crowdsourced searches for similar kinds of information through use of digital media.^[33][34]

Journalists

Journalists with the newspaper The Journal News of Westchester County, New York, were accused of doxing gun owners in the region in a story the paper published in December 2012.^[35][36]

Newsweek came under fire when writer Leah McGrath Goodman claimed to have revealed the identity of the anonymous creator of Bitcoin, Satoshi Nakamoto. Though the source of her sleuthing was primarily the public record, she was heavily criticized for her doxing by users on Reddit.^[11]

The Satoshi Nakamoto case brought doxing to greater attention, particularly on platforms such as Twitter, where users questioned the ethics of doxing in journalism. Many Twitter users condemned doxing in journalism, wherein they argued that the practice was seemingly acceptable for professional journalists but wrong for anyone else. Other users discussed the effect the popularization that the concept of doxing could have on journalism in public interest, raising questions over journalism concerning public and private figures. Many users have argued that doxing in journalism blurs the line between revealing information in the interest of the public and releasing information about an individual's private life against their wishes.^[20][22]

Curt Schilling

In March 2015, former Major League Baseball (MLB) pitcher Curt Schilling used doxing to identify several people responsible for "Twitter troll" posts with obscene, sexually explicit comments about his teenage daughter. One person was suspended from his community college, and another lost a part-time job with the New York Yankees.^[37]

Donald Trump

In July 2015, US presidential candidate Donald Trump read out the cell phone number of fellow candidate South Carolina Senator Lindsey Graham at a campaign rally and encouraged attendees to call it. Media outlets and Graham reported that the number belonged to the senator.^[38]

Alondra Cano

In December 2015, Minneapolis city councilwoman Alondra Cano used her Twitter account to publish “private cellphone numbers and e-mail addresses of critics who wrote in discontent” about her involvement in a Black Lives Matter rally.^[39]

Lou Dobbs

In 2016, Fox Business news anchor Lou Dobbs revealed the address and phone number of Jessica Leeds, one of the women who accused American presidential candidate Donald Trump of inappropriate sexual advances; Dobbs later apologized.^[40]

Erdogan emails

In July 2016, Wikileaks released 300,000 Turkish e-mails called the Erdogan emails, initially thought to be damaging to Turkish President Recep Tayyip Erdogan. Included in the leak was Michael Best, who uploaded Turkish citizens’ personal information databases that WikiLeaks promoted, came forward to say that doing so was a mistake after the site where he uploaded the information took it down. The files were removed due to privacy concerns, as they included spreadsheets of private, sensitive information of what appears to be every female voter in 79 out of 81 provinces in Turkey, including their home addresses and other private information, sometimes including their cellphone numbers. ^[41]

Michael Hirsh

In November 2016, Politico editor Michael Hirsh resigned after publishing the home address of white nationalist Richard B. Spencer on Facebook.^[42][43]

See also

• Doxbin
• Identity theft
• Outing

References

Internet slang
Abuse	cyberbullying cyberstalking doxing flaming griefer hacker keylogger malware spyware phishing script kiddie Stealth banning spamming troll
Chatspeak	emoticon emoji leet owned Pr0n pwn teh w00t fap LOL nsfw padonkaffsky jargon sexting
Imageboard	4chan anonymous -chan CP goatse.cx lolcat lulz lurk newbie OP pedobear rickrolling Rule 34 tripcode weeaboo
Memes	advertising and products animation and comics challenges email film gaming images music politics videos miscellaneous
Usenet	eternal September PKB plonk
Category Portal Wiktionary