Our ubiquitous online presence makes us vulnerable to cyber harassment and abuse. It doesn't take much for someone to access private information and publicize it to harass or humiliate. This act, known as “doxxing,” can happen to anyone.
But, armed with knowledge and a plan, you can protect yourself against Internet trolls.
The term “doxxing" arose in the hacker community a couple of decades ago. “Dox” is an abbreviation of the word “documents.” “Doxxing” has evolved to refer to the hostile or vengeful public release of another’s private information without consent. Doxxers research, compile, and publish a subject’s real name, home address, account numbers, photographs, embarrassing information, and other private material to threaten or intimidate the subject on websites, such as Pastebin.
Many doxxers just release the information without making threats. They leave it to other harassers to spread the private information, use it to intimidate the subject, or both. Of course, even a “neutral” publication of one’s private information can imply a threat that the person possessing the private information might use it to harm the subject. Victims may also reasonably worry that the doxxer has access to all of the subject’s private information.
The threat level from an incident of doxxing depends on the type of information released and how privately the subject had kept it. The release of certain information is more threatening than others. For example, posting your home address is potentially more threatening than publishing an embarrassing article you wrote in your school newspaper.
While doxxers usually just want to embarrass or harass a subject, some are potentially scarier because they make threats of violence or other harm. Even a doxxing incident that is merely harassing is a concern, of course, but there are actions you can take if it happens.
Most doxxers use pseudonyms, making it hard to identify them. This makes legal action difficult. But there are options available under certain circumstances.
If the doxxer uses private information to damage your reputation, you may be able to sue for defamation. However, you have to prove that the doxxer's statements about you (express or implied) are false. And, you have to identify the doxxer. Some social media and other sites require users to provide their names, which the site makes publicly available. In certain states, you may be able to bring an action for invasion of privacy against the doxxer. Same caveats apply as to anonymity.
If the doxxer is making a credible threat of harm to you or your family, you should go to the police and ask that they take action. Depending on the circumstances, the prosecutor may be able to charge the doxxer with the crime of stalking, harassing, revenge porn, or cyberbullying. You may want to obtain a restraining order against the doxxer (again, if you can identify this person). And, if the doxxer or anyone uses your information to access your bank or credit card accounts, that is a crime.
The degree of threat the doxxer presents should govern your response. If you feel that the information released is not particularly sensitive and there’s no risk of physical or other harm, you may want to just block the doxxer and move on. Because online harassers hunger for attention, this can be quite effective. And it may make sense where the information released is already available online or the doxxer has sent it to you to upset you.
But where the information published is sensitive and/or may expose you to harm, you should consider a more serious response.
Take a screenshot, download the page, or otherwise record the doxxing, including the timestamp and URL of the message or site. This information can assist law enforcement or others who are investigating the doxxing, helping them to locate those responsible. This is a good step to take regardless of how threatened you feel, in case the initial doxxing is just an opening in what may become a larger attack on you.
Take your private information offline. Many sites, including Pastebin, have procedures you can follow to remove doxxed information.
Social media sites like Twitter and Reddit include doxxing as a violation of their terms of service. So, report the activity to the site and insist that the dox posts be removed. If doxxed information includes your telephone number and you’re getting harassing calls, investigators might be able to locate callers—it’s generally easier to track a caller than an online harasser. But, you may have to change your phone number to stop the harassment.
If the doxxing revealed your address or other information that exposes you to harm and the doxxer or others have threatened to harm you, go to the police. Bring the documentation of the doxxing with you.
If the doxxing has exposed your bank, credit card, or other financial account information, contact all of the financial institutions involved immediately and report the breach. You may need to change passwords and take other actions to beef up security of accounts that have been exposed. Tumblr and other sites have information about steps to take to increase your account’s security. Promptly block all doxxers from your social media sites and increase your privacy settings.
Much doxxing and subsequent harassment is done for the sick entertainment of the harassers. So, if you aren’t satisfied that blocking, reporting, and other measures are adequate, you may choose to cease online activity. When you’re gone, the harassers will eventually lose interest and move on.
Take swift action to respond to a doxxing that reveals your home address and contains credible threats of harm. If you feel at risk in your home, you might consider moving. This is an extreme measure, obviously, but a real threat may demand it.
Most importantly, don’t lose your head. First, because you must think rationally about how to respond and calmly take measures to protect yourself. Second, because you can deny the doxxers the thing they desire most: a reaction. Don’t play into their hands—protect your information at all times and never give the satisfaction of an emotional response.