The dangers of ‘doxing’ and the implications for media regulation – David Brake

The events in the US city of Charlottesville where a far-right protest turned violent raise a multitude of questions – some of which touch upon media ethics and media regulation. Especially the practice of ‘doxing’ – sharing individuals’ personal information online to cause them harm – has significant ethical and regulatory ramifications. 

One response by those outraged by the tragic events in Charlottesville has been to try to identify and shame those who marched in “Unite the Right” rallies against the removal of a statue of Robert E Lee, the military leader of the pro-slavery Confederacy in America’s civil war. Many of those in the demonstration that is being targeted chanted Nazi and white supremacist slogans, and the unambiguously despicable nature of that behaviour makes this form of vigilante justice understandably appealing.

And yet I must argue that even in this ‘best case’ the practice of ‘doxing’ – using the internet to share the personal information of those whose views you dislike to cause them harm – is extremely dangerous and its increasing prevalence with the growth of social media is of grave concern for three main reasons:

Reason 1: Judgements based on social media are easy but can be premature

As mobile phones have become the tool of choice for publishing on social media, we have seen a move from relatively long textual postings (like this one) towards photos, short videos and tweets. It is often this material that is the ‘evidence’ doxers use to establish guilt and blameworthiness, and the lack of accompanying context is problematic.

Pictures can stir strong emotions, but they can also mislead. For example, Malcolm Gladwell argues that this picture that has come to symbolise racist police oppression may actually show a policeman attempting to protect a protester:

CREDIT – Bill Hudson, AP via Revisionist History

Similarly, in the tweets above, all of those visible are characterised as Nazis and white supremacists. It’s true that some damningly racist chants were heard at the rally pictured, but the ostensible purpose of the rally was to oppose the movement of a statue and it’s at least possible that some of those in that picture were there for that reason alone, or perhaps because their friends were there – a cause that we may agree is misguided but which arguably falls short of the espousal of white supremacist ideology.

Reason 2: Doxing is subject to error and misinformation

Even when the targets of doxing are unambiguously worthy of condemnation, the low ‘standards of proof’ for action are problematic. For as long as the practice of doxing has existed, those who have used it have mis-identified their targets. In 2013, doxers wrongly identified student Sunil Tripathi as the bomber in the Boston Marathon attacks, and he subsequently killed himself. This time around, Kyle Quinn, an engineering professor, has already fallen victim to online misidentification by activists who posted his home address and sent him abusive messages.

And while the New York Times’ intervention and the fact he was thousands of miles away when the rally occurred appears to have ensured Quinn’s innocence is now clear online, those who attempt to correct inaccuracies online can be disbelieved and their debunking generally gets much less prominence than the original claims.

Worryingly, technology is advancing that allows not just for faking of pictures and text but also of video and audio, which people tend to trust even more as evidence. When this technology is widely available, it will make it easy for those with ill intent to ‘weaponise’ doxing. Facial recognition software is increasingly available to members of the public (for example: the software FindFace connects to VK, the Russian social networking service which is similar to Facebook) and makes doxing all the more tempting. However the potential for misidentification by face alone is high – 30% in the case of Findface software, but even border agents are wrong 25% of the time.

Reason 3: ‘Punishment’ can be disproportionate and hard to predict

Clearly the crimes and misdemeanours of doxing targets can vary. But the punishment that is meted out to these people is strikingly similar – at the very least online harassment by the perpetrators and not infrequently large numbers of their online allies. This can spill over into physical harassment or at least fear of this when the locations of their homes and workplaces are revealed. For more serious crimes employers are often urged to fire the offending person – as has already happened with one rally participant.

Furthermore, friends and family may also be encouraged to condemn the target.

While making people accountable for such reprehensible conduct is understandable (when they are accurately identified), online shaming can work differently to traditional shaming practices. Most notably, the stigma of having been accused can linger online long after the original incident. Formal criminal justice recognises the possibility of personal redemption. Those convicted of a crime in court can often apply to have the evidence of this removed from their records after a certain number of months or years – sometimes having to express remorse, make amends, or demonstrate that they are seeking treatment. Courts recognise that people can change and grow. Looking at white supremacists in particular, organizations like Life After Hate are staffed by those who used to espouse extreme far-right views and help others to disengage themselves from those ideologies and organizations. The scholar Randy Blazak, who studied white terrorists, notes, “as with other forms of crime, most youthful hate criminals will ‘age out’ of their criminality”.

Someone who has been doxed must be prepared for the possibility that the original accusations could linger online, attached to their name and online identity, indefinitely. It’s true that older social media postings may be “buried” by newer postings, and that over time the platforms originally used to share information may themselves discard old data or disappear altogether – Hany M. Salaheldeen and Michael L. Nelson found11% of web pages that were referenced in tweets that they studied had vanished after a year, for example. The lifespan of the reputational taint of doxing may be particularly long, however, and its online prominence may be high because the act of doxing itself tends to be an inherently ‘noisy’ process, with many people sharing information about the target publicly online as part of the process, which indicates to algorithms that this information is of interest.

Implications for media regulation

Where people are engaged in legal (if morally reprehensible) activities, media outlets should act responsibly. They may have a legitimate interest in finding the Charlottesville marchers to interview them, but should not be encouraging doxing behaviour, as this journalist is doing, even if this makes their jobs as journalists easier.

Of course if they go on to write about protesters, they can publish their names and other identifying information as part of the story but should do so only once they have verified the involvement of those they have identified. Publication of more information about them than is necessary to tell a story in the public interest (or encouragement to others to do so) could reasonably be considered harassment, which is forbidden in the IPSO Editor’s Code of Practice in the UK, for example.

Social media platforms have some doxing-related regulation themselves, but their terms vary. Twitter prohibits posting others’ private and confidential information like addresses and phone numbers but not their names and general locations (which could in turn be used by others to find more private information). Facebook prohibits “pages that identify and shame private individuals” but explicitly excludes from protection those who “have gained the interest of the public by way of their actions”, which veers dangerously close to the press’ hoary defence that reporting is in the public interest if it is interesting to the public.

Is there anything media regulators can or should do to tackle the problem of the lengthy retention of online accusations and doxing? Europeans already have some protection thanks to the “Right to be Forgotten” – protection that may be extended in some form to Canada and retained in the UK even after Brexit. But as Meg Leta Jones reflects in her book Ctrl-Z: The Right to Be Forgotten, the European Court of Justice has, “essentially put the right to be forgotten in [Google’s] hands to be shaped” – unsurprisingly perhaps since as she notes, “each European country has a different history when it comes to data, speech, access, public interest, public figures, privacy, identity, reputation, self-determination and self-presentation” – to say nothing of differences that exist globally.

On the form Google provides for users to apply to be forgotten, it simply asks them to demonstrate that the information is, “unlawful, inaccurate, or outdated” but says it may decline to remove from its search results if there is a public interest in the information.

The ultimate solutions to the moral conundrums posed in the aftermath of Charlottesville will emerge as societies come to understand the new privacy and accountability landscape we find ourselves in in the social media age – educators will have an important role in guiding discussions. Meanwhile, regulators in Europe and around the world must strive to provide clearer guidance and if necessary legal frameworks to social media and search companies about how to handle these issues.

David Brake is the author of “Sharing Our Lives Online: Risks and Exposure in Social Media”.

This post originally appeared on the LSE Media Policy Project blog and is reproduced with permission and thanks