After Twitter CEO Elon Musk accused numerous journalists of violating Twitter's new policy against "doxxing" by sharing data showing his live location, the meaning of "dox" became a subject of online chatter in late 2022.
According to Merriam-Webster, to "dox" or "doxx" is to "to publicly identify or publish private information about (someone) especially as a form of punishment or revenge." The sensitive personal information shared could include home addresses, social security numbers, phone numbers, emails, bank account information, or more.
According to Avast, a digital security and privacy firm, "Doxxing attacks range from the relatively benign, such as fake mail sign-ups or pizza deliveries, to the far more dangerous, like harassing a person's family or employer, physical harassment, swatting, identity theft, and other forms of cyberbullying."
Avast describes doxxing as a way of gathering "breadcrumbs" about an individual across the internet and using the information to reveal the supposedly real person behind an alias, or to buy and sell the private address, phone number, and other data on the internet. The practice evolved from online arguments, and resulted in people digging up information on adversaries: "More recently, doxxing has become a popular tool in the culture wars, with activists doxxing those with opposing viewpoints. Many politicians, celebrities, and journalists have been doxxed, causing them to suffer from online mobs and even death threats."
Revealing someone's private information is not necessarily illegal across the United States, though legality is determined on a case-by-case basis. Almost a dozen states have passed anti-doxxing laws (with more in the works), including a law in California that increased penalties for doxxing reproductive health care workers. After the reversal of Roe v. Wade, the Electronic Frontier Foundation (EFF) put together a guide on how to protect information that reproductive health workers submit to the government as California seeks to become a place where women can travel to in order to get abortions. One resource is the Safe at Home program, which "allows reproductive health care workers and patients facing threats to obtain a confidential snail mail address that they can use to protect their privacy."
In the United States, certain laws, like the Interstate Communications Statute and the Interstate Stalking Statute, may be applied to doxxing, while social media sites like Twitter already have anti-doxxing rules built into their platforms. According to Avast, doxxing can contribute to other criminal activity like stalking, harassment, incitement to violence, identity theft, and more, and the action is often prosecuted alongside other criminal offenses.
However, under Musk, the anti-doxxing rule has come under fire after it was amended to include a ban on sharing "live location information, including information shared on Twitter directly or links to 3rd-party URL(s) of travel routes, actual physical location, or other identifying information that would reveal a person's location, regardless if this information is publicly available." Commentators argue that Musk is using this rule to crack down on his critics on the platform, after he banned journalists who he claimed reported on the movement of his private jet.
Indeed, some fear that anti-doxxing laws can be abused, as journalists regularly publish private information for the sake of public accountability, especially when it comes to reporting on politicians' activities. The Nevada branch of the American Civil Liberties Union (ACLU) expressed concerns against an anti-doxxing bill being passed in the state in 2021, saying recent struggles against racism rely on people posting videos and identifying information about others on the internet who are acting in a harmful way toward others.
"Posting information online and in other forums is one of the few ways that ordinary people have to hold people in a position of power accountable," Holly Wellborn, the ACLU's policy director said to The Associated Press. "Statute cannot under any circumstances be used by a government official — whether that is a police officer or a legislator — as a tool to punish innocent behavior and constitutionally protected speech."
There are many ways to protect yourself from being doxxed, and steps to take if you have already been doxxed. The University of California, Berkeley's Ethics Center, EFF, and Avast have handy guides on self-protection. According to the Ethics Center, you can get started by doing the following:
- Adjust your social media settings:
- Ensure that your profiles, usernames/handles are kept private
- Remove any addresses, places of work, and specific locations from your accounts
- Set your posts to "friends only"
- Avoid discussing personal information that could be used against you, as well as anything that can identify your address, workplace or contact information
- Use a Virtual Private Network (VPN) and a
- If you must use public wi-fi, turn off the public network sharing functionality on your device
- Use strong passwords
- Vary usernames and passwords across platforms
- Hide domain registration information from WHOIS (a database of all registered domain names on the web)
Numerous types of doxxing exist — through someone obtaining your IP address, through collating information from your social media accounts, purchasing information from a data broker, phishing scams, sniffing (when someone intercepts internet traffic on its way from the sender to the receiver), WHOIS lookups (WHOIS is a service that allows anyone to learn information on the person who owns a domain on the internet), and more. You can read more about all of them here.