Doxing for Great Justice?
Doxing for Great Justice?
Is there an ethical way to dox or is it a tool we should just put aside?
Doxing! Is it Good? Is it Bad? Is it actually spelled Doxxing? We’re going round and round again.
Yes my friends, the debate over who should or should not be doxed is back. Along with it is the question: what is a dox? Do you really use 2 ‘x’s like that? Is there ever a good doxing? Or a bad one? What—dear deity—are the rules here?
The inciting incident this time is a Daily Beast story about the person who created and distributed the fraudulent video of Nancy Pelosi. In that story they revealed the name of the person and some journalistic-types and random Twitter people got Very Upset.
CJR rounded up some folks to talk about it:
They are all a lot more qualified than I am, but I have some real FEELS about doxing as a practice. Those feels haven’t gone anywhere as I’ve seen it well-weaponed against Nazis.
I think it is worthwhile to first speak a little to what it is “to dox”. There are a variety of definitions out there and all of them tend to come under dispute. I'm going to be very strict in my interpretation here: doxing is revealing or amplifying personal identity information about a person without their consent. This is a more stringent definition than most, but I think it is accurate to how I think about doxing. With this frame all of the following are doxing:
Revealing the real life name of someone who was previously posting under an anonymous username.
Revealing the real life location of someone who is posting under their real life name.
Taking efforts to significantly publicize the employer and employer contact information of someone who might have been previously public with their name but didn't make that information widely available.
Two major things to note here: First: I consider doxing to be the revelation of anything that would make it significantly easier to push a person into real life consequences for digital behavior. Second: I think that taking information that was public in a narrowly-available way and pushing it to be public in a broadly available way is indeed doxing, if only by amplification.
The baseline standard for what I consider doxing? Does it make harassing a person significantly easier? If the answer is yes, then it is likely doxing.
Ok, so now I have established what doxing is. Is it ever ok?
Yes.
I think that doxing, under ethical rules and considerations, is an important and relevant journalistic function. There are people who take advantage of operating in the dark and they use that anonymity in ways that responsible people should see as reason to withdraw that protection. That said, there are serious bars to doxing someone I think are worth considering before making a decision. I'll put all the rules at the top and go into detail below.
Does the doxing achieve a journalistic objective?
Have you fully confirmed this information is true and accurate?
If you have doxed this person through your own research have you documented that research and made your methods transparent and honest?
Are you minimizing harm?
Have you added context?
Is this person a public figure or do they deserve to be?
Are you punching up?
Is the only possible use of this information unethical?
(1) Does the doxing achieve a journalistic objective?
Does the revelation of personally identifying information about this person provide a larger context? If just the identity alone does not provide a larger context, is revealing in the service of a larger piece of reportage in which the identity of this person is a relevant fact to the larger story; or in which their attempt to seek anonymity is contextually relevant? Is this information the public needs to know? Would people not knowing potentially put them in danger?
If the answer to these questions is no, then perhaps it doesn't even make sense to pursue the person's identity.
(2) Have you fully confirmed this information is true and accurate?
Before taking any further steps is this information verified? 'Someone tweeted it' and 'Reddit said it was true' are both not valid verification. A real human or a legitimate news organization both count as verification. Interviews, research, documents, all of these can be supporting sources.
(3) If you have doxed this person through your own research have you documented that research and made your methods transparent and honest?
If you are doxing a person purely with information you have discovered and have confirmed to your own satisfaction that your methods are accurate can you account for those methods? You should publicly document them.
(4) Are you minimizing harm?
While many of these rules are built on top of SPJ's code of ethics this one is more directly applicable. ‘Use compassion, avoid arrogance and avoid pandering to lurid curiosity’. Particularly notable:
– Show compassion for those who may be affected by news coverage. Use heightened sensitivity when dealing with juveniles, victims of sex crimes, and sources or subjects who are inexperienced or unable to give consent. Consider cultural differences in approach and treatment.
– Recognize that legal access to information differs from an ethical justification to publish or broadcast.
This is especially relevant in the modern age where identifying even a Twitter account can open someone up to significant online harassment. If doxing a person would open them to harassment or significant offline consequences then the question has to be asked: does the journalistic value of this reporting—in whole or in part—outweigh the potential harm?
(5) Have you added context?
There are very few cases in which saying "Account X is Person Y" or "Person Y is at Address Z" is in the public interest. There are exceptions, but if all you are doing is just revealing personal information about a person against their wishes you may just be an asshole, not fulfilling an ethical imperative. Ask yourself: 'What's the story here?' and if the story is 'this Twitter account is this person' then you likely have failed to reach the bar for an ethical dox.
(6) Is this person a public figure or do they deserve to be?
Hopefully this has been addressed when considering the first and fourth rules, but it is especially important and so deserves special mention. Again from SPJ's code of ethics:
– Realize that private people have a greater right to control information about themselves than public figures and others who seek power, influence or attention. Weigh the consequences of publishing or broadcasting personal information.
This does not mean that only public figures are eligible for doxing, but it does mean that people who are not already public and known figures deserve special consideration.
That said, note the language of the SPJ rules here. Those seeking power, influence or attention are held to higher standards and that alone may be enough of a case for revealing or amplifying their identity.
(7) Are you punching up?
This is particularly relative to the situation, in that it means that there are cases where it makes sense and is ethical for one person to reveal the identity of Person Y but not for another person. It is especially relevant where people share a peer association. It might be unethical for me to dox someone who is another engineer or journalist if they are relatively minor in the field or if they work for me.
On the other hand, revealing that an abusive Twitter account is actually a VP of a company in your industry is legitimate. When someone is of equal stature or when you have significant influence over their professional field you should consider strongly if you are the right person to be doing the dox. Perhaps it would be more appropriate to pass that information to a journalist who would consider it with more abstract judgment.
If you are going to dox someone, don't punch down. Being in that situation compromises your judgement and it will likely make you look petty and unreliable anyway.
(8) Is the only possible use of this information unethical?
Perhaps this applies to your entire action, or perhaps only to a piece of it, but it is important to consider. If you reveal a piece of data that has no conceivable use except to help people harass the person, then don't. A good rule of thumb is: would this help a third-party sign the person you are doxing up for a magazine subscription or a credit card on behalf of the subject of the dox? Personal home addresses feature prominently among the data points that likely shouldn't be revealed with a dox.
In Practice
Let's consider some real and theoretical situations that can illustrate how to use these rules:
Drunk Pelosi
Poulsen wrote that his story was evidence “Russia doesn’t have a monopoly on disinformation,” and that “even a hastily produced, low-budget fraud can fool millions if it lands just right.” But not long after it was posted, a number of critics—including many associated with the alt-right—said the story was a sign of something else entirely: namely, a shameful attempt by the media to identify or “dox” a previously anonymous citizen for the harmless crime of posting a video. On Twitter, Intercept co-founder Glenn Greenwald said it was “repellent to unleash the resources of a major news outlet on an obscure, anonymous, powerless, quasi-unemployed citizen for the crime of trivially mocking the most powerful political leaders.”
From: Should The Daily Beast have exposed the man behind ‘drunk Pelosi’ video?
Our example from the top! Let’s dig into it. First of all, FFS Greenwald for not seeing that any time your argument gets you aligned with a bunch of Nazis it isn’t worth making.
Ok, that’s out of the way.
Is this a doxing?
Yes. This person’s name might have already been out there, they may have been willing to talk to a journalist but those do not automatically make this persons identity ‘public’. This is an example of doxing via amplification.
Is this a legit doxxing? Let’s check the rules.
1: This person’s identity is relevant because many people are being exposed to this piece of content without the context of who created it, how or why.
2: Yes, confirmed with the person themselves apparently.
3: Passes, see above.
4: The author of the article uses archive (dot) is links in order to assure they are not directly linking to the persons user accounts. Since those accounts are the place the video was posted this seems the maximum amount of protection for the individual that can reasonably be expected. Personally, I would have just downloaded the video and re-posted it rather than even use the archive links, but I think this is a reasonable decision.
5: Yes, the article adds a lot of context about why this person’s identity is important.
6: Examine SPJ’s code of ethics statement. The author of the doctored video clearly “seek[s] power, influence or attention”. Test passed.
7: This is where the argument can be made that the reporter had more of a platform than the author of the video. However, as we noted in 6 the creator of the video is clearly seeking more of a platform and in this particular case managed to create a significant audience. At this point we leave it to a professional journalist to handle this using a relatively neutral professional platform. Which is what occurred.
8: The Daily Beast withheld any non-relevant personal information that would only be used for abuse. The person’s personal address is not amplified, their phone number is not given away, their family is not put in the spotlight. This is a responsible selection of personal information for publication.
Verdict:
Ethical Doxing.
Random Sexiness
Before long, a user in the subreddit r/randomsexiness managed to figure out her name, track her down on social media and post a host of personal photographs -- including requisite bikini beach shots -- along with her full name. As can be expected, there were creepy remarks, like this one: “From when her first pic showed up, I knew that chick was looking for this attention.” Most commenters, however, criticized the original poster -- one even complained that the post should be taken down as it violated Reddit’s ban on “doxxing,” the practice of outing someone’s personal information on the Internet.
From: Doxxing Internet babes: "She wanted it"
This is another clear example of doxing by amplification. What was used here was already-public information on someone who was a nominally public figure. But it’s bad. It fails literally all of the 8 tests. I don’t even have to go into detail about why.
Verdict:
Unethical Doxing. Duh.
Doxing at Temple
Nieman Journalism Lab editor Josh Benton accessed private user data through the Disqus commenting platform to identify [name withheld] on Twitter and share other samples of disagreeable comments. Specifically, he was able to obtain her email address out of the Disqus administrator back end, information only available to him because of his role as a comment moderator for Nieman Lab's website.
From: In Temple 'doxxing' case, news orgs should learn a lesson about respecting readers
I wanted to talk about this case because it is a difficult one from an ethical standpoint and was what started me thinking about building ethical doxing rules to begin with.
Is it a doxing?
Clearly so.
Is this a legit doxxing? Let’s check the rules.
1: This person’s identity is relevant because they are an educator in a field responsible for training students specifically opposing the very type of thinking they are demonstrating.
2: This is fully confirmed with clear data from the commenting system.
3: The methodology is clear and documented. However, the person did not have a chance to comment and the exact nature of what is going on is obscured by using screenshots.
4: I don’t think harm was minimized here. Not only was their place of employment specifically mentioned but it was also tagged. The form and tone is aggressive. If it was less so perhaps the mention of her place of employment might have been justified, but just making it clear that she was indeed in a role where her identity was relevant without diving into amplifying specifics may have been sufficient.
5: There was some added context in the form of history of comments elsewhere, but that context did not include detailed thought about why the holding of these views in this specific case were bad. One could argue that was perhaps self-evident, but the lack of it in this case would make things a lot clearer.
6: This is a maybe. This person is not seeking a larger platform with their views and it would be very easy to argue that the messaging Benton did around revealing their identity was not particularly journalistic, something he later stated. Does this person even deserve to be a public figure is another questionable case. It could have been proven out if there was more context on how this person’s beliefs impacted what they did at their job or in public; say quotes from students or something along those lines. Remember: “Recognize that legal access to information differs from an ethical justification to publish or broadcast.”
7: Here’s where the biggest problem is. As both a fellow academic and a media reporter Benton has not one but two positions of power over this person. Some readers caught this right away, that the Twitter thread almost came out as a threat. Once again, there is a world in which a threat to employment can be justified, but that was not done here. The power differential is just too high in favor of the person doing the doxing, they are very much punching down. This is a definitive case for passing the information to a more neutral and less power-imbalanced third-party. Someone else might have been able to make this an ethical dox, but a fellow academic was not the right person to take the information public.
8: Tagging in their place of employment could be relevant and valid with additional reportage around the person being doxed, but right now it is not. There have been previous examples where the point of reporting the person’s place of work was a case for individual safety or to call for boycott (a good example is the attempts by antifa to not only ID Nazis marching in public but make them unemployable by tying them back to their jobs). I think in cases where the individual has threatened the public safety (like by being a public Nazi) or where their views and work give them an opportunity to do indirect harm (say lawmaking) there is a case that could be made for making their place of work public as part of reporting on them. This could be one of those cases, but there would need to be further reporting to prove it out.
Verdict:
Unethical Doxing. As made even clearer by the later apology by the doxer.
There was a version of this that could have been an ethical doxing, but—as it happened—it was not. It lacked the right person doing the doxing and the appropriate power differential between the two parties. Remember, sometimes it is better to pass the information on and let someone further from the case make the call.
You disagree?
At the height of some rather strident arguments on my Facebook page around (sigh) ethics in video games journalism I decided to enact some rules about how commenters are supposed to behave within comment threads with my face on the top post. These rules were written by me, for me—a reminder for when I get angry and illogical—that there are ways I should act and standards that I want to hold myself (and the spaces I’m in charge of) to.
That's the intent here too. I will apply these rules to myself (these days the only place I could conceivably dox someone is in the comments sections of my old WordPress blogs) but this is intended as a reminder and a standard of how I want to act ethically on the internet. These are my rules for me, you can adopt them (or not).
PS: Because I’m sure some people might challenge me on ‘being a Nazi’ as sufficient reason: Being a white supremacist or Nazi requires you to believe that a whole bunch of people not only have lives that are less valuable than your own but that they deserve to die for their differences. They are inherently a threat to public safety.
Interested in talking more about this newsletter? Join the Keybase.io team to chat about it: https://keybase.io/team/gneist.newsletter
Image Sources (in order included):
https://www.flickr.com/photos/monkeymashbutton/5948655391
https://giphy.com/gifs/funny-animation-loop-xT9IggKFA2NkEXuRVu
https://media.giphy.com/media/1wmPiqYt2xnOIQnZ17/giphy.gif