Should doxing be illegal?

In 2016, a “troll storm” hit Tanya Gersh, a Jewish wedding planner and real estate agent in Montana. The storm began when Andrew Anglin, the editor of the Neo-Nazi publication The Daily Stormer, published her photo, phone numbers, email addresses, and social media profiles, including one belonging to her young son.

Her phone rang incessantly, and she received death threats at her work email along with hundreds of anti-Semitic messages, including a Photoshopped image of her family superimposed above a Nazi concentration camp.

Gersh’s experience is emblematic of a type of harassment called doxing. Slang for doc-dropping, doxing is the process of making someone’s address, contact information, identity, or other information public, usually in order to intimidate, harass, or incite public outrage. The term dates back to the mid-2000s, but doxing has since become a well-known harassment tactic. There aren’t clear statistics on how many people have been doxed, but a 2021 report from the Anti-Defamation League estimates 9 percent of Americans have experienced doxing.

The deluge of hate, which lasted months, forced Gersh to scrub her online life. Police sent patrols by her home and work. Her children’s school tightened security. She spoke with the FBI. But the trolling continued. She had panic attacks and says her physical health suffered as a result of the online abuse.

“What they did to me was not harassment. What they did to me was like terrorism. They took away everything that I knew to be my life,” Gersh said.

There is no doubt the doxing caused Gersh extreme harm. And victims of doxing can sometimes use laws against harassment, conspiracy, or cyberstalking to sue people who release their information. But was publishing Gersh’s contact information illegal? Many states are grappling with this question right now.

This year, at least eleven states have passed laws against doxing or strengthened existing cyberstalking laws to include the practice.

Three more states, Nebraska, New Jersey, and West Virginia, are currently considering anti-doxing laws. California is considering increasing the penalties for doxing reproductive health care workers.

Even without an anti-doxing law in place in Montana, Gersh, working alongside the Southern Poverty Law Center, successfully sued Anglin for invading her privacy, inflicting emotional distress, and violating Montana’s Anti-Intimidation Act—a law that the “troll storm” incited by Anglin had defied but not one designed specifically to address the doxing that caused it. In 2019, the U.S. District Court for the District of Montana adopted the recommendation of a federal magistrate to award Gersh $14 million in damages. She has yet to see the money.

Gersh argues if there had been a law in place that specifically addressed doxing, the storm might not have descended upon her in the first place.

“The lack of the doxing laws is why this did happen to me, and why it has happened to so many people before me,” she said. “I just happened to be the lucky one.”

How do anti-doxing laws work? 

The doxing laws that have passed, or are under consideration, allow people to hold the doxers accountable for releasing their information and the consequences of doing so.

So far, states have taken three approaches: laws that allow victims to sue doxers, laws that make doxing criminal, and laws that protect certain groups of people, such as health care workers, from online harassment. Each approach has its quirks.

In June, Nevada passed a law allowing doxing victims to pursue civil action if personal information is shared online with the intent of inciting harassment, stalking, or death.

This approach comes with some advantages, says Kendra Albert, a clinical instructor at the Cyberlaw Clinic at Harvard Law School. You don’t need law enforcement or a prosecutor to buy into the fact you’ve been doxed, and the burden of proving you’ve been doxed is lighter than it would be in criminal court.

However, when you’re being doxed by hundreds of people (some of whom may use anonymous accounts), it can be hard to identify just one person to sue.

“These laws are based primarily on the idea that you’re suing one individual, which may not be very helpful if what’s happening is a huge mob of people or multiple people are sharing the information,” Albert said.

Some states have made doxing a crime. In this case a doxer could face jail time or fines if convicted.

Nebraska is considering a bill that would make doxing a misdemeanor, or a felony if someone experiences death, mental anguish, or significant economic injury because of it.

It’s harder to prove a criminal case, but this approach does allow for more robust investigations to take place, said Albert. But that investigative power hinges on law enforcement taking action when people report doxing, or knowing what to do when online harassment does happen. That “has historically been a huge problem,” Albert said.

Finally, a handful of states have created hyper-targeted doxing laws protecting specific groups. Colorado has made it illegal to dox health care workers. Oklahoma passed a law making doxing police officers a misdemeanor punishable by six months in jail or a $1,000 fine. It’s already a misdemeanor to dox reproductive health care workers or patients in California, but legislators there are now considering a bill that would increase penalties.

There are also similar federal protections making it illegal to share personal information on various classes of federal employees, jurors, and witnesses.

Could anti-doxing laws be abused? 

Journalists regularly publish private information, like addresses or names. Voters might share a politician’s email address on Twitter. Both of these actions include sharing someone’s identity or contact information—sometimes against that person’s wishes. But they’re also tools to hold the powerful accountable, and concerns have been raised that doxing laws may be used to prevent or prosecute protected First Amendment activities.

The ACLU of Northern California voiced concerns over California’s bill, which would increase penalties for posting photos or personal information for reproductive health care workers and patients, because it could infringe on “protected expressive conduct.” The Northern California branch of the ACLU didn’t respond to a request for comment for this story.

In Nevada, the local ACLU raised objections to an earlier version of the anti-doxing bill that would have made doxing a criminal offense, out of concern that the law could lead to government officials pursuing action against people engaged in protests or freedom of speech.

The Nevada branch of the ACLU didn’t respond to requests for comment for this story. When the law was passed, Holly Welborn, the policy director at the ACLU of Nevada, told The Associated Press, “[The statute] cannot under any circumstances be used by a government official—whether that is a police officer or a legislator—as a tool to punish innocent behavior and constitutionally protected speech.”

The idea that anti-doxing laws could be used to punish whistleblowers is a real concern, said Bruce Schneier, a fellow at the Berkman Klein Center for Internet & Society at Harvard University. “Any of these laws could be subverted by the powerful,” he said.

Lauren Krapf, the technology policy and advocacy counsel for the Anti-Defamation League, argues there are ways to craft anti-doxing laws that don’t harm whistleblowers. Under the proposed Nebraska law, doxing is only illegal if the perpetrator intends to cause harm by releasing information, or accidentally causes harm through recklessness.

“To the extent that these people are publishing information to share facts—and not acting with a level of intent that the information posted will be used to carry out criminal conduct such as death, bodily injury, or stalking—the Nebraska anti-doxing law would not apply,” Krapf said.

Requiring proof of malicious intent or negligence is an attempt to address free speech concerns. But it also opens a backdoor for bad actors to get around these laws. Doxers might attempt to disguise the fact that they intend to harm someone.

When Anglin’s followers doxed Gersh, she says, they tried to walk through this door. They peppered their threats with modifiers like “could” or “should.”  Still, the evidence and the harm the doxing had caused her family remained overwhelming enough for a judge to award damages. And in Gersh’s case, it was abundantly clear Anglin and his followers were attempting to harass her.

Still, Gersh remains adamant that an anti-doxing law could have helped stop the troll storm in its tracks, not just because those new laws could lead to damages or even jail time for doxers, but because, in her view, they send a message. “Don’t think, haters, that you can hide behind a computer screen and not be held accountable for your actions,” she said.

This article was originally published on The Markup by Emma Betuel and was republished under the Creative Commons Attribution-NonCommercial-NoDerivatives license.