Sunlight or Stalking? The Legal Ramifications of Doxing

-- By StewartPollock - 09 Mar 2022

Section I: Current Legal Status of Doxing

Doxing is the act of exposing a web user’s identity and other personal information, such as their location or address. Depending on who you ask, doxing is either an especially malicious form of harassment, or a sometimes-justified act of vigilantism, which can prevent bad actors from using the relative anonymity of the web as a shield for harassment and misconduct. Doxing frequently exists in a legal grey area—there is no federal “anti-doxing statute”, but doxing or doxing-esque behavior has been prosecuted under broader federal and state anti-stalking statutes. However, these statutes, which impose criminal penalties, have limited ability to reach individuals who are part of larger campaigns of loosely organized harassment. In particular, statutory language which requires a “course of conduct” by one individual limits the applicability of these laws where many people are involved individually. Kentucky recently passed what has been described as the first true “anti-doxing” statute, which would create both civil and criminal penalties for releasing personally identifying information with the intent to intimidate, abuse, threaten, harass, or frighten individuals. This law, by imposing joint and several liability on would-be doxers, goes further than federal or state laws, and has been presented by its advocates as a way to crack down on malicious forms of doxing. However, by moving doxing into the realm of civil law suits, the Kentucky law raises questions about where to draw the line between doxing and legitimate muckraking.

Section II: Federal and State Anti-Doxing Laws

The federal law which most closely covers doxing behavior is 18 U.S. Code § 2261A(2), the federal anti-stalking and cyberstalking statute. This statute makes it a crime to use the mail or any electronic communication service to engage in a course of conduct with the “intent to kill, injure, harass, or place under surveillance with intent to kill, injure, harass, or intimidate another person.” Although the language of the statute would seem to cover doxing that is intended to harass or intimidate, in practice courts have set a very high threshold for the applicability of the anti-stalking statute to threats based on revealing personal information. This is because of the specific “course of conduct” language of the statute means that a single threatening post or message is not enough to be prosecutable, even if it contains information that would put the target at risk. As many doxing attacks are coordinated from multiple accounts and users, the language of § 2261A(2) makes holding any individual accountable difficult. Furthermore, there is some evidence that federal prosecutors do not have the capacity to utilize § 2261A(2) in the doxing context, because there are more pressing cases concerning drugs and terrorism.

Several states have laws analogous to § 2261A(2), but they generally suffer from the same enforcement limitations when it comes to doxing carried out by coordinated groups. California’s cybercrime law, codified in California Penal Code § 653.2, has been used to prosecute doxing and doxing-like activities. Under this statute, enacted in 2010, this statute makes it a misdemeanor to use electronic communication in order to (1) intentionally cause another person to fear for their safety; (2) to harass, alarm, annoy, terrorize or cause injury to another person without “legitimate purpose”, and (3) to make personally identifiable information viewable or available to download which would be reasonably likely to cause that person or their family harm. This language is broader that the federal statute, however, like the federal law, California’s statute contains “course of conduct” language which makes it hard to utilize against a particular individual who is acting as part of a larger group.

Section III: Kentucky's "Anti-Doxing" Law

In January 2019, a confrontation at the Lincoln Memorial in Washington, D.C. involving a group of high school students from Park Hills, Kentucky (several of whom were wearing “MAGA” hats in support of Donald Trump) went viral on social media, leading to one of the students, Nicholas Sandmann, having much of his personal information revealed, and being subject to highly negative news coverage. In part in response to this incident, the state of Kentucky passed a law last year intended to provide both civil and criminal penalties for doxing. This bill, signed into law in April 2021, makes it a civil tort to “release of someone’s personal information [in a way that] would cause a reasonable person to be in fear of physical injury to himself or herself, or to his or her immediate family member or household member.” The Kentucky statute differs from previous "anti-doxing" laws, because it imposes joint and several liability on would-be doxers, rather than requiring a “course of conduct” by one individual. In addition, the Kentucky statutes shifts away from using criminal statutes to punish doxing, and instead creates a private right of action for individuals who are the target of doxing campaigns. Moving anti-doxing into the civil sphere could theoretically eliminate one of the major problems with using § 2261A(2) to prosecute doxing, which is a lack of law enforcement resources. However, there is strong reason to be skeptical of both the intent and utility of this new type of "anti-Doxing" law.

Section IV: Protection or Political Theater?

Laws such as Kentucky’s anti-doxing statute are presented by their advocates as providing a valuable way for the victims of harassment to strike back against those who maliciously publish their personal information online. Given the Kentucky attitudeof the legislature which adopted the bill, perhaps that chilling effect is the point. For those such as Sandmann (who settled his defamation claims against major media outlets for large sums) there are existing laws that offer greater protection than the new Anti-Doxing law. Other states have begun passing similar politically-charged "anti-doxing" laws, such as an Oklahoma statute which specifically targets the "doxing" of police officers, which critics have decried as an effort to prevent filming of police misconduct. The attributes of Kentucky’s anti-doxing law, particularly in light of the politically-charged circumstances in which it was adopted, raise questions of what it is actually intended to counteract. If interpreted broadly, it is easy to see how these types of laws can have a chilling effect on genuine journalistic activities. To the extent that harassment in the form of doxing is a problem which requires a legal solution, a new wave of politically-charged "anti-doxing" laws akin to those of Oklahoma and Kentucky in not an effective solution, and may make the underlying problem worse by muddying the waters of what constitutes "doxing".