Doxing

Doxing (or Doxxing) is the dropping of documents or information onto the Internet.  It is generally taken to mean the disclosing of information that someone would rather not have been revealed.  The original data is usually freely available or disclosed for a modest fee and might be gathered from social media or data hosting collections (private or government run).  Doxing is sometimes done just because the user can, it could be to cause irritation or annoyance to the target but in extreme cases it can all get out of control; in a USA case it led to police killing an innocent man and jail for the prankster.

The practice is legal in most countries including the UK although if it leads to harassment or stalking then there would be grounds for action against the stalker.  A simple example of doxing would be to publicly post (or paste) details of an account user name together with details of the real person behind it.  This sort of paste might include the real name, address and names of relatives linked to the online name.  If the target is an Internet criminal this might be seen as a good thing.  Revealing the full name and address of someone you feel has ‘wound you up’ on some forum or social media site may not be so clever.  In any such case it is now possible for someone to visit the previously anonymous poster at their real address and threaten or even assault them in person.  In a slightly less severe example it is possible to see where a user name is active, find out what the owner is interested in and link that to an individual.  This could then be used to make decisions about them on career progression or social acceptance.  The growth of AI and the continued existence of sites or forums dating back many years is making it easier to gather such a profile on individuals.

The doxing site; doxbin has 333,680 users and has promotes itself as legal and honest with clear guidelines on what it will accept and how it can remove content.  Kindus, in no way agrees with some these pastes many of which are clearly discriminatory.  The site’s black background, devil-face wallpaper and some of the language used does seem to be aimed at the user with lower morals.  A casual scan of the pastes on Doxbin reveals very little.  To make sense of any would require some knowledge of the user names ‘outed’.  Most would be aimed at a small group of readers who already have an interest in the target.

Doxbin does not collect data on users.  Their list of banned content includes personal information specifically about children under the age of 15 and direct threats of physical harm, terroristic threats and swat threats/requests.  Pastes can be password protected by their authors and Doxbin provide a (worryingly short) listing of where posts have been removed or removal requests refused together with the law enforcement body involved.  For example the most recent UK report (out of a total of 6 in 4 years):

[November 26th, 2023] – Leicestershire Police, Leicestershire, United Kingdom – Requested: User information – Verdict: Denied | Account doesn’t exist. | Information regarding users are not logged, therefore we have nothing to hand out.

Other doxing sites are available, plus the process can occur on mainstream sites such as Facebook but it does seem that doxing of casual Internet users is a relatively uncommon issue.  It could however lead to considerable distress to the victims of personal data disclosure.

It is good practice for Internet users to adopt some form of moniker rather than to use their real name.  It also makes sense not to use the same user name over a range of sites and services unless they need to be deliberately linked (perhaps to promote an on-line brand).  Everyone should take care over the information that they put out over the Internet.  Social media posts or blogs dating back many years can be trawled to piece together personal information.  Images are another source of data, not only from what they show but also looking at where and when they are taken.

The best protection against doxing is to consider what is being posted online.

• Avoid heated debates and flame wars any of which could escalate badly.
• Use separate personae and accounts for different purposes each with unrelated on-line names and passwords.
• Do not use general sign ins from Google or Facebook but create new unique accounts.
• Delete accounts and remove posts, images and videos that are no longer relevant.