Doxing

Overview

Doxing (also spelled doxxing) is the act of publishing personal information about a targeted person, such as their name, address, phone number, workplace, and family members, on the internet without their consent. The word comes from "dox," a variation of "docs," short for "documents," and means "exposing documents." It is used as a means of harassment, revenge, or threats, and it seriously affects the victim's life.

How doxing is done

Gathering information for doxing relies on piecing together public information. Social media profiles, past posts, photo metadata (EXIF data), domain WHOIS records, public court records, real estate registrations, and so on: pieces of information that each look harmless are combined to identify a person.

When identifying an anonymous account, accounts get linked together if the person uses the same username or profile picture on several platforms. There are also techniques that estimate where someone lives or what they do for work from fragments of information, such as features of their writing style, patterns in the times they post, and the place names or shop names they mention.

How anonymous question services relate to doxing

An anonymous question service can be both a route for doxing attacks and something to protect against them. As an attack route, there is the act of guessing the sender's personal information from the content of a question and trying to identify them. For example, one tactic is sending a question like "Are you Mr. Y, the teacher at Z High School?" and drawing information out of the owner's reaction.

On the defense side, the owner needs to be careful that personal information can't be guessed from the content of their answers.

Legal position and countermeasures

In Japan, there is no law that directly regulates doxing, but it can count as a civil tort as an infringement of the right to privacy. If the published information is used for threats or stalking, the crime of intimidation or the Act on Regulation of Stalking Behavior may also apply. In 2022, the statutory penalty for insults was raised.

Things individuals can do include reviewing their social media privacy settings, using different usernames on different services, removing EXIF data from photos, and using WHOIS privacy protection when registering a domain. Complete protection is hard, but reducing the amount of public information about you can make doxing harder.