Skip to content

“Doxxing”: A Primer

March 19, 2015

I learned a new term today: doxxing (also spelled doxing). In short, doxxing involves the spreading of personally-identifiable information (documents, of “dox”) on the internet.

I noticed that some usage of the term presumes inappropriate “dropping” of personal “docs.” However, it seems that the perceived appropriateness of doxxing can sometimes be difficult to determine and seems to be tied to the motivations of the one “dropping the docs.” In his On the Media article dated March 10, 2014, producer Alex Goldman captures the complexity in determining such appropriateness (and, indeed, of defining doxxing):

The word “Dox,” for years an internet term of art for revealing personal information online, suddenly entered the popular lexicon last week when Newsweek published a story about a man named Satoshi Nakamoto who the author claims is the founder of Bitcoin. But I have to say that I think the term is not being very well applied in this case, and before we can decide whether the outing of Satoshi Nakamoto is, in fact, doxxing, we should have a better idea of what doxxing actually means. …

Back in the pre-world wide web universe, doxxing, or “dropping dox,” as it was known then, was basically a petty, retributive act meant to shame or embarrass rivals, and to establish supremacy as a hacker. A good example of the classic variety of doxxing occurred last week at Duke University. First, a student named Thomas Bagley outed a woman who goes to his school that he recognized as appearing in pornograpy to some of his friends (in itself a sort of analogue version of doxxing). Bagley, in turn, was doxxed by the CEO of a porn company for having a pretty healthy online pornography budget.

In the case of Newsweek’s article, however, it’s more complicated than doxxing as I define it. Generally, doxxing is perpetrated against private individuals without any relationship to newsworthiness or the public interest. The same can’t be said about the identity of Bitcoin’s creator. A guy who invented a crypto currency that has an (albeit miniscule) chance of destabalizing the online payments industry is certainly newsworthy. At the same time, the article ran with a picture of Nakamoto’s house and license plate, easily allowing reporters to discern its location, which, as a journalist, makes me pretty uncomfortable. The article’s impact is complicated by the fact that the man himself denies any relationship to Bitcoin, and Newsweek’s article, while building a pretty excellent circumstantial case that Nakamoto is Bitcoin’s founder, is conspicuously absent any smoking guns. …

So what are my conclusions? Well, I think that whether or not Newsweek’s Bitcoin article is actually doxxing kind of rests on whether the author was correct about Satoshi Nakamoto’s identity. In the larger context, I feel like it’s only doxxing when revealing a person’s information has no news value whatsoever. But what determines news value is, of course a gray area. In the end, I hate to get all Potter Stewart on you, but when it comes to doxxing, I know it when I see it

Thus, the motive of the writer as intending to serve the public interest via newsworthiness of publishing personal information is (for Goldman, and for me, as well) a key issue in determining what actually constitutes negatively-connoted “doxxing.”

Not all view the term doxxing as negative. But it’s complicated.

If one takes the term doxxing at its most general, it simply involves “dropping documents.” Yet the definition has nuances. Some refer to “doxxing” the as the publicizing of personal information not otherwise publicized. Yet others maintain that it is “doxxing” for one to even draw attention to publicly-available, personally-identifiable information.

To some, doxxing is always negative. To others, it is not. Again, I think motive plays an important role. If I assemble a dossier of publicly-available personal information on an individual and disseminate it as a means of revenge, I think most would agree that my actions would fit the term “doxxing” in a clear, negative sense. However, if I reference information available on a nonprofit tax form in order to establish that the leader of Los Angeles Parent Revolution actually lives not in Los Angeles but in Beverly Hills (which I did in chapter 20 of my book, A Chronicle of Echoes), then my motive as intending to inform the public is pretty clear. Note that in the text of my book, I do not print the specific Beverly Hills address of the individual in question; however, as a competent researcher, I do provide reference information so that the public might view the tax form and see the specific address.

Another interesting issue regarding doxxing is whether the personally-identifiable “docs” that are “dropped” aid in revealing concealed identities of those violating the rights of others via cyber threats. It is in such situations that doxxing appears to not carry a negative connotation. For example, Boston Red Sox pitcher Curt Schilling doxxed in order to identify (to both himself and to their schools/employers) individuals sending violent messages about his daughter via social media:

…Former Boston Red Sox pitcher and game studio founder Curt Schilling enacted some online vigilante justice against Twitter users who had posted violent and sexual comments about his daughter—by doxing them. …

The former Red Sox hurler… us[ed] publicly available information to attach identities to these two users. One was a DJ at a community college radio station and the other was the vice president of a fraternity. “Worse yet, no less than seven of the clowns who sent vile or worse tweets are athletes playing college sports,” Schilling added. “I knew every name and school, sport and position, of every one of them in less than an hour. The ones that didn’t play sports were just as easy to locate.”

Schilling didn’t publicly disclose the identities of the other seven people, but he did hint that he might share that information with relevant parties …

Other news agencies have confirmed that both outed men have already suffered public consequences; one was suspended from his community college, while the other was fired from his part-time job as a ticket seller for the New York Yankees.

Instead of “dropping” his “docs” about these perpetrators on the internet in general, Schilling doxxed their schools and employers. And I am hard pressed to think of anyone who would reprimand Schilling for doing so.

In the past year, I have had an angry commenter on my blog “drop” a detail of publicly-available, personal information about me in such a manner that sent a message, “I know how to find you.” I deleted the comment and discontinued communications with the commenter. Such creepy “hinting” appears to be on the fringes of negatively-connoted doxxing; moreover, the message did qualify as a thinly-veiled cyber threat.

In another instance, I had an anonymous commenter write a disparaging comment (which I did not publish) and then write a second comment, a challenge for me to “disclose my funding” (which I did publish in this March 2015 post). I am not sure whether my anonymous commenter realized it, but via the internet, I was able to locate the exact home address from which the comments originated. I did not “drop” that home address “doc,” but I could have. I could have even shown up on that person’s doorstep had I the inclination (which I did not).

Anonymous commenters: Take a lesson.

In my case, “dropping” the mean, anonymous commenter’s home address “doc” would have been wrong because my motive would have been one of revenge. However, “dropping” a public “doc” that involves a home address can serve the public good. Consider New Jersey blogger Bob Braun’s exposure of a glaring conflict of interest between New Jersey commissioner of education Bari Anhalt Erlichson and her husband, Andrew Erlichson, whose employer, MongoDB, has a fiscal connection to PARCC vendor, Pearson. Braun writes,

Bari Anhalt Erlichson, an assistant New Jersey education commissioner and chief testing officer who supervises PARCC testing throughout the state, has a personal connection of sorts to PARCC’s developer, the British publishing giant Pearson. Anhalt Erlichson is married to Andrew Erlichson, a vice president of a company named MongoDB. MongoDB (the name comes from humongous database) is a subcontractor to Pearson, developing its national student database that provides the larger company with access to student records in New Jersey and the nation.

Anhalt Erlichson wrote a memorandum to New Jersey educators March 17 defending the actions of her department and Pearson in monitoring the social media of New Jersey students while they took the PARCC tests. She blamed the uproar caused by the revelation of the cyber-spying on the failure of parents and educators to understand social media.

She did not mention her personal ties to a company that profits from the business relationship to Pearson which, in turn, has a contract with the state education department. Bari Anhalt Erlichson and Andrew Erlichson own a home in Princeton valued at $2.9 million, according to property records.

Braun is establishing the fact of a conflict of interest when it comes to the Erlichsons’ ties to Pearson. In his original post, to support his assertion of the value of the Erlichson home, Braun linked to the publicly-available, New Jersey property tax records that one might locate using this search engine from the State of New Jersey Transparency Center.

On March 18, 2015, education historian Diane Ravitch posted Braun’s piece on her blog. For doing so, she and Braun were accused on Twitter of doxxing.

As a result, Braun removed the link that he provided as evidence for his statement that the Erlichsons can afford a home worth almost $3 million.

What I notice from the indignant “doxxing” tweet linked above is that there was no comment about Braun’s conflict of interest charge being wrong.  There was simply the deflecting of the weight of Braun’s charge by aiming at Ravitch and Braun (particularly Ravitch) for “doxxing” publicly available information on adults– and, as it happens, for “doxxing” information also readily available on whitepages.com for anyone who knows that Bari Erlichson is married to Andrew Erlichson.

I know. I just doxxed. For the purposes of this post, call it a teaching tool.

doxxing

The tweeter also asks Ravitch how she “reconciles doxxing and privacy.” Let’s do some word substitution: How does one “reconcile linking to a public record in order to support concern for a conflict of interest between a public employee and a private company with which the public employee does business in the capacity as a public servant but who also benefits privately from the same company’s fiscal well being and privacy”?

And the question crumbles.

I do, however, have a closing proposition for our doxxed-indignant tweeter:

When the families of the New Jersey students who are being regularly (and until recently, secretly) monitored on social media by NJDOE and Pearson also collect money from either Pearson or NJDOE for taking the PARCC tests, then we can talk “victimized” NJDOE employee for having her easily-discovered home address “doxxed.”

Let me know when NJDOE and/or Pearson plan to cut those PARCC-testing-completer checks.

Ready for more?   Doxxing: The Sequel

desk money

_____________________________________________

Schneider is a southern Louisiana native, career teacher, trained researcher, and author of the ed reform whistle blower, A Chronicle of Echoes: Who’s Who In the Implosion of American Public Education.

25 Comments
  1. JCIII permalink

    Mercedes,
    I can’t count the number of people I tell to subscribe to your site. Thanks so much for your outstanding work. Remain strong…don’t be intimidated!! John Craven. Fordham University.

  2. Thank you, John. I appreciate the encouragement.🙂

  3. I just learned a new word—there are more than 1 million in the English language so there is always room to learn new words when the average person’s vocabulary is 30k – 50k.

    Thank you.

    But, I think alleging someone of doxxing, in this case, might be an attempt to discredit and diminish credibility by alleging that doxxing was taking place. By removing the link when they were accused of doxxing, some might claim that is proof of guilt. How can someone be guilty of providing proof of an alleged crime?

    I think the links should be put back that were removed and your explanation of doxxing added.

    • I was thinking just the same thing when I was reading this. Part of the reaction might have been due to strong negative connotations, especially with all publicity surround #gamergate and the association of doxxing with trolls. That still makes it caving to bullies

  4. CNN’s Morgan Spurlock did an Inside Man episode on Bitcoin. Fascinating and scary. Don’t know if the show is available on line yet.

  5. Prominent cases of doxxing have involved swarms of extremely hostile men’s rights activists issuing rape and violence threats to feminist critics of online sexism — critics who do not have publicly available information in most cases. The most extreme cases of doxxing involve breaking someone’s online anonymous id via IP tracing.

    Braun’s piece attempted to show a lucrative relationship between the Erlichsons and Pearson, but it tangentially hit on this phenomenon by directly linking to the home listing. The information without the link is, however, public information and within the realm of journalism.

    This is not really doxxing, but it is vulnerable to the accusation of participating in a phenomenon that has driven a number of women in internet social critique underground.

    • This accusation is off base when there is no one to “drive underground,” which is the case with Braun’s post.

      • Agreed. This is light years from what has happened to Anita Sarkeesian or Zooey Quinn. This was about establishing a potential financial incentive for a public official to give favorable treatment to Pearson. The link to the publicly available home information was what opened to door to the accusation, having certain parallels to prominent doxxing cases. It was also not really needed — while anyone could find it, such a link would not appear in a print source but the home value information would have been still published.

        The Internet is an odd social system — what happens in one spot can strongly impact how people interpret what happens elsewhere in totally unrelated phenomena. But this is the first time I have seen an accusation of doxxing used to defend and Republican education appointee.

      • FYI — when they accuse Bob and Diane of doxxing, this is the kind of behavior they are invoking:

        http://abcnews.go.com/Technology/woman-center-gamergate/story?id=26519987

      • I should also note that while doxxing has taken on serious implications with the death and rape threats from gamergate, it is not actually always negative. People have doxxed trolls to get them to leave communities alone and stop stalking people. People claiming to be Bruce Wayne like figures have been doxxed to prove they don’t live up to their own hype. It is frowned upon as a routine course of action but there have been legitimate cases of doxxing that shut down trolls and stalkers.

  6. Reblogged this on As the Adjunctiverse Turns and commented:
    If you follow Audrey Watters’ Hack Education, which I certainly hope you do, you should already have a good understanding of “doxxing.” Even so, this post adds a new and necessary perspective.

  7. Bill Michaelson permalink

    There is parallel in law with regard to defamation that seems to be predicated on the notion that public officials surrender certain expectations of reputation protection as part of the responsponsibilities associated with their position. Thus the standard for defining libel is higher, such that a victim must prove that the writer stated something with malicious intent, in addition to the lower standard of mere falsehood. Is the concept ethically applicable here? I think so. And I think that the title of Assistant Commissioner of Education for the State of New Jersey carries certain burdens that Bari Erlichson will just have to bear. Braun reported only facts.

  8. Bill Michaelson permalink

    Hey, no post-submission edits allowed? s/ponspons/pons/

  9. Laura chapman permalink

    Really important information. Thanks.

  10. First Chester Mitchell and now this woman! I am a public school teacher and every year I have to read and sign a document that explains ethics regarding my employment, including conflict of interest. Why are these people immune???

  11. I’m troubled by the implication that if you believe you’re virtuous, doxxing is okay. I guess that if you believe you’re virtuous, you can justify all sorts of things, such as using public funds to accumulate an “opp file” (Klein’s NYCDOE on Ravitch). I’m sure Klein and his former underlings had all sorts of ways to rationalize that. I didn’t buy that argument then, and I don’t buy it here.

    • The issue is not whether I believe I am virtuous. It is in whether my actions serve the public good. This includes using public funds before the public for appropriately-designated, public purposes.

      As stated in my post– based on my researching the issue– doxxing is not exclusively defined as negative.

  12. The arguments made in this piece are really off base, and incomplete.

    To talk about doxxing in 2015 and ignore Kathy Sierra, Adria Richards, Anita Sarkeesian, Randi Harper, Brianna Wu, Gamergate, etc, is incredibly narrow and inaccurate. To ignore the harassment, violence (from SWATting on up) that accompanies doxxing feels like either shoddy research or an intentional omission – and neither is good.

    Moreover, by your logic – “if it’s public info, it’s fair game” – social media monitoring is okay. And to be clear, it’s not. Both social media monitoring and doxxing are practices that need to stop.

    Moreover, the Braun piece has incredible weaknesses. They show a complete lack of understanding of how people use open source software. The tool Braun mentioned – the NTC – was sold by Pearson to Hobsons in 2013. And MongoDB – the database – is freely available for people to download and use without any contact with MongoDB.com , the company.

    But even if the Braun piece was rock solid (and it’s far from it) the piece did not require a link to their home address to make his point. That was completely irrelevant to the issue at hand. It’s inclusion in the piece is cruel and unnecessary. The piece is diminished, rather than strengthened, by its inclusion. Braun did the right thing by removing the link.

    And I know that the justification for this is some version of “it’s public info” and “they are supporting social media monitoring, so they had it coming.” But that is so incredibly off base.

    There is a huge difference between information being accessible, and information being actionable. Doxxing – like social media monitoring – is an act of collection, organization, and presentation. Doxxing – like social media monitoring – collects information within a context, and removes barriers to acting on that information.

    For example: if a crank is upset by this story and wanted to do something about it, they would need to go through the research steps to find the information. They would need to dig through the public records, collect the number, and that time – that effort – is both a barrier to action and an opportunity for thought. Your post removes that barrier.

    What you advocate for here – what your “primer” instructs people on here – is dangerous. I strongly urge you to reconsider what you are advocating for here. Justifying doxxing puts you in the company of harassers and abusers. That’s not a good place to be – and it’s especially not where we want to be if we are advocating for student privacy, student rights, and a better education system.

    • “What you advocate for here – what your “primer” instructs people on here – is dangerous.”

      Who is this danger to that you allege exists—corporate reformers and/or their corporate masters? Make no mistake. We are at war with the corporate reformers—with the 9 Hedge Fund billionaires, with Bill Gates, Eli Broad, the Walton family, etc., and everyone they pay to do what they want.

      In a war, be it economic or with bullets and bombs, anyone who follows rules that restrict—usually written by the enemy who doesn’t follow the rules—they also limit their ability to fight, and then they will lose.

      I suggest strongly that if providing the information and links to public information that leads to fraudsters, then use that method even if it is alleged to be doxxing.

      I wonder what Sun Tzu, who wrote the Art of War, would say.

    • In order for me to be put “in the company of harassers and abusers,” one must selectively read my post. What I have found is that this term “doxxing” is being liberally applied, and it is being applied to researchers, like me.

      As to the monitoring of social media, the testing companies need to be up front with the public about their actions. And they cross a line in encouraging districts to open sites in order to lure students into following the site for the purpose of monitoring. Again, we are at an issue of public good. Beefing up testing company profits is not a public good.

      • RE: “selectively read my post”

        I read you post upwards of ten times over a few days, start to finish.

        Your post, authored March 19, 2015, starts with this admission: “I learned a new term today: doxxing” – today is the 21st, which means that doxxing has been part of your lexicon for two days.

        While a beginners mind is often a useful asset in understanding a topic, there’s also something to be said from a greater depth of understanding that comes with familiarity with a topic over time.

        I agree that social media monitoring is a problem that needs more daylight, more transparency, and needs to be limited. It’s a new(ish) frontier in surveillance, and needs to be sharply curtailed. In the absence of greater transparency, I’d argue that there is a good case to be made for eliminating social media monitoring until that transparency is in place.

        But that doesn’t justify doxxing.

        Doxxing is a tool used to maintain existing power structures. Doxxing is used to threaten, harass, and belittle. The history of doxxing slants heavily toward abusers, sexism, racism, bullying. The justifications you cite in your piece are the same justifications used by other people who have attempted to justify doxxing in the past.

        I’m not saying that you are doing this – as you say, you have only been aware of the term for two days. But there is an ugly and detailed history here. Doxxing exists within a larger, ugly context.

        As Audre Lorde says: “For the master’s tools will never dismantle the master’s house. They may allow us to temporarily beat him at his own game, but they will never enable us to bring about genuine change.”

        Doxxing is the master’s tools.

      • I “just learned the new term” because it was used on a fellow blogger, not because he hacked into someone’s personal files and broadcast such by way of deranged motive, but because he linked to a publicly available document to note that a couple who both stand to benefit from ties with a testing giant are living well. So I investigated the term “doxxing” to find that it is liberally used. And as a researcher, I used my new knowledge to teach others. Take issue with this if you like. But the usage of the term “doxxing” has moved beyond application to the malicious hacker and into the realm of documenting research. And I will write about it if I choose. You may object if you like.

  13. Ken Watanabe permalink

    It’s a new word for me, too. But based on my reading of the post, I think it sounds pretty much common skill set activists have to put perpetrators into shame. A good example of doxxing is to create the list of university blacklist for perpetrating “academic apartheid” (ahem)– employment discrimination by race, nationality, gender, etc. Post any document or record already released to the public–not the ones labeled as private or confidential. And see how it gets perpetrators so mad and prompt a furious response in an e-mail to make accusation or whatever beef they have, only to reveal their flaws–fallacious attribution, bad science, etc.

    Here are the links:

    http://www.debito.org/blacklist.html

    Examples here:

    http://www.debito.org/miedata.html#mieresponse
    http://www.debito.org/Hokuseidata.html#response
    http://www.debito.org/keiwadaidata.html
    http://www.debito.org/keiwadaidata.html#keiwaresponse

  14. jgorman permalink

    Mercedes, I don’t always get a chance to read your blog as much during the busy baseball season being as I’m the coach but I always leave more informed, inspired, and most important, ecstatic that you chose to remain in teaching. Keep up the good fight and thanks for sharing gifts of wit and humor with the rest of us!

  15. Bill Michaelson permalink

    I’m not sure what to make of the links, but they are a legitimate subject for public consideration. Comparing this exposure to Gamergate is absurd hyperbole. Maybe Braun’s link to a primary source for the home address was gratuitous, but it’s not a big deal. The home addresses of many public officials are readily available with minimal research. I doubt that Erlichson is being harrassed. Get a grip.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: