Doxxing: What it is, and how to prevent it

Fanatical Taylor Swift fans vowed to get their revenge on a music critic whose review of her new album was insufficiently ecstatic. They posted the writer’s address and phone number on Twitter - resulting in an avalanche of online abuse and threats.

There’s a word for this kind of harassment: doxxing.

While some persist in seeing doxxing as a prank, the consequences can be profoundly serious, ranging from intimidation to emotional distress to loss of employment and even loss of life.

Exactly what is doxxing?

Doxxing is a form of cyberbullying that involves the malicious posting of private information without consent. It could be about you, your family, or your kids. It could be photos or actual documents (hence the term “doxxing," sometimes spelled "doxing".)

Way back in the dark ages of the internet - the 1990s - doxxing made its debut as a revenge tactic employed by hackers. “Dropping dox” on someone meant making their private data publicly accessible online.

Social media is the start

Today, anyone who uses social media has voluntarily (although not necessarily intentionally) allowed enormous amounts of personal information to be easily available to anyone who cares to find it.

“Facebook meticulously scrutinizes the minutiae of its users’ online lives, and its tracking stretches far beyond the company’s well-known targeted advertisements. Details that people often readily volunteer — age, employer, relationship status, likes, and location — are just the start,” a recent New York Times report found.

“Facebook tracks both its users and nonusers on other sites and apps. It collects bio-metric facial data without users’ explicit ‘opt-in’ consent.”

Hackers have ways of infiltrating the back-end of Facebook and other platforms.

Doxxers dig deeper

But doxxers dig much deeper. They are skilled at ferreting out unlisted phone numbers, home addresses, tax file numbers, and the location of your children’s school. How?

“Beyond social media and online discussion boards, there are public records of property ownership and voter registration, as well as massive databases of financial information assembled by credit-rating agencies,” explains University of Florida telecommunication professor Jasmine McNealy.

Doxxers are experts at harvesting these rich sources of personal data.

Why do they do it?

In a word: revenge.

The doxxing we hear about most often in the news is politically motivated. The pro-democracy protests in Hong Kong, for example, have spawned thousands of online harassment complaints, according to the city’s privacy commissioner.

The children of police officers were among the targets - prompting Facebook to finally introduce a policy protecting children’s identities.

One particularly insidious version of doxxing is called SWATTING, which involves the doxxer posting a fake terrorist threat, then exposing the discovered contact details of the target. When armed police (or a SWAT team, hence the term) converge on the target’s house, the doxxer’s job is done.

Celebrities who have been the targets of SWATTING include Chris Brown, Miley Cyrus, and (yet again) Taylor Swift.

In general, however, it is women and minorities who are most likely to experience doxxing.

The most severe cases have resulted in online and real-world harassment of women in the gaming industry, prank calls to summon police to a politician’s home, and even death threats.

“Doxxing, ultimately, makes data into a weapon,” says McNealy.

How to prevent it

You can minimize the risk of doxxing by:

• Maintaining strict privacy settings on social media
• Avoiding posting any identifying details about your place of work or your children’s school
• Avoiding posting any photos of your kids, and ask others who take pictures of them at events not to post them online
• Avoiding public WiFi hotspots, which can be intercepted by hackers’ fake hotspots
• Protecting your email identity with a “burner” webmail account you can use for sites that require an email address when you register (some of them may be doxxing harvesting sites).
• Varying usernames and passwords.