Tuesday, October 30, 2012

« Stay Safe, NWN Readers in Hurricane Sandy's Path! | Main | Watch the Machinima Trailer for the Machinima Expo »

Is It Ever Right to Dox a Pseudonymous Internet User?

Doxxing pseudonymous user

Andrew Kaczynski of Buzzfeed is looking into the identity and motivations of a pseudonymous Twitter user who's been spreading incredibly irresponsible and potentially dangerous false Hurricane Sandy rumors, thus bringing up a subject that's been coming up a lot lately: "Doxxing" -- that is, the act of publishing a pseudonymous user's real life identity and identifying details. danah boyd has a very good introduction to the topic on Wired that cites two extremely well known, recent cases of doxxing, one a Gawker article which outed a troll on Reddit, the other a stalker on YouTube whose actions contributed to a woman's suicide. danah weighs the moral dimensions each situation exposes:

By enabling the rapid flow of information, technology offers us a unique tool to publicly out people or collectively tar and feather them. Well-meaning people may hope to spread their messages far and wide using Twitter or Facebook, but the fast-spreading messages tend to be sexual, horrific, or humiliating... When someone’s been wronged – or the opportunity arises to use someone to make a statement – it is relatively easy to leverage social media to incite the hive mind to draw attention to an individual. The same tactic that trolls use to target people is the same tactic that people use to out trolls.

I think about the topic of pseudonymous identity a lot, because Second Life and other online worlds mainly involve users known only by their avatar pseudonyms, and would prefer not to connect their in-world activity with their real life identity. Generally my policy on that is this:

I only associate someone's real life name with their SL avatar in print if and only if it's important to the news story I'm writing, and they give me their explicit permission to do so -- or if the SL-RL connection has already been displayed on the Internet elsewhere. (A simple Google search of [real name] + [SL name] shows whether or not that's the case.) Generally, someone's real life identity isn't crucial to a story, but there are cases when it matters. (For instance, when an SL user dies in real life, and I absolutely need to confirm this is true.)

However, all this is different from "doxxing", since that's the involuntary outing of someone's real life identity. For various reasons, I don't do that on this blog, and don't ever plan to do so. However, much larger blogs like Gawker and Buzzfeed have already made that decision for themselves, which will probably establish a more general precedent.

Is there ever a good or advisable time to doxx someone? As danah notes, that's still a very difficult ethical conversation, but it's one we're now destined to have.


TrackBack URL for this entry:

Listed below are links to weblogs that reference Is It Ever Right to Dox a Pseudonymous Internet User?:


Feed You can follow this conversation by subscribing to the comment feed for this post.


I would only support d0x if it was due to a real-life crime and would aid law enforcement in doing their jobs. (Example, I know someone who d0x'd someone who was doing kiddie porn =-S The FBI took it from there.)

shockwave yareach

Imho: The only justification for Doxxing (I'm used to calling it Outting, but I guess that was a different era) is to a) prevent a suicide, murder or other heinous bodily crime, and b) expose RL child molestors/rapists to the authorities.

This is the only time I'll cross that line -- to save lives. If someone is bragging about stealing a car, how do I know he isn't talking about playing Grand Theft Auto? But someone has pics of naked children in their SL home, yeah, I'll call the cops and tell them anything I know.

The difficulty comes in knowing whether or not someone is honestly suicidal or not. You have to actually know the person well to make this judgement call. Likewise with the question of murder -- I'm sure my wife has said she's gonna kill me when I get home countless times. That's not enough to summon the long arm of the law. Someone talking about X or Y property crime may just be talking about some game they play, just like someone overhearing you talking about AD&D game and the woman you slowly slaughtered with a glaive to get the information you needed (Hello? Police? Listen, there's a couple of nerds talking about mutilating some poor girl...)

I won't out people just because they are talking smack about some property crime. But, if I believe them when they talk about a rape or murder or suicide or other bodily crime, that's when I have to make the harsh decision. I've had to make the call a handful of times: a few, the police got there in time. One, the guy wasn't really suicidal and didn't appreciate the police hassling him. And one time, I didn't make the call because I didn't believe Hitz was really suicidal -- I was wrong.


There are only 3 types of people that use false names. 1. Someone representing a business. 2. Someone wanting to have harmless fun. 3. Someone that is out to harm, break laws, stalk etc.

These 3 types must be known and understood by everyone including other online users/viewers. Once these types are known it is obvious who should and who should not be exposed, it is obvious who should be ignored or listened to. For it is by their actions, (words in this case) that they fall into one of the types and we know who they really are since their name tells us nothing of their identity.

The business name and the just for fun types are in the majority and will never give others reason to expose them. For business names it is a matter of security, for just for fun people the largest group they are fun for everyone. This leaves type 3, the only reason this article and many others like it are being written. Focusing on them and not false user names in general is the real issue at hand that needs attention. One bad apple never soils the bunch if we learn to remove the bad apples and only the bad apples, this is an old analogy that we still have not gotten right yet. Time to learn.


This happens daily in any welcome area of Second Life. It's trolling to the max, taken into real life. Sad.


I think it's difficult to argue with the idea that people should be prepared to accept responsibility for their actions, and trolls like Violentacrez on Reddit, who get their kicks from violating the privacy of the women who feature involuntarily in their Creepshot galleries, can hardly claim that their own boundaries should be sacrosanct.

The problem is not so much the doxxing, but rather that, as things stand, there is no way to hold the self-appointed doxxers democratically accountable. We might cheer when the sleazy misogynists are exposed, but what if someone decides to out people who use their anonymity to do good things, like political bloggers in repressive countries?

This is part of a whole debate about where real power lies on the internet, and how it can be brought more under popular control. I'm not sure that there is an answer that doesn't involve a more general restructuring of power relations in society though.

Emilly Orr

"There are only 3 types of people that use false names. 1. Someone representing a business. 2. Someone wanting to have harmless fun. 3. Someone that is out to harm, break laws, stalk etc."

Jake, I profoundly disagree. Six years ago, I started playing Second Life. At that point, I started a separate account to keep my then-established virtual persona away from the 'new' Emilly Orr name.

Six years later, my previous persona has been all but abandoned, and while I haven't connected the dots from Emilly to that name, there's a ton of personal, RL connections to Emilly now. My bank has Emilly Orr as a contact. My doctors and my insurance have Emilly Orr as a contact. More than half the time, my friends and my partners call me Emilly.

I have a business only in the most ludicrous and laughable sense; I'm not a troll; and giving out Emilly as a contact for legal *and* personal reasons pretty much says I'm not in this for "harmless fun". So where does that put me, and the hundreds of thousands of pseudonymous users like me?

I will agree doxxing is of great ethical concern (though I'm still wondering who first used that word, and how it caught on). I think it should be. I don't think it's at all cut and dried on when to out someone, and when to hold off.

Arcadia Codesmith

I'll happily out anybody who's victimizing other people, without the slightest hint of an ethical qualm. If you can't take the heat, don't grief.

Pussycat Catnap

Mostly with Janet.


But I would ad hate groups to that. And in 2012, we have a universal declaration of human rights and common sets of anti-hate laws around the western world - so you can't argue that "my idea of a hate group is not yours" - there is a standard. That standard would -not- cover all of the things I would personally put in it, but its there, and it (the standard) is what I would use, rather than my own personal lists.

I would also support outing stalkers, and 'stalker-trolls' (not a random internet forum troll, but a stalker - which some folks mistakenly call a troll).

For example this article:
- Is not even about a troll, but about a stalker.

Stalkers should be outed.

Trolls... Once they become stalkers yes, but there are too many varied definitions of what a troll is for it to just be labeled a "crime" of some kind... Until it can be defined in some very narrow commonly agreed upon scope... handle them by what they do and what policies already exist for that.

@Emily: Under Jake's list, your name seems to fall into both number 1 and 2.

What I think though is we don't need a 3 point list.

We just need:

harmful actor and non-harmful. Again with up above: have you broken laws? Are you stalking somebody? Working in a criminal conspiracy (hate group, terrorist group, et all).

People can have a million reasons for a million potential names and identities.

Most people who adopt one end up finding it is very freeing in letting them be truer to an inner self they may or may not have known was there beforehand.
- Finding this out is VERY USEFUL both to the individual, and to the various people trying to crack our identities...

It is actually -MORE- useful for marketing and business to -NOT KNOW- your meat identity. People don't behave as 'true to their desires' when all those desires are exposed. If I know you instead as an aggregate of interests, I can sell and market to those interests - and you will not feel "shy" buying from me.
- And that's not just about the naughty stuff.

I can sell and market to you over anything if I know more about how interests connect in a population sample rather than about specific people.

This is why advertising on Google adwords is so effective, but advertisements on Facebook have such amazingly low ROI. People are intimidated when it circles back to them too much. Even if just buying a new calculator.

- Google knows more about you than Facebook does, but it doesn't know -who- you are... and its discovered this is actually beneficial.

Policing agencies: from FBI to the "secret police" of China... might believe they need to know your name... but they can control a population better if they learn to understand it as seas or oceans of interconnecting interests and thought patterns. This 'dangerous meme' is connection to people who are in that income bracket, that one is connected to people who have read these 'banned books'.
- This is more valuable than knowing individual dissidents. Modern policing works by stamping out individual "roaches", but anyone who's ever lived in a house with roaches knows that is pointless. What if you could understand the bugs in general and shift them over to your neighbor's house... much more useful. Or get them to do your gardening, even more useful.
But once you start forcing people to out themselves, you lose the ability to know what they really think and feel, which means your only means of 'state control' becomes stepping on the loudest roaches.

You only need to out harmful actors when your 'dissident' or criminal actually needs to be stepped on. This is always a messy process - the less you have to do it the better. Use anonymity as tool to manipulate your masses with propaganda, and then step on isolated roaches. Out them all, and you are losing control of them in order to control them.

Breen Whitman

"Is It Ever Right to Dox a Pseudonymous Internet User?"

No. No it it not. Don't do it.

"if the SL-RL connection has already been displayed on the Internet elsewhere"


Given that instance may have arisen from malicious doxing.

I use an example where it may, may, be ok.

If we use Opensim as an example, we see Diva Canto, who does much Opensim work, is self promoted in her RL and OS (for Opensim) work.

Even then, if running a story, get permission to use the RL name.

Cloud Racer

This is such a timely post. In general doxxing is understandable in cases where someone's posts are meant clearly to harm a person in RL. The problem is doxxing can just easily be used to harm or as you said tar and feather people -- this just happened on a site I'm on regularly - a poster's IP info was outted by another user, not because of any harm, but because the poster disagreed with the other's opinion on a completely inane subject.

Personally I think doxxing is a cure that worse than any trolling.

GreenLantern Excelsior

Only to law enforcement, and only for crimes. Amanda Todd committed suicide, and Anonymous thought it was due to "bullying," so they doxed the bully and revealed his personal information. Only trouble was, it wasn't the right guy. Oops, sorry for making your life a living hell. Spike Lee got on Twitter and revealed the home address of George Zimmerman as revenge for the death of Trayvon Martin. Only trouble was, it was the address of some uninvolved elderly couple in Florida. Oops, my mistake, sorry for destroying your lives. If your doxing is inaccurate, you've caused more problems than you've solved.

Revealing someone's personal information to the world seems to me to be a form of trolling or "bullying." Why would you post someone's personal information in public if not to exact revenge upon them? You have become the enemy by doing that.

As for "hate groups," just because someone makes a list of groups that they dislike doesn't mean you should dislike them too. Common sense and the Golden Rule should influence your decision. What if someone decides that your group is a "hate group" and exposes your personal information to the world?

Supply your information to law enforcement and let them investigate and make the decision. Never reveal someone's private information in public.

Ananda Sandgrain

One thing I find a little confusing here is that "doxxing" used to mean a lot more than just outing someone. The more common use of it for years meant *getting the documentation*, digging up the real information on a subject. This is about exposing the truth in general, not just getting a person's real name.


Think of a gig like a bushel. Just as a bushel measures the amount of grain grown, a gig simply measures the amount of data used. And, like a bushel, a gig is pretty big. With one gig (or GB), you can send and receive a million emails. But what about the things that eat up a lot of data?

Post a comment

If you have a TypeKey or TypePad account, please Sign In.