The Volokh Conspiracy
Mostly law professors | Sometimes contrarian | Often libertarian | Always independent
A Test Suite for Proposals to Restrict "Doxing"
The term "doxing" is not well defined, but is often used broadly to refer to publicly disclosing a person's name, photograph, address, phone number, employer name, and the like, in connection with some express or implied condemnation of the person. The concern is that such disclosure can instigate or facilitate violence or vandalism targeting the person, or the sending of threats, or the sending of insulting messages, or economic retaliation (often through the person's employer). Different states have different rules dealing with such matters, and they generally define "doxing" differently, both as to what information is covered, who is protected against such disclosure, what (if any) specific purposes on the discloser's part must be shown to lead to liability, and more.
In any case, in thinking about the subject (and especially the questions that aren't limited to information such as social security numbers, bank account numbers, and the like), I came up with a set of hypotheticals that I hoped might be helpful. If any of you are interested in this, I'd love to hear your thoughts about which, if any, of these situations should lead to, say, criminal or civil liability (and, briefly, why). One can of course think that none should lead to liability—at least unless the allegations are false and therefore libelous, or are part of a criminal conspiracy involving the speaker, or involve some other factual feature not included in the hypothetical—or one can think that all should, or one can come to some conclusion in between.
Some doxing rules might not involve criminal or civil liability, and might not be subject to First Amendment restraints: For instance, a private university might restrict such speech by its students (especially about other students, staff, or faculty), or a social media platform might restrict such speech on the platform, or a newspaper might set up editorial policies about what kinds of material it publishes. But for purposes of this comment thread, I thought it would be good to focus on criminal or civil liability.
[1.] Dentist Who Shot Cecil the Lion: In 2015, Minnesota dentist Walter Palmer was publicly "named and shamed" through many people's social media posts for killing Cecil, a famous Zimbabwe lion, on a hunting trip. This led to likely economic harm to his practice, and to his "receiv[ing] a slew of death threats on social media." How the Internet Descended on the Man Who Killed Cecil the Lion, BBC, July 29, 2015. Assume the posts identified Palmer and the name of his dental practice.
[2.] Central Park Karen:
The white woman dubbed "Central Park Karen" when a video of her confrontation with a black birdwatcher went viral three years ago [in 2020] says she is still living in hiding and struggling to stay employed.
Amy Cooper claimed in a new opinion piece for Newsweek that she has received an endless flurry of hate mail that told her she deserves to be raped in prison or to kill herself and referred to her as a "Karen"—a term used for white women who victimize people of color—since the 2020 encounter in the Manhattan park….
Cooper was fired from her job as an insurance portfolio manager at Franklin Templeton Investments within 24 hours of the viral confrontation on May 25, 2020—the same day that George Floyd was killed by police in Minneapolis, sparking a national reckoning over racism.
She was caught on camera yelling at science and comic book writer Christian Cooper (no relation) and calling the police to claim an "African American man" was "threatening" her while she was walking her dog in the Ramble in Central Park….
Cooper was charged by Manhattan prosecutors in July 2020 with falsely reporting an incident—and while the rap was ultimately tossed after she attended therapy sessions on racial bias, she still lost her job.
Olivia Land, NYC's 'Central Park Karen': I Still Live in Hiding Three Years After Viral Video, N.Y. Post, Nov. 7, 2023. Assume some of the posts included the video, her name, and the name of the employer.
[3.] Accused Child Molester: A newspaper reports on allegations of child molestation against a local resident, and includes the man's name and place of employment (e.g., the school through which the molestation allegedly occurred). As a result, the man or his family get death threats. This is based, with the addition of the place of employment, on Ashleigh Panoo, His Twin Brother Allegedly Molested a Girl. Now He's Getting Death Threats, Fresno Bee, Jan. 13, 2018. (The Fresno Bee story doesn't indicate whether the threats came as a result of newspaper coverage, but it seems likely they would, in this case or in some other.)
[4.] Boycott Noncomplier: An NAACP chapter organizes a black boycott of white-owned stores. "Store watchers" stand outside stores and write down the names of black residents who aren't going along with the boycott; the names are then "read aloud at meetings at the First Baptist Church and published in a local black newspaper." Apparently as a result, there are crimes against some violators: three incidents of shots fired into homes, "a brick … thrown through a windshield," "a flower garden [being] damaged," and two beatings. The addresses of the targeted people aren't published, but they are presumably known in the community. These are basically the facts of NAACP v. Claiborne Hardware, 458 U.S. 886 (1982).
[5.] Palestinian Advocates: A truck with a billboard bearing the words "Columbia's Leading Antisemites" alongside the names and faces of students and faculty is circling around the Columbia campus. The truck lists 29 Columbia students and faculty who allegedly signed a statement of Palestinian solidarity; so does a website titled "Columbia Hates Jews," run by the same conservative group that hired the truck. The website states that the people listed belong to various pro-Palestinian campus groups who signed statements of solidarity with Palestinians and opposition to Israel in the days following the Oct. 7 attacks; the website's operators view those statements as expressing support for the attacks.
The website calls on readers to send messages to Columbia's board of trustees urging them to "take a stand" against "these hateful individuals." The group has also bought the Internet domain names that correspond to the actual names of several students and faculty on the list. The truck also regularly patrols outside the targets' homes. Two law students who were targeted by the truck had job offers withdrawn by prestigious New York law firms. See Esha Karam, 'Doxxing Truck' Displaying Names and Faces of Affiliates It Calls 'Antisemites' Comes to Columbia, Columbia Spectator, Oct. 25, 2023; Sabrina Ticer-Wurr, Nearly Two Dozen Palestinian Solidarity Groups Release Open Letter, Joint Statement, Columbia Spectator, Oct. 11, 2023.
[6.] Real Estate Broker: A self-described civil rights group believes that a local real estate agent is engaging in sales practices that undermine the group's goal of having a racially integrated community. (Assume that the practices are legal.) To pressure the agent, they "distribute[] leaflets" in the agent's home town describing and criticizing his actions. They do this each week for several weeks at local shopping malls; twice, they distribute leaflets "to some parishioners on their way to or from [the agent's] church"; they also leave leaflets "at the doors of his neighbors." "The … leaflets gave plaintiff's home address and telephone number and urged [the home town's] residents to call [the agent] and tell him to" agree to the group's demands that he change his practices. These are basically the facts of Organization for a Better Austin v. Keefe, 402 U.S. 415 (1971).
[7.] School Board Member: Three School Board members—elected officials, who serve part-time—take a controversial stand on the display of Black Lives Matter materials in local schools. Three parents post online the names and phone numbers of the members' employers, hoping that readers will pressure the employers (e.g., through threat of boycott) into pressuring the members to change their positions. Assume that some readers do call the employers, which makes the members fear for their careers. Assume also that a few readers also send threatening e-mails to the officials personally (by finding the e-mail addresses on the Board's website). This is loosely based on the facts of DeHart v. Tofte, 326 Ore. App. 720 (2023).
[8.] Police Chief: Charles Kratovil, founder and editor of the online publication New Brunswick Today, believes that New Brunswick police chief Anthony Caputo is living in Cape May, two hours away from New Brunswick. He wants to write about this, and to include a voter record that he has obtained from some government agency that shows Caputo's home address. Caputo demands that Kratovil not do this, because Caputo is concerned that people might use the information to physically attack Caputo or his family, or at least vandalize his home. These are basically the facts of Kratovil v. City of New Brunswick, now pending before the New Jersey Supreme Court (see 258 N.J. 468 (2024), granting review of 2024 WL 1826867 (N.J. Super. Ct. App. Div. Apr. 26, 2024)).
[9.] Judge: John Smith, a disgruntled litigant who is unhappy about Judge Mary Jones' decisions in his now-completed divorce case posts a website accusing Judge Jones of being biased against men. He includes Jones' photograph and home address, and encourages people to join him in picketing her home. Some people leave threatening messages for Jones at her home; others do indeed join him for the picketing. Assume that residential picketing is not illegal in that jurisdiction.
[10.] Election Worker: William Johnson posts a video of a poll worker, accompanied with (1) a note saying that Johnson thinks the actions depicted on the video might be indicative of election fraud, and (2) a request for information about who the poll worker is. An anonymous commenter posts the poll worker's name, and the name of the poll worker's employer. That in turn leads to anonymous threats sent to that poll worker, and demands sent to the employer to fire the poll worker.
Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of Reason.com or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Comments may only be edited within 5 minutes of posting. Report abuses.
Please
to post comments
Doxxers and cancelers should be required to use their real names.
My general notion of how the law should work:
If you target somebody's employer about something that isn't job-related then that's tortious interference with contract and the Twitter mob should be liable when somebody gets fired. This covers Central Park Karen and part of the school board case. The real estate broker and maybe the dentist are self-employed and not covered by this principle. By analogy, secondary boycotts are sometimes illegal when direct boycotts are legal. If the accused child molester was doing it on the job, naming the school should not be actionable.
I would mostly say the Columbia case should not be actionable. Personally, I consider accusations of anti-this and that-phobic to be meaningless. Some people take them seriously. To the extent the shamers tried to get the students to lose their job offers, see previous paragraph. Buying up domain names should lead to trouble if there is a chance that viewers will think the content belongs to the subject. (As a general rule, domain name squatters and speculators should have no more right to exist than high frequency traders. That's not a First Amendment issue.)
The judge and police chief are public figures and should man up. They have less right to privacy than ordinary people.
The poll worker might be out of luck unless there is a specific step in the game of telephone where opinion turns into defamation.
I am as yet undecided but you are absolutely correct to refer to a right to privacy, and it is not easy to balance the right to free speech or to publish, against the right to privacy. The fist-swinging argument suggests that the right to privacy has greater weight.
You only dox people for evil ends. If you published a name so people could send money, you would be certifiable.
John, what about the example of the Wynn Casino in Everett?
Something about Steve Wynn's ex wife doxing him to the MA gambling authority and they even had to take his name off the casino.
Was that a report to regulatory authorities about the on-the-job activities of a person within the agency's jurisdiction? She should have a qualified privilege even if she hoped to get his license pulled.
"If you target somebody's employer about something that isn't job-related then that's tortious interference with contract..."
I'm not sure that that's correct. And I don't think it's tortious interference with employment either. No tort.
The question was what should lead to liability.
If stirring up a Twitter mob can be actionable, I should think about how it is or is not different from stirring up a real-world mob on January 6. I think the cases are distinguishable because Trump didn't clearly tell the mob to break into the Capitol. Spreading hate online and incidentally getting somebody fired is closer to what Trump did.
"If you target somebody's employer about something that isn't job-related then that's tortious interference with contract and the Twitter mob should be liable when somebody gets fired. "
That's an interesting idea, but the last person who tried to do that to me, unsurprisingly, did it anonymously through a burner email account.
The anonymous speech issue is related to the doxxing issue. In case of criminal activity the FBI would have a good chance of tracking down the creator of a burner account. Most people don't know how to cover their tracks.
I am disinclined to think that criminal liability should attach to any of the hypotheticals, with the possible exceptions of nos. 8 and 9 if there is a law on point that specifically prohibits publication of certain officials' home addresses (such as "Daniel's Law" in the Kratovil case). But I still think I would be very open to as-applied challenges even if the law were allowed to stand more generally.
I am much more open to civil liability in cases such as hypothetical no. 10, because the doxxing results in threats and harassment based on false/frivolous suggestions that the person being doxxed was engaged in nefarious activities.
But I think I am generally opposed to civil liability for doxxing that is intended to name and shame a person who actually committed what the doxxer believes is an immoral activity. I could *maybe* see my way to an exception where the doxxer continues to engage in doxxing activity despite notice that such activities are resulting in death threats and/or physical harm to the person being doxxed. For example, if the NAACP in hypothetical no. 4 continued to dox those who won't participate in a boycott even after learning about the violent incidents described in that hypothetical.
I think that Clairbone Hardware was wrongly decided -- by this point, the NAACP had reasonable cause to know that violence would likely ensue from their actions.
#9 sounds loosely based on Judge Esther Salas. That was a real tragedy. I do not believe that we should ban publication of judge addresses, though.
To me, the accused child molester #3, might have a case, along with the boycott non-complier. The behavior of the doxxers crossed a line, to me.
The rest are SOL, to me.
Also compare Judge Arthur Garrity who ordered busing in Boston in the 1970s. For a while he had a security detail around his house in the suburbs. Quoting Wikipedia quoting the New York Times:
I think people were entitled to protest a public official for his official acts.
Quibble: "'Karen'—a term used for white women who victimize people of color"
Not quite right. It's more used to suggest dominance and entitlement; this is the first time I've seen it used to suggest racial animus.
Think of "Karen" as another Wakanda myth. Blacks didn't really invent it but pretend they did.
Karen started off as the aggressive, entitled woman who demands to speak to your manager. In 2020 she turned racist.
It was also inaccurate to say she victimized a person of color. It was just a stupid dog-walker bird-watcher dispute. She said that he was threatening her, but he really was threatening her, according to his own account.
Agreed. Being a "Karen" is a highly derogative term (though often well deserved) but it has nothing whatsoever to do with racial animus. You can, of course, be a racist and a Karen but the two are not linked.
I'll bite:
[1.] If only the dentist's name and practice name are revealed this is legitimate negative publicity and should be allowed.
However, the forum in which the death threats were published should be required to turn over identifying information about the threat senders to the dentist so that he can file police complaints and/or lawsuits. And if it refuses, the law should presume the forum owner responsible for any illegal harm that may happen to the dentist.
[2.] The CPK case was decided the wrong, racist way, and Christian Cooper's actions toward her were a threat from which she is entitled to protection. And in a rightful country she would successfully sue her former employer for retaliating against her for exercising her civil rights.
And of course the police did not kill George Floyd.
[3.] Same as [1.]
[4.] The watchers, and their organization, are engaged in coercion/extortion and are committing a crime of violence just by gathering and passing on those names. The law should presume them responsible for whatever violence follows. And if the police do not shut the name-gathering and -reading down immediately, the victims should arm themselves. This also goes for similar behavior by labor unions and others.
[5.] Similar to [1.], but without any death threats. I call this entirely OK. I distinguish this from [2.] because persuading someone not to offer you a job is not as bad as persuading someone you are already working for to fire you. And of course, unlike in [2.], the billboard trucks' message is true.
[6.] Sharing another person's home address and/or phone number (to other than authorities) without permission needs to be categorically tortious and enjoinable in all circumstances, except that I'd OK passing the info to an attorney so somebody can sue the target. Demonstrations at or near a target's home should also be categorically tortious and enjoinable in all circumstances, because they are a threat-by-gesture of the form "We know where you live."
Harassment by telephone or electronic means should also be illegal, though I would
expect to get better results by installing technological protection measures such as a phone that can blacklist callers rather than suing.
[7.] This is more like [1.] but if any of the employers fire the members then [2.] applies.
[8.] Kratovii should be required to redact Caputo's home address and the names and addresses of any family members. But publicizing the name is fair game, and the fact that he doesn't live in the town he works for is something voters deserve to know.
[9.] Sane as [6.]
[10.] Finding out and publishing the poll worker's name is legitimate. Sharing his address is not. Sharing the name of the poll worker's employer is borderline, but I lean toward banning it. If they get him fired then [2.] applies.
"Sharing another person's home address and/or phone number (to other than authorities) without permission needs to be categorically tortious and enjoinable in all circumstances, except that I'd OK passing the info to an attorney so somebody can sue the target."
So you've never heard of a phone book?
How are you people this stupid?
If he was born after 1995 or so, he might never have heard of a phone book, or have heard of it but not really understand the concept.
And if he's the type that's rented his whole life, he might not realize that every single person who owns their own home not only has their address posted online, but when they bought it, who they bought it from, how many square feet it has, how much they paid for it, how much they paid in taxes including lots of details about any irregularities in paying, and how much the government thinks it's worth.
Yes, but see my note below about unlisted numbers.
And in my experience it's usually possible to deindex yourself from online property tax records if you're interested in doing that -- some jurisdictions allow the name to be masked on request, some allow a generic placeholder such as "Current Owner," and in others you can generally just use a shell LLC or similar vehicle.
I'll not speak for others, but I'm personally sentient enough to know that, back when phone books were a thing, individuals could pay to prevent their numbers from being listed in them.
That's the distinction I see that carries through a number of the hypotheticals: if you are indeed just republishing information that the the subject had previously published or allowed to be published (phone books, business cards, property tax records, etc.), I can't see how that can or should be actionable.
I think it's a closer case when a subject takes active steps to keep their address, phone number, etc., out of the public purview and the rabble-rouser digs it up through surreptitious means (stalking, trash picking, etc.)
Rightly or wrongly, that's the lens through which I had read jdgalt1's "without permission."
Yet another armchair coroner?
And of course the Earth is flat.
See how easy it is to make a blatant assertion that is laughably disconnected from reality? JDGalt1, he'll be here all week! Try the veal, tip your waitress.
Never forget the undeniable QUEEN OF DOXERS, Kamala Harris, chastised by the ACLU and the Supreme Court --- how often does that happen. She foudn some organizations she didn't like in California and FORCED disclosure of those affillated with them and those people were hurt severely
How Kamala Harris Earned Rebukes from ACLU and SCOTUS on Privacy
https://www.realclearpolicy.com/articles/2024/08/22/how_kamala_harris_earned_rebukes_from_aclu_and_scotus_on_privacy_1053395.html
IT was so evil of her...
", her office promptly leaked thousands of those forms online. ... Harris’ actions were done with the authority and imprimatur of the California Attorney General’s office. ... Her track record, however, is clear. Harris has consistently supported efforts to invade Americans’ privacy and force nonprofits to publicize their members’ names and home addresses. She has demonstrated a willingness to ignore unanimous Supreme Court precedents and the outcry of nonprofits across the spectrum in her pursuit of these goals."
I'd forgotten that was her. California was notorious for that sort of thing, to the point that the Supreme court finally ruled that non-profits didn't have to disclose their memberships, essentially because the state's promise not to disclose them publicly was established to be worthless.
None of that is right, of course.
1) Harris didn't do anything. It was a California law.
2) Harris did not "promptly leak" anything.
3) And it was about donors, not members.
Probably none should be actionable, all ar. e protected speech.
Can't see criminal or civil liability in any of the cases, unless some extra facts are added.
I could see the following exceptions:
1. Revealing personal information that the speaker obtained improperly, or that the speaker should have known was obtained improperly. That could include violating an "I agree to the terms and conditions" checkbox on some database, regardless of whether the speaker chose to read the terms and conditions.
2. The usual exceptions for violence and true threats of violence, including conspiracy to do either. But note: Boycotts, pickets, termination of employment, divestment, loss of business relationships, and loss of friendships and social status are not acts of violence. They are all legitimate acts of expression and/or freedom of association.
3. Libel, strictly defined and with truth as an absolute defense.
One can imagine a future where if you retweet something hateful and the collective tweetstorm results in a million dollars of harm, you and a million other users get an extra dollar added your next social media account bill. Basically, if "the internet" causes harm then internet users are severally but not jointly liable.
Are you suggesting that when companies get hit with a lawsuit, they select which of their customers to assign the cost to?
I'm not for banning such an arrangement, that's between the platform and their paying customers. But I'm not sure I'd want to sign up, there are lots of flaws: the company is less incentivized to fight the lawsuit, it's hard to objectively distinguish between approving and critical reposts, the primary instigators get charged the same as the merely curious or unthinking.
To address the last flaw, how about something like the following arrangement:
1. Company gets hit with a $3M judgement.
2. Company notifies the 500,000 people involved that they're both the voters and the candidates in a snap online election to determine who's gonna pay.
3. "Winners" pay $6 per vote received.
Getting the right incentives is a prerequisite to imposing such liability. Suppose you get a camera ticket or toll in a rental car. The rental agency is happy to pay the fine or toll, or even ten times the fine or toll, because it can be passed onto you with a $100 surcharge. That is antisocial behavior and the companies that do it should be broken up for scrap.
Weakening Section 230 liability for large social media companies could provide the right incentives. Facebook has to have some incentive to fight. It should not be fully liable as the deep-pocketed entity. The right to bill individual users has to be limited to small amounts in cases that are effectively reverse class actions. Mass liability could be capped at say $50 and claims for higher amounts resolved by ordinary court procedures. Or any defendant can choose to intervene as a regular party at the risk of unlimited liability.
The social media company could have the benefit of an anti-SLAPP law. You sue Facebook for a mob's actions. If the mob's actions are clearly legal Facebook gets attorney's fees.
Any social media company officer or employee who attempts to use an arbitration clause to avoid liability under this scheme becomes individually liable for the company's users' actions.
An implication of my idea is social media companies have the ability to bill users. I don't like the "you are the product" business model. The small dollar limit I suggested will avoid nasty surprises. Quite a few Americans could not come up with $2,000 to save their lives.
To make it even more useful, informative, and entertaining:
4. Votes are not secret, much the opposite. Everyone can look up who voted for who.
Legislation / Law(s) have never created civil society, nor ever encouraged ethical behavior.
Conflict is natural and will never be eliminated; that being human means, and depends on, choosing between self-control and no control - Order and Corruption.
A good rule of thumb is to take a look at Trudeau's Canada ("liberal" society par excellence) ... and do the opposite.
Here's what they're doing (or at least threatening to do) over there:
https://www.foxnews.com/media/canadian-police-warn-posting-videos-alleged-package-thieves-violation-privacy
Thus, my answer is: "none [of these hypotheticals] should lead to liability—at least unless the allegations are false and therefore libelous, or are part of a criminal conspiracy involving the speaker, or involve some other factual feature not included in the hypothetical."
Can’t see how any of these could be actionable, civilly or criminally. And current laws trying to work otherwise (like in NJ) aren’t gonna survive a meaningful 1A challenge.
Another potential hypo is former Wapo Taylor Lorenz reporter doxxing Libs of Tiktok. I don't think that should be actionable either, but if other forms of doxxing are actionable, I don't see why that wouldn't be.
I don't remember anything actionable in the original report. The remedy is to counter-dox Taylor Lorenz or boycott her employer. Her employer is fair game in this case. I wonder how many followers of Libs of Tiktok subscribed to the Post. I refuse to subscribe to a publication I never subscribed to before!
(She quit the Post so a boycott now would be unproductive.)
Very good hypotheticals. I don't have clear answers for most of them but they prompted a couple of possible principles.
1. If the complaint is about things you said or did in the course of your employment, telling the world who your employer is cannot be doxxing even if it leads to complaints and adverse employment action. (This is also true if you're self-employed and the 'adverse action' is a boycott.)
1a. If the complaint is about things you said or did in your private life, complaining direct to the employer might be appropriate if your job entails special obligations (think a security clearance or financial impropieties by a banker). But encouraging others to complain to the banker? John F Carr's 'tortious interference' argument above is intuitively compelling but I need to think about it more.
2. Some of the hypotheticals seem like they could be better resolved through 'incitement to riot' laws than 'doxxing' laws. Or maybe 'conspiracy to interfere with civil rights'.
3. Public officials are already public. They voluntarily put their lives in the public sphere when they sought and accepted public office. They should always have less privacy rights than private citizens. The 'Daniel's Law's to the contrary should be void as contrary to public policy. (To be clear, that's a normative opinion, not something the court could do unilaterally.)
Typo in my 1a. Should be "encouraging others to complain to the
bankeremployer?" Apologies."The 'Daniel's Law's to the contrary should be void as contrary to public policy."
Yup. The powerful gonna protect the powerful.
Restricting the doxing in most of these cases seems like a Heckler's Veto. The bad outcomes that would presumably be prevented are things like harassment, assault, property damage, slander/libel, trespassing, tortuous interference, etc. All of those are already illegal in themselves (as is "incitement to riot"). Let's stop those first, and maybe people would begin to question random claims from teh internets instead of rushing out to get arrested (again).
In the employment hypotheticals we could distinguish states where off the job activities are protected. Suppose the Internet tries to get somebody fired for supporting or opposing aid to Israel. The person works in a state where off the job political activities are protected. The mob is trying to pressure the employer into breaking the law.
Normally the employer will have deep enough pockets and the mob would be hard to sue. If we had the lawsuit equivalent of microtransactions, the mob should be liable to a fired employee as joint tortfeasors. The mob should also be liable to the employer for any economic harm caused by pressuring it to do an illegal act. Secondary boycotts have less legal protection than direct boycotts.