2.8 Doxxing

2.8.1 What is doxxing?

Doxxing refers to the act of publishing personal or identifying information or details about a person without consent, often with a call to others in the perpetrator’s network to harass or threaten the person whose personal information is published. The information revealed could include the targeted person’s name, address, phone numbers, email address, unique identifiers for government records, employment details, sexual preferences, personal photos, details of their close contacts like family, etc. As such, this information makes it possible to identify, locate, or contact the person. Doxxing constitutes a serious breach of the victim’s privacy, and is usually committed with the objective of causing distress, panic, or alarm to the victim, by posing a threat to their safety as well as the safety of those around them, both in the online and the offline world. The personal information for committing doxxing is usually obtained by scouring public databases and social media profiles to gather information such as photos, location, and contact details. Such information may also be obtained directly from the victim speaking in confidence. Technologically equipped abusers use sophisticated means such as reverse phone lookup, running a search on a domain name, phishing, tracking an internet protocol (IP) address, etc., to obtain personal information about the targeted victim.1Douglas, M. (2016). Doxxing: A Conceptual Analysis. Ethics Inf Technol, 18, pp. 199–210. https://link.springer.com/content/pdf/10.1007/s10676-016-9406-0.pdf Doxxing can also be an offshoot of voyeurism, when an image or video produced as part of a voyeuristic act is published online, thereby revealing the identity of the victim.

Doxxing can take three major forms:2Douglas, M. (2016). Doxxing: A Conceptual Analysis. Ethics Inf Technol, 18:199–210. https://link.springer.com/content/pdf/10.1007/s10676-016-9406-0.pdf

  1. Deanonymizing doxxing, where the identity of a previously anonymized individual is revealed.
  2. Targeting doxxing, where specific details of an individual that are usually private, obscure, or obfuscated, are targeted and revealed.
  3. Delegitimizing doxxing, where intimate personal details of a person are revealed to destroy their credibility.3Douglas, M. (2016). Doxxing: A Conceptual Analysis. Ethics Inf Technol, 18:199–210. https://link.springer.com/content/pdf/10.1007/s10676-016-9406-0.pdf

While deanonymizing and delegitimizing doxxing can sometimes be used to expose wrongdoings and wrongdoers, thus serving public interest, all three forms of doxxing are unjustified if they humiliate, threaten, intimidate, or punish the subject of doxxing.4Douglas, M. (2016). Doxxing: A Conceptual Analysis. Ethics Inf Technol, 18:199–210. https://link.springer.com/content/pdf/10.1007/s10676-016-9406-0.pdf

In India, the bulk of online bullying and harassment, including doxxing, is faced by women in public life, especially those who dare to transgress societal norms.5Kasturi, S. (2022). As Bulli Bai Creators Get Bail, The Risks of Normalising Violence Against Women. The Wire. https://thewire.in/women/bulli-bai-app-creators-bail-women-violence-online. A disturbing instance of doxxing in recent times is the creation of the open source applications called ‘Sulli Deals’ and ‘Bulli Bai’ which put images of several Muslim women, many of whom are vocal online, up for auction. Hosted on GitHub, the applications used photographs sourced from the women’s social media handles without their consent.6Salim, M. (2022). ‘Bulli Bai’, 'Sulli Deals': On Being Put Up for ‘Auction’ as an Indian Muslim Woman. The Wire. https://thewire.in/communalism/indian-muslim-woman-auction-bulli-bai

2.8.2 What is a gender-sensitive way to read a case of doxxing?

Regardless of the gender of the victim, doxxing breaches a person’s privacy by taking control of their data without their consent. But, the “power dynamics of gendered hate online” make women the more susceptible targets.7WomanStats. (2021). “Doxxing” And Online Threats: Why Women Are More Vulnerable to Internet Harassment. https://womanstats.wordpress.com/2021/03/22/doxxing-and-online-threats-why-women-are-more-vulnerable-to-internet-harassment/. Studies have shown that the gendered aspects “shape the flow and suspected intent of doxxing and the ensuing harassment that victims experienced”.8Eckert, S., & Metzger-Riftkin, J. (2020). Doxxing, Privacy and Gendered Harassment. https://www.nomos-elibrary.de/10.5771/1615-634X-2020-3-273.pdf. An act of doxxing against a woman, treats her data as a commodity without impunity, in a surveillance culture that already exploits women as producers and consumers of content for commercial purposes.9Eckert, S., & Metzger-Riftkin, J. (2020). Doxxing, Privacy and Gendered Harassment. https://www.nomos-elibrary.de/10.5771/1615-634X-2020-3-273.pdf.

Doxxing can limit the online participation of women, particularly those who are vocal on the internet and rely on it for their work and to express opinions. Revealing personal information that enables perpetrators to identify their victims in real life can expose women to myriad types of harassment such as online and offline stalking, death or rape threats,10Jens, K. (2015). Looking for Evidence of Gender Inequality in Sexual Harassment on Twitter. GenderITOrg. https://www.genderit.org/resources/looking-evidence-gender-inequality-sexual-harassment-twitter cyberbullying, and real-world harms that include harassment of families or employment contacts, physical harm, sending offensive substances to their address, etc.11Posetti, J., et al. (2021). The Chilling: Global Trends in Online Violence against Women Journalists. UNESCO. https://unesdoc.unesco.org/ark:/48223/pf0000377223/PDF/377223eng.pdf.multi

Due to the greater susceptibility of women and other gender minorities to online violence, a gender-sensitive approach that goes beyond a simplistic privacy framework is necessary to reveal the full gendered impact of doxxing. Here, it may be useful to take note of Nissenbaum’s theory of informational privacy as contextual integrity.12Nissenbaum, H. (2004). Privacy as Contextual Integrity. Washington Review, 79(1). https://digitalcommons.law.uw.edu/wlr/vol79/iss1/10. As opposed to a traditional notion of privacy, with its strict dichotomy between the public and the private, and disclosure and secrecy, the contextual integrity approach recognizes that the particular social and political context determines what information about a person can be appropriately revealed. Such an approach takes into account how individuals use their discretion to share certain information about themselves in various contexts and relations. Thus, according to such an approach, even if a woman shares information about herself with a person or group online, she still has the right to control the flow of information pertaining to her. The contextual integrity approach is especially crucial in the digital space where the public and the private overlap.

When adjudicating a case of doxxing, it is, therefore, necessary to examine whether the personal information shared by a woman in an online space she saw as “expected, intentional or desired”13 Eckert, S., & Metzger-Riftkin, J. (2020). Doxxing, Privacy and Gendered Harassment. https://www.nomos-elibrary.de/10.5771/1615-634X-2020-3-273.pdf. has been disseminated in other online spaces that are “unexpected, unintentional and undesired” by her.14 Eckert, S., & Metzger-Riftkin, J. (2020). Doxxing, Privacy and Gendered Harassment. https://www.nomos-elibrary.de/10.5771/1615-634X-2020-3-273.pdf.

2.8.3 Which laws are applicable?

Currently, India has no laws or statutory provisions that specifically penalize the act of doxxing. However, some acts that lead to doxxing are subject to criminal sanction. For instance, when information about a person is obtained through cyberstalking for the purpose of doxxing, the act of stalking may be dealt with under Section 354D of the Indian Penal Code (IPC). Similarly, doxxing a private image of a woman obtained through an act of voyeurism can be charged under Section 354C of the IPC and Section 66E of the Information Technology (IT) Act, 2000 (IT Act). Section 66 of the IT Act penalizes the act of hacking, but does not specifically criminalize hacking for the purpose of doxxing. Further, while Section 72 of the IT Act read along with Section 43 of the Act criminalizes the breach of confidentiality and privacy, both are framed as economic offenses and, therefore, not apt to deal with the gendered concerns raised by doxxing.

Another useful provision is Rule 3(1)(b) of the Information Technology (Intermediary Liability and Digital Media Ethics Code) Rules, 2021 (IT Rules), that allows courts to direct internet intermediaries, such as social media platforms, search engines, etc., to remove specific content from their platform if such content invades another’s privacy, including bodily privacy. This provision can help complainants ask for the removal of their personal information published by perpetrators, thereby limiting the harm from such publication.

The legal lacunae in comprehensively addressing the issue of doxxing, particularly its differentiated impact on women and other gender minorities, is worrying. In such a situation, reports that the Ministry of Electronics and Information Technology is deliberating a new Digital India Act containing specific regulation to address the issue of doxxing are welcome.15Barik, S. (2022). New IT Act Looks to Rein In ‘Deliberate’ Misinformation. Indian Express. https://indianexpress.com/article/technology/tech-news-technology/new-it-act-looks-to-rein-in-deliberate-misinformation-8027748/

2.8.4 How have courts dealt with the problem of doxxing?

2.8.4.1 Subhranshu Rout @ Gugul v. State Of Odisha (2020)16Subhranshu Rout @ Gugul v. State Of Odisha, (2020) BLAPL No.4592 OF 2020, judgment dated 23 November 2020. Odisha High Court.

The lack of specific legal provisions limits the ability of the court to adopt a gender-sensitive approach to doxxing by addressing the privacy concern it raises. The court expressed this inability in this case. Here, the photos and videos of a rape victim were uploaded online by creating a fake Facebook account. The court noted that India’s sentencing-oriented criminal justice system is not adequate to address the privacy infringement suffered by the victim, as it does not recognize the right to be forgotten, and does not contain provisions for getting photos erased from the server of the social media platforms permanently.

2.8.4.2 X v. HTTPS : //WWW.YOUTUBE.COM/WATCH?V=IQ6K5Z3ZYS0 (2021)17X v. HTTPS://WWW.YOUTUBE.COM/WATCH?V=IQ6K5Z3ZYS0, CS(OS) 392/2021, I.As.10543/2021, 10544/2021, 10545/2021 & 10546/202, order dated 23 August 2021, High Court of Delhi.

A movie producer shot some video clips of an actress, offering her a lead role in exchange. Later, he uploaded these videos on his YouTube channel, unrelated to the movie, without her knowledge or consent. In this case also, the court correctly recognized the privacy issue involved, and upheld the petitioner’s right to be forgotten, to be left alone, and to be free from unwanted intrusion into her privacy by strangers on account of the released videos. The court ordered the defendants to remove the video from the YouTube channel, and directed the search engines to remove the video from appearing in their search results pages and listing.

2.8.4.3 Ms. Nimisha Bhagat v. Sneha Mahajan Nee Dogra @ Sneeha (2020)18 Ms. Nimisha Bhagat v. Sneha Mahajan Nee Dogra @ Sneeha, (2020) CS No. 20/2020, judgment dated 13 February 2020, Delhi District Court.

In this case, the court awarded compensation to the petitioner for the acts of the defendant who posted provocative, derogative, and threatening comments against her on Facebook and WhatsApp groups, and circulated her phone numbers to strangers who then proceeded to troll the petitioner.19Ms. Nimisha Bhagat v. Sneha Mahajan Nee Dogra @ Sneeha, (2020) CS No. 20/2020, judgment dated 13 February  2020, Delhi District Court. This case shows how current criminal law provisions are wholly inadequate to deal with doxxing of personal information and breach of informational privacy resulting from it, forcing plaintiffs to resort to civil remedies.

2.8.5 How have other jurisdictions dealt with doxxing?

The issue of doxxing has increasingly been gaining regulatory attention around the globe, and many countries are either proposing new statutory provisions or guidelines, or using existing provisions to deal with the offense. In 2016, the UK’s Crown Prosecution Service issued guidelines to help prosecutors bring perpetrators of online harassment to justice.20CPS. (2022). Social Media and other Electronic Communications. UK Government. https://www.cps.gov.uk/legal-guidance/social-media-guidelines-prosecuting-cases-involving-communications-sent-social-media A section of the Guidelines addresses violence against women and girls, and reminds prosecutors of the potential use of social media to exert power and control over women and girls by threatening to post their personal information on social media, in order to bring shame or to silence or coerce them.21CPS. (2022). Social Media and other Electronic Communications. UK Government. https://www.cps.gov.uk/legal-guidance/social-media-guidelines-prosecuting-cases-involving-communications-sent-social-media

In the US, the House of Representatives is considering a bill for the Online Safety Modernization Act introduced by Congresswoman Katherine Clark to “combat the rise in online crimes that disproportionately affect women and girls”.22H.R.3067 - Online Safety Modernization Act of 2017. (United States).

In South Australia, Section 19AA(1)(a)(ivb) of the Criminal Consolidation Act, 1935, considers doxxing as a stalking offense and punishes the perpetrator with three years in prison if the victim has been doxxed more than twice. The definition of stalking in this Section includes communicating about the victim with others or acting in a manner that is reasonably expected to arouse apprehension or fear in the victim.23Criminal Consolidation Act, 1935, Section 19AA(1)(ivb) and (vi). (South Australia). Further, Section 474.17 of the Commonwealth Criminal Code of Australia, which penalizes the use of a telecommunication service in a way that reasonable persons would regard as menacing, harassing, or offensive, is also used in cases of doxxing.24Corbridge, A. (n.d). Responding to Doxxing in Australia: Towards a Right to Informational Self-Determination. University of South Australia. https://ojs.unisa.edu.au/index.php/uslr/article/download/1489/924. However, both these statutory provisions are considered inadequate as a potential victim may be doxxed by multiple persons at the same time, and it is ambiguous when a reasonable person would deem the publication of personal information as menacing, harassing, or offensive.25Corbridge, A. (n.d). Responding to Doxxing in Australia: Towards a Right to Informational Self-Determination. University of South Australia. https://ojs.unisa.edu.au/index.php/uslr/article/download/1489/924 ; Anderson, B., & Wood, M. A. (2021). Doxxing: A Scoping Review and Typology. The Emerald International Handbook of Technology-Facilitated Violence and Abuse. https://www.emerald.com/insight/content/doi/10.1108/978-1-83982-848-520211015/full/html.

Singapore contains a gender-neutral provision to deal with doxxing. Section 3 of the Protection from Harassment Act, 2014, considers doxxing as a form of harassment, and penalizes the publication of any part of the identity of or information about a targeted individual, or a person related to the targeted individual, with the intent to cause harassment, alarm, or distress.

Footnotes

Sub-sections on this page:

PREVIOUS MODULE

NEXT MODULE