Doxxing: A Scoping Review and Typology

Abstract This chapter examines the phenomenon of doxxing: the practice of publishing private, proprietary, or personally identifying information on the internet, usually with malicious intent. Undertaking a scoping review of research into doxxing, we develop a typology of this form of technology-facilitated violence (TFV) that expands understandings of doxxing, its forms and its harms, beyond a taciturn discussion of privacy and harassment online. Building on David M. Douglas's typology of doxxing, our typology considers two key dimensions of doxxing: the form of loss experienced by the victim and the perpetrator's motivation(s) for undertaking this form of TFV. Through examining the extant literature on doxxing, we identify seven mutually non-exclusive motivations for this form of TFV: extortion, silencing, retribution, controlling, reputation-building, unintentional, and doxxing in the public interest. We conclude by identifying future areas for interdisciplinary research into doxxing that brings criminology into conversation with the insights of media-focused disciplines. Keywords Doxxing Technology-facilitated violence Anonymity Privacy Personally identifying information Informational privacy Citation Anderson, B. and Wood, M.A. (2021), "Doxxing: A Scoping Review and Typology", Bailey, J., Flynn, A. and Henry, N. (Ed.) The Emerald International Handbook of Technology-Facilitated Violence and Abuse (Emerald Studies In Digital Crime, Technology and Social Harms), Emerald Publishing Limited, Bingley, pp. 205-226. https://doi.org/10.1108/978-1-83982-848-520211015 Publisher: Emerald Publishing Limited Copyright © 2021 Briony Anderson and Mark A. Wood. Published by Emerald Publishing Limited. This chapter is published under the Creative Commons Attribution (CC BY 4.0) licence. Anyone may reproduce, distribute, translate and create derivative works of these chapters (for both commercial and non-commercial purposes), subject to full attribution to the original publication and authors. The full terms of this licence may be seen at http://creativecommons.org/licences/by/4.0/legalcode. License This chapter is published under the Creative Commons Attribution (CC BY 4.0) licence. Anyone may reproduce, distribute, translate and create derivative works of these chapters (for both commercial and non-commercial purposes), subject to full attribution to the original publication and authors. The full terms of this licence may be seen at http://creativecommons.org/licences/by/4.0/legalcode. Introduction Doxxing, a neologism derived from the hacker culture slang of “dropping dox [documents],” has been used to describe a range of acts in which private, proprietary, or personally identifying information is published on the internet against a party's wishes, usually with malicious intent. To assist researchers in distinguishing between the different forms doxxing may take, in this chapter, we undertake a scoping review of research into doxxing and develop a typology of this form of technology-facilitated violence (TFV). Our scoping review reveals that the majority of studies that have examined doxxing focus on its use either within specific fora, such as cryptomarkets (Bancroft & Scott Reid, 2017) and hacker communities (Serracino-Inglott, 2013), or against specific groups, such as white supremacists (Colton, Holmes, & Walwema, 2017). Furthermore, our review identifies seven mutually non-exclusive motivations for doxxing: extortion, silencing, retribution, controlling, reputation-building, unintentional, and doxxing in the public interest. These various motivations represent the first dimension of our doxxing typology. The second dimension we consider is the form of loss faced by victims of doxxing, and here we build upon David M. Douglas's (2016) compelling typological work on the phenomenon. As we hope to demonstrate, the intersections between these motivations for doxxing and the subsequent losses experienced by its victims are paramount in understanding harms associated with this form of TFVA. Our chapter begins by reviewing Douglas's (2016) typology of doxxing, the most sophisticated typological accounting of the phenomenon to date. After detailing the methodology employed to undertake our review, we discuss our findings in three substantial sections. Drawing on Sayer's (1999) distinction between extensive and intensive research, we have divided our review into (1) extensive studies of doxxing, which examine common patterns and characteristics of doxxing; (2) intensive studies of doxxing, which examine how doxxing works within particular cases, communities, and circumstances; and (3) legal studies of doxxing, which examine legal precedent in responding to doxxing. This division, in part, reflects key methodological differences in the studies reviewed. The extensive studies of doxxing (n = 5) reviewed employed quantitative methods, namely large-scale cross-sectional surveys (n = 2; 40%), content analysis (n = 2; 40%), and software testing (n = 1; 20%). Moreover, they attempted to generate generalizable knowledge on different dimensions of doxxing. By contrast, the intensive studies of doxxing (n = 13) employed qualitative methods, namely interviews (n = 3; 23%), content analysis (n = 4; 31%), focus groups (n = 1; 8%), participant observation (n = 2; 15%) and discourse analysis (n = 3; 23%), or they represented purely theoretical treatments of doxxing (n = 3; 23%). Douglas's Typology of Doxxing Douglas (2016) offers the most sophisticated typological treatment of the nature and forms of doxxing. At its core, Douglas defines doxxing as “the intentional public release onto the internet of personal information about an individual by a third party, often with the intent to humiliate, threaten, intimidate, or punish the identified individual” (2016, p. 199). Within this definition, he distinguishes between three forms of doxxing: (1) deanonymizing doxxing; (2) targeting doxxing; and (3) delegitimizing doxxing. In each of the three forms of doxxing, Douglas (2016) identifies the individual targeted as being faced with a loss or damage to different things. In the case of deanonymizing doxxing, the target is faced with the loss of their anonymity, either in a professional or personal capacity. In the case of targeting doxxing, the target faces the loss of their obscurity, for example, through having their home address revealed online. And in the case of delegitimizing doxxing, the target faces a loss of credibility, for example, through a doxxer releasing evidence that they have engaged in willful deception or ‘immoral’ activity. In conceptualizing these different forms of doxxing, Douglas (2016) draws upon Gary Marx's (1999) typology of the seven forms of identity knowledge: information that, if known, precludes the perfect anonymity of an individual. Marx's concept is particularly useful in conceptualizing doxxing because, as Douglas (2016) notes, it removes “some degree of anonymity from a specific person” (p. 200). For this reason, Douglas (2016) suggests that we understand doxxing as the act of publicly releasing a type of identity knowledge about an individual, which acts to establish a “verifiable connection” between one or more other types of identity knowledge about the individual (p. 201). One important part of Douglas's definition is that it entails the intentional public release of personal information. This intentional release of information need not be undertaken with malicious intent. For example, journalists publicly outing the identities of an individual's pseudonym in stories represents doxxing, even when there is no intent of wrongdoing. But for Douglas, accidentally “outing” an individual on the internet through unintentionally releasing personal information does not represent doxxing. In other words, while doxxing may represent one form of outing individuals online, the two terms are not synonymous. According to Douglas (2016), doxxing is also not synonymous with blackmail, defamation and gossip, though it may represent a technique of blackmail (p. 202). Unlike gossip, doxxing trades in identity knowledge as opposed to “suggestion, hearsay [or] innuendo” (Douglas, 2016, p. 202). As Douglas (2016) cogently observes, the difference between doxxing and gossip is “the difference between communicating information about someone and communicating information of someone” (p. 202). Methodology The articles presented in this scoping review were obtained using two electronic research databases: Web of Science and Google Scholar. Articles and conference papers were primarily located using the search terms: “doxing,” “doxxing,” “dox,” and “doxxed.” However, to locate articles that discussed the phenomenon of doxxing without using the term, we also searched for: “publication of personal details,” “publish personal details,” and “exposing personal information,” in combination with the terms “malicious,” “threaten,” “harass,” “abuse,” and “intimidate.” Finally, a snowballing approach was employed to locate relevant articles by scanning the reference lists of each article identified. Studies were included in the review if they met two eligibility criteria: (1) they discussed the nonconsensual disclosure of personally identifying information on the internet (i.e., doxxing); and (2) they examined the phenomenon at length, as opposed to merely in-passing. These broad inclusion criteria enabled us to include articles that, while not focusing primarily or wholly on doxxing, detailed the phenomenon at length in relation to other issues such as online hacktivism (Heemsbergen, 2016) or intimate partner violence (Fish & Follis, 2016). Articles published in languages other than English were excluded from the review. Titles, abstracts, and keywords were screened to identify clear inclusions. In cases where we were unsure of an article's eligibility, we analyzed how the terms “doxing”/“doxxing,” “doxed,” or “dox” were used in context. Our initial searches returned 48 results on Google Scholar and 10 results on Web of Science. Three additional articles were located through a snowball technique for an initial total of 61 papers. Following a preliminary analysis, 29 papers were excluded as they mentioned doxxing only in-passing, leaving 32 articles, which are the focus of this chapter. Results As we found, the academic literature on doxxing is relatively new. Despite the term dating back to the mid-1990s, we identified no academic articles published before 2010 that employed the term in the sense explored here. Indeed, the earliest reference to the term in academic literature that we identified appears in Phillips's (2011) article on RIP Trolling (the organized practice of targeting social media memorial pages with abusive or harmful content). The overwhelming majority of the articles identified in our scoping review dated from the mid-2010s onwards, with most articles being published between 2017 and 2018. Few articles had doxxing as their primary focus. More frequently, doxxing was discussed alongside other practices, as a technique of politically motivated harassment (Colton et al., 2017; Fish & Follis, 2016; Massanari, 2015, 2018), as a form of intimate partner violence (Freed et al., 2018), or as a contestation of privacy rights (Corbridge, 2018; MacAllister, 2017) (Fig 12.1). Opens in a new window.Fig. 12.1. Combined Line/Bar Graph Showing the Number of Doxxing-Related Studies Published per Year between 2010–2019. As noted above, we identified seven mutually non-exclusive motivations for doxxing in the literature: extortion, silencing, retribution, controlling, reputation-building, unintentional, and public interest. Extortion doxxing or “doxtortion” entails releasing or threatening to release compromising information about an individual online to extort (usually) financial benefits from them. Silencing doxxing involves leveraging doxxing, or the threat of doxxing, to remove an individual from an online forum. Retribution doxxing is doxxing motivated specifically by a desire to “punish” an individual. As detailed in the studies discussed below, retribution doxxing may represent a technique of targeted harassment employed against individuals holding opposing political views. However, it may also take the form of informal justice-seeking actions (see Salter, 2013; Wood, Rose, & Thompson, 2019), wherein victims of crime seek justice beyond the formal justice system through publishing personally identifiable information online about their perpetrator's actions. Controlling doxxing is used to control an individual's behavior. As such, it may represent a measure of technology-facilitated coercive control, often employed in concert with other iterations of intimate partner violence (Douglas, Harris, & Dragiewicz, 2019). Often coinciding with one or more of the other motivations we identified, reputation-building doxxing serves to grant entry or clout within a group or subculture through, for example, demonstrating skill within a hacker forum. Unlike the forms of doxxing outlined above, unintentional doxxing is not undertaken with malicious intent but rather results from carelessness or negligence on the part of the perpetrator. Unintentional doxxing may, for example, result from journalists failing to protect the anonymity or obscurity of their sources. Lastly, public interest doxxing is motivated by a belief that the release of personally identifiable or proprietary information will promote the welfare or well-being of the general public (see Cheung, this volume). Public interest doxxing may take numerous forms, including as a mechanism for holding governments, institutions, and public figures accountable, as well as a mechanism for issuing public safety announcements through, for example, releasing personally identifiable information about predatory Tinder dates. As detailed in Table 12.1, most of these motivations can underpin more than one of the three forms of doxxing identified by Douglas (2016), leading to a variety of subcategories. However, our review of the literature also indicates that the forms of loss that may be faced by doxxing victims are not exhausted by the three forms anonymity, obscurity, and legitimacy identified by Douglas. Specifically, Douglas's original typology faces challenges when we consider the case of corporate or organizational doxxing: doxxing that targets an organization rather than an individual (Khanna, Zavarsky, & Lindskog, 2016). As we detail below, the existence of corporate doxxing necessitates the addition of a fourth form of potential loss faced by doxxing victims, competitive advantage over other corporations or organizations. This prompts a fourth variety of doxxing, disadvantaging doxxing, which may be underpinned by a variety of motivations. Table 12.1. A Typology of Doxxing. Form of Information Published Personal Identifiable Information Proprietary Information Loss experienced by the victim Loss of anonymity (Deanonymizing doxxing) Loss of obscurity (Targeting doxxing) Loss of legitimacy (Delegitimizing doxxing) Loss of competitive advantage (Disadvantaging doxxing) Motivation Extortion Deanonymizing doxtortion Acquisitive doxxing extortion. Targeting doxtortion Delegitimizing doxtortion Doxware-facilitated doxtortion. Sexual extortion/doxtortion. Disadvantaging doxtortion Corporate doxtortion (Khanna et al., 2016). Silencing Deanonymizing doxxing to silence (Massanari, 2018; Jones, 2016). Doxxing as a political silencing technique (Massanari, 2018). Targeting doxxing to silence (Jones, 2016; Massanari, 2018). “Swatting” a member of a marginalized community (Binder, 2018). Delegitimizing doxxing to silence Gamergate Zoe Quinn case: rumors of unprofessionalism imbued with sexist and derogatory comment (McIntyre, 2016). Controlling Deanonymizing doxxing to control (Bancroft & Scott Reid, 2017; Fish & Follis, 2016; Heemsbergen, 2016; Marwick, 2013). Targeting doxxing to control (Freed et al., 2018). Doxxing as a form of intimate partner violence (Freed et al., 2018). Delegitimizing doxxing to control (Freed et al., 2018). Threats of doxxing as a technique of coercive control (Freed et al., 2018). Motivation Retribution Retributive deanonymizing doxxing (Coleman, 2014; Colton et al., 2017; Corbridge, 2018; MacAllister, 2017; Marwick, 2013; McNealy, 2017; Serracino-Inglott, 2013; Snyder et al., 2017) Stalking and other malicious harassment; see Wilkinson v Downton (Corbridge, 2018). Online hate campaigns; Brianna Wu case (MacAllister, 2017). Retributive targeting doxxing (Marshak, 2017; Snyder et al., 2017) Retributive delegitimizing doxxing (Chen et al., 2018, 2019; Snyder et al., 2017). Threat to professional reputation e.g., the case of Dr Quinn (Pittman, 2018). Nonconsensual sharing of sexual imagery. Retributive disadvantaging doxxing Reputation-building Deanonymizing doxxing for reputation-building (Massanari, 2018; Snyder et al., 2017). Doxxing as a vehicle for obtaining social capital within hacker subculture (Snyder et al., 2017). Targeting doxxing for reputation-building (Massanari, 2018; Snyder et al., 2017). Delegitimizing doxxing for reputation-building (Massanari, 2018; Snyder et al., 2017). Disadvantaging doxxing for reputation-building Motivation Public interest Deanonymizing doxxing in the public interest (Coleman, 2014; Colton et al., 2017). Citizen journalists deploying Twitter and other platforms to identify attendees of a white supremacist rally. Targeting doxxing in the public interest Delegitimizing doxxing in the public interest (Oldberg, 2016). Snowden NSA leaks as a form of “organisational doxxing” (Oldberg, 2016). Disadvantaging doxxing in the public interest Unintentional Unintended deanonymizing doxxing (McNealy, 2017). Journalistic doxxing of anonymous sources (McNealy, 2017). Unintended targeting doxxing (McNealy, 2017). Journalistic doxxing of individuals (McNealy, 2017). Unintended delegitimizing doxxing (Chen et al., 2018, 2019). Unintended disadvantaging doxxing Extensive Studies of Doxxing To date, only a few studies have examined the demographic characteristics of doxxing perpetrators and victims (Chen, Chan, & Cheung, 2018; Chen, Cheung, & Chan, 2019). Drawing on a random sample of 2,120 secondary school students in Hong Kong, the first article published by Chan and colleagues reports on a cross-sectional survey of doxxing victimization, as well as the age, gender, and education-level demographics of doxxing victims and perpetrators. Chen et al.'s (2018) regression analysis found positive correlations between depression, anxiety, and stress, and the doxxing of most forms of personal information. Furthermore, they found strong positive correlations between the doxxing of mobile phone numbers and depression and anxiety among victims. The disclosure of phone numbers provides an example of our category of retributive targeting doxxing: doxxing underpinned by a perpetrator's motivation to punish a victim through facilitating harassment against them. Furthermore, Chen et al.'s (2018) study indicates that women are more likely to be victims of doxxing than men, with victimization prevalence for all but one type of information (Hong Kong ID number) higher among female students (p. 4). In the same study, 50.7% of respondents indicated that they had been doxxed by a classmate, 30.3% had been targeted by an individual in the same grade, 25.7% by a friend outside of school, and 24.6% by a parent or family member (Chen et al., 2018). Only 4.1% indicated that they had been doxxed by a stranger (Chen et al., 2018). This suggests that the interpersonal relationship between the victim and perpetrator is one of familiarity, which casts doxxing as a technique of social harassment, rather than random harassment of a stranger. In a second article stemming from this study, Chen et al. (2019) examine adolescents' intentions when doxxing their peers. In doing so, Chen et al. (2019) distinguish between what they term social doxxing defined as “obtain[ing] social information” but not releasing it about a person they liked and hostile doxxing, which is collecting and releasing personal information with malicious intent (p. 1). Here, however, we identify several definitional concerns about the category of “social doxxing.” Namely, given that the notion of social doxxing proposed by Chen et al. (2019) does not involve the releasing of personal information by perpetrators, does this constitute doxxing at all? We argue that it does not. Rather, what Chen et al. (2019) describe as social doxxing more accurately represents what Andrejevic (2004) has termed “lateral surveillance.” There are two reasons for this: first, it involves public rather than private information which conflicts with Chen et al.'s (2019) acknowledgment that the target information of doxxing “can be any personal, private, or sensitive information” (p. 2) and second, it does not involve the release of this information. Given social doxxing arguably falls outside the definitional boundaries of doxxing, we focus here on Chen et al.'s (2019) findings relating to hostile doxxing. Although Chen et al. (2019) did not find gender a statistically significant predictor of perpetrating hostile doxxing, the young males sampled in their study were more likely than the young women to target “personally identifiable and physical location information” (p. 11). Given the expansive definition of doxxing employed within this research includes “social information” that is publicly self-disclosed by individuals, this finding indicates that what is generally understood as doxxing (the public release of personally identifiable and other private information) is a gendered phenomenon in both its perpetration and victimology. Whereas Chen et al. (2018) and Chen et al.'s (2019) study of doxxing drew upon a cross-sectional survey approach, Snyder, Doerfler, Kanich, and McCoy (2017) adopt a naturalistic approach to examining doxxing rates, employing a specialized web crawler to collect data on doxxing files uploaded to three websites associated with doxxing: Pastebin, 4Chan, and 8Chan. This approach produced several findings contrasting with those of Chen et al. (2018) and Chen et al. (2019). For example, Snyder et al. (2017) found that victims of doxxing were overwhelmingly male and a significant number were active in a gamer community (p. 432). However, we would suggest that this may be a product of Snyder et al.'s (2017) focus on files uploaded to Pastebin, 4Chan, and 8Chan, rather than a generalizable finding. Indeed, Snyder et al.'s (2017) somewhat questionable assertion that there “appears to be few dox files that appear elsewhere that do not also appear on pastebin.com, 4chan.org, and 8ch.net” (p. 434) contrasts with Chan et al.'s (2018) finding that it was instant messenger applications and mainstream social networking sites that were the most prevalent platforms used to perpetrate doxxing. This hypothesis is given further credence by the fact that two of the other main “communities” targeted by doxxing on these sites were hackers (a key community associated with 4Chan and 8Chan) and celebrities; a demographic that has been targeted by hack-facilitated doxxing (Snyder et al., 2017). This discrepancy further indicates that Snyder et al. (2017) focused on a particular subset of doxxing incidents, rather than doxxing more generally, which, as a number of the studies discussed below indicate, is often quotidian in nature and not necessarily classified as doxxing by its perpetrators. Through their analysis, Snyder et al. (2017) identify four general motivations for doxxing: (1) competitive: demonstrating superior abilities within a subculture; (2) revenge: doxxing in retribution to a perceived harm committed against the perpetrator; (3) justice: doxxing someone in response to them committing an act perceived to be immoral or unfair; and (4) political: doxxing in the service of a goal larger than targeting a single individual. As the intensive studies discussed in the next section demonstrate, these four motivations are very much ideal types and are far from exhaustive, with doxxing also being employed for the purpose of coercion and control, among other things (Dragiewicz et al., 2018; Freed et al., 2018). Although we question Synder et al.'s (2017) distinction between revenge and justice, (given that both are underpinned by a retributive conception of justice), three key motivations for doxxing can be extracted from their typology: reputation building (analogous with Synder et al.'s competitive motivation), retribution, and public interest doxxing (analogous with their political motivation category) (p. 1). Unlike the three papers detailed above, the final two articles broadly reporting on extensive studies of doxxing examine responses to doxxing. The first of these, Fiesler et al.’s (2018) study of the community rules governing subreddits within the social media site Reddit, provides an indication of the prevalence of anti-doxxing rules on the site. Analyzing a dataset of 100,000 subreddits, Fiesler et al. (2018) found that, of the 23,752 subreddits that had rules, only 128 (0.54%) had rules specifically prohibiting doxxing. However, it is worth contextualizing this finding by noting that posting “personal and confidential information” (i.e., doxxing) is prohibited in Reddit's (2019) Content Policy. This may explain, in part, why few of the subreddits Fiesler et al. (2018) examined banned the behavior. The four papers examined so far in this section pertain to personal doxxing, that is, doxxing targeting an individual. Khanna et al.'s (2016) study, however, focuses on responses to organizational or corporate doxxing: releasing organizational secrets and sensitive proprietary information (see Oldberg, 2016). In their analysis, Khanna et al. (2016) examine tools used to undertake organizational doxxing attacks, most notably Maltego Chlorine CE 3.6.0, a forensics and intelligence program that gathers information from open sources. Identifying key limitations in Maltego Chlorine CE 3.6.0 as a doxxing tool, Khanna et al. (2016) suggest a number of countermeasures that organizations may employ to prevent doxxing attacks. These include employing the very tools of organizational doxxers used against companies and conducting information privacy audits through websites such as Pipl, which can trace the source of information on the internet. Although Khanna et al. (2016) do not systematically compare and contrast corporate doxxing to doxxing targeting individuals, their analysis demonstrates two key ways in which the former may differ from the latter. Namely, corporate doxxing often differs from doxxing targeting individuals in that it (1) often involves the release of proprietary information rather than personally identifiable information; and (2) the form of loss faced by the victim is often an economic loss of competitive advantage against other corporations, as opposed to a loss of anonymity, obscurity, or legitimacy. When the form of loss is competitive advantage through the release of proprietary information, we might term such doxxing disadvantaging doxxing. In proposing this category, it is important to qualify that disadvantaging doxxing is not synonymous with corporate/organizational doxxing, for corporations can be the victim of both disadvantaging and delegitimizing doxxing. Moreover, that this can occur suggests that, contra Douglas, delegitimizing doxxing can be underpinned by a disclosure of either personally identifying information or proprietary information. The release of sensitive confidential information about a corporation's waste (mis)management may, for example, lead to backlash against the corporation, and consequently, economic losses as a result of boycotts. However, this economic loss is rooted in the corporation's loss of legitimacy, rather than in a loss of trade-secrets, and thus should be categorized as delegitimizing doxxing. Intensive Studies of Doxxing Doxxing in Forums Characterized by Social Community Anonymity A considerable portion of the literature examining doxxing concerns its use within populations and communities characterized by strategic internet-facilitated anonymity, namely, hacker collectives and subcultures (Coleman, 2014; Fish & Follis, 2016), webcam models (Jones, 2016), darknet cryptomarkets (Bancroft & Scott Reid, 2017), and internet news story commenters (McNealy, 2017). In internet fora, where anonymity affords users protection, such as hacker subcultures and darknet cryptomarkets, doxxing may be employed as a technique to “out” individuals who break rules or to ensure compliance with a community's norms (Bancroft & Scott Reid, 2017). As Bancroft and Scott Reid's (2017) interviews with cryptomarket users demonstrated, cryptomarket users may use the threat of doxxing for disciplining vendors who scam buyers (p. 504). In some situations, the motivation for deanonymizing individuals in these fora was retribution, falling within the category of retributive deanonymizing doxxing. In other situations reported in the literature, however, the motivation for deanonymizing other users was instead a bid to control behavior–what we term deanonymizing doxxing to control. A vendor may, for example, be “partially doxxed” through publicly releasing part of their phone number to demonstrate the doxxer's knowledge of the number, without releasing it in its entirety and opening them up to abuse (Bancroft & Scott Reid, 2017, p. 504). Such threats of doxxing would often, however, elicit a very negative response from other users. Given that in such fora “anonymising [is] both practical and a m