Outfoxing Doxing: Why We Should Criminalize Vigilante Harassment on the Internet: Part Three

I. The Problems with Tort Law

Privacy torts present a potential solution for those harmed by doxing. These torts fall under common law,^[1] meaning the elements can vary from state to state, as there is often no uniform statute outlining standard criteria. In Illinois, a plaintiff pursuing the tort of intrusion upon seclusion must prove the alleged intrusion caused “anguish and suffering”^[2]—a requirement not present in Georgia.^[3] Despite these differences, there is a common theme among privacy torts: it is often difficult to argue that certain types of information, such as names or addresses, are not part of the public record. As a result, someone suing for doxing under a privacy tort may struggle to meet a fundamental requirement of most privacy-related causes of action—proving that the information disclosed was, in fact, private.^[4]

In a criminal case in New Hampshire, a man murdered a woman at her place of work after he found her personal information and work address on a website.^[5] Following the trial, the victim’s mother sued the website under the tort of intrusion upon seclusion, a statutory commercial appropriation claim, and other negligence claims.^[6] Regarding the public disclosure of the woman’s work address, the location where she was murdered, the court stated, “[w]here a person’s work address is readily observable by members of the public, the address cannot be private and no intrusion upon seclusion action can be maintained.”^[7] For the appropriation claim, the court ruled that “appropriation is not actionable if the person’s name or likeness is published for ‘purposes other than taking advantage of [the person’s] reputation.’”^[8] Since the woman’s work address could have been observed by the public, it was considered public information. Even though the website profited from her identity, an appropriation action could not be maintained.

In Dwyer v. American Express Co., the plaintiffs asserted intrusion upon seclusion after American Express sold their financial information to third-party merchants as part of a marketing scheme. The court found that because cardholders had “voluntarily, and necessarily, giv[en] information to [American Express],” at some point while signing up for a credit card, no intrusion upon seclusion had occurred.^[9] If someone has posted a photograph of their house on Facebook, and later that picture is used to find their address and dox them, there is no cause of action to pursue. They voluntarily posted the photo; they relinquished their privacy.

A. Defamation

Defamation appears to be the most appropriate legal action for addressing harm caused by doxing. Defamation laws are designed to protect an individual’s reputation, allowing those who believe they have suffered dignitary harm to seek redress.^[10] In Georgia, libel and defamation are codified,^[11] and defamation remains one of the most widely recognized torts in the public eye.^[12] Notably, however, libel and defamation lawsuits can be challenging to win when the plaintiff is considered a “public figure.”^[13] Many communications are privileged and protected by both the U.S. Constitution and state constitutions.^[14] In general, journalists and private citizens are free to express opinions about public figures and controversies without fear of being sued.^[15]

In Georgia, one does not have to be as well-known as Jimmy Carter to be considered a public figure; the threshold is lower than many might expect.^[16] For example, in Mathis v. Cannon, the court overturned a plaintiff’s defamation claim after he was classified as a “limited purpose public figure.”^[17] The court found that there was sufficient public controversy surrounding the subpar garbage collection in Crisp County, a community of approximately 20,000 people.^[18] Despite the relatively small scale of the issue, this was enough for the court to designate the plaintiff (the former president of the waste service company) a limited purpose public figure, and to categorize Crisp County’s garbage collection problems as a matter of general “public concern.”^[19]

Similarly, in Atlanta Humane Soc’y v. Harkins, another defamation lawsuit, the defendant criticized an animal humane society in Fulton County on WSB-TV for poor management.^[20] Although the defendant sought media attention regarding the animal shelter, the court still deemed the plaintiff a public figure, despite the plaintiff's involuntary publicity.^[21] The court ruled that the management of a shelter in Fulton County was a matter of widespread public concern, and thus, the First Amendment protected the defendant’s speech.^[22]

Perhaps most notably in Georgia, security guard Richard Jewell sued the Atlanta Journal-Constitution for defamation after the newspaper published articles accusing him of being the Olympic Park Bomber.^[23] Jewell, who was later cleared of any involvement, sought damages for the “anguish” he and his family had endured.^[24] The court found Jewell to be a public figure, and he could not maintain a defamation action. The court reasoned that Jewell had “thrust” himself into the spotlight by appearing on televised news reports, making him a public figure within the context of the controversy.^[25]

These cases suggest that individuals in the civic arena^[26] are particularly at risk of losing a cause of action if they are harmed by someone’s speech.^[27] Given Georgia’s political climate, it is possible that people such as jurors serving on a high-profile case—for example, a hypothetical RICO trial against a former president—would have no right to sue if doxed by outraged citizens.^[28]

In the context of suing for doxing, which is often used as a retaliation tactic, the concept of “thrusting” oneself to the forefront of an issue can be problematic for a plaintiff.^[29] Consider Zoë Quinn, the original target of a hateful and misogynistic harassment campaign known as “Gamergate.” This phenomenon began after Quinn released her first videogame, Depression Quest, and was falsely accused of trading sexual favors for positive reviews.^[30] Despite the lack of evidence for these accusations, far-right extremists repeatedly doxed Quinn, sending rape and death threats to her cellphone and home.^[31] For years, she was unable to move forward with her life due to the lasting impact of this harassment. Quinn continues to experience mental anguish, and her name is permanently tied to hatred and extremism due to the public nature of the doxing.^[32] Every video game she creates will inevitably be associated with this event. Doxing has more than an emotional effect; there are practical implications for the victim.

Would Quinn have won a defamation lawsuit against those who published her information and spread lies about her in Georgia? Could she succeed with a claim for intrusion upon seclusion? She was the one who originally released the game and initiated the conversation about female gamers. Would that be considered “thrusting” herself into the forefront of the controversy? Did this make her an involuntary public figure? Georgia caselaw suggests she may have been considered one.^[33]

B. The Defense of Truth

Even when the disclosure of private facts causes significant harm—such as death—it remains difficult for plaintiffs to recover. A plaintiff forfeits the right to seek damages if the shared information is already known to the public.^[34] If the information is part of a public record, or if the plaintiff previously disclosed it voluntarily, there is no cause of action. In Cabaniss v. Hipsley, a woman’s private photos were published in Playboy without her consent.^[35] The court ruled that she had no right to privacy because she had been a stripper and previously used similar photos for self-promotion at clubs.^[36] She forfeited her right to assert ownership over images of her body by voluntarily sharing similar photos in a completely different context. Once information is shared, individuals often lose the right to control where information might end up.^[37]

Much of the information we consider private is public record.^[38] Addresses and birthdays, for example, can be found through voting registries.^[39] Workplaces can be listed on corporate websites; some people even link them in their Facebook accounts.^[40] While damages may be sought in court, and true threats may lead to criminal charges, civil accountability for mass publication of personal information remains limited.

Some tort laws explicitly discourage lawsuits that plaintiffs might bring in response to doxing.^[41] Strategic Lawsuit Against Public Participation (SLAPP) lawsuits are filed to prevent critics from generating negative publicity, often for malicious purposes.^[42] Many states, including Georgia, have anti-SLAPP laws in place. These laws allow for the swift dismissal of claims that are based on the exercise of free speech, discouraging individuals from filing frivolous lawsuits.^[43] Anti-SLAPP laws effectively quash suits seeking damages for doxing in states that have enacted them.^[44] In DeHart v. Tofte, school board members in Oregon had a doxing claim dismissed as an impermissible SLAPP lawsuit.^[45] Similarly in Georgia, a man sued for libel after his name was published on social media alongside the label murderous “neo-Nazi” by the owner of a shop where he had left a negative review.^[46] The shop owner moved to have the case dismissed under Georgia’s Anti-SLAPP suit and won.^[47]

II. Statutory Schemes That Specifically Address Doxing

Some state and federal statutes have been successful in punishing doxing,^[48] particularly by protecting specific types of citizens with careers which put them at higher risk of doxing. Following the COVID-19 pandemic, many states passed laws to protect the personal information of healthcare workers.^[49] Other states extended protection to people serving in civil capacities, such as election workers or elected officials.^[50]

The federal Protection of Individuals Performing Certain Official Duties Law criminalizes publicizing “restricted personal information about a covered person.”^[51] Here, a “covered person” is defined as a “juror, witness, or other officer” of the United States, and violators are subject to a fine and to a prison sentence of up to five years.^[52] In 2019, an aide to a senator was sentenced to four years in prison for posting the personal information of five other senators, including their personal cellphone numbers, usernames and passwords, and families’ addresses.^[53] However, this statute only protects victims who can be defined as covered persons, meaning there is no redress outside of this parameter. While the law currently applies to people working in federal positions, given the nature of recent elections, Congress has proposed legislation to extend coverage to poll workers during elections.^[54] This amendment has not yet been enacted.

Several federal provisions could theoretically be used to prosecute doxing, but none were specifically created with it in mind.^[55] For example, the Interstate Communications Statute (ICS) punishes “[w]hoever transmits in interstate or foreign commerce any communication containing any threat to kidnap any person or any threat to injure.”^[56] This statute can be enforced with respect to online communications and does not require the defendant and victim to be in different states.^[57] Similarly, federal stalking laws prohibit conduct aimed to “kill, injure, harass, or intimidate another person.”^[58] Although these statues appear helpful on the surface, there is debate about their use in cyberstalking cases.^[59] Cyberstalking is not necessarily something federal agents have time for or even want to pursue.^[60]

Certain states elected a more generalized approach by illegalizing doxing regardless of the victim’s status. In Montana, an “anti-intimidation” statute provides a civil remedy for those who feel threatened in any capacity.^[61] The act aims to protect citizens experiencing harassment from extremist groups.^[62] In 2016, Tanya Gersh, a Jewish woman, was doxed on a neo-Nazi website after refusing to sell real estate to a white nationalist.^[63] Andre Anglin, the owner of the forum, not only published Gersh’s personal information, but also wrote thirty articles urging his followers to harass Gersh.^[64] Gersh’s family received hundreds of messages in the following months, including threats to lock her twelve-year-old son in an oven.^[65] Gersh later stated that the experience drove her to have suicidal thoughts.^[66] The Montana court found that Anglin’s actions were not protected by the First Amendment because they conveyed a true threat unrelated to any issue of public concern.^[67] In the end, Gersh was awarded millions in compensatory and punitive damages.^[68]

California has a unique statute that criminalizes doxing as a misdemeanor.^[69] Unlike the generalized approach in Montana, this statute specifically addresses doxing and defines every type of “electronic communication device” that may be used to harass someone.^[70] The prosecution does not need to prove the defendant intended to incite unlawful action. Instead, proving that the defendant had the capacity to do so is enough to sustain a conviction.^[71] However, California’s law does not include civil provisions, meaning victims in these cases are not entitled to any damages.^[72]

Kentucky takes a blended approach. The state’s anti-doxing statute criminalizes doxing as a “Class A misdemeanor” punishable by up to twelve months in prison or a fine.^[73] If a victim suffers bodily harm, the charge is upgraded to a felony with a maximum sentence of twenty years.^[74] Kentucky’s law also allows citizens to initiate a civil action under this statute, enabling both state intervention when necessary and private remedies for plaintiffs seeking damages.^[75]