Outfoxing Doxing: Why We Should Criminalize Vigilante Harassment on the Internet: Part Two

I. The First Amendment

A. Freedom of Speech

Freedom of speech is a cornerstone of American democracy.^[1] When evaluating whether speech is constitutionally protected, courts tend to interpret issues broadly to avoid censoring content-based expression.^[2] The Supreme Court has consistently upheld the right to be rude, annoying, and even outright hateful,^[3] emphasizing that the right to address matters of public concern lies “at the heart of the First Amendment.”^[4]

Courts have upheld the right to publish private information when it is truthful, lawfully obtained, or deemed newsworthy.^[5] In Smith v. Daily Mail Publishing Co., two newspapers published the name and image of a fifteen-year-old on trial for murdering a classmate. Despite a West Virginia statute prohibiting the publication of juvenile offenses,^[6] the Court ruled in favor of the newspaper: “[t]he asserted state interest [protection of a juvenile identity] cannot justify the statute’s imposition of criminal sanctions.” The newspaper lawfully obtained the information from public records and was therefore shielded by the First Amendment.^[7] Similarly, in Cox Broad. Corp. v. Cohn,^[8] a case originating in Georgia, the Court found in favor of a television station that had broadcast the name of a rape-murder victim.^[9] Since the information was of public interest and obtained through public means by a journalist, the Court deemed the publication of the victim’s name constitutionally protected speech.^[10]

In the digital age, the distinction between those who qualify as a reporter and those who do not has become somewhat convoluted.^[11] As the definition expands, establishing liability for publishing private facts is becoming more difficult.^[12] People’s addresses and phone numbers can be lawfully obtained simply by typing a name into a search bar. Now some of our most personal information is public fact; sometimes without our knowledge.^[13] Even if individuals obtain privileged information illegally, they may still be protected by the First Amendment protections.^[14] If the publication is newsworthy and a journalist was not involved in illegal gathering of the information themself, the First Amendment will triumph.^[15]

B. True Threats

There are also, however, well-defined and narrowly applied exceptions to the broad protections of free speech.^[16] Perhaps the most ubiquitous is the prohibition against yelling “fire” in a crowded theater.^[17] Other exceptions include obscenity, such as child pornography,^[18] libelous statements,^[19] and “fighting words.”^[20] The state can prosecute speech that contains fighting words because that speech is not constitutionally protected.^[21]

To determine what qualifies as fighting words, courts will look to the context in which the words were used.^[22] Courts have emphasized the need for these words to cause an “immediate breach of the peace,” as determined by common knowledge.^[23] Speech that will realistically cause violence can be punished.^[24] A “true threat,” which threatens to injure a state official, is not constitutionally protected speech.^[25]

II. Current Protections for Those Harmed by Doxing

A. Criminal Law

Some doxing behavior can be prosecuted under existing criminal laws depending on what exactly the doxer does and why. O.C.G.A. § 16-11-37 criminalizes terroristic threats and acts,^[26] and § 16-11-37.1 specifically makes it illegal to communicate terroristic threats through a computer.^[27] A terroristic threat is made when someone threatens to “commit any crime of violence” with the intention of terrorizing the victim.^[28] “Threat” refers to communication made to someone else with the intention of inflicting damage.^[29] The penalty increases depending on how serious the threat is.^[30] Statutes criminalizing terrorist threats are constitutional because this kind of speech falls under the “true threats” exception.^[31] It does not matter if a defendant is capable of carrying out the threat^[32] or if the defendant even directly communicated with the victim;^[33] as long as it can be proved the defendant acted with the intent to terrorize someone and that person was able to infer a threat, a conviction can be sustained—but courts do not apply this consistently.^[34] Blatant innuendos have been enough to sustain a conviction, but the threat must suggest the death of the victim for the rule to apply.^[35] Threats communicated over social media have been prosecuted before.^[36] Conditional threats, or statements that leave room to interpretation regarding whether they are a legitimate threat, are harder to pursue.^[37]

The court must consider the subtle differences between statements like “I am going to kill you” and “I want you to die.”^[38] While sharing personally identifiable information could be perceived as threat, it is not clear whether intent to harm could be established purely on the basis of implication.

O.C.G.A. § 16-11-39.1 classifies harassing communications as misdemeanors.^[39] While the statute requires that the defendant “[c]ontact[] another person repeatedly,” courts have upheld convictions even when a defendant only made a single phone call threating bodily harm.^[40] The key factor here is intent. Even if the victim perceives the contact as harmless, a case can still be made if the defendant’s intent was to harass the victim.^[41] There is no private remedy available for harassing phone calls under this statute.^[42]

A person can be charged with disorderly conduct for similar behavior.^[43] To avoid constitutional conflicts, language under this statute cannot be criminalized unless it constitutes “fighting words.”^[44] Obscene, vulgar, or profane language is not penalized unless it can be interpreted as fighting words.^[45] Once again, courts must consider not only the literal meaning of the words used, but also the context in which they were spoken.^[46]

Georgia’s stalking statute may also apply in cases of doxing.^[47] A person can be convicted of stalking if they “place[] under surveillance, or contact[] another person . . . without the consent of the other person for the purpose of harass[ment].”^[48] The victim must be placed in reasonable fear for his or her safety or the safety of his or her immediate family. ^[49] To successfully allege stalking, there must be an established course of conduct, or a pattern of harassing and intimidating behavior.^[50] Although it is unclear how long the behavior must occur to qualify as a “pattern,” it must be persistent to some degree.^[51] Additionally, there is no corresponding tort for this crime, meaning victims cannot be awarded damages for any harm caused by the stalking.^[52] Doxing often involves multiple perpetrators. While the conduct may be continuous, it remains unclear whether the actions of several individuals’ actions can collectively constitute a pattern of behavior.

B. Tort Law

The Georgia Supreme Court recognizes a right to privacy, calling it an “ancient law” that recognizes a person’s legal right “to be let alone.”^[53] Georgia’s constitution is somewhat unique in this aspect because it recognizes privacy as an intrinsic right in a way that other states do not.^[54] Consequently, there are several invasion of privacy torts derived from common law creating a cause of action in Georgia.^[55] There are four distinct causes of action found in the Second Restatement of Torts: Intrusion upon seclusion, publicity given to private life, publicity placing person in false light, and appropriation of name or likeness.^[56]

“Intrusion upon seclusion,”^[57] applies when “one . . . intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns . . . if the intrusion would be highly offensive to a reasonable person.”^[58] There is no publication element here :the invasion itself is enough to sustain a lawsuit.^[59] The critical factors are whether the intrusion is “highly offensive to a reasonable person” and whether the plaintiff had a reasonable expectation of privacy.^[60] This expectation is context specific, as explained by the Georgia appellate court: “The right of privacy is not absolute, but is qualified by the rights of others’ . . . . There are some shocks, inconveniences and annoyances which members of society . . . must absorb without the right of redress.”^[61] This principle derives from a 1986 case where the plaintiff, previously convicted of sodomy, could not proceed with a privacy suit against an officer who surveilled him by climbing into the ceiling of a locked bathroom to spy on the man.^[62] It is difficult to ascertain what is “highly offensive” as offensiveness is subjective for every person,^[63] and there is no bright line test to figure out what is offensive: “Reasonable” people can disagree.^[64] A court’s ideological commitments or personal feelings might influence who gets awarded damages.

The tort of “Publicity given to private life” is defined as “[giving] publicity to a matter concerning the private life. . . if the matter publicized is of a kind that would be highly offensive to a reasonable person, and is not of legitimate concern to the public.”^[65] There is ongoing debate about whether this tort is compatible with the First Amendment, and the issue has only become more complex since the New York Co. v. Sullivan decision.^[66] The element of “publicity” does require that the information be “published, simply meaning that the information has been made public”^[67] Sharing personal information with a small group of people, for instance, does not necessarily constitute an invasion of privacy in Georgia.^[68] Sharing private information in a chatroom with limited participants may also not qualify as publicity,^[69] even if the consequences spread far beyond the confines of the chatroom. Further, there is no cause of action if the plaintiff “leaves himself open to the public eye.”^[70] Individuals do not have a right to privacy in public or when engaging in any public activity.^[71] There is also discrepancy about what constitutes a “legitimate concern to the public.” In Department of Labor v. McConnell, the Georgia Department of Labor emailed a spreadsheet to “approximately 1,000 recipients” with the names, social security numbers, telephone numbers, ages, and email addresses of 4,757 customers without their consent. ^[72] The court found that the information leaked “[would] not normally affect a person's reputation, which is the interest the tort of public disclosure of . . . private facts was meant to remedy.”^[73]

The third privacy tort, “Publicity Placing Person in False Light,” applies when someone “gives publicity to a matter concerning another that places the other before the public in a false light.” The portrayal must be highly offensive and the actor needs to have knowledge or have “acted in reckless regard” to a statement’s falsity.^[74] Simply put, the plaintiff must show that the defendant knew they were lying. This tort is similar to defamation— so similar in fact that a plaintiff is not allowed to recover under both theories.^[75] Again, there is an ongoing dispute as to whether constitutional limitations to the tort exist.^[76] Since the Sullivan decision, Courts have understood that public figures (both voluntary and involuntary) must prove that a speaker acted with “actual malice” or “reckless disregard” of the truth when alleging defamation.^[77] This is a difficult thing to prove. Subsequently, in Gertz v. Robert Welch, Inc., the Court made clear that private citizens do not need to reach this heightened standard and must only show that the speaker acted with negligence.^[78] However, before Gertz, there was Time, Inc. v. Hill.^[79] In Hill, the Supreme Court decided that to prove a false light claim a plaintiff must show that the speaker acted with actual malice.^[80] That is the higher, more difficult-to-prove standard associated with public figures in defamation cases. Now, it is unclear whether the burden of proof for non-public figure plaintiffs is consistent with the Sullivan standard or the Gertz standard.^[81] Georgia has applied different standards based on the status of the plaintiff, contrary to the Supreme Court’s ruling in Hill.^[82] In addition, “highly offensive” is case specific, and the offense must be something most people would be “seriously . . .  aggrieved by.”^[83] A plaintiff will be unable to recover if they have not sufficiently been placed in the public eye,^[84] or if their depiction is something that might interest the public.^[85] A false light claim must be based on something that is construed or depicted as fact.^[86] Opinions are constitutionally protected.^[87]

An individual who commits “Appropriation of Name or Likeness” is defined as “[o]ne who appropriates to his own use or benefit the name or likeness of another . . . .”^[88] The appropriation at issue in this tort does not have to be for commercial purposes unless such a requirement is specifically enumerated within a state’s statute.^[89] This tort is a dignitary harm,^[90] as opposed to the “right of publicity,” which is rooted in property law.^[91] This cause of action protects “. . . name and likeness as an aspect of [] identity.”^[92] Mentioning someone’s name is not enough to sustain a cause of action.^[93] Even using someone else’s identity is not enough to sustain a cause of action unless a plaintiff can prove that the bad actor was trying to seek benefits from the plaintiff’s identity.^[94] Appropriating someone’s likeness to spread false statements or insulting them might not qualify as a valid cause of action because it is unclear who exactly is benefitting.

In Georgia there is an option to sue under the cause of action of “intentional infliction of emotional distress.”^[95] “Offensive” conduct is not enough; the behavior involved must be “so outrageous in character, and so extreme in degree, as to go beyond all possible bounds of decency . . . .”^[96] Conduct that causes “intense feelings of humiliation, embarrassment, fright or extreme outrage” is not outrageous enough to be considered tortious.^[97] The guiding principle is whether the activity would be intolerable to the “average member of the community.”^[98]If something is common practice, such as within the political sphere or on certain websites, that conduct might not rise to intentional infliction of emotional distress.^[99]

It is also possible to pursue a civil action for conspiracy in Georgia in addition to the law’s criminal counterpart.^[100] A civil conspiracy has specific guidelines and requires “two or more persons either to do some act which is a tort, or else to do some lawful act by methods which constitute a tort.” ^[101] A conspiracy itself is not something that one can be sued for.^[102] A conspiracy must have resulted in a completely different tort; essentially, a plaintiff must prove two torts for one cause of action. The act of conspiring is legal, so a plaintiff must show the goal of the conspirators was illegal.^[103] It is also still necessary to prove the conspirators committed an overt act causing legal damage.^[104]