The limits of doxxing

Aside from the death and injuries in Charlottesville and the fact that in 2017 KKK white supremacists can demonstrate without hoods because they feel protected by their government, events there highlight the growing practice of using the internet, and doxxing in particular, to investigate and divulge people’s private information.

Using photos from the demonstration featuring series of individuals marching with torches and making Nazi salutes, a Twitter account with more than a quarter of a million followers, @YesYoureRacist, has publicly requested people who recognize someone in those photographs to post their names or social profiles and reveal their identities. The original tweet, reproduced in the image, has been retweeted more than 60,000 times, and has already resulted in at least one person losing his job, while another risks being expelled from the university where he studies.

Is it permissible to use those photographs disclosed by the media to identify participants in a demonstration? In principle, they were marching in public, the event was extensively reported by the media, and some of those participants were even interviewed later. Twitter defines as a violation of its rules the publication of private or confidential information without consent, but defines that private or confidential information as:

Intimate photos or videos taken or distributed without the consent of the person appearing in said material.

• Images or videos that are considered and treated as private according to the applicable legislation.
• Financial or private contact information, for example:
• Credit card information
• Social security number or national identity card
• Addresses or locations that are considered and treated as private
• Personal, non-public telephone numbers
• Personal, non-public email addresses

In principle, the information published by the Twitter account in question does not fall into those categories: what is being done is to identify people who have participated in a public demonstration, without revealing any personal data or contact information beyond their name, which is not protected under the terms of service of Twitter. The definition of personal information, however, is broader, and does include information that may be used to identify, contact, or locate a particular person, or may be used, along with other sources of information, to do so, especially because privacy laws vary from country to country.

The expectation of privacy of somebody who participates in a manifestation with their face uncovered and who gives interviews to the media, would not seem too worried about their privacy. However, the identified people are exposed to reprisals of all kinds: few companies or institutions want to be associated with such individuals. The vast majority of the universities I know, in fact, have behavior clauses that immediately exclude people with racist, supremacist attitudes or who incite hatred, as is clearly the case the individuals concerned. However, the idea of identifying and demanding reprisals against somebody for participating in a demonstration seems to be difficult to accept in a country that makes much of the First Amendment of its Constitution enshrining the free exercise of religion, freedom of speech, freedom of the press, and the right to peaceably assemble, and has already generated criticism from both sides of the political spectrum. In many European countries, though, freedom of expression specifically excludes the use of Nazi symbols, which were extensively on display at Charlottesville; but such rules do not exist in the United States.

With more and more cameras everywhere, and with evermore sophisticated identification technology, identifying people has never been easier. In May 2016, I mentioned a Russian app, FindFace, that looked for the traits of individuals within the highly popular VK social network in Russia. Soon, this type of identifications will be almost immediate, thanks to applications that allow us to focus on a person’s face or to introduce a photograph and quickly identity them.

There are no limits as to what can be done with such technology. And even if they could be avoided in some way, should measures be taken to protect people who incite hatred, racism or exclusion? Does someone who advocates such ideologies deserve the protection of their privacy, or should they be named and shamed? Should there be limits to doxxing based on ideology?

Until a few years ago, somebody who made no attempt to hide their face at a demonstration risked at most appearing in the media and perhaps being recognized by a few people. Thanks to the social networks, it is now possible to find out who somebody is and publish it, calling for reprisals, with 140 characters and a click. Technologies such as biometrics make it even easier, and the whole issue of ideology complicates the subject even more. How should we define issues such as doxxing or privacy in such a context?

(En espa?ol, aquí)