Is posting doxxing information ever acceptable?

Question

I would think the obvious answer here is no, but...

Recently certain American politicians have been circulating some unsubstantiated doxxing information alleging to out a whistleblower. This has led to some posts on SE which repeat this doxing information.

I've been flagging these posts, but the response from moderators has been a mixed bag.

• In one case, the edit which added the information was rolled back and the edit history was redacted.

• In another case from the last 24 hours, the post was edited to remove the information and the edit history was not redacted.

• In another case from the last 24 hours, the flag was declined arguing that it has already been posted by other sources so it's fine now (quote redacted because it too has the name for some reason).

The identity of REDACTED was already leaked by several other sources. Not saying that this was an ethic thing to do, but by now it is pretty pointless to try to keep the identity hidden.

This seems like the sort of thing which might have legal ramification for Stack Exchange. Is there an official policy on such a thing?

UPDATE: After re-flagging the declined flag with a link to this post, this was the borderline-rude response (name redacted, typos preserved):

Like it or not, but REDACTED has now become a public person. The genie is out of the bottle, and pretending otherwise is just ridiculous. Complain to the people who deanonymized him publically.

We might need an official response from SE to clear this up.

UPDATE 2: There's even a self-answered Q&A dedicated to posting this doxxing information now...

Answer 1

Likely covered by existing policy in the form of the Acceptable Use Policy? (Some emphasis mine.)

Identity Theft and Privacy. Users that misleadingly appropriate the identity of another person are not permitted. Users may not post other people's personally identifying or confidential information, including but not limited to credit card numbers, Social Security Numbers, and driver's and other license numbers. You may not post information such as other people's passwords, usernames, phone numbers, addresses and e-mail addresses unless already publicly accessible on the Web.

Considering that "The Whistleblower" has been protected up to this point with the highest levels of confidentiality (despite attempts by others to name them), I would presume that any post which corroborates or attempts to identify them would be in acute violation of this policy.

Doxxing in general would easily be covered by this since that information is probably inappropriate to display or send out on the site in most every context.

It could also be covered by the below:

Hate Content, Defamation, and Libel. Hate speech and other objectionable content that is unlawful, defamatory, and fraudulent. Note that an allegation of defamatory expression, in and of itself, does not establish defamation. The truth or falsehood of a bit of expression is a key element in establishing defamation, and we are not in a position to make that sort of fact-based judgment. That said, if we have reason to believe that a particular statement is defamatory (a court order, for example), we will remove that statement.

Answer 2

No, but I am unsure that this qualifies as doxxing.

Although this answer argues that posting the name of the purported whistleblower is not acceptable or advisable, I'm going to argue differently. I think the Acceptable Use policy leads to precisely the opposite conclusion, and that even from a broader perspective there's little reason to omit the information.

First, let's look at the section of the Acceptable Use policy mentioned previously:

Identity Theft and Privacy. Users that misleadingly appropriate the identity of another person are not permitted. Users may not post other people's personally identifying or confidential information, including but not limited to credit card numbers, Social Security Numbers, and driver's and other license numbers. You may not post information such as other people's passwords, usernames, phone numbers, addresses and e-mail addresses unless already publicly accessible on the Web.

I think we can discard the notion that "personally identifying" information is meant to cover publicly available names. For instance, if I say that Mark Felt was probably Deep Throat, or that Individual One is likely Donald Trump, that is not a violation of the policy since these individuals' names are widely known. In other words, the confidentiality portion is important.

However, contrary to what the other answer argues, the name of the whistleblower has not been "protected with the highest levels of confidentiality (despite attempts by others to name them)." On the contrary, their name has been 1) tweeted by the president of the United States, 2) tweeted by the US Senator, 3) bandied about on live TV, and is 4) currently visible on, by my count, at least 160 webpages (The search results said over 100,000, but when I went through there were far fewer. Perhaps this reflects aggregation of domains with a huge number of mentions).

The "confidentiality" mentioned here mainly consists of various major news outlets declining to use the name in their stories, due primarily to their own specific journalistic codes of ethics. The majority of people who don't know the name of the purported whistleblower don't know because they have chosen not to go to the mainly dodgy far-right sites where the name is mentioned extremely regularly.

And this brings us to the second half of the acceptable use policy, which implies that if otherwise personal information is "publicly accessible on the web", it is acceptable to post, even passwords and usernames! The unavoidable fact is that, with over 100 websites giving the name of the alleged whistleblower, it is very much publicly accessible on the web, and is only likely to become more accessible. Although the sites that mention this person's name are, to my estimation, primarily far-right or conspiratorial sites, this is not a universal characterization: the Dallas Morning News, with a somewhat conservative but highly anti-Trump editorial board, also has an article that mentions their name, for instance. This information is also now available on CSPAN and in the Congressional Record. It is emphatically no longer private in any colloquial sense.

In short, based on the demonstrable fact that the name of the alleged whistleblower is publicly accessible on the web and has been mentioned by politicians on Twitter and in person to literally hundreds of thousands or millions of people, I think this does not fall into the category of confidential information as classified by the Acceptable Use policy.

We also need to consider the portion about defamation. That portion says:

Hate Content, Defamation, and Libel. Hate speech and other objectionable content that is unlawful, defamatory, and fraudulent. Note that an allegation of defamatory expression, in and of itself, does not establish defamation. The truth or falsehood of a bit of expression is a key element in establishing defamation, and we are not in a position to make that sort of fact-based judgment. That said, if we have reason to believe that a particular statement is defamatory (a court order, for example), we will remove that statement.

It's clear from this merely alleging that a statement (say, Rand Paul's tweet about the purported whistleblower) is defamatory is not sufficient. Even if I feel it is, or even if the whistleblower themself does, the policy emphasizes that this, by itself, is not enough to prevent any mention of the statement, in the absence of a court order. Further, in line with the US legal notion that truth is an absolute defense to an accusation of defamation, the Acceptable Use policy requires that the statement be fraudulent. Thus, in what I consider the quite probable case that the purported whistleblower is in fact the actual whistleblower, this would not constitute defamation under SE's policy. Moreover, even if a tweet or article by another person could be defamatory, merely noting their allegation would not necessarily be defamatory under US law, which is most likely to apply to SE posts.

In conclusion, I doubt the defamation portion of the Acceptable Use policy requires its removal.

Of course, the acceptable use policy is only one aspect. We should also consider whether it's ethical to post the information. On the one hand, we need to consider the possibility that mentioning the name of the purported whistleblower could lead to a risk to their safety. I consider this implausible. First, the government officials who are clearly motivated to retaliate against them are clearly well aware of who they are. Second, the much larger but much less motivated group of potentially dangerous far-right followers of Trump are also well aware of their identity, because their version of newspapers like the New York Times are conspiracy sites like The Blaze, which have had few scruples about sharing the name of the alleged whistleblower.

On the other hand, we have the fact that a person who has divulged information that led to the impeachment is inherently newsworthy. See the aforementioned Deep Throat. In addition, there's a possibility of a Streisand Effect, whereby the paucity of information about a fact increases its popularity: even, in this case, potentially driving people to highly unreliable news sources due to the relative absence of the information from trustworthy ones.

To summarize, I think mentioning their name contributes little if at all to informing the people who would threaten them, and promotes the cause of providing the public with trustworthy information about newsworthy events. It's also quite unlikely that this constitutes defamation according to the SE policy. In conjunction with the idea that the Acceptable Use policy does not prohibit divulging their name, I think it is acceptable to include in an answer.

Answer 3

In another case from the last 24 hours, the flag was declined arguing that it has already been posted by other sources so it's fine now (quote redacted because it too has the name for some reason).

It's a very difficult situation. Since the quote applies to one of my posts, I'll elaborate on the dilemma.

In my answer, I quote a politician's tweet which is directly related to the question. A question which is about that politician and why he has been assumed (by the media) to have done something to make that name public.

The dilemma here is simple. On the one hand, the tweet has direct relevance with respect to the question, but also with respect to this politician's broader conduct in this matter. On the other hand, many people find it inappropriate to spread this name.

The obvious solution would be not to reference the tweet, because it contains inappropriate text. That solution isn't ideal, because bad faith actors could abuse that system: insert these key words so they won't be scrutinized by people who take the issue in your question seriously while allowing the messages to spread on the internet for all who don't take the issue seriously.

Also, merely censoring the name while linking the tweet is pretty pointless. It allows one to see the name when clicking on the link.

It is also my understanding that while inappropriate, the naming of this person is not illegal. Naming this person (allegedly, a whistleblower in the US) is not illegal. Whistleblowers do not have a statutory right to anonymity. There are protections, but they seem to apply to the relevant Inspector General and the employer, not to others.

---

That said, the site, like congressional committees, can choose not to have their platform used to spread these names. For that to work, I agree that Stack Exchange should make a clear statement on what they allow on their platform. While others have cited rules from the code of conduct, they don't have the nuance on where the line is.

For example, is quoting a tweet allowed if the offending name is censored in the quote, but still available from the link? Or can politicians choose to avoid scrutiny on sites like Politics by adding inappropriate key words in their messages?

Answer 4

This is a classic example of a Loaded question or Begging the question: OP presupposes that revealing the whistleblower's name is doxxing, rather than opening it up for debate. Therefore this question can only be answered in two parts.

No, it is not acceptable if it's actual doxxing

The definition of doxxing from Wiki is:

Doxing, or doxxing (from "dox", abbreviation of documents), is the Internet-based practice of researching and broadcasting private or identifying information (especially personally identifying information) about an individual or organization.

Looking up someone's Facebook to find their address and post it online is a clear example of doxxing. Outing someone who uses a pseudonym online is doxxing. Hacking someone's mailbox to find out the identities of the people they correspond with is doxxing.

Yes, it is fully acceptable in the case of the alleged whistleblower

Sharing the contents of the US President's tweets is definitely not a form of doxxing, as by that time the message has been read by tens of millions of people around the world. And at this point the alleged whistleblower has indeed been directly named by Trump, as well as dozens of other prominent politicians. It doesn't matter if the alleged whistleblower is threatened by others having had revealed his identity - at this point it is far too late for StackExchange to help by censoring his name.

Finally, don't forget about the Streisand effect - forcing others to censor their speech only makes it more attractive for others to share it. I didn't care about the alleged whistleblower up until I found out its being censored and then it took me 30 seconds on Google to find the answer. Whoever wants to know will know, so why keep up the charade?

Answer 5

Code of Conduct - Stack Exchange

[...] No harassment. This includes, but isn’t limited to: bullying, intimidation, [...], direct or indirect threats [...]

"Obvious" cases of "doxxing" must be covered under harassment. It would make no sense to exclude "doxxing" from this definition.

---

From the first article I found about these claims - it takes care to avoid repeating the name - it sounds like they are part of a campaign of threats and general harassment, including from the most powerful position.

This was recent; the campaign is probably still going on. For the sake of those affected, I hope this case is relatively simple. If so, we can still treat it as a violation, and try to follow positive examples like the article linked above.

At some point the harassment and threats will decrease. By the time this is history, I guess it will not be practical to enforce my answer :-). But at this time, apparently we are dealing with several posts "in Stack Overflow which [...] attempts to make them look like programming answers". I am very suspicious about the attempts to spread this information here.

---

Trump accused the whistleblower's sources of being “close to a spy”, adding, “you know what we used to do in the old days when we were smart? Right? With spies and treason, right? We used to handle them a little differently than we do now” [...]

The Post “has long respected the right of whistleblowers to report wrongdoing in confidence, which protects them against retaliation. We also withhold identities or other facts when we believe that publication would put an individual at risk. Both of those considerations apply in this case”. [...]

The whistleblower, who is reportedly still at his job, is driven to and from work by armed security officers when threats are elevated. Threats against him seem to spike whenever Mr Trump tweets about him, The Post has previously reported.

Relevant concepts:

• Historical and legal treatment of treason in the United States.
• Regarding "spies", the famous case of Julius and Ethel Rosenberg.
• "Stochastic terrorism."
• "Will no one rid me of this turbulent priest?"
• Implicitly inciting harassment by large numbers of followers. Example: harassment of Carlos Maza.
• For a general introduction to internet-organized harassment: read GamerGate. Consider similar levels of effort to be operating continuously.

Some efforts to publicize the supposed name of the whistleblower may claim a legitimate reason to discuss this specific person. There isn't one, because the whistleblowing details were since corroborated. Including by the White House itself. I refer to "The Whistleblowers and the Text Messages" section at https://www.2016activemeasures.org/ukraine - it provides news sources for these claims. The reason to publicize the name is vengeance, to discourage whistleblowing.

Or if that's over-simplifying, another driving reason is to draw attention. This is an unfortunate thing to do, after starting a campaign of harassment.

Sometimes people quote or link a racist troll, setting their idea in full context to defuse it. This has high stakes and must be handled with care. You cannot entirely avoid further propagating the idea, and rewarding the racist by sending more people to read their full output. Harassment campaigns are the same.

We have a site dedicated to "challenging unreferenced notable claims". Hopefully they have good discussions about problems like this on their meta site. Hopefully, the answer I wrote from outside that site will be useful to some other outsiders :-).

Answer 6

Here it is completely unacceptable, as with most other platforms. I will get into why later.

However, as a whole ethically the issue becomes more complicated.

The right to anonymous speech should be respected to a point.

The ethical question really is if the person's actions you are stripping them of their anonymous nature for is considered speech.

Targeted harassment, making threats and advocating genocide have not traditionally been considered "speech" so much as criminal actions or social infractions, depending on degree. They are traditionally not protected speech which it is generally a social infraction to oppress in public forum, and generally a crime for governments to oppress.

Hence, denying the person from being able to do these things anonymously is reasonably ethical. This amounts to denying an anonymous platform.

Still, certain information is inappropriate to publish even in these cases. This is where I think people doxxing go too far. Often only the minimum amount of information needed to hold a person accountable for their misdeeds is necessary.

Information that can enable identity theft, such as Social Security numbers, should never be published, nor should private contact information that would enable someone to personally harass the individual.

Additional information that should never be considered a valid to release are certain personal details that may endanger their life, may subject them to harassment or are unrelated to their actions in any way.

As of why here is obviously not a valid to doxx someone, the moderators here do a good job that anything that would warrant doxing someone is not permitted, hence doxxing someone's handle on this platform would never be valid. The same goes for many other platforms.

However, some other platforms are so large and fast moving that the moderation falls into lapse. On those platforms I would encourage you to attempt appealing to moderation before even attempting to consider doxing someone for their actions there.

The only exception to this I would consider is people in a position of authority that you have reason to believe they are abusing based on their posts. This is a different matter altogether. Due to the nature of this site, it is unlikely such material would come up here.

Still, doxxing is a very troublesome ethical gray area. It is an extreme measure, and should not be taken as lightly as it has been lately. I strongly recommend you take some time for deep ethical consideration of your actions before you ever consider to doxx someone.

You are denying someone their right to anonymous speech. In addition to the misuse of it being a social infraction, this is a Pandora's Box that could be used against you and your allies as well, so I recommend strongly against it unless you have exhausted other options for deplatforming.