I would think the obvious answer here is no, but...

Recently certain American politicians have been circulating some unsubstantiated doxxing information alleging to out a whistleblower. This has led to some posts on SE which repeat this doxing information.

I've been flagging these posts, but the response from moderators has been a mixed bag.

  • In one case, the edit which added the information was rolled back and the edit history was redacted.

  • In another case from the last 24 hours, the post was edited to remove the information and the edit history was not redacted.

  • In another case from the last 24 hours, the flag was declined arguing that it has already been posted by other sources so it's fine now (quote redacted because it too has the name for some reason).

The identity of REDACTED was already leaked by several other sources. Not saying that this was an ethic thing to do, but by now it is pretty pointless to try to keep the identity hidden.

This seems like the sort of thing which might have legal ramification for Stack Exchange. Is there an official policy on such a thing?

UPDATE: After re-flagging the declined flag with a link to this post, this was the borderline-rude response (name redacted, typos preserved):

Like it or not, but REDACTED has now become a public person. The genie is out of the bottle, and pretending otherwise is just ridiculous. Complain to the people who deanonymized him publically.

We might need an official response from SE to clear this up.

UPDATE 2: There's even a self-answered Q&A dedicated to posting this doxxing information now...


6 Answers 6


Likely covered by existing policy in the form of the Acceptable Use Policy? (Some emphasis mine.)

Identity Theft and Privacy. Users that misleadingly appropriate the identity of another person are not permitted. Users may not post other people's personally identifying or confidential information, including but not limited to credit card numbers, Social Security Numbers, and driver's and other license numbers. You may not post information such as other people's passwords, usernames, phone numbers, addresses and e-mail addresses unless already publicly accessible on the Web.

Considering that "The Whistleblower" has been protected up to this point with the highest levels of confidentiality (despite attempts by others to name them), I would presume that any post which corroborates or attempts to identify them would be in acute violation of this policy.

Doxxing in general would easily be covered by this since that information is probably inappropriate to display or send out on the site in most every context.

It could also be covered by the below:

Hate Content, Defamation, and Libel. Hate speech and other objectionable content that is unlawful, defamatory, and fraudulent. Note that an allegation of defamatory expression, in and of itself, does not establish defamation. The truth or falsehood of a bit of expression is a key element in establishing defamation, and we are not in a position to make that sort of fact-based judgment. That said, if we have reason to believe that a particular statement is defamatory (a court order, for example), we will remove that statement.

  • 2
    Good find! I guess the help center wasn't the right place to search. Jan 31, 2020 at 19:53
  • 21
    It's funny how when one wants to find legal policy and guidelines that the help center isn't the right place for it...that's definitely a new one for me.
    – Makoto
    Jan 31, 2020 at 19:54
  • 6
    The whistleblower hasn't been protected with the highest levels of confidentiality. It's been an open secret for weeks, if not months. Also, note that "name" is not on the list of protected information. Also note that the policy says "unless already publicly accessible on the web"... which it is. Feb 2, 2020 at 7:19
  • Wouldn't this be a criminal act in many countries as well?
    – Mast
    Feb 2, 2020 at 11:24
  • 4
    You say that "Considering that "The Whistleblower" has been protected up to this point with the highest levels of confidentiality (despite attempts by others to name them)." This is manifestly false. The alleged whistleblower's name has been mentioned on national television (several times), tweeted by the president and various politicians, and is available on many websites (albeit of a mostly conspiratorial bent). If there is someone who doesn't know it now, it's because they don't care to.
    – Adamant
    Feb 3, 2020 at 7:33
  • 3
    @Adamant: To be fair, all we have is a name. We don't know if that name is the whistleblower until it's actually confirmed by someone with intimate and close knowledge of the situation, hopefully duly corroborated by reputable news sources. So...I suppose I won't disagree that the whistleblower hasn't been protected. However, the point of all of this comes back to whether or not naming that person here would or would not be against policy. Since the main point of naming this person is to defame them, I really do feel like the Acceptable Use Policy is explicit enough here.
    – Makoto
    Feb 3, 2020 at 8:05
  • 1
    @Makoto - Rand Paul may feel that it's defamation. That doesn't make it defamation when he does it, never mind when other people use their name. As to not knowing whether they are the whistleblower...Trump and Paul's fixation on them suggests to me that it is highly likely.
    – Adamant
    Feb 3, 2020 at 8:07
  • 3
    @Adamant: Look at it from this angle. Why name them at all? Does the quote require that you cite it verbatim? One could justify a redaction of that piece of information and leave a link to somewhere reputable for a follow-up if it's required. We get an opportunity to exercise some common sense - I'd recommend we do so. If we don't have to do something controversial, let's just... not.
    – Makoto
    Feb 3, 2020 at 8:08
  • 3
    @Makoto - Common suggest suggests that refusing to talk about widely known information will only get less and less sensible and more and more unproductive as time goes on. In addition, yes, the name of the person who helped bring about one of the most noteworthy events of our time, and who is regularly the object of the rants of the US president, is quite relevant. And not being controversial isn't a great ethical or legal strategy.
    – Adamant
    Feb 3, 2020 at 8:09

No, but I am unsure that this qualifies as doxxing.

Although this answer argues that posting the name of the purported whistleblower is not acceptable or advisable, I'm going to argue differently. I think the Acceptable Use policy leads to precisely the opposite conclusion, and that even from a broader perspective there's little reason to omit the information.

First, let's look at the section of the Acceptable Use policy mentioned previously:

Identity Theft and Privacy. Users that misleadingly appropriate the identity of another person are not permitted. Users may not post other people's personally identifying or confidential information, including but not limited to credit card numbers, Social Security Numbers, and driver's and other license numbers. You may not post information such as other people's passwords, usernames, phone numbers, addresses and e-mail addresses unless already publicly accessible on the Web.

I think we can discard the notion that "personally identifying" information is meant to cover publicly available names. For instance, if I say that Mark Felt was probably Deep Throat, or that Individual One is likely Donald Trump, that is not a violation of the policy since these individuals' names are widely known. In other words, the confidentiality portion is important.

However, contrary to what the other answer argues, the name of the whistleblower has not been "protected with the highest levels of confidentiality (despite attempts by others to name them)." On the contrary, their name has been 1) tweeted by the president of the United States, 2) tweeted by the US Senator, 3) bandied about on live TV, and is 4) currently visible on, by my count, at least 160 webpages (The search results said over 100,000, but when I went through there were far fewer. Perhaps this reflects aggregation of domains with a huge number of mentions).

The "confidentiality" mentioned here mainly consists of various major news outlets declining to use the name in their stories, due primarily to their own specific journalistic codes of ethics. The majority of people who don't know the name of the purported whistleblower don't know because they have chosen not to go to the mainly dodgy far-right sites where the name is mentioned extremely regularly.

And this brings us to the second half of the acceptable use policy, which implies that if otherwise personal information is "publicly accessible on the web", it is acceptable to post, even passwords and usernames! The unavoidable fact is that, with over 100 websites giving the name of the alleged whistleblower, it is very much publicly accessible on the web, and is only likely to become more accessible. Although the sites that mention this person's name are, to my estimation, primarily far-right or conspiratorial sites, this is not a universal characterization: the Dallas Morning News, with a somewhat conservative but highly anti-Trump editorial board, also has an article that mentions their name, for instance. This information is also now available on CSPAN and in the Congressional Record. It is emphatically no longer private in any colloquial sense.

In short, based on the demonstrable fact that the name of the alleged whistleblower is publicly accessible on the web and has been mentioned by politicians on Twitter and in person to literally hundreds of thousands or millions of people, I think this does not fall into the category of confidential information as classified by the Acceptable Use policy.

We also need to consider the portion about defamation. That portion says:

Hate Content, Defamation, and Libel. Hate speech and other objectionable content that is unlawful, defamatory, and fraudulent. Note that an allegation of defamatory expression, in and of itself, does not establish defamation. The truth or falsehood of a bit of expression is a key element in establishing defamation, and we are not in a position to make that sort of fact-based judgment. That said, if we have reason to believe that a particular statement is defamatory (a court order, for example), we will remove that statement.

It's clear from this merely alleging that a statement (say, Rand Paul's tweet about the purported whistleblower) is defamatory is not sufficient. Even if I feel it is, or even if the whistleblower themself does, the policy emphasizes that this, by itself, is not enough to prevent any mention of the statement, in the absence of a court order. Further, in line with the US legal notion that truth is an absolute defense to an accusation of defamation, the Acceptable Use policy requires that the statement be fraudulent. Thus, in what I consider the quite probable case that the purported whistleblower is in fact the actual whistleblower, this would not constitute defamation under SE's policy. Moreover, even if a tweet or article by another person could be defamatory, merely noting their allegation would not necessarily be defamatory under US law, which is most likely to apply to SE posts.

In conclusion, I doubt the defamation portion of the Acceptable Use policy requires its removal.

Of course, the acceptable use policy is only one aspect. We should also consider whether it's ethical to post the information. On the one hand, we need to consider the possibility that mentioning the name of the purported whistleblower could lead to a risk to their safety. I consider this implausible. First, the government officials who are clearly motivated to retaliate against them are clearly well aware of who they are. Second, the much larger but much less motivated group of potentially dangerous far-right followers of Trump are also well aware of their identity, because their version of newspapers like the New York Times are conspiracy sites like The Blaze, which have had few scruples about sharing the name of the alleged whistleblower.

On the other hand, we have the fact that a person who has divulged information that led to the impeachment is inherently newsworthy. See the aforementioned Deep Throat. In addition, there's a possibility of a Streisand Effect, whereby the paucity of information about a fact increases its popularity: even, in this case, potentially driving people to highly unreliable news sources due to the relative absence of the information from trustworthy ones.

To summarize, I think mentioning their name contributes little if at all to informing the people who would threaten them, and promotes the cause of providing the public with trustworthy information about newsworthy events. It's also quite unlikely that this constitutes defamation according to the SE policy. In conjunction with the idea that the Acceptable Use policy does not prohibit divulging their name, I think it is acceptable to include in an answer.

  • I thought Makoto's argument from the AUP was, well, arguable. And if we're disagreeing, I think it's a bit desperate for us to try to argue on the AUP. It's mostly for the company. Hence why I answered pointing to "doxxing" as a technique for harassment and threats, instead. I see Makoto's argument has been preferred [edit: compared to my argument] by the voters :-). If it's controversial / ambiguous whether there is a risk, I believe we should favour the side of caution.
    – sourcejedi
    Feb 3, 2020 at 22:11
  • 2
    @sourcejedi - They posted their answer several days before I did, when there was also more activity on this question. I don't doubt that it's a more popular opinion, but perhaps not by as much as it seems.
    – Adamant
    Feb 3, 2020 at 22:12
  • 1
    At this point, I can sympathize if mods would begrudge being asked to redact edit history (or being asked to provide careful edits, as opposed to making delete/undelete judgments). But I think we should be concerned about the idea of SE being in that pretty dubious set of public search results, directly spreading the name(s).
    – sourcejedi
    Feb 3, 2020 at 23:00

In another case from the last 24 hours, the flag was declined arguing that it has already been posted by other sources so it's fine now (quote redacted because it too has the name for some reason).

It's a very difficult situation. Since the quote applies to one of my posts, I'll elaborate on the dilemma.

In my answer, I quote a politician's tweet which is directly related to the question. A question which is about that politician and why he has been assumed (by the media) to have done something to make that name public.

The dilemma here is simple. On the one hand, the tweet has direct relevance with respect to the question, but also with respect to this politician's broader conduct in this matter. On the other hand, many people find it inappropriate to spread this name.

The obvious solution would be not to reference the tweet, because it contains inappropriate text. That solution isn't ideal, because bad faith actors could abuse that system: insert these key words so they won't be scrutinized by people who take the issue in your question seriously while allowing the messages to spread on the internet for all who don't take the issue seriously.

Also, merely censoring the name while linking the tweet is pretty pointless. It allows one to see the name when clicking on the link.

It is also my understanding that while inappropriate, the naming of this person is not illegal. Naming this person (allegedly, a whistleblower in the US) is not illegal. Whistleblowers do not have a statutory right to anonymity. There are protections, but they seem to apply to the relevant Inspector General and the employer, not to others.

That said, the site, like congressional committees, can choose not to have their platform used to spread these names. For that to work, I agree that Stack Exchange should make a clear statement on what they allow on their platform. While others have cited rules from the code of conduct, they don't have the nuance on where the line is.

For example, is quoting a tweet allowed if the offending name is censored in the quote, but still available from the link? Or can politicians choose to avoid scrutiny on sites like Politics by adding inappropriate key words in their messages?

  • 19
    The only reason that the person is being named at all is to harass, defame and/or discredit them. There would be no other incentive to do so otherwise, which would mean it neatly falls in the scope of the Acceptable Use policy.
    – Makoto
    Feb 2, 2020 at 0:42
  • 4
    @Makoto yes, but that doesn't take away the other side of the dilemma. What do you propose as a matter of dealing with this specific case? Cite the tweet verbatim? Cite it with the name redacted? Not link the tweet at all? Or maybe even a step further, maybe we shouldn't name the politician at all, because then it's just one step to their Twitter account. And while I agree with you, be careful with those comments. One may construe that as saying everyone who asks for the name to be public or their testimony is acting in bad faith. That might be taken as discrediting political groups.
    – JJJ
    Feb 2, 2020 at 1:03
  • 13
    Personally I would probably take a screenshot of the tweet and black out the name. Also it's worth noting just because something might not be illegal, doesn't mean it's permitted by SE policy. Feb 2, 2020 at 1:11
  • 1
    I mean, if you absolutely had to cite it @JJforPopcornandMonica, then ideally you'd want to do so in a way that also followed the policies here. It's still very much the case that just because something's not illegal doesn't mean it's not also against site policy.
    – Makoto
    Feb 2, 2020 at 1:12
  • @AlexanderO'Mara yea that's good idea. I think you should post that as answer if you don't get a response from the company. :)
    – JJJ
    Feb 2, 2020 at 1:13
  • 4
    @Makoto but it's not clear that it is against the site policy. Objectionable content is a relative term. I've even seen it coming from our friends in charge of the company. Very similar actually, without vilifying a person without evidence, throwing them under the bus and opting for legal action rather than admitting they were in the wrong. With that in mind, I also doubt you'll get an official response here.
    – JJJ
    Feb 2, 2020 at 1:16
  • 1
    The US networks (including IT platforms such as SE) seem to be voluntarily hiding the whistleblower's name.
    – Richard
    Feb 2, 2020 at 10:21
  • 1
    If you just need a citation to evidence a detail like "[The politician re-tweeted someones] Twitter post [that] prominently named the alleged whistleblower and suggested that he had committed perjury", it's possible to find citations from sources which are generally reliable for citing simple facts, do not provide the whistleblowers name, do not provide a simply clickable link to find the name, and at least have some practice in not being seen to reveal more than they intended.
    – sourcejedi
    Feb 2, 2020 at 10:31
  • 1
    @sourcejedi in this case the question was about a senator whose question was not read aloud by the Chief Justice. The media said it was because it named someone as the whistleblower but the question I answered was asking what they were basing their reports on, what evidence there is.
    – JJJ
    Feb 2, 2020 at 10:53

This is a classic example of a Loaded question or Begging the question: OP presupposes that revealing the whistleblower's name is doxxing, rather than opening it up for debate. Therefore this question can only be answered in two parts.

No, it is not acceptable if it's actual doxxing

The definition of doxxing from Wiki is:

Doxing, or doxxing (from "dox", abbreviation of documents), is the Internet-based practice of researching and broadcasting private or identifying information (especially personally identifying information) about an individual or organization.

Looking up someone's Facebook to find their address and post it online is a clear example of doxxing. Outing someone who uses a pseudonym online is doxxing. Hacking someone's mailbox to find out the identities of the people they correspond with is doxxing.

Yes, it is fully acceptable in the case of the alleged whistleblower

Sharing the contents of the US President's tweets is definitely not a form of doxxing, as by that time the message has been read by tens of millions of people around the world. And at this point the alleged whistleblower has indeed been directly named by Trump, as well as dozens of other prominent politicians. It doesn't matter if the alleged whistleblower is threatened by others having had revealed his identity - at this point it is far too late for StackExchange to help by censoring his name.

Finally, don't forget about the Streisand effect - forcing others to censor their speech only makes it more attractive for others to share it. I didn't care about the alleged whistleblower up until I found out its being censored and then it took me 30 seconds on Google to find the answer. Whoever wants to know will know, so why keep up the charade?

  • Downvoters care to explain? Feb 8, 2020 at 2:38

Code of Conduct - Stack Exchange

[...] No harassment. This includes, but isn’t limited to: bullying, intimidation, [...], direct or indirect threats [...]

"Obvious" cases of "doxxing" must be covered under harassment. It would make no sense to exclude "doxxing" from this definition.

From the first article I found about these claims - it takes care to avoid repeating the name - it sounds like they are part of a campaign of threats and general harassment, including from the most powerful position.

This was recent; the campaign is probably still going on. For the sake of those affected, I hope this case is relatively simple. If so, we can still treat it as a violation, and try to follow positive examples like the article linked above.

At some point the harassment and threats will decrease. By the time this is history, I guess it will not be practical to enforce my answer :-). But at this time, apparently we are dealing with several posts "in Stack Overflow which [...] attempts to make them look like programming answers". I am very suspicious about the attempts to spread this information here.

Trump accused the whistleblower's sources of being “close to a spy”, adding, “you know what we used to do in the old days when we were smart? Right? With spies and treason, right? We used to handle them a little differently than we do now” [...]

The Post “has long respected the right of whistleblowers to report wrongdoing in confidence, which protects them against retaliation. We also withhold identities or other facts when we believe that publication would put an individual at risk. Both of those considerations apply in this case”. [...]

The whistleblower, who is reportedly still at his job, is driven to and from work by armed security officers when threats are elevated. Threats against him seem to spike whenever Mr Trump tweets about him, The Post has previously reported.

Relevant concepts:

Some efforts to publicize the supposed name of the whistleblower may claim a legitimate reason to discuss this specific person. There isn't one, because the whistleblowing details were since corroborated. Including by the White House itself. I refer to "The Whistleblowers and the Text Messages" section at https://www.2016activemeasures.org/ukraine - it provides news sources for these claims. The reason to publicize the name is vengeance, to discourage whistleblowing.

Or if that's over-simplifying, another driving reason is to draw attention. This is an unfortunate thing to do, after starting a campaign of harassment.

Sometimes people quote or link a racist troll, setting their idea in full context to defuse it. This has high stakes and must be handled with care. You cannot entirely avoid further propagating the idea, and rewarding the racist by sending more people to read their full output. Harassment campaigns are the same.

We have a site dedicated to "challenging unreferenced notable claims". Hopefully they have good discussions about problems like this on their meta site. Hopefully, the answer I wrote from outside that site will be useful to some other outsiders :-).


Here it is completely unacceptable, as with most other platforms. I will get into why later.

However, as a whole ethically the issue becomes more complicated.

The right to anonymous speech should be respected to a point.

The ethical question really is if the person's actions you are stripping them of their anonymous nature for is considered speech.

Targeted harassment, making threats and advocating genocide have not traditionally been considered "speech" so much as criminal actions or social infractions, depending on degree. They are traditionally not protected speech which it is generally a social infraction to oppress in public forum, and generally a crime for governments to oppress.

Hence, denying the person from being able to do these things anonymously is reasonably ethical. This amounts to denying an anonymous platform.

Still, certain information is inappropriate to publish even in these cases. This is where I think people doxxing go too far. Often only the minimum amount of information needed to hold a person accountable for their misdeeds is necessary.

Information that can enable identity theft, such as Social Security numbers, should never be published, nor should private contact information that would enable someone to personally harass the individual.

Additional information that should never be considered a valid to release are certain personal details that may endanger their life, may subject them to harassment or are unrelated to their actions in any way.

As of why here is obviously not a valid to doxx someone, the moderators here do a good job that anything that would warrant doxing someone is not permitted, hence doxxing someone's handle on this platform would never be valid. The same goes for many other platforms.

However, some other platforms are so large and fast moving that the moderation falls into lapse. On those platforms I would encourage you to attempt appealing to moderation before even attempting to consider doxing someone for their actions there.

The only exception to this I would consider is people in a position of authority that you have reason to believe they are abusing based on their posts. This is a different matter altogether. Due to the nature of this site, it is unlikely such material would come up here.

Still, doxxing is a very troublesome ethical gray area. It is an extreme measure, and should not be taken as lightly as it has been lately. I strongly recommend you take some time for deep ethical consideration of your actions before you ever consider to doxx someone.

You are denying someone their right to anonymous speech. In addition to the misuse of it being a social infraction, this is a Pandora's Box that could be used against you and your allies as well, so I recommend strongly against it unless you have exhausted other options for deplatforming.

  • 3
    This answer doesn't actually add anything new...
    – Makoto
    Feb 2, 2020 at 0:38
  • 3
    Also, "Targeted harassment and advocating genocide have not traditionally been considered "speech" - the latter depends on the jurisdiction.
    – Adamant
    Feb 3, 2020 at 7:35
  • I have not seen my points stated elsewhere in the conversation. As of advocating genocide, traditionally it falls under hate speech, which is not protected by free speech protections in any country that has such protections, including the US, last I checked. If you know of a nation that protects it, I'd gladly hear it. Yes, in the US the while it isn't protected, the Jury is still out on what is considered hate speech and genocide, as well as who can take action against it. (Traditionally the government cannot unless another crime has been committed such as harassment.) Feb 4, 2020 at 2:05
  • 3
    In the US there is a VERY strong difference between actions by the government and actions by individuals. The government is traditionally not permitted to prosecute people based on speech alone, unless that speech is a real and viable threat or targeted harassment. That is not to say that the Government doesn't have a long history of violating these constitutional provisions. Feb 4, 2020 at 2:10
  • p.s. Thank Peter Mortensen for the proofread. Feb 4, 2020 at 2:14
  • Hate speech is not only speech in the US (self-evidently), it is also protected speech, which means precisely that, as you say, the government cannot prosecute it. However, I don't quite understand what you mean by "actions by individuals". I suppose you mean civil suits. These can indeed be used to seek damages for hate speech within the general framework of defamation law. However, the amount of the damages will be limited to whatever concrete harm can be demonstrated from the defamatory allegations, which is generally next to impossible.
    – Adamant
    Feb 4, 2020 at 4:20
  • Actions by individuals are by something like a group refusing to give a person a platform for their hate speech. Nobody is obligated to give a platform to a person's speech. Also, like I said clearly, several things go beyond hate speech, such as threats of violence, and targeted harassment. These things have been deemed not protected speech. Feb 4, 2020 at 5:50
  • Threats of violence are indeed illegal in the US, but under certain circumstances. Generally speaking, it's when they're criminal threats (e.g. they are specific enough to put reasonable people in fear for their immediate safety or that of others) or harassment (directed at an individual, usually requiring either a pattern of behavior or specific intent) or of course defamation (criminal in some but not all states). Because advocating for genocide doesn't usually fall into these categories, it is legal, which is why it is not too hard to find people calling for the genocide of Jews etc.
    – Adamant
    Feb 4, 2020 at 8:26
  • Of course, there are circumstances where advocating genocide would be encompassed in the preceding categories. For instance, if you repeatedly send someone unwanted emails about how a group should be exterminated, harassment would probably cover it. If you get your neo-Nazi friends together and hold a rally outside a black church or a synagogue and tell them that those groups should be killed, there would be a credible criminal threat case. If you say that a group needs to be killed because specific members thereof have committed crimes, and they haven't committed crimes, that's defamation.
    – Adamant
    Feb 4, 2020 at 8:28
  • A non-genocide example of criminal threat for further clarity might be Trump saying that someone should rough up the reporters at his rallies. I expect if he weren't president, there'd be a plausible criminal threat case there based on the reasonable expectation of reporters that his supporters will heed his words and attack them. Oh, and we shouldn't forget assault, which has similar criteria to criminal threat in many cases.
    – Adamant
    Feb 4, 2020 at 8:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .