Doxing: How online threats spill off the screen

February 17, 2022

Curious to learn more about this topic? Check out Concentric’s upcoming presentation at South by Southwest, “From Virtual to Reality: Gamers’ Security Paradigm Shift in the Physical World.”

Personal information has long been exploitable, but its accessibility and impact have reached new heights as digital records become increasingly prevalent. Whereas private eyes and paparazzi used to go dumpster diving for paper records detailing the intricacies of someone’s life, it takes a little more than an internet connection and a few hours of internet sleuthing to find a person’s name, family connections, contact information, physical address, or other potentially compromising information. This practice of publicly posting private information is called doxing (or doxxing), and it has physical safety implications for average families and high-profile individuals alike.

A brief history of doxing

The term “doxing” is derived from the shorthand for “documents” and refers to publicly posting documents with personally identifiable information. According to The Atlantic, doxing first appeared in the 1990s among early computer hackers as a means of retaliation during online arguments, and it was mostly used to reveal the identity behind anonymous usernames.

Doxing later evolved into orchestrated campaigns, one of the first stemming from anti-abortion activists in 1997 who published a hit list with the personal information of U.S. abortion providers. Doxing achieved a special level of notoriety during a 2014 online harassment campaign known as Gamergate, which targeted female gaming journalists. During Gamergate, multiple women had their addresses leaked, and they were driven out of their homes after receiving death threats. Many of the contributors to the Gamergate trolling also crossed into far-right extremist circles, and they brought their doxing tactics along with them. Now, doxing is a weapon of choice for both sides of the domestic extremist fight. For a moment, doxing even had an air of being state-sanctioned as the FBI solicited help with identifying the January 6 protestors who trespassed on Capitol grounds.

How can this affect you or your loved ones?

Unfortunately, one does not have to be actively involved in the domestic extremism fight or even notably active online to be a victim of doxing. Many individuals simply get caught in the crosshairs or inadvertently provoke the ire of extremists. In one instance, a Montana real estate agent was doxxed and received death threats for several months after giving ill-received advice to a far-right extremist’s mother. Mistaken identities also put families unknowingly at the center of harassment campaigns intended for someone else, often leading to menacing drive-bys and suspicious packages left at doorsteps.

Doxxing compromises the physical safety of its targeted victims by exposing their residences and whereabouts. Nefarious actors can easily use leaked information to attack or harass their targets at places where they should feel the safest. However, experienced doxers do not even require leaked information to track down targets. Through crowdsourcing and Google Maps, one can find the name and address of a user based on a single photo. Doxxing is also closely related to another phenomenon known as swatting, in which a person falsely reports a crime at their intended target’s address. The intent is that an armed response, such as a SWAT team, will be dispatched to the target’s location. Because of the intensity and ambiguity that are inherently a part of these armed responses, swatting has caused fatalities and injuries in the United States. Preventing home addresses from falling into the wrong hands is consequently one of the first lines of defense in combating swatting and other forms of violence.

How can Concentric help mitigate the threat of doxing?

Concentric has helped families protect their online information for years. One way that Concentric mitigates doxing threats is through Concentric360. Concentric360 removes your information from data broker sites that buy, sell, and store your information. Concentric360 also manages your online data and helps limit your reputational risks. Additionally, Concentric specializes in audits and monitoring services where analysts comb social media and the deep and dark web to ensure that your personal information has not been leaked. These services are built around core Concentric strengths to keep you safe, which include:

A Holistic Approach: Concentric works to manage risks everywhere, which includes both cyberspace and the real world. By combining the expertise of several different teams, including cybersecurity teams, physical security teams, and open-source intelligence teams, Concentric protects your family and your information from multiple angles.
Experience: Concentric understands the risk associated with leaked online information because of our experience in digital investigations and research. Having monitored domestic extremist groups for years, Concentric is intimately familiar with favorite sources and tactics used to unveil personal information. Concentric uses that knowledge to check if your family is at risk.
Relationships: Concentric provides tailored advice and services that match the unique needs and circumstances of your family. Whether your family needs a regular review of their digital footprint or needs assistance removing information, Concentric is ready to help.

Regardless of your unique needs, there are several basic recommendations that Concentric advises you take to protect your family from doxing:

Conduct an internet search of yourself: Quickly check to see how much information can be discovered about you. Make sure to also search for yourself using a private browsing window or in incognito mode to get a better idea of what information is publicly available.
Remove old and unused accounts: After you search for yourself, you might discover old blogs or maybe even old wedding registries that contain information personal to you (for example, your maiden name or a marriage date). Take the time to take these sites off the web.
Make all of your accounts private: Adjust the settings on your personal social media accounts so that only approved followers can view your information. Create unique usernames for each platform you are on to make it more difficult for bad actors to piece together information about you.
Delete photos with identifiable features about you: Something as simple as a photo of your unique tattoo or a picture in front of your new home can be exploited to track you down.
Ask your local law enforcement about anti-swatting registries: Some police departments employ an opt-in registry for households worried about becoming victims of swatting, which is especially true for journalists, celebrities, online influencers, or even individuals with stalkers. When enrolled on the registry, 911 operators will inform the emergency teams responding to a call if your address might be at risk of swatting.

If you have been a victim of doxing, contact your local law enforcement. For more information on Concentric’s products and services, please reach out at https://www.concentric.io/contact.

Author: Reilly Andreasen, Intelligence Analyst, Global Intelligence

Sources: