Online vigilantes: Is 'doxing' a neighbourhood watch or dangerous witch hunt?

Hackers and others who 'dox' — or poke through internet documents to try to break anonymous identities — have created a conundrum for police. How helpful, and legal, are their actions?

How dangerous is it to out someone's internet identity?

Hackers and others who dox — or poke through internet documents to try to reveal real-life names behind anonymous identities — have been rooting around on the internet for awhile. (Reuters)

When the internet hacking group Anonymous claimed — wrongly, it seems — to have found the main anonymous online tormentor of B.C. teen Amanda Todd, before she took her own life, it was relying on information it found by what's called doxing.

Hackers and others who "dox" — or poke through internet documents to try to reveal real-life names behind anonymous identities — have been rooting around on the internet for a while.

'At its worst, it could be a kind of vigilantism.'—David Murakami Wood

In the real world, though, this kind of online sleuthing has created something of a conundrum for police forces and others.

The main concern being: are these actions the internet equivalent of a helpful Neighbourhood Watch, or do they run the risk of becoming an online witch hunt, with the particularly worrying potential of causing harm if they turn out to be wrong?

"At its worst, it could be a kind of vigilantism," says David Murakami Wood, associate professor in surveillance studies at Queen's University in Kingston, Ont.

"It could be the return of the posse and those kinds of things, and you can imagine there are very bad versions of this."

But what if doxing could provide a helpful tip in a police investigation, or shed light on the identity of someone whose online actions, behind the cloak of anonymity, seem quite abhorrent?

"In some cases," says Murakami Wood, "you or I would approve of what's being done." 

Range of sources

In the Amanda Todd case, internet data gathered by Anonymous was posted on a social media clipboard. Under a title "Amanda Todd's Punisher," viewers could find a name, an online user name, a location in New Westminster, B.C., and a year of birth.

Only trouble was the man the data pointed to had nothing to do with the Todd case, police said later.

Clues doxers can use lie in all sorts of online sources, ranging from Facebook pages to comment boards. Sometimes something in one place can be linked to something somewhere else. For those who are into it, it can be like an online treasure hunt.

People "may not reveal something on the one particular forum but on the other one they may reveal something that can be triangulated with other information they've given in another identity," says Murakami Wood.

"So those kinds of clues can be put together. It's like any other kind of detective work or forensic work in a way."

And it's really not that hard. In fact, most of what can be gleaned can be achieved with a minimum amount of technical knowledge, people in the field say.

The RCMP declined a request for an interview about doxing, pointing instead to its website in B.C., where a news release addressed the thousands of tips they were reviewing in the Todd case, and noted that online rumours were causing delays in the investigation.

'Everything we can'

"We are doing everything we can as quickly as we can. And we want to acknowledge the role of the public in submitting information," said Sgt. Peter Thiessen.

"But we want to urge everyone who has been touched by Amanda's story to respect Amanda's memory by being a responsible citizen of the internet and thinking critically about information received online before passing it along."

In that comment, police acknowledge a significant fact about policing: the need for help from the public in solving crime, whether in the real or online world

"Very much like the internet, the public police are not capable of singlehandedly producing order, preventing crime or even responding to crime without citizen input in the real world," says Michael Kempa, associate professor of criminology at the University of Ottawa and a Munk fellow of global journalism.

There are some specific reasons for that.

"The biggest one is a lot of space in which crime and inappropriate conduct takes place in the real world is not openly accessible to the police," says Kempa.

It's happening on private property, and police can't just go in willy-nilly, just as they can't gain automatic entry to a person's private online activities.

"Police need a reason to access your information just as they need a reason to enter your house, but also technically it's very difficult for police to penetrate a lot of internet space," says Kempa.

So what is acceptable?

So police are dependent on everyone from citizens to ISP providers to victims when they're trying to deal with anything nefarious online.

"It's impossible [for police] to keep up an unremitting watch over collective goings-on on the internet. If you can't do it in a city, you certainly can't do it on the internet," says Kempa, adding, "The trick will be that the public has to put pressure on itself to make sure the input is the right kind, [that] it doesn't slip into vigilantism."

In some ways, the online world has already started to evolve its own methods for determining what is generally acceptable.

Gawker, a media gossip blog, recently revealed the real-life name of a man known on the link-sharing community of Reddit as "Violentacrez." Among the sexually suggestive content he seemed to favour, Violentacrez liked to post pictures of underage girls or have people upload pictures of women taken without their knowledge.

In that case, says Murakami Wood, it's difficult to argue that Violentacrez, who has now given interviews under his real name, Michael Brutsch, a 49-year-old Texan, was actually having his free speech impinged by being identified.

"What these cases are showing is there is a limit, and it’s not just a question of completely unbridled freedom of speech or unbridled privacy, that there are limits and these limits, if you like, are being created right now through these cases."

But what if it's wrong?

But in Violentacrez's case, the identification was right. What if, like in the Todd case, the identification is wrong?

"One of the problems with sort of vigilante action or actions taken by organizations that aren't accountable to anybody else is that there's no method of holding those organizations to account," says Murakami Wood.

Kempa says it's going to be up to society "to keep a lid on the appropriate assistance" that flows to police and others acting in the public interest.

"This is a debate that's going to come a lot more in society," he says. And it's unlikely to find an easy answer any time soon.