What is Doxxing?

No, it’s not a spelling mistake. Doxxing is a real word and is now an offence in Singapore.

‘Doxxing’ comes from the abbreviation of the word for documents which is ‘docs’, later altered to ‘dox’. ‘Dropping dox’ means finding personal information or documents about someone and publishing them online. The well-known hacker collective, ‘Anonymous’ popularised the term.

What is doxxing?

Doxxing is a type of online harassment. Information about a person, including their address, job, or real name, is published without their consent. The aim is to bully, intimidate, or harass with the intent to cause harm and even facilitate violence against that person.

From 1 January 2020, doxxing became an offence in Singapore under the Protection from Harassment Act (POHA). This law gives victims of doxxing the right to seek redress from those sharing their personal information online.

Doxxing has become an offence because of the ability of the internet to spread information far and wide, and the rise in online vigilante groups.

The definition of doxxing

Doxxing usually targets one person by publishing information online about them. The offence of doxxing also includes posting personal details about that person’s relatives, friends, or colleagues, with the sole aim of harassing or threatening them.

Whether doxxing has taken place depends on the unique circumstances of each case. Sharing a phone film showing a pedestrian running in front of a car to highlight the dangers of not crossing the road with due care is not doxxing. However, it is doxxing if you share that same footage because you are the driver and angry about narrowly avoiding a near-fatal collision – you identify the pedestrian, encourage people to give them a taste of their own medicine, and publish where they live.

What constitutes personal information?

Personal information includes anything which could be used to identify that person, including text, images, and videos. Personal data can relate to any aspect of the victim’s life, including education, employment, or family.

The Protection from Harassment Act

The POHA has established three specific doxxing offences.

Publishing personal information with the intention to cause harassment, alarm, or distress

Section 3 of the POHA states that a person is guilty of an offence if they publish personal information about a third party or other people related to that third party with the intention of causing harassment, alarm or distress, and that person does experience harassment, alarm, or distress.

The offence extends to harassment and distress felt by the intended victim’s family or colleagues, even though it is not their personal information.

Publishing personal information to cause the fear of violence

Under Section 5 of the POHA, a person is guilty of an offence if they release personal information into the public domain which they intend, know, or have reasonable cause to believe will identify that person and that unlawful violence will be used against them as a result.

A clear example of this is releasing address details or a picture of a known or convicted paedophile who is new to the area, and in the sure and certain knowledge that local vigilantes will take matters into their own hands.

For a conviction to be secured for this offence, the victim must believe that violence will be used against them or their family or colleagues.

Publishing personal information to facilitate the use of violence

The offence of fear of violence under Section 5 can be extended to the actual facilitation of violence, which is also punishable. If a person publishes the personal information of a third party or people related to them while intending, knowing, or having reasonable cause to believe that it is likely to facilitate the use of unlawful violence against that person or any other person, then this is an offence. The offence extends to connections of the intended victim and not just the original party.

Proving doxxing

The required proof depends upon which section of the Act is being used. For a Section 3 offence, the publisher of the information must have intended to cause harassment, alarm, or distress – it can’t be accidental or negligent; there must be genuine intent.

The publisher’s intention is not essential with either of the offences under Section 5 of the Act, as they can still be found guilty if it can be shown that the publisher knew or ought to have known that their actions would cause the particular outcome, that is the fear of violence, or something which would facilitate the use violence against the victim.

Target victim  

The identity of a victim depends upon which offence it is. A Section 3 offence includes people whose information has been published and related people. The same applies to the Section 5 offence, facilitating the use of violence. However, the Section 5 offence relating to the fear of violence concerns only the person whose information has been published, who is put in fear of violence, or believes that violence will be carried out against another person.

Taking action against doxxing

Report to the police

Victims of doxxing can make a report to the local police. If the report is substantiated under Sections 3 or 5 of the POHA, the publisher of the information can face criminal proceedings.

Civil proceedings 

Another option is to commence civil proceedings and claim compensation by way of damages from the publisher. Legal action does not come cheap, so it’s always worth discussing this route carefully with a suitably experienced lawyer. The attraction of civil proceedings is the successful victim can claim financial compensation. That’s not the case with a prosecution under the POHA, which penalises the publisher and offers the victim nothing.

Protection Orders

Victims can apply for a Protection Order (PO) or an Expedited Protection Order (EPO). Orders are tailored to the victim’s requirements and can extend beyond the publisher of the information to the owners of the platforms where the data appears.

The courts can grant an EPO within 48-72 hours of the application, reflecting the seriousness of a risk of or actual violence to the victim. Regular Protection Orders take longer, that being around four weeks on average.

For a PO to be granted, the offender must have committed an offence under either Section 3 or Section 5 of the POHA. The court should believe it to be ‘just and equitable’ to grant a PO considering all the circumstances. It is up to the court to determine how long the PO should remain in effect.

Final thoughts on Doxxing

The ‘new’ offence of doxxing results from a society which spends a lot of its time online, and the capacity offered by the internet to spread personal information to the four corners of the earth at the touch of a button.

The internet also allows people to band together on subjects they are passionate about. Essentially, the digital age has given power to online groups, including self-appointed vigilantes and troublemakers who are able to identify people accurately, publish personal data about them, and use this to intimidate or harass them. Doxxing is an offence which could never have existed before the advent of the world wide web.