Slashdot Mirror
Ask Slashdot: How Do I Recover From Doxxing?
An anonymous reader writes: I've been doxxed on a popular forum, by one of the moderators no less. The forum owner doesn't care, the hosting company doesn't care. I'm getting bombarded by email and social media, even via GitHub. How does a person recover from this? I don't want to create a whole new identity or shut down all my web sites, social media etc. Can't really change my real name either, at least not without an incredible amount of hassle. The police don't care, and since the forum owner is on the other side of the world it's unlikely there could be any legal consequences, and even if they were they would probably only draw more attention to me. I've tried to clean up Google's search results about me. How do I fix this? What does a fix even look like?
OP said the forum owner was not within the US, so it's a fair guess that the hosting site isn't either. A DCMA request will be met with either a "Aww, how cute. [delete]" - or a new round of "Hey everyone, check out Op's attempt to stop us! Let's get him!"
In either case, a DCMA takedown request has done nothing positive.
If you go to a user page on GitHub, you can report abuse and/or block users.
Even if they are using an alt account, reporting abuse is a good first step because if they create more alts, GitHub may eventually block those, and even the main account if they have one.
On email, mark the sender as spam, for the phone if you can just disable voice mail for a while and whitelist calls.
It's probably just a handful of idiots so if you ignore them and carry on eventually they will tire of getting nothing out of their efforts.
If the moderators of a forum are against you not much you can do except carry on and complain to the web site owners. But do be really sure about what you are complaining about and present evidence of what you are claiming they did.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
More often than not, 'doxxing' is just compiling information that is already available on the internet. People think they've been 'hacked' or 'stalked' but they often forget that they posted the information in some forum/comment section using the same username they use everywhere. I once had a guy ask me to do it to him because he didn't believe that I could. He'd posted 6 times on the forum in question using that username. I was able to identify 2 or 3 other anonymous accounts he'd used on that forum, pictures of not only the exterior but the interior of his house, his real name/social media profile and all the troves of information that provides. It took me about an hour to tease out his data from a woman in Florida. Why? Because he'd mentioned his cats names in one of those 6 posts. That lady in Florida had the same names for her cats, otherwise it was the only thread I needed to pull to unravel exactly who this guy was.
You're not going to be able to wipe stuff off the internet. You need to bury the bad with something good. Here's an article that might help about how the woman whose tasteless joke picture was taken out of context and blown out of proportion got her life back together.
Good luck and God bless.
We don't have a state-run media we have a media-run state.
Questioner here. By publishing my details on this forum they have started off a campaign of harassment. I also have to keep checking Google and bing to make sure I'm not going to be screwed next time I apply for a job, and that it won't stop people contributing to my open source projects.
The worst part is that although I'm not the one doing it, at a casual glance it makes me look childish. Like some 4channer who pissed off other 4channers.
You can't become someone new in real life, but you can become a new person on the Internet, someone nobody cares about anymore. There are probably millions of doxx out there, and nobody has time to SWAT all of them. If your old identity disappears, people will stop caring.
Change your email, create new logins for your forum and social media sites and give the new identity only to people you absolutely trust. And stop going to the forum that doxxed you (or if you insist on being a moron, create a new login).
Two comments: first, this only works if people are interested in you because of who you are on the Internet. If you're somebody in real life, you're screwed, but you can probably get the cops to care. Second, yes, this is totally letting the doxxers win. But once your info's out there, it's not about being right on the Internet, it's about keeping your house from burning down.
It isn't a prank, it's not a joke, it's a serious invasion of your privacy that puts you at real risk of physical and financial harm - not just mental.
You need to hire a lawyer and start suing them. Don't send warning letters and requests, send subpoenas and court orders.
excitingthingstodo.blogspot.com
Serious question. Why?
I always use my real full name. My slashdot account is an exception now (it was my email address back in '97) but my email is real. I don't see the benefit of total anonymity--as a free software developer both as a hobbyist and professional programmer, I don't want to participate in development behind some random handle, I want people to know who they are interacting with both in real life and via email/usenet/forums/bugtrackers/whatever. And vice versa Hiding behind anonymous handles is the exception rather than the rule, and while there are sometimes reasons for it, it's unusual. For whatever subconcious reason, I also tend to prefer to know who I'm dealing with--I'd be more likely to ignore or postpone dealing with a bug report from an anonymous person, for example. For some random unimportant forum it might not matter, but when you're participating in development with others over an extended period (years to decades) it would be a bit weird to be anonymous. While I think "doxxing" sounds like childish bullying, I don't see that hiding my name would help much should someone single me out. If they cared enough, they'd find out anyway.
That said, while my name and email addresses are not kept secret, I do value the privacy of my actual personal details etc., and I wouldn't be amused if they were published, but as mentioned in this discussion, stuff like phone numbers and addresses are "public" if you know where to look. Mine is in the paper phone book and you can look it up online. While it would be nice if idiots didn't abuse this, it's not realistic to keep secret stuff we need to communicate with each other. If you do a google image search for my name, three of the first two rows of images are me; two take you to my work profile page and my work contact details (email, phone, address), the other is my github profile. It would probably only take a few more minutes to work out my home address as well for a determined person. Occasionally I do get people contacting my via all these work details for legitimate purposes. While it would be nice to not have idiots abusing these things, we equally can't wall ourselves off from the world in an isolated bubble.
Regards,
Roger
Yup. I may have G+ profiles under my real name and the name I go under when dealing with internet-stuff. My domains point to PO boxes. Good luck mailing shit to a PO box.
Doxx'ers get their stuff from public Whois first, Phonebooks second, legal records third, and insiders of Verizon/AT&T or other Utility companies. Sometimes even having a cop or someone who works at the DMV in the state is leaking the information.
It's very hard to figure out who leaks your information, thus every time you change physical address, you should change utility providers (gas, internet, electricity, phone, tv/cable) until you figure out which one leaked the information. Unfortunately it's usually the phone companies that do this. Good god, when I first got a landline out here in the city, I was getting a dozen calls per day of telemarketers, that I just stopped answering the phone. My Mobile phone, other than the random "obviously fake same NPA-NXX" calls, I get no calls whatsoever. When I briefly subscribed to the Cable Company's digital phone line... I got no phone calls whatsoever than one day I got a call... from the Phone company trying to sell me on switching to them. What does that tell me? The Cable Company sold a list, or is abusing their LNP database.
So... to the OP...
Your best bet if you really want to get away from this crap is to change your physical name (costs about 300$ here and a lot of document replacement costs thereafter) , physically move, even if it's to another unit in the same building (but better if you move to a different city altogether,) change your mailing addresses on everything to a PO box, if you have a job, get a new one under the new name. Delete your facebook/twitter/linkedin/etc profiles and stay off those sites going forward.
I've actually done all of this after I had a falling out with an insane roommate who is one of those 4-chan types. I needed to disappear just enough that I couldn't be found in Google, but anyone who followed the bread crumbs long enough would only come to old contact information. My cell phone number changed as a result of moving to a different area code, so that wasn't even a possibility for stalkers to find me.
But end result is that I've generally not had to worry about assholes doxx'ing me. At worst, I've had assholes that I sent DMCA requests to attempt to destroy the email address sent from with mailbait + botnet, but jokes on them, that email address is only used to SEND DMCA requests.
Had a friend have the same thing happen from a horri-bad breakup. Said ex was known to go to veteran forums and show "Old Glory" being pissed on with the person's name. Of course, there is a point where going too far will step into felony-hard territory and the popo will start going after IP addresses, which is what happened to the ex once the ex thought their reign of terror was unstoppable.
As for E-mail addresses, thanks to tons of free sites, all it takes is a burner phone (bought anywhere) and an E-mail, and you can Joe-Job someone enough so they lose their employment, even if the employer is doing "where there is smoke, there is fire" CYA.
From what I know, here is what the friend of mine did to mitigate getting doxxed:
1: Do a name change. Joe becomes Joseph. Joe becomes Jose. Teresa becomes Theresa. Slight spelling.
2: Use one's middle name or change it. Jane Charles Doe is different from Jane Doe and Jane C. Doe.
3: As the parent states: physically move, even if it is the same apartment complex.
4: Get an offshore corporation set up in Switzerland or some other place. Set it up so it owns another holding company with you as the physical employee who is authorized to do anything, and this info is classified as an offshore trade secret. Now, move assets to the corporation's name. The corporation's address should be a rental 1 room suite at a local Regus or some other item. This way, someone scanning license plates will find a company owned car, and stuff stops right there. To boot, police tend to do a lot more if a vehicle belonging to "XYZ, llc" has a car set on fire than if Jane Doe reports it. I have learned that a burglary of a business gets a lot more interest than a burglary of a habitation.
5: Trade your car in and have it titled under the corporation. Keep it somewhere secure until you get plates for it (so it isn't obvious to a vandal looking for a vehicle to key or slash tires.)
The biggest problem is that until lawyers get involved, an attacker has free reign even with a restraining order against them (assuming they are not mind-fuckingly stupid). There are whole books devoted to destroying people's lives as vendettas.