Exactly what obligation does Brian Krebs have to maintain the anonymity of random people on the Internet?
“Sharing someone’s private information online without their permission, sometimes called doxxing, is a breach of their privacy and of the Twitter Rules. Sharing private information can pose serious safety and security risks for those affected and can lead to physical, emotional, and financial hardship.”
Sometimes those relationships are quite broad! For instance: on HN, it is generally verboten to out people. That's a rule we've adopted to maintain civil discourse on the site, and something we agree to when we decide to participate here. But HN has lots of rules that are not in fact rules in the real world; for instance, 'pvg regularly chides 'dang for enforcing the HN's idiosyncratic (but good) rule about not putting quotation marks around paraphrases of other people's comments.
Does any such circumstance apply here? The professional ethics rules of journalism have more the opposite directionality, cautioning journalists against maintaining anonymity of sources to the detriment of the readership.
I’ll take that as an agreement that it wasn’t nice then?
Regardless, I don’t think I said anywhere that he had an obligation to be nice, only that his comments were a violation of Twitter’s TOS. Which presumably he does have an obligation to follow since he’s using their platform.
> The professional ethics rules of journalism have more the opposite directionality, cautioning journalists against maintaining anonymity of sources to the detriment of the readership.
Krebs is not posting their names and location as a journalistic act, he’s posting them to serve as retribution for speaking badly about something he has a personal involvement in. I don’t know what the professional ethics rules of journalism say about that, but I think it’s something most people would agree is pretty shitty.
While it’s a debatable point, it’s most certainly not “plainly false” that he violated the TOS; Twitter would be well within bounds to take action against his account.
I've stopped reading his blog and tweets, and he went way, way, way down in estimation after this.
What obligation does anyone have to behave well?
2. Linked article is poorly written and unclear as to what actually happened and the context. If I'm reading it correctly it looks like everyone was using a real name associated with their online work anyway.
3. In any case mentioning someone's name and town in a Twitter fight is a world away from systematically organizing armed SWAT police calls to journalist's homes, physically threatening them or have them falsely arrested because they write about white supremacists and terrorism.
Then the bad person hacks their icloud and dropbox and releases their private pictures and videos, the naughtier the better.
And yes, all of that happened recently in Germany mostly to some prominent politicians, who also use their own names in public really often.
Now, Krebs doxed people in the past who didn't want their true identities revealed. Often because those people were up to no good, but sometimes Krebs went a bit overboard in my opinion.
More in general, and I am not saying Krebs ever did this, there are valid reasons why people might not want their true identities widely revealed. Think whistleblowers, some critical journalists, etc.
A more general definition of doxing would be "publish personal information that the people to whom this information belongs did not give consent to publish". As such, I don't see doxing as generally evil, it depends on the kind of information and context. Out a criminal? OK. Out a journalist? Probably not OK.
And he doesn't just rely on public sources:
> KrebsOnSecurity uncovered strong evidence to support a similar conclusion. In 2010, this author received a massive data dump from a source that had hacked into or otherwise absconded with more than four years of email records from ChronoPay — at the time a major Russian online payment provider whose CEO and co-founders were the chief subjects of my 2014 book, Spam Nation: The Inside Story of Organized Cybercrime.
> Querying those records on Yalishanda’s primary email address — stas_vl@mail.ru — reveal that this individual in 2010 sought payment processing services from ChronoPay for a business he was running which sold counterfeit designer watches.
And he posted a copy of the guy's passport!
0) https://krebsonsecurity.com/2019/07/meet-the-worlds-biggest-...
> ... you mean "reports", which is what reporters do ...
So this doxx site just reports on people, no?
The distinction between him and the doxx site he writes about is subtle.
Also, "semi-routinely break actual laws" is a huge bin. Reporters also get sued for libel. And sometimes lose.
Edit: And hey, once you're "break[ing] actual laws", you're a criminal. And by Krebs' standard, you're fair game.
But for what it's worth, I'll briefly clarify my position. I'm rather anarchistic, but not very collectivist or communitarian. I believe that we're all free to do what we like, consistent with our principals and values. Notwithstanding whatever laws exist. And that includes self defense, and weeding out troublemakers.
So in that sense, I agree that Krebs has the right to doxx supposed criminals. But I also believe that others arguably have the right to act against those who attack them. And of course, everyone else has the right to act against those who attack them, recursively.
So it's fair to root for Krebs, and to attack neofascist doxxers. But, in my opinion, it's deceptive to argue that one is moral, and the other is evil.
I'm not asking why it would violate a norm to post home addresses or phone numbers; it's clear to me why that's problematic.
I'm asking what obligation Krebs has to pretend he doesn't know who a Twitter user is, when that information is available to anyone who knows how to consult public sources to find it. Why is Krebs obligated to help someone remain pseudonymous? It seems clear to me that he is not.
That isn't an excuse for compiling this information and publishing it as wide a possible. You still have to consider the implications if you want to act morally and in good faith.
Think of the stupid pseudonymous twitter user who made a really abhorrent, ill-considered joke and the people used "public information from public sources" to first get to their real identity and then crawl further until they find their employer and get the person fired. The person who did the research and then started the witchburning by publishing the information so that every other bored twitter user could write easily write a mean email to the employer should have considered what compiling and publicizing that dox could do.
Also, I think Krebs does take this into consideration, and is generally acting in good faith and with consideration, it's just that I disagree with his conclusion sometimes.
If he's posting home phone numbers or addresses, I'm clear on what the problem is. But if you have a public LinkedIn profile and don't have the OPSEC to keep public sources from linking your secret Twitter handle to that profile, I don't see any problem at all.
Dox some criminal? OK, but you have to be sure your allegations have merit and you've done your due diligence[0]. This is mostly what Krebs does.
Dox some politician who had an extramarital affair? Maybe OK. Dox their extramarital partner? Probably not OK.
Dox the latest terrorist? Generally OK. Dox every person that ever came into contact with the terrorist? Not OK. Publish personal information about the victims of the terrorist without their (next of kin's) consent? Not OK, even if you only report information you got from their facebook.
Dox some kid who misbehaved once on the internet, thereby directing an army of assholes on twitter to take notice, dox the kid further and bully them? Not OK.
When I was young (pre-facebook era), one of my teachers got murdered; her husband was later convicted. Some (tabloid) journalists showed up like locusts camping around our school, offering money for our pictures and other private information about the victim, her husband and their kids. Not OK. The same journalists also found "public information from open sources" about e.g. the kids' memberships in youth groups and such, and published that and also went to those youth groups for more information like they did at our school. Not OK.
[0] There was more than one case where "helpful" people on the internet and sometimes journalists published the names of alleged criminals who turned out to be entirely innocent, which didn't stop people from bullying them or even neighbors from forming mobs to "visit" them at home.
We do not agree about the particulars. For instance: the extramarital partners of politicians? To me, fair game. Kids who commit crimes on the Internet? To me, fair game.
Counterexamples? Sure. Undocumented immigrants who could be forcibly deported. I have a special obligation not to help ICE find those people. Iranian democracy activists. I have a special obligation not to subvert advocacy for democracy in authoritarian regimes.
But I don't have a general obligation to help maintain someone's pseudonymity, nor does anyone have the general right to restrain my own speech to protect their pseudonymity.
I understand that the rule exists on Reddit, and, to a lesser extent, here. And I respect the rule... on Reddit. And here. But in real life? I have a problem with message board norms leaking into the real world.
I knew somebody, part of our gang of friends, who had a one night stand with a local "personality", was then revealed by some "journalist" only giving a the first name and printing a picture with a black bar across the eyes (which is still more than enough for people who knew him to identify him, of course), outed as gay in the process, didn't even know the other dude was married or a "personality", and after being shunned and bullied by a lot of people including his parents and grandparents ended up hanging himself in a tree near the place in the woods where our gang used to barbecue in the summers. At least his parents showed up for his funeral.
I have no doubt the journalist who doxed him had no intention of causing that amount of harm. And yet, the journalist could have considered the situation a little more thoroughly, considering that the the identity of my friend had no bearing on the story whatsoever. I can only hope it was a mistake that this journalist learned from, and not general disregard for other human beings' welfare.
And I am telling you that story in the hopes you and others agreeing with your "fair game" will keep it in mind if they ever are in the position where they have to make a moral decision whether to dox or not dox somebody.
I have no idea why you keep trying to frame what I said differently.
"researching and broadcasting private or identifying information (especially personally identifying information) about an individual or organization"
I'm not talking about personal addresses and phone numbers. I'm talking about names and public LinkedIn profiles.
Or is it just the case that, as one friend said on Slack, "doxxing is when someone you don't like posts information about someone you do like"?
Apples and oranges are different, yes. A private individual communicating independently is a much different thing than a lobbying front.
>Isn't this just Reddit's weird norms leaking into the real world?
It could be that online culture might know a thing or two about the downsides of exposing people's identities, especially when done by journalists with large audiences.
>Or is it just the case that, as one friend said on Slack, "doxxing is when someone you don't like posts information about someone you do like"?
Do some people have double standards about doxing? Sure. Double standards are pretty common in general.
At issue is a site called the “Doxbin,” which hosts the names, addresses, phone number and often known IP addresses, Social Security numbers, dates of birth and other sensitive information on hundreds of people — and in some cases the personal information of the target’s friends and family.
We should really stop with the scope creep attempts around "violence".
This makes no sense. The "attack" of letting people know who a particular person is has always existed, but applied as an attack only in the very rare case where an exile came to your town and was later exposed. The norm was that everyone already knew exactly who everyone was -- in other words, that everyone was always and automatically subject to exactly the "attack" you claim didn't exist.
The attack of shaming has always existed and has generally been much more serious than it is now.
I don't expect strangers to protect information about just how much cash I have in my wallet that they found out by standing behind me in checkout line. But I surely want them nailed if they purposefully broadcast that and a mugger overhears and robs me.
Putting aside the debate over what level of doxxing is acceptable, I think we can at least assert that there no level of SWATting is acceptable in any context.
This is a genuine question, but is doxxing really illegal? I recently read that posting someone's social security number is not illegal, so I'm finding it hard to reconcile the two notions.
Please cite that. Last I checked, SCOTUS was very clear that there is only one type of forbidden speech: fighting words. See [1], [2], [3], and [4]
[1] https://en.wikipedia.org/wiki/National_Socialist_Party_of_Am...
[2] https://en.wikipedia.org/wiki/Fighting_words
[3] https://en.wikipedia.org/wiki/R.A.V._v._City_of_St._Paul