[tptacek]

I'm still lost. What obligation does Brian Krebs have to pretend that the real identity of a pseudonymous Twitter user isn't discoverable from open sources, or to help conceal that identity? I submit that he has no such obligation, but that message board people like to pretend that he does, and that contravening that norm constitutes the real-world offense of "doxxing". Baloney, I say. Am I wrong? Educate me.

If he's posting home phone numbers or addresses, I'm clear on what the problem is. But if you have a public LinkedIn profile and don't have the OPSEC to keep public sources from linking your secret Twitter handle to that profile, I don't see any problem at all.

[rndgermandude]

What obligation? A moral one. Do no harm.

[tptacek]

I do not have a general moral obligation to actively help shield you from the consequences of your own speech, however harmful they might be.

[rndgermandude]

I am rather speechless... This is just... wow.

[tptacek]

Go on? By the definitions being used on this thread, a good part of all of journalism constitutes "doxing".

[rndgermandude]

So what? Doxing isn't inherently evil or inherently good. It has to be seen in context, and it is your and my and the journalist's moral obligation to look at the context first and weigh the likely harm to the person you dox against the possible good it can do. And it doesn't matter if the information was kinda public in some obscure corner of the internet or some public record or commercial database before. Once you publicize their information, you create publicity and draw a target on that persons back.

Dox some criminal? OK, but you have to be sure your allegations have merit and you've done your due diligence[0]. This is mostly what Krebs does.

Dox some politician who had an extramarital affair? Maybe OK. Dox their extramarital partner? Probably not OK.

Dox the latest terrorist? Generally OK. Dox every person that ever came into contact with the terrorist? Not OK. Publish personal information about the victims of the terrorist without their (next of kin's) consent? Not OK, even if you only report information you got from their facebook.

Dox some kid who misbehaved once on the internet, thereby directing an army of assholes on twitter to take notice, dox the kid further and bully them? Not OK.

When I was young (pre-facebook era), one of my teachers got murdered; her husband was later convicted. Some (tabloid) journalists showed up like locusts camping around our school, offering money for our pictures and other private information about the victim, her husband and their kids. Not OK. The same journalists also found "public information from open sources" about e.g. the kids' memberships in youth groups and such, and published that and also went to those youth groups for more information like they did at our school. Not OK.

[0] There was more than one case where "helpful" people on the internet and sometimes journalists published the names of alleged criminals who turned out to be entirely innocent, which didn't stop people from bullying them or even neighbors from forming mobs to "visit" them at home.

[tptacek]

When you say "doxing isn't inherently evil or good", you're putting us on the same page.

We do not agree about the particulars. For instance: the extramarital partners of politicians? To me, fair game. Kids who commit crimes on the Internet? To me, fair game.

Counterexamples? Sure. Undocumented immigrants who could be forcibly deported. I have a special obligation not to help ICE find those people. Iranian democracy activists. I have a special obligation not to subvert advocacy for democracy in authoritarian regimes.

But I don't have a general obligation to help maintain someone's pseudonymity, nor does anyone have the general right to restrain my own speech to protect their pseudonymity.

I understand that the rule exists on Reddit, and, to a lesser extent, here. And I respect the rule... on Reddit. And here. But in real life? I have a problem with message board norms leaking into the real world.