ICANN’t Even: New Internet Standards Could Make Doxing Easier Than Ever

Doxing has become an all too familiar in the lives of internet-using women. The public posting of our home addresses is a particularly brutal way that our lives can be policed and upended by determined harassers–to say nothing of how it has been used by stalkers and domestic abusers to find their targets. I myself have been the target of doxing because of my editorial writing.

One would think that the Internet Corporation for Assigned Names and Numbers (ICANN), which is charged with setting various protocols and standards for the entire internet, would not wish to be complicit in this ongoing disaster. Instead, ICANN is now seriously considering a proposal that could make doxing easier than ever, and act as yet another barrier to equal economic and political opportunity for marginalised groups. ICANN is considering the adoption of unprecedented limits on which kinds of domain registrants can use proxy or privacy services, potentially exposing millions of peoples’ home addresses to the entire internet.

This sounds a bit heady and in the weeds. The arcana of internet architecture and governance, though we depend on it as surely as we depend on public works utilities, remain opaque to many.

But the gist is this: when you register a domain for a website, you have to provide personal information including your legal name, address, and phone number, which is then posted to the worldwide WHOIS database, searchable by all. If you wish to keep this information private, there are ways of masking it from the general public, including the use of proxy services which substitute their company’s address for your own.

The proposal before ICANN would disallow such masking for all “commercial” websites, with “commercial” defined in the broadest ways possible, thus exposing your address and other personal data. If you sell vegan cookies, jewelry, or knitted scarves, or just collect donations for your art, activist work, or to support a loved one’s medical expenses, you may be considered a “commercial website” under the current proposal–no matter how small your site is, or how little money you make from it. Even if your website happens to host nothing more than the ubiquitous Google ads, you could be caught under the new guidelines.

In other words this proposal could rob such site owners of privacy, ensuring that they are just one WHOIS inquiry from giving a hostile stranger their home address and potentially more, and exposing millions to being doxed.

Such measures tend to disproportionately impact women, minorities, and LGBTQ people because of politicized and prejudicial targeting. Even if the target is not politically active in any way, their identity marks them for the senseless wrath of the internet’s worst. Take Kathy Sierra, the technologist whose only crime was being passionate about educational games. The capricious online horde suddenly began sending her and her family graphic death and rape threats, leaving her afraid to leave her own house. The already senseless abuse escalated still further when her home address and Social Security number were posted online. Sierra’s recent reflections on her case remain essential reading.

Doxing is efficient in its cruelty, an implicit threat and a display of power all in one, something that makes the “somebody should rape your corpse”-style threats press that much further into your personal space. As harmful as doxing is, it’s not “going nuclear” so much as one of the first weapons deployed by the committed harasser — a weapon that leads to escalating violence and fear. Doxing  can paint a target on your back.

One of the great risks that attends most online harassment is the global audience, in every sense of the term “global.“ It encompasses not only a wide geography, but a wide variety of potential viewers, not necessarily united in moralities, goals, or politics. You can put information before a hostile crowd, of whom it only takes one to do something drastic with it, whatever their particular reasons may be. Game developer Brianna Wu was doxed early on when GamerGate targeted her; photographs of her home and car appeared on a GamerGate tabloid blog in the months that followed as members of the harassment campaign strained to prove that she had been lying about fleeing her home.

The obsessiveness of harassers both leads to and feeds from doxing.

The phenomenon known as “swatting,” the use of a false report to local police to precipitate a SWAT team assault on a household, depends on doxing (police reports require a complete address, after all). Swatting is, often as not, a consequence of doxing and one of the more alarming and extreme uses of such information–if you’re familiar with the concept of “suicide by cop,” think of swatting as “attempted murder by cop.” This too requires information that could now be one WHOIS search away under ICANN’s proposal.

***

A WHOIS search is by no means the only way to dox someone, but we should be making it harder to acquire such information, not greasing the skids. The internet would benefit: after all, securing our privacy ensures a freer exchange of information, and wider economic participation as people feel more comfortable exchanging goods and services online. What’s worse is that this proposal to ICANN is being driven by yet more hamfisted anti-piracy initiatives coming out of the entertainment industry. The latter’s wealthy lobby sees this policy as a way to help crack down on commercial websites that distribute pirated content; according to them, forcing such site-owners to register with publicly available home addresses will make them less likely to host “illegal” content.

We are owed better than this institutionalized abuse of an already outdated domain registration system. We are owed better than ICANN providing a well-paved road for trolls and harassers, all in the name of an initiative that is unlikely to work as intended. The potential gains from this initiative are dubious to say the least–existing laws and provisions already enable law enforcement and entertainment lawyers to pierce the veil of WHOIS, and unmasking domain ownership does not help much in increasing transparency to consumers. But the fact that this will make doxing infinitely easier is a certainty. It is possible that a compromise could be reached that sufficiently narrows the definition of “commercial” to the point where ICANN would dox far fewer people, leaving small business owners, people who crowdfund or accept donations for their work, and activists out of this mess. But better still would be to scrap the thing entirely.

Would-be doxers don’t need help from the internet’s custodians.

***

If you want to do something about this, the following links are a good place to start.

https://www.respectourprivacy.com/

https://www.savedomainprivacy.org/

(Header photo: Tim Hales, AP)