Doxing Ethics

[0phidian]

I was just curoius what you guys(or girls) philosophies are on doxing from an ethical standpoint, especially you limdis since it's kinda your thing.
I'm a big avocate of privacy and anomitity but at the same time I'm naturally incredibly curious about everything so I'm kind of torn on this. I suppose the main thing has to do with how you use the information, but what about if you just want the info for yourself? Do you think it's a total invasion of privacy to dox somebody you met just out of curiosity? Is it always perfectly acceptable or is there a point were one crosses a line?
My other question is how would you define the difference between doxing and stalking, is there a point at which doxing becomes stalking?

[xsvMix]

I feel that it depends on two things. How you get the info and what you do with it but mostly the latter. If the info is from careful observation and just generally finding what you can, then why not, for better or worse the target did put it on the web on purpose. Using this information for any sort of financial gain or in a way that damages the target I feel is not cool, unless that target has done similar actions or other equally or greater unethical deeds. Wow this is getting deeper than I first thought

Though the fact is, if you want to think outside the box and act outside the box sometimes you have to cross lines. How many white hats have never illegally accessed something?

A loosely related example is that I have the root password for a random guys VPS. He gave it to my friend who was helping him set up rtorrent. The problem, it is his generic password for everything. Forums, email, probably a bank account and daughters pants too. Thing is it's just wrong to use this to do harm.

[Shade_of_Gray]

There's nothing inherently wrong with finding information on someone. Some methods of doing so may be wrong (like rubber hose interrogation, to pick an extreme example).

The ethicality of using the information you turned up is no different from the ethicality of using any information you already know about someone.

So the real questions you have to ask when doxing are "am I obtaining the information ethically" and "am I using the information ethically."

I don't believe in "privacy rights." I think they're an invention of modern society. Everyone has a responsibility to protect others' well-being, and in some cases that means protecting their private information, but public responsibility doesn't imply a personal right. That's why I don't believe there's anything inherently wrong with collecting information on someone. The ethical issue comes when that information is not protected and someone is harmed as a result (either by the individual/corporation/etc. who gathered it, or by someone else). Again, that doesn't mean the individual has a "right" to privacy; it means the individual (and the corporation) have a responsibility to protect that individual's interests.

These are general principles and there are exceptions. But I don't think you're asking for my complete moral framework.

[limdis]

I was just curoius what you guys(or girls) philosophies are on doxing from an ethical standpoint, especially you limdis since it's kinda your thing.
I'm a big avocate of privacy and anomitity but at the same time I'm naturally incredibly curious about everything so I'm kind of torn on this. I suppose the main thing has to do with how you use the information, but what about if you just want the info for yourself? Do you think it's a total invasion of privacy to dox somebody you met just out of curiosity? Is it always perfectly acceptable or is there a point were one crosses a line?
My other question is how would you define the difference between doxing and stalking, is there a point at which doxing becomes stalking?

Alright here is how I see it:
Doxing at it's core isn't that much different than conducting research. But instead of a historical event it's on a person that is a alive today. How and why you gather this information and later what you do with it plays into the ethical "right or wrong". I personally never dox anyone I personally know without a reason, no matter how curious I am. Not that it might be wrong but because I think that's just a little weird and removes the human element of knowing them or getting to know them. Those that I do know that I dox I will tell them I am doing it. Well they'll ask me to do it actually lol. Online doxing is entirely different. I'm always doing it. To the curious individual or event I might hear about in the news to a defaced webpage trying to uncover who might be responsible. 99% of the time I do nothing with the information I find. It's just a drive that I have to attain knowledge, to see around corners and connect the dots in understanding the bigger picture. That drive pushes me in other directions as well, a lot of which falls into the hacking realm. But back on topic. If you dox for illicit gain then that answers your question right there. Such as doxing for identity theft, blackmail, to hack them, or stalking. All of which is obvious but the difference between doing a dox and stalking (if that is not your goal) is that stalking is by definition referred to as unwanted or obsessive attention. Stalking, like harassment, in most states has to be stated by the individual as unwanted before it falls into the category of stalking or harassment. For example; you can text your girlfriend 100 times a day and it's fine. You break up because you cheated, and she says never talk to her again. You text her several more times pleading for forgiveness and finally she tells you to stop or she will file for harassment. Now, texting her again, even though it is entirely legal for you to text, would fall into pushing illegal simply because she has stated it as being unwanted and therefor harassment. This varies by state/country, but generally it does. So that covers legally. Doxing, unlike physically following, they will likely never know you are doing it, so it can't really become unwanted. Ethnically however it boils back down to why you are doxing in the first place. Are you doxing your ex because you are jealous and want to see who she is talking too? To me that would be unethical.
Perception to those hearing about a dox not fully understanding what a dox is can give you a bad rep. There is an article released by the FBI that gives doxing a very very bad rap. It also states that doxing is the collection and public release of personal information. Well no, it isn't. Releasing information is releasing information. It itself is not 'doxing' and really has nothing to do with it at all. Secondly, the information collected from doxing (legally) is already public. On top of that, it's perfectly acceptable to spend $50 to get a background check on some stranger that you just met. If you think doxing is deadly pay for one of those reports.
Fact is, doxing is only a name given to a direction of research. You are searching out publicly listed information on an individual or group. If your intentions are to not do something illegal and you aren't just a straight out creeper, then it is no more than that, research. However, knowledge is power and doxing leads to a wealth of knowledge. That falls into the hands of the wrong few and already it has a terrifying reputation.
If it makes you feel any better, I designed the mission to teach the methods so you can protect yourselves. I have already gotten several PMs thanking me for shining light on that they never realized just how vulnerable they really were.

[0phidian]

It's funny I used to not understand what was so bad about doxing, and I wondered what harm could be down by simply collecting publically avialible info. Now that I have actually gotten into it, it's kinda scary. I think one of the biggest things is not even the personally identifiable info by itself, but how much you can really learn about how the persons mind works, their thoughts, beleifs, interests, who these interact with, ect. That coupled with other data makes the possibility for manipulating your target incredibly easy. Just thinking about some of the stuff I could do with the info I've collected gives me the chills, mostly because I know people who would be incredible vulnerable to these things.

[LoGiCaL__]

I was just curoius what you guys(or girls) philosophies are on doxing from an ethical standpoint, especially you limdis since it's kinda your thing.

This made me lol. Then I read the 10 yr long response. +1

[not_essence2]

Society today has a frighteningly ignorant standpoint on all things "h4xorz", as they call it. Doxing, even though it isn't, will be automatically seen as stalking and a practice to be shunned and eradicated.
On another forum, I talked about doxing in one post. This was the next post:

Isn't that stalking?

But seriously, doxing is not unethical in my standpoint. Mistakes will be mistakes when giving out information. I accidentally give out information sometimes. I accept it.
And it took me only 5 posts to come up with 2 people's email accounts when I needed them for a project. It was funny, because one of those 2 people's friends actually posted an email on Google+, with the header and the forwarding addresses and such, which gave me a major LOL.

[weekend hacker]

As long as you don't have to do anything illegal I don't see a problem with it.
In that case it is of course the persons own decision to make that information available.
I do have some issues when companies/government agencies who you are forced to give information abuse that privilege and make it publicly available. In that case my issues is with that company/agency for failing to protect peoples privacy, and I'll avoid using that place if I legally can. It always makes me sad when laws are created to decrease peoples choice in this matter. And it seems as a standard these days that any database with juicy personal details NEEDS to be shared and profited on.
Even governments start with "we need a database for x" and will say "we'll protect peoples privacy and will not share this information or allow it to leak" but they always manage to misplace copies or samples of this database..
And worse is when after a number of years they forget about the whole "protecting privacy" part of their promise and actually sell the data to the private sector without even bothering to remove personally identifying data.(and even if they do remove that data, they often fail to do it properly)
example: http://www.theregister.co.uk/2012/11/08 ... data_grab/

In the end though, everyone can have an online identity that isn't linked to the real world in any way at all.
I've been staff here for a good 8 years or so and to this day not a single staff member knows my real name.
And I guess I'll just have to trust the few hackers that do.(In my defence, identifiable data was required to accept payment for an irc bet I won. And I really wanted to get a free bong)

[not_essence2]

That's where it crosses the line for me. I really think doxing should be a challenge as in searching public records, SE if you're desperate for someone to release information, watching for patterns, etc. Not selling private information to others.