Publishing someone’s personal information online could now result in jail time. Upset about a taxi ride or saw a situation that you feel warrant a social media post? You would need to think twice now before posting any rants online.
Such revelation of crucial personal information online is known as ‘doxxing’.
Doxxing has been defined by Parliament as “the disclosure of personal information to cause violence or harassment to others”. The term was originally used in the 1990s to describe a tactic used by hackers, where they would release personal information about other hackers, to breach their anonymity and expose them to harassment.[1]
The information could include the name of the implicated individual, phone number, address, NRIC, passwords, photos or video recordings that identifies the person at question, or information on his/her family, education and employment, and publishing said information on online platforms to third parties.
Is doxxing a crime?
It is a matter of time. Of course, the mere act of publishing information gathered from publicly available sources itself is not a crime. However, if it has been established that the deed has been done with the intention to harass the victim, it will be punishable by the law.
Anyone who posts sensitive information online that identifies a person with intent to cause harassment, alarm or distress to that person (and has thereby caused that person or any other person harassment, alarm or distress), or in order to put that person in fear of provocation of violence could be liable to a fine not exceeding S$5,000 or to imprisonment for a term not exceeding 6 months or to both. Should the facts of the case fall under sections 8 or 8A of the POHA, the offender may be liable to enhanced sentences of a fine up to, not exceeding S$10,000 or to imprisonment for a term not exceeding 2 years or both.
The story of the BMW driver who had wanted to top up $10 worth of petrol should be familiar. The pump attendant had pumped a full tank instead of the requested $10. It was then alleged that the pump attendant had to pay the difference – which turned out to be untrue, and the BMW driver became the target of online vigilantes. His personal information was shared online, including his contact number and his job and he was harassed because of a conclusion drawn by netizens without the full story.
Earlier in January this year, a Go-Jek passenger was doxxed when she reacted poorly to the behaviour of the Go-Jek driver and had her crucial personal information posted online.
It included her personal information, photographs of her and her friends and resulted in the deactivation of all her social media accounts.
Recently, a 47-year-old man who punched a security guard at Roxy Square had his work details posted online. Individuals were egging others to share his photo and information online, asking the public in the advertising industry ‘to take note’.
All these doxxing incidents can be punishable by law when the law comes into effect later this year, depending on whether the requisite intent or knowledge can be established.
The latest incident concerning Monica Baey, a 23-year-old undergrad victim filmed by a peeping tom while showering at Eusoff Hall has spoken up and identified the perpetrator online. She had revealed personal details of the student, including his name, photos, faculty at the university and place of employment.
It must be stressed that vigilante justice, whilst may very well be well-intentioned, does not always result in a positive outcome. One reason is this – we are susceptible to error. Misidentification of alleged culprits, pressing of blame on their loved ones, mischaracterisation of the facts are but a few things that commonly happen. And the victims of these misidentification are suddenly left to fend for themselves, with little to gain and so very much to lose.
Is she guilty of doxxing?
In order to be found guilty of doxxing, the mens rea (intention) or knowledge of the publisher is key. Doxxing will be made out if the person published identity information of another person:
- Intending to cause harassment, alarm, or distress
- Intending to cause the victim to hear that unlawful violence will be used against him or another person;
- To facilitate unlawful violence against the victim; or
- Knowing or having reasonable cause to believe that the publication is likely to cause the victim to fear that unlawful violence will be used against him or another person.
That being said, it is easier said than done to determine the exact intention or state of a mind of a person when he / she has committed an act. After all, who else truly knows what one is thinking, unless of course you are Professor Charles Xavier from the X-Men. Of course, the situation is clear when one publicly states “This is Person XXX involved in XYZ incident and here are his details. Let’s teach him a lesson! He has to suffer as much as he hurt Person ABC!”
It has been left to the Courts to make a determination based on overt acts or declarations to infer an intention, and the context in which the personal information was made available. The alleged culprit will have a valid defence, if he can prove that his conduct was reasonable in the circumstances.
However, short of such blatant statements, it would be a tall order for our Courts to find an accused person guilty, especially if the perpetrator has made careful plans as to how to toe the line and still achieve his / her objectives.
As a case study to apply the above, let’s examine the recent Monica Baey incident.
On or about November 2018, Ms Baey was showering on a university campus residence when she was filmed by a man. The man was eventually arrested and dealt with by the police and the university.
Being a victim of such a serious offence, Ms Baey was understandably concerned and affected by the steps taken (or omissions) by the authorities having purview of her matter. Dissatisfied with the way things had been handled, Ms Baey took to social media to voice her concerns, in the process also intentionally identifying one Mr Nicholas Lim to be the culprit. She had personally known Mr Lim and had personal knowledge of some of his details.
Apart from his name, Ms Baey posted the following items on her Instagram story:
- The apology letter written to Ms Baey by Mr Lim with her comments;
- Mr Lim’s Instagram page which included details of his Instagram handle, faculty of study, and company he was working for;
- A private message from a netizen stating that “Nicholas parent are powerful people” and that Ms Baey might not want to anger them;
At first blush, the above items posted might not qualify as doxxing as provided under the law.
Parliament has stated that the identification of perpetrators of a crime would not be considered doxxing. It also cannot be an offence if the details were posted simply raising queries over one’s conduct.
However, if one were to analyse the accompanying statements on the images, whether her actions amount to doxxing are not as clear anymore.
In her post, she acknowledges that the “trial is over” and that she feels that “justice hasn’t been served”. She follows up stating that if he commits a crime, to be prepared to face the consequences.
The following questions / statements may be what a Court considers in coming to its determination:
- Ms Baey has, in multiple Instagram posts and interviews with the media, categorically stated that she had only intended for NUS to step up its frameworks to better deal with sexual assault case. Would her stated objective have been possible even without such disclosure?
- If not, the Court will have to see if such disclosure was necessary or reasonable.
- If so, that raises doubt as to her true intentions behind disclosing Mr Lim’s information. To do so, the Court may look at other information to determine and consider if any inferences can be drawn, for example, what might be relevant are:
- Ms Baey’s very first post on this matter seems to be addressed to Mr Lim and revolves around him being able to live life like an ordinary person.
- In another post, she mentioned that she had “appealed for a heavier sentence” with the police which did not succeed, hence she is no longer keeping quiet.
- Her reasons for posting DMs she received from other people about Mr Lim’s parents.
- It is not disputed that the “trial” of the matter is over and he has been subjected to due process, and is serving his punishment (whatever it may be) without comment.
- The juxtaposition of the above and her comments of justice not being served and a warning (for the lack of a better word) to Mr Lim to “be prepared to face the consequences” does raise an inference that consequences aligned with her idea of justice being served is imminent and Mr Lim should be prepared to face it.
- Length of time between the disclosure of the information and her published reasons for doing so.
- Was it necessary or reasonable for Ms Baey to have disclosed Mr Lim’s details? If so, what was the reason for Ms Baey to publicly identify Mr Lim on her Instagram?;
Ultimately, Ms Baey defended her actions, claiming that her acts were not premeditated on revenge, and her intentions in identifying Mr Lim was to deter him from hurting someone else, for him to get better, and also to make him realise his wrongdoing through “his punishment that he is serving now”.[2]
It is interesting to note also that during the Oral Answers to Questions regarding the above and other related matters, Minister of Education, Mr Ong Ye Kung, had accepted Ms Baey’s version of events: “that her objective in publicising her story was not to seek revenge for the present case, but to ensure fairness for both the perpetrator and the victim in future cases.” This was not questioned by any of the members in sitting.[3]
In my view, doxxing as a crime will be one which will be hard to detect, and an even harder one to prove in a court of law. At the end of the day, Ms Baey was never tried before a court of law as to whether she will be guilty of doxxing (had the law already kicked in by then), and we will never know for sure what the result will be. But as long as the various doubts and questions in her matter can be adequately addressed, the ordeal which Mr Lim was put through would simply be attributed to bad luck. If not, this would serve a reminder to all that whether you are a victim or not, two wrongs do not make a right.
How do I avoid getting doxxed?
It will be wise to make sure all personal information are not posted on your social media accounts, especially details that are commonly doxxed. You can do so by ensuring that your social media profiles are privatised. This will give you a greater degree of security by limiting access to your information. It may also bolster any complaint under POHA, that your information was not publicly available, and that efforts were made to disclose and/or uncover it. Short of any valid defence, the Court may make an inference against the culprit.
What if my employee is the one being doxxed?
Employment information is usually the first to be leaked online. It is easy to identify the employer through LinkedIn profiles or social media posts. Netizens will expect the employer to take disciplinary actions (validly or otherwise) proportionate to the amount of ‘damage’ they are deemed to have caused.
There is no hard and fast rule when dealing with an employee being doxxed. It can put the company in a bad light and attract unnecessary attention. It is a tricky situation, often the public puts pressure on the company when the employee commits the mistake. Google recently reinforced their rules for a no doxxing, trolling or name calling workplace culture, and the effect that these actions have on company culture.
It is recommended to adopt a forthcoming and transparent stand when it comes to the employee in question, as well as ensure that your company’s social media policies are always updated to reflect the rights pertaining to the legislation available.
It is also prudent to note that disciplinary actions (especially dismissal or suspension) should be only be brought after a thorough investigation AND under the contractual rights in the employment contract. Whilst it is tempting to simply cave in to the laser eyes of public scrutiny to take the heat off the company, it would definitely not be in the company’s best interest to lose a perfectly capable and ethically upright employee, and at the same time be slapped with a wrongful termination suit.
Enforcement is the challenge, and education is the key
While doxxing is not unique to Singapore, different countries take varied approaches to handle malicious online content. Establishing malicious intent will be the crux of the matter and enforcing these new changes to the legal landscape will be the new challenge.
Doxxing, fake news, online manipulations – everyone today is armed with a Weapon of Mass (In)struction (“WMI”) – the power to influence and viralise. Whilst entirely different from the nuclear missiles we fear from insidious militants, the fallout from these WMIs are comparatively as destructive. The victim, the victim’s family, and even the victim’s employers feel the radiating shockwave. Like Chernobyl, these affected persons then go on to bear scars of the fallout for years to come – after all, the Internet never forgets.
And lest we forget, or fail to realise, many of us are mere clicks away from social doom. All it takes is just one moment of folly, and you could be the next internet sensation – with your private life laid out bare.
We are in a digital era, where billions of people from all walks of life and of all ages, are logged on, masked behind a virtual avatar. With everyone wielding the power to viralise any content, all it takes is for a woman to posts details of her philandering husband and his new beau, a classmate who posts his female classmate’s number with her photo on an internet forum in mischief, a vigilante who feels exposing the details of the owner of a vehicle involved in a road rage would ensure justice is served, and the Court of public opinion is in session.
Perhaps the way moving forward is not to legislate, but really to educate the people on the proper use of the internet. If the online vigilantes cannot be caught, then any form of legislation will not be effective in deterring such errant behaviour. From young, we are taught to be polite to our family, friends, neighbours, and the public in general; yet, as we move into a new era of digitalisation, where there is practically no need to meet anyone in the flesh, we are incapable of treating people respectfully online. This is a lacuna that only proper education can fill.
The Internet is indeed a scary place, and no one wants to be in the centre of its attention. For that, any step to eradicate doxxing, online bullying, fake news (whilst not ideal) is still a step in the right direction.
[1] Official Reports – Singapore Parliamentary Debates, vol. 94 (7 May 2019) (Senior Minister of State for Law, Mr Edwin Tong)
[2] https://www.instagram.com/p/Bw6bxYSluC1/
[3] Official Reports – Singapore Parliamentary Debates, vol. 94 (6 May 2019) (Minister for Education, Mr Ong Ye Kung)