Last Friday, Illinois became one of the few states to pass an anti-doxxing law, making it possible for victims to sue attackers who “intentionally” publish their personally identifiable information with intent to harm or harass them. (Doxxing is sometimes spelled “doxing.”)

The Civil Liability for Doxing Act, which takes effect on January 1, 2024, passed after a unanimous vote. It allows victims to recover damages and to request “a temporary restraining order, emergency order of protection, or preliminary or permanent injunction to restrain and prevent the disclosure or continued disclosure of a person’s personally identifiable information or sensitive personal information.”

It’s the first law of its kind in the Midwest, the Daily Herald reported, and is part of a push by the Anti-Defamation League (ADL) to pass similar laws at the state and federal levels.

ADL’s Midwest regional director, David Goldenberg, told the Daily Herald that ADL has seen doxxing become “over the past few years” an effective way of “weaponizing” the Internet. ADL has helped similar laws pass in Maryland, Nevada, Oregon, and Washington.

Illinois’ law was motivated by a doxxing attack on a business that subsequently shut down. The UpRising Bakery and Café was doxxed last year after it planned an all-ages drag brunch, which triggered threats of violence against the bakery’s owner, Corrina Sac, and vandalism of the establishment. Goldenberg told Ars that the doxxing “tore apart [Sac’s] business” and, after the bakery closed, ADL raised nearly $50,000 through a GoFundMe campaign to help her recover.

Illinois state representative Jennifer Gong-Gershowitz told the Daily Herald that she introduced the anti-doxxing law as “a way to hold accountable those who perpetuate hate online.”

The law does not involve criminal charges but imposes civil liability on individuals who dox any Illinois residents. Actions can also be brought against individuals when “any element” of a doxxing offense occurs in the state.

While many states don’t have doxxing-specific laws, some have passed laws against online stalking, harassment, and cyberbullying that allow victims to press criminal charges against those who dox them. But few laws, Goldenberg told the Daily Herald, help people financially recover from doxxing the way that Illinois’ law seeks to do.

Feds mull best way to combat doxxing

The ADL’s ultimate goal is to see a federal anti-doxxing law passed, but right now, Congress is only taking small steps in that direction by mulling the Doxing Threat Assessment Act introduced in May.

Rather than provide legal remedies for doxxing victims, this federal law would “require the Department of Homeland Security to develop and disseminate a threat assessment regarding the use of cyber harassment, including doxxing, by terrorists and foreign malicious actors, and for other purposes.”

Congress may be right to exercise caution in passing anti-doxxing laws, according to the ACLU of Illinois, which opposed the Illinois law that passed this month.

ACLU of Illinois’ director of communications and public policy, Ed Yohnka, told the Daily Herald that his organization remained opposed because the law could infringe on free speech rights. The ACLU’s chief complaint seems to be that individuals can be sued for sharing publicly available personally identifiable information that any ill-intentioned person wishing to confront others in person could readily find.

“It continues to be overly broad and inclusive of protected speech—namely, the inclusion of both truly publicly available information as well as private conversations between more than two people,” Yohnka told the Daily Herald.

The ACLU of Illinois did not immediately respond to Ars’ request to comment.

Goldenberg told Ars that the Illinois law was written to emphasize not how information was found and gathered by people seeking to dox others, but on what they did with the information and how much harm they caused. The law might need less updating as the Internet evolves if it doesn’t focus on the methods used to mine personally identifiable information.

“The reality is that those who are using the Internet to spread hate, to spread misinformation, to do bad are pretty nimble and technology changes on a near daily basis,” Goldenberg told Ars. “The law was crafted in a way that ensures that if technology changes, and people use new technologies to share someone’s personally identifiable information with the intent to do harm and that harm actually happens, this law remains relevant.”

US Rep. Debbie Wasserman Schultz (D-Fla.) said in a press release that the first step toward federal action against doxxing is to better understand the problem. A company that conducts safety research, SafeHome, reported last year that more than 43 million Americans have experienced doxxing.

“Extremists are exploiting our online platforms to spread private information and incite violence against vulnerable individuals and groups,” said Wasserman Schultz. “Arming our national security officials and law enforcement with knowledge of how these groups operate and for identifying vulnerabilities and preventing attacks is a first step to protect our communities from harm.”

Since the Doxing Threat Assessment Act was introduced, the number of co-sponsors has doubled, suggesting the bipartisan bill is gaining popular support and has a decent chance of passing.

The bill’s co-sponsor, Rep. Don Bacon (R-Neb.), said that persecuted religious groups and businesses appeared most vulnerable and “with more information, our law enforcement will be able to develop a more robust approach to the protections of Americans and their data.”

Until there’s a federal anti-doxxing law passed, Goldenberg told Ars that ADL will continue talking with states considering passing anti-doxxing laws during next year’s legislative session

https://arstechnica.com/?p=1960461