# Responding to Doxxing: An Incident Response Guide Doxxing, the deliberate sharing of personal information to harass or endanger, remains a persistent and evolving threat. While preventative measures and managing one's digital footprint are crucial, understanding how to respond effectively when an incident occurs is equally vital. This guide builds upon previous recommendations, shifting focus to incident response tactics for IT security professionals and privacy-conscious users. ## The Importance of an Incident Log Establishing an incident log is a fundamental first step. This doesn't require complex software; a simple document where you can quickly record suspicious or harmful online activity is sufficient. Key details to capture include dates, times, platforms, a brief description of the action, details about the threat actor (if known), and any other individuals involved. Such a meticulously maintained record can be invaluable should law enforcement become involved.  Navigating the emotional toll of tracking hateful incidents online can be immense. This underscores the importance of a support system, as discussed in previous guidance. ## Assigning Team Roles for a Coordinated Response Effective doxxing response is a collaborative effort. Identifying trusted individuals and clearly defining their roles is paramount. These roles might include monitoring online forums, maintaining the incident log, setting up web alerts, securing social media accounts, or liaising with law enforcement to prevent serious incidents like **SWATing** (a malicious tactic where bad actors falsely report an emergency to dispatch armed police to a target's address). ## Monitoring Threat Landscapes and Hate Forums Victims of doxxing and harassment often belong to communities targeted by bias or bigotry. If you are aware of forums or platforms where such activities are coordinated, safely and privately monitoring these sites for discussions or plans targeting you or your community is a critical step. The **Tor browser** is highly recommended for these information-gathering missions to ensure anonymity. It is crucial to observe without engaging. This process can be emotionally taxing; consider enlisting a trusted friend or automating aspects of this monitoring. ## Setting Up Search Alerts Services like **Google Alerts** offer a free way to be notified when specific keywords, such as your name, are indexed by search engines. While less effective against anonymous doxxing, it can be useful for tracking smear campaigns in media or by prominent public figures. Due to the potential frequency of alerts, assigning a trusted individual to monitor these can prevent overwhelm. For more advanced and automated tracking of coordinated campaigns, tools like **Open Measures** can be considered. However, it's important to note that such tools might miss nuanced language or oblique references. ## Hardening Public-Facing Accounts For accounts that cannot be deactivated, a thorough review and enhancement of privacy and security settings are essential. Enabling **two-factor authentication (2FA)** should be a top priority. For social media, switching accounts to a 'private' setting, requiring explicit access requests, can limit exposure. To minimize exposure to distressing content, utilize features like muting specific terms and blocking accounts. Each platform's settings differ, so allocate time to familiarize yourself with their security and privacy options. ## Shutting Down Affected Accounts If an account is heavily targeted or identified as a source of information used in doxxing, temporary or permanent deactivation may be the best course of action. Many platforms offer temporary deactivation options, allowing for account recovery once the immediate threat subsides. ## Revisiting Data Broker Removal Strategies While a preventative measure, actively removing your information from data brokers is a crucial ongoing effort. The largely unregulated data broker industry frequently serves as a primary source for doxxing campaigns. Recent studies, including one by **Consumer Reports**, suggest that a DIY approach to data broker opt-out requests, often guided by resources like the **Big Ass Data Broker Opt-Out List** on **GitHub**, remains more effective than relying on paid services, though the latter may offer convenience. ## Addressing Public Records Personal information can be accessible through public records over which you have limited control. While direct removal may not always be possible, you can often request that republishing sites remove your data. Reviewing voter records, business registrations, court documents, and property records helps you understand what information is publicly available and strategize against potential misuse. ## Considering Law Enforcement Engagement For some, involving law enforcement can be counterproductive. However, in scenarios where **SWATing** is a potential threat, proactively informing local police about the ongoing doxxing can be a critical preventative step. Awareness of fraudulent calls is in their best interest and can mitigate the risk of a dangerous response to your home. ## Enacting PACE Contingency Plans For those involved in activism or community organizing, **PACE (Primary, Alternate, Contingency, Escape/Emergency)** documentation provides a structured approach to crisis planning. This framework helps outline pre-determined responses to escalating threats, creating a 'panic button' checklist of actions. Integrating recommendations from this guide into a **PACE** document ensures a ready-made strategy for when doxxing escalates to higher levels of harm or danger.