[Discussion] DEATing for "Doxing" - The Reboot

[Cogitation]

A couple of days ago, user "Aksun" posted a thread to discuss what the punishments should be for doxing, in response to the following post from my superior:

It is hugely inappropriate to publicly post a moderator's private Facebook account. I'm extremely disappointed you did that. To date, the rules have focused on how mods will not share players' personally identifying information, but we will be updating them to clarify that doxing people is a DEATable offense.

Aksun raised concerns that this might be too harsh.

However, the thread went off-track in at least two different ways and when I tried to split the thread, today, I become reminded that splitting a multi-page thread by the pick-and-choose method is problematic. So, we're starting over.

First, I want to remind everyone of the scope of this topic: we are discussing, generally speaking, what punishments should be applied to a NationStates user who exposes someone elses real-world information on NationStates.

We will not be discussing specific cases, here, and any attempts to do so with get split out at a minimum and might be punished as threadjacking.

(In the event of massive thread derailment, I will state right now that while "splitting a multi-page thread by the pick-and-choose method" is problematic, it turns out that "splitting a multi-page thread by the CUT EVERYTHING STARTING FROM HERE method" is much easier to use, so it's possible that legitimate on-topic posts might get removed by mistake in any crossfire. I'm not inclined to do another thread reboot on this subject, so please be patient if your post that didn't talk about specific cases gets culled because it was in the midst of a bunch of posts that insist on talking about specific cases.)

For the Reploid/Nathicana case, specifically, an announcement will be made in the coming days, but is delayed for reasons that will be made clear when the announcement is made. Most especially, you are all required to avoid discussing that case in this thread.

---

Second, to resume the discussion, I want to reiterate that [violet] did not mean to say that any doxxing violation no matter how minor will be met with DEAT at a minimum, merely that (depending on the severity), a DEAT can be issued. It depends on factors that I'll return here to elaborate on once the other announcement has been posted.

Linky: [Watch this line for a link to be edited in to a future post where I explain what those factors are.]

For example, careless and dumb might get a warning or forumban. "Hey, look at this Facebook, guys! Mr. Nation is a Russian rocket scientist! That's so cool! " will probably get their post shoved into the Secret Evidence Locker and the user smacked upside the head (that is, an unofficial warning). On the other hand, malice aforethought might get a DEAT or DOS. "Mr. Nation's real name is Sputnik Sputnikovich and he lives on 12345 Stalin Is Awesome Boulevard, Moscow, Russia, and he helps Putin put nukes into space" will be fried with Modly hellfire.

One of the things that we want to make clear in this rule is that posting someone else's personally-identifiable information (PII) is always unacceptable. Even if Mr. Nation posts his own PII somewhere on the NationStates forums, that does NOT grant YOU license to then repost that same PII yourself. The most that YOU may do is link (NOT quote) the NationStates forum post in question so that, Mr. Nation later deems it necessary, Mr. Nation can then edit or delete. Every user needs to remain in control of their own privacy; that user sharing something does NOT make it open season for it to be spread around beyond that user's control.

Now, if anyone makes a mild, innocent mistake on this point on rare occasion (such as accidentally quoting instead of linking), then we will probably only edit the post into compliance and warn unofficially. If we notice that someone is consistently making this sort of "mild, innocent" mistake, then we might start escalating the punishments.

---

I hope that I've clearly laid out the parameters for this thread. Stay within those parameters.

--The Modified Democratic States of Cogitation
"Think about it for a moment."
NationStates Game Moderator

[Basitia]

This is a fine example of why I will never be a moderator of any major forum. I would have zero tolerance of bullshit about the simple RULES from people that used the forum.

[Idzequitch]

Doxxing is a more serious offense than most of the others, because it can noticeably affect the life of the user outside of this site. I would suggest that, as a general rule, if a user is guilty of doxxing, the minimum consequence be a One Week Ban, (though context is, of course, important). If there's a second offense, move up to DEAT. There's no room for that nonsense here and I hope to see the Mod Team take a no-nonsense approach on this matter.

[Grenartia]

I think its fair to say that the discussion of the specific case in question was (and is) necessary for discussion of this topic in general, since said case illustrates a key question.

What is personally identifiable information?

Its hard to settle that question without getting into the specifics of the case at hand. I don't think you'll find anybody on this forum, short of trolls, who would actually say that DEAT being a punishment in the toolkit for doxxing is a bad thing. Obviously, posting somebody's address and the like leads to some serious endangerment of their safety. But this case was not so black and white.

I can't really say I like the implications of this new rule. Nathi said that she linked to Reppy's FB in-character NS profile. Reppy, to my knowledge, has not denied that fact. If simply linking to something offsite that is NS-related without the explicit ok of the person behind it becomes doxxing, then what else is subject to doxxing rules? Linking to blog posts (daresay, even Max's)? Offsite forums for a specific region or RP group? An image-hosting service album for somebody's NS military vehicles/regular vehicles/whathaveyou? Any NS-related wiki pages for a user's nation(s)?

[Idzequitch]

I think its fair to say that the discussion of the specific case in question was (and is) necessary for discussion of this topic in general, since said case illustrates a key question.

What is personally identifiable information?

Its hard to settle that question without getting into the specifics of the case at hand. I don't think you'll find anybody on this forum, short of trolls, who would actually say that DEAT being a punishment in the toolkit for doxxing is a bad thing. Obviously, posting somebody's address and the like leads to some serious endangerment of their safety. But this case was not so black and white.

I can't really say I like the implications of this new rule. Nathi said that she linked to Reppy's FB in-character NS profile. Reppy, to my knowledge, has not denied that fact. If simply linking to something offsite that is NS-related without the explicit ok of the person behind it becomes doxxing, then what else is subject to doxxing rules? Linking to blog posts (daresay, even Max's)? Offsite forums for a specific region or RP group? An image-hosting service album for somebody's NS military vehicles/regular vehicles/whathaveyou? Any NS-related wiki pages for a user's nation(s)?

I agree, what does and does not constitute doxxing here needs badly to be clarified. Names, addresses, birthdays, SSN's and all that are obviously bad, but NS-specific FB accounts? Blogs? It's all currently gray, because we have no clarity on the issue. We really need to have parameters set for what will and will not be considered doxxing on this site before this line of discussion can be very meaningful.

[NERVUN]

Nathi said that she linked to Reppy's FB in-character NS profile. Reppy, to my knowledge, has not denied that fact.

viewtopic.php?p=28598060#p28598060

That answers that.

Now, enough.

[NERVUN]

I think its fair to say that the discussion of the specific case in question was (and is) necessary for discussion of this topic in general, since said case illustrates a key question.

What is personally identifiable information?

Its hard to settle that question without getting into the specifics of the case at hand. I don't think you'll find anybody on this forum, short of trolls, who would actually say that DEAT being a punishment in the toolkit for doxxing is a bad thing. Obviously, posting somebody's address and the like leads to some serious endangerment of their safety. But this case was not so black and white.

I can't really say I like the implications of this new rule. Nathi said that she linked to Reppy's FB in-character NS profile. Reppy, to my knowledge, has not denied that fact. If simply linking to something offsite that is NS-related without the explicit ok of the person behind it becomes doxxing, then what else is subject to doxxing rules? Linking to blog posts (daresay, even Max's)? Offsite forums for a specific region or RP group? An image-hosting service album for somebody's NS military vehicles/regular vehicles/whathaveyou? Any NS-related wiki pages for a user's nation(s)?

I agree, what does and does not constitute doxxing here needs badly to be clarified. Names, addresses, birthdays, SSN's and all that are obviously bad, but NS-specific FB accounts? Blogs? It's all currently gray, because we have no clarity on the issue. We really need to have parameters set for what will and will not be considered doxxing on this site before this line of discussion can be very meaningful.

*sighs* Cog DID say more details will be forthcoming.

Please be patient instead of worrying.

[Idzequitch]

I agree, what does and does not constitute doxxing here needs badly to be clarified. Names, addresses, birthdays, SSN's and all that are obviously bad, but NS-specific FB accounts? Blogs? It's all currently gray, because we have no clarity on the issue. We really need to have parameters set for what will and will not be considered doxxing on this site before this line of discussion can be very meaningful.

*sighs* Cog DID say more details will be forthcoming.

Please be patient instead of worrying.

I'm not worrying. I'm saying this discussion will be of minimal value until we have those details available for reference.

[Gidetisms]

Could someone give a definition of doxxing first?

[Idzequitch]

Could someone give a definition of doxxing first?

According to Wikipedia: "the Internet-based practice of researching and broadcasting personally identifiable information about an individual"

[Gidetisms]

Could someone give a definition of doxxing first?

According to Wikipedia: "the Internet-based practice of researching and broadcasting personally identifiable information about an individual"

But we call each other our real names on here all the time. So there has to be more specific information

[Idzequitch]

According to Wikipedia: "the Internet-based practice of researching and broadcasting personally identifiable information about an individual"

But we call each other our real names on here all the time. So there has to be more specific information

That's why I'm saying that we need parameters. Doxxing in itself is too vague a term.

[Gidetisms]

But we call each other our real names on here all the time. So there has to be more specific information

That's why I'm saying that we need parameters. Doxxing in itself is too vague a term.

Yeah, I mean, obviously linking to a persons' FB page is forbidden. But how much info crosses the line?

[Araraukar]

According to Wikipedia: "the Internet-based practice of researching and broadcasting personally identifiable information about an individual"

But we call each other our real names on here all the time. So there has to be more specific information

Elsewhere I've run into the definition of "information that is specific enough that you can be tracked down in real life with it". So I'd guess specific street address, phone number, stuff like that. Personally I'm at the unlucky disadvantage of having such a rare surname that there's just one other person on the planet (with 99.999% certainty) with the same combination of first and last name, so I guard knowledge of my last name viciously carefully.

If someone says, for example, that they're from Queens, New York, that's probably not enough to count - though the mods will be the final judges of that - since that's still a huge mass of people to "hide in". But specifying that they are the "only person who dyes their hair blue in [town with under 100 people]" might be.

IP addresses are of course off-limits, because they can be used for really accurate pinpointing.

[Imperializt Russia]

Doxxing is a more serious offense than most of the others, because it can noticeably affect the life of the user outside of this site. I would suggest that, as a general rule, if a user is guilty of doxxing, the minimum consequence be a One Week Ban, (though context is, of course, important). If there's a second offense, move up to DEAT. There's no room for that nonsense here and I hope to see the Mod Team take a no-nonsense approach on this matter.

Basically this. My opinion on what constitutes a valid punishment, along with most people in the thread, frankly, doesn't really matter.

Doxing is a substantially more serious offence than almost any other standard offence on a web forum, and moves into an attack on a person's real life. It is a substantial elevation of threat to a person and lack of regard for the rules or common decency, that requires a substantial elevation in the response afforded to it.

No tolerance for malicious doxing, ever, anywhere.

[NERVUN]

That's why I'm saying that we need parameters. Doxxing in itself is too vague a term.

Yeah, I mean, obviously linking to a persons' FB page is forbidden. But how much info crosses the line?

It depends, as Cog noted.

[Grenartia]

But we call each other our real names on here all the time. So there has to be more specific information

That's why I'm saying that we need parameters. Doxxing in itself is too vague a term.

Indeed. I'm the delegate of The Transgender Region. I participate regularly in the Transgender Thread. In both spaces, we have people who ask the rest of us to use their RL preferred names. It would, at the very least, be nice to have some sort of clear policy regarding cases such as that.

[Grenartia]

But we call each other our real names on here all the time. So there has to be more specific information

Elsewhere I've run into the definition of "information that is specific enough that you can be tracked down in real life with it". So I'd guess specific street address, phone number, stuff like that. Personally I'm at the unlucky disadvantage of having such a rare surname that there's just one other person on the planet (with 99.999% certainty) with the same combination of first and last name, so I guard knowledge of my last name viciously carefully.

If someone says, for example, that they're from Queens, New York, that's probably not enough to count - though the mods will be the final judges of that - since that's still a huge mass of people to "hide in". But specifying that they are the "only person who dyes their hair blue in [town with under 100 people]" might be.

IP addresses are of course off-limits, because they can be used for really accurate pinpointing.

And what of cases where users, say, make the news (or, [insert whatever power you wish]-forbid, make the obituaries), and for whatever reason, are unable to respond? In Dya's remembrance thread, Nana posted a picture of Dya. Is that not PII? Would quoting anybody who posts a picture in the What Do You Look Like thread fall afoul of doxxing?

[Ever-Wandering Souls]

That's why I'm saying that we need parameters. Doxxing in itself is too vague a term.

Indeed. I'm the delegate of The Transgender Region. I participate regularly in the Transgender Thread. In both spaces, we have people who ask the rest of us to use their RL preferred names. It would, at the very least, be nice to have some sort of clear policy regarding cases such as that.

Not to mention the existence of the "what do you look like" thread is something we have. People give away real life photos of themselves- by the post above, quoting those could be construed as a violation.

Edit: ninja'd xD

[Grenartia]

The most that YOU may do is link (NOT quote) the NationStates forum post in question so that, Mr. Nation later deems it necessary, Mr. Nation can then edit or delete. Every user needs to remain in control of their own privacy; that user sharing something does NOT make it open season for it to be spread around beyond that user's control.

Another question: What about threads which have been locked? I hold no illusions that somebody may need to quickly have their previously-posted PII quickly removed. How will Moderation ensure that PII that was posted in locked and/or archived threads is redacted in a timely manner?

[The Blaatschapen]

The most that YOU may do is link (NOT quote) the NationStates forum post in question so that, Mr. Nation later deems it necessary, Mr. Nation can then edit or delete. Every user needs to remain in control of their own privacy; that user sharing something does NOT make it open season for it to be spread around beyond that user's control.

Another question: What about threads which have been locked? I hold no illusions that somebody may need to quickly have their previously-posted PII quickly removed. How will Moderation ensure that PII that was posted in locked and/or archived threads is redacted in a timely manner?

GHR, also IRC.

In this case, it probably is better to not to use the moderation forum, as to not draw attention to it.

[Minoa]

I am a bit more cautious in order to maintain good relations between players and the mod team, and the penalty should depend on how serious the offence.

Posting a link to someone else's Facebook profile without knowledge should start with a knock-it-off on the first offence.

Knowingly posting the link, without malicious intent should start with a warning on the first offence.

Malicious intent would be a 7 day ban to deletion on the first offence, depending on the severity?

[Grenartia]

Another question: What about threads which have been locked? I hold no illusions that somebody may need to quickly have their previously-posted PII quickly removed. How will Moderation ensure that PII that was posted in locked and/or archived threads is redacted in a timely manner?

GHR, also IRC.

In this case, it probably is better to not to use the moderation forum, as to not draw attention to it.

Is there good mod coverage, timezone-wise, in the IRC?

Also, can I get a response to my other points of concern?

[The Blaatschapen]

GHR, also IRC.

In this case, it probably is better to not to use the moderation forum, as to not draw attention to it.

Is there good mod coverage, timezone-wise, in the IRC?

Also, can I get a response to my other points of concern?

I am on holidays. So not from me right now.

[The Corparation]

May I make a suggestion that the OSRS be changed to make it more clear that posting this sort of information is banned. While it does currently states that posting personal identifying information is banned here, at the top under the table of contents for the rules, the link to that section is labeled merely as "IP addresses". I think that changing the wording of the link in the overview from the current "IP addresses" to "Privacy violations" would be help make the section easier to find. Expanding the section itself would also be nice, but I'm not sue if that's strictly necessary.