Images of Hong Kong protesters in the streets have flooded news outlets for weeks, but fighting is also taking place on a second front: The internet. Protesters have resorted to encrypted online messaging and other tools to organize themselves, but a more pernicious online threat has proven difficult to fight.

The first victims of this online fight have been the victims of doxxing, or personal data leaks. The trend has recently reached disturbing new heights in Hong Kong, to the point that police officers and members of the press have requested court orders against the publication of personal information. But what does doxxing actually mean for those involved?

What is doxxing?

Doxxing is publishing personal information online. While it's related to online activism (hacktivism) and vigilantism, doxxing goes further than just advocating for a cause. It’s specifically done to harass people.

The word comes from “docs,” short for "documents," which are compiled for a specific person and published online. Experts say that people use the method because it works; victims are often intimidated.

Hong Kong’s protesters have taken great pains to hide their identities out of fear of retribution. (Picture: Nora Tam/SCMP)

Doxxing victims used to be hackers or people who got into arguments online. One well-known example includes a man who got into an argument over Call of Duty. Someone unrelated to the feud wound up getting doxxed and was killed when a SWAT team was sent to his home.

More recently, however, doxxing has become a tool used against political opponents, minorities and women, who were targets of the Gamergate controversy. Now it’s becoming a prominent weapon in Hong Kong’s anti-government protests, which have gone on for nearly five months.

Is having your personal information put online really such a big deal?

It’s true that many of us put an enormous amount of our own personal information online every day. But much of that information isn’t easily accessible online or people aren’t searching for it. It's only once a person become a target that this becomes an obvious problem. As the protests heat up and tensions rise, many doxxed people have reported receiving harassing phone calls.

In some cases involving journalists and activists, doxxing is believed to have led to physical attacks. Researchers from DFRLab believe that information about anti-government protesters is being leaked to Chinese state security agencies.

This is part of the reason why protesters have been dedicated to keeping their identities hidden.

Who is getting doxxed?

It could be anyone involved in the protests, no matter what side they’re on. Complaints about doxxing have come from police, journalists, activists, social workers, government employees and even local media magnates. Sometimes simply voicing an opinion is enough to get a person doxxed.

Pictures of police officers pasted on the streets of Hong Kong during a protest on China’s National Day on October 1st. We’ve blurred their faces and contact details in this photo. (Picture: Masha Borak/Abacus)

Doxxing is even a problem for trolls from mainland China. When members of the nationalist online forum Diba started jumping the Great Firewall to leave messages in support of the Chinese government, their Hong Kong adversaries struck back in a particularly creative way. They found Diba members' personal information and signed them up online for the People’s Liberation Army.

How bad is Hong Kong's doxxing problem?

It's bad. There have now been thousands of people whose information has been shared online. The Hong Kong's Office of the Privacy Commissioner for Personal Data has received more than 2,600 complaints of doxxing since the protests began, with nearly a third of them from the police.

The leaks have spread to multiple social media platforms, including some in China. Some have set up specialized websites to doxx protesters, with one local politician offering up to HK$1 million for tips on people involved in “illegal acts.”

The amount of detail being leaked online is staggering, according to researchers. In some cases, doxxing includes everything needed to piece together a complete picture of a person's life: Photos, date of birth, social media account details, addresses, phone numbers, and even family members and their employment details.

Why is the doxxing happening?

As with so many online conflicts, the people doing the doxxing in Hong Kong seem to believe they’re doing the right thing as online activists.

Doxxing police officers is often excused by protesters as justified because of what they see as police aggression. Hong Kong police have faced criticism for hiding their identities during clashes by removing identifying information from their uniforms and using face masks. Police say that they need to protect their staff from retribution and harassment, but they also say individuals can be identified in the case of a complaint.

Hong Kong police requested an interim injunction be granted to prevent personal information from being shared, but critics say that rules about what information can be shared are too vague. (Picture: Edmond So/SCMP)

On the other side, government supporters justify doxxing protesters by citing vandalism and attacks on police.

“Both camps, pro-government people and pro-protest people, believe that doxxing is a way to punish wrongdoers for their misdeeds and to deter the other side from any further action,” Michael Cheung from the University of Hong Kong’s Law and Technology Centre told us in an earlier interview.

Experts say doxxing isn't easy to control, in part because local laws aren’t sufficient to deal with it. A website called HKleaks that has been doxxing activists and journalists for months has been taken down several times, but it seems to keep cropping up.

How can you protect yourself from doxxing?

For those seeking to protect their data online, checking your social media for any personal information is a good start. People should also be careful about revealing identifying information on online forums.

However, there are more sophisticated kinds of doxxing that involve hacking and tracing information through metadata. You can guard against some of this by watching out for metadata like location tags in photos, for example. But more sophisticated attacks could require help from a professional.