The Dangers of Doxxing in Pakistan: A Case Study
This case study was commissioned to me in August 2021 by a digital rights organization in Pakistan as part of a global report to be submitted to the Meta (then Facebook) Oversight Board. For this, I interviewed Pakistani journalist Asad Ali Toor and artist/activist Leena Ghani on their experiences of being doxxed within Pakistan’s social media space.
Disclaimer: The facts stated in this report are true as of the dates I conducted my research. I interviewed Asad Ali Toor on September 3, 2021, and Leena Ghani on September 5, 2021.
To live in the digital age is to live two lives: offline and online. While the intersection of these lives is ripe ground for innovation, it also breeds unprecedented dangers. The rise of social media platforms means that people’s real-life identities remain deeply tied to their digital footprints.
This has more sinister implications than just offline fueds finding online battlegrounds. An ever-increasing danger lies in online threats that lead to offline repercussions. From hacking to hate speech, the Internet often enables violence that bleeds into the physical lives of its users. Doxxing is one such crime.
What is doxxing?
Doxxing refers to the public, non-consensual sharing of someone’s private information, such as their contact or residential details. It is derived from the expression “dropping docs,” with “docs” being shorthand for “documents.”
In the digital landscape, doxxing means releasing an individual’s private details on the Internet. It is usually done “by a third party, often with the intent to humiliate, threaten, intimidate, or punish the identified individual” (Douglas, 2016).
Like most phenomena, doxxing does not adhere to a single type. Variables such as method, motivation (or lack thereof), and intended impact can distinguish any instance of doxxing from another. Broadly, doxxing can be categorized into three types: deanonymizing, targeting, and delegitimizing.
Deanonymizing doxxing “reveals any kind of identity knowledge about a person.” Targeting doxxing “reveals information that allows an individual to be physically located.” Meanwhile, delegitimizing doxxing “reveals information intended to damage an individual’s credibility, reputation, or character.” (Douglas, 2016)
The incidents explored in this study largely fall into the targeting and delegitimizing categories. This study focuses on journalist Asad Ali Toor as its primary and feminist activist Leena Ghani as its secondary subject.
Asad Ali Toor
Asad Ali Toor is no stranger to notoriety within the Pakistani social media sphere. A journalist who candidly reports on Pakistan’s politics, laws, and state infrastructure, he is deemed a contentious figure by many. Despite his various brushes with authority, Toor maintains that no incident impacted him like the May 2021 assault upon his person, property, and privacy.
On May 25, 2021, Asad Ali Toor was violently attacked at his Islamabad residence by a group of men claiming to represent a state agency, per media reports. Suffering multiple physical injuries from the incident, Toor was ill-prepared to promptly be targeted through another means: doxxing.
Three days after his assault, Toor woke up to a barrage of calls and text messages from unknown numbers. He turned on his TV to see his face flash across multiple bulletins. That is how Toor learned that the Federal Investigation Agency (FIA) had summoned him to inquire about charges of “defamation of [the] institution of Government of Pakistan through social media” against him.
Within minutes of the news first being announced, a copy of the First Information Report (FIR) filed against Toor started making the rounds on Twitter. Images of the FIR — containing Toor’s private details, including his contact number and residential address — were being shared faster than he could even consider reporting them.
Speaking to me over a video call, Toor expresses his incredulity at the situation.
“A random citizen I didn’t even know — some Fayyaz Mahmood Raja — alleged that I had maligned certain state institutions and agencies by naming them in my statement after I was attacked,” he says. He adds that he had not even received the notice of summons when the news was first reported.
“The funny thing is that someone claiming to be an FIA official also messaged me on WhatsApp to ask if I had received the notice,” he quips.
The situation, however, was far from funny, and Toor is quick to remind me of it.
“When I saw the flood of text messages hurling all sorts of abuses and threats at me, I was stunned. It was only when I checked my social media that I realized what had happened.”
Soon after the news broke, allegations of Toor being a “foreign-funded traitor,” “Indian agent,” and “Israeli agent” were rife against him on social media. Foul language, threats, and demeaning, targetted hashtags accompanied them.
“I kept receiving calls from unknown numbers, day in and out,” he says. “The moment I’d end one call, my phone would ring again. For days, this happened without pause. Every call or message would brim with threats and insults.”
Narrating the incident, Toor informs me he was “traumatized for days” by the hateful online campaign. Eventually, he says, he was forced to change his phone settings to block all incoming calls from unknown numbers.
The threat of physical harm
Toor had more to worry about than just unsolicited calls and messages. Soon enough, suspicious, unmarked packages started arriving at his doorstep.
“Since my address was out there, I started receiving packages of food at my apartment from unknown people,” he tells me. While unsure what to make of this, he never risked consuming the food or sharing it with others.
Unwelcome visits by unknown people were another consequence of the doxxing.
“I wouldn’t be home, but my building staff would inform me that strange people had tried to visit me,” he says. “In the end, I instructed them to only send guests up to my apartment after calling me and confirming my approval.”
The unsafety Asad Ali Toor felt at his home followed him outside of it, too.
“Of course, it has affected my mobility,” he states. “Once all those allegations were spread against me and my face was shown on TV screens, I was very conscious of being recognizable.”
He claims that whenever someone now comes up to him in public and asks him if he is Asad Ali Toor, he hesitates.
“Before I confirm my identity, I always find myself looking at their hands,” he says, adding that he is not immune to threats.
“After what I have been through — I was gagged and beaten with the butt of a pistol — I am naturally afraid,” Toor admits. “At the end of the day, I’m human.”
The question of intent
Instances of harassment and trolling on social media, incidental or orchestrated, are common to witness. The organized spreading of someone’s contact and residential details is a rarer occurrence.
When asked about what anyone could possibly gain through doxxing his personal details, Toor confidently responds: “It communicates this message: ‘You are on your own. Now if anything were to happen to you, no one person can be blamed.’”
This aptly describes the malintent that often drives many online hate and doxxing campaigns. During doxxing instances, personal information is commonly used to harass, intimidate, or blackmail targets (Eveleth, 2015).
However, it is not necessary for doxxing to always be intentional. Within Pakistan’s social landscape, where there is little consideration for privacy laws, doxxing incidents can occur due to oversight alone. While Toor’s doxxing experience involve multiple elements, its mode of occurrence — through the sharing of an FIR — is common. For instance, simply searching the term “FIR” on Twitter brings up multiple tweets with images of FIRs displaying uncensored personal details of the concerned individuals.
Similarly, the lack of a standardized framework of ethical journalism in Pakistan may also be linked to cases of doxxing. A 2019 news report by a leading local English newspaper, The News, detailed a fatal car accident in Islamabad by doxxing the complete home address of one victim. Not only did this distress the bereaving family, but it also exposed them to online scrutiny and further breaches of their privacy. The doxxing incident led to the victim’s identity, photographs, and social media activity becoming a subject of online discussion.
The role of journalists in enabling doxxing incidents — regardless of intent to harm — is also evident in the case of this study’s secondary subject, Leena Ghani.
Leena Ghani
Leena Ghani is an artist and activist based in Lahore. She is also one of the organizers of the city’s annual Aurat March (Women’s March), which takes place every International Women’s Day. Since its inception in 2018, the March and its attendees routinely face online threats and vitriol. Because of this, Ghani is very familiar with online unsafety and antagonism.
However, she never felt as threatened as when she became a victim of doxxing—and subsequently, harassment—when Pakistani journalist Iqrar ul Hassan Syed shared a video revealing her name and picture on Twitter.
Fashioned as a news explainer, this video shared details about those caught in a high-profile celebrity harassment case. It showed Ghani and eight others, alonsgide a copy of a defamation FIR registered against them by musician Ali Zafar. Zafar was accused of harassment by fellow musician Meesha Shafi, and subsequently accused Shafi and her supporters of defamation. The FIR shared in the video was registered by Zafar against Shafi and the owners of prominent Twitter accounts that spoke against Zafar, including Ghani.
After Syed’s sharing of this video — which was biased in favor of Zafar, in line with his public support for him — the non-celebrity personalities named in the FIR became a target of online harassment.
Leena Ghani, in particular, became victim to an elaborate online harassment campaign after being doxxed by Syed. Speaking to me of the incident, she claims that Syed was the first person to reveal the personal details of the people Zafar had filed defamation charges against.
“In such high-profile cases, if you share the personal details of the survivors with their names and pictures, and try to portray that there is a lot of evidence, the survivors end up feeling extremely intimidated and fearful,” she says.
She holds fully Syed responsible for the online harassment she faced. Despite being repeatedly contacted, he still has not deleted the video.
The gendered impact of doxxing
Like the online hate campaign faced by Asad Ali Toor, an organized campaign of insults and threats targeted Leena Ghani. However, Ghani’s detractors attacked her through insults and memes depicting or threatening violence of a gendered nature.
According to Stine Eckert and Jade Metzger-Riftkin, while women and men both experience doxxing (Duggan, 2017), “women are more likely to have certain types of private information posted online and to receive higher amounts of unwanted, vitriolic messages (Lenhart et al., 2016).” They are also likely to experience other sexualized forms of online harassment.
This was true for Ghani, who was targeted through a Facebook group where men shared videos, memes, and derogatory images that threatened her with sexual violence. Moreover, a Facebook user even made a direct call-to-action to find Ghani’s home address.
“I reported [it] to FIA and showed them the videos and threats,” she tells me. “They were disgusted, but there was nothing they could do. They said they don’t have any technologies right now to help me out.”
She adds that she reported the group to Facebook, and it was taken down with the help of a personal connection she had at the social media giant.
“The only reason Facebook helped me was because I knew someone in Facebook,” she maintains. “Otherwise, there was absolutely no way anybody would have helped me.”
She adds that since the doxxing, she has become extra-vigilant about her surroundings and her house’s security. She recalls the incident with horror and disgust, and acknowledges that she feels unsafe.
In a tweet detailing the threats she received, she desperately questions: “Is this enough proof that our safety is a joke in this country?”
The role of social media
Social media applications today comprise a large portion of people’s daily networking habits. Easy to use, increasingly accessible, and developing newer specifications every day, applications like Facebook, WhatsApp, and Twitter are ripe grounds for the production and spread of information. Their merits notwithstanding, they provide easy channels for the dissemination of disinformation, formation of exclusionary communities, and breach of privacy policies.
Instances like doxxing, as evident in this study, primarily occur through social media. This is because social media applications are designed to aid the quick consumption and sharing of information. This means that these application maintain an environment that is conducive to activities like doxxing and harassment. While they have policies in place to maintain security standards for users, their implementation is questionable.
As witnessed in Asad Ali Toor’s case, Twitter was the main host to his private information and the vitriol against him. This was despite the social media platform’s official stance on doxxing. The so-called Twitter Rules state: “You may not publish or post other people’s private information without their express authorization and permission. We also prohibit threatening to expose private information or incentivizing others to do so.”
“Sharing someone’s private information online without their permission, sometimes called doxxing, is a breach of their privacy and of the Twitter Rules,” the policy adds. “Sharing private information can pose serious safety and security risks for those affected and can lead to physical, emotional, and financial hardship.”
“We may take action against home addresses being shared, even if they are publicly available, due to the potential for physical harm,” Twitter maintains. The wide dissemination of Asad Ali Toor’s residential and contact details suggests the contrary.
Similarly, Facebook’s official policies on Violence and Incitement and Hate Speech do not leave room for the presence of content and groups that incite violence. However, incidents like harassment and doxxing are commonplace on Facebook, despite user feedback and reports.
Conclusion
As evidenced in this study, social media platforms do very little to control the spread of people’s personal information or to take it down proactively. Many times, victims of doxxing are left with no recourse to have their information removed. This is because the processes of content moderation and policy implementation by social media platforms regarding doxxing are usually slow.
Often, the mechanisms and human moderators lack the local context and language skills to grasp the seriousness of the information being shared. This particularly impacts users in countries like Pakistan, where victims cannot promptly seek help against threats expressed in local languages.
Therefore, one of the biggest barriers to social media spaces becoming safer for users is the inconsistent implementation of their user policies. To not become party to the rampant abuse of their functions, social media applications need to prioritize the safety and well-being of their user base across the world. For this, they must increase the resources they allot to user security, and equip their platforms with efficient mechanisms to address global user concerns.
