Doxxing as a Criminal Offense and Its Prosecution Record

Doxxing is treated as a serious crime, but the legal protection you actually get depends on where you live, who you are, and what harm has already happened. There is no single federal statute against it. There is no shared definition of it. What exists instead is a patchwork of state laws, borrowed federal charges, and constitutional limits that make prosecution possible in some cases and nearly impossible in others.

Why doxxing resists a clean legal definition — and why that matters for prosecution

The root problem is not that lawmakers cannot agree on a word. It is that the absence of a shared definition changes what prosecutors can charge and what courts can convict on. Most state statutes do not use the word "doxxing" at all. The Council of State Governments notes they refer instead to "improper disclosure of private information," "cyberintimidation by publication," or "dissemination of personal information on the internet."

Three elements recur across nearly all state definitions where they exist. Someone discloses personal identifying information. The subject did not consent. And the person doing the disclosing intended to cause harm or harassment. That sounds tidy, but only until you look at how each element is defined. Different states set different evidentiary thresholds for what counts as identifying information, what counts as consent, and what counts as intent. The same conduct can be a crime in one state and protected speech in another.

The intent component is what separates doxxing from simply publishing public information. Sharing a home address is not automatically criminal. Sharing it alongside a call to action, or with knowledge that harm will follow, is what triggers liability. That distinction sounds reasonable, but it puts the entire legal weight on proving what was going on inside someone's head.

What the federal government can and cannot charge doxxers with today

Federal prosecutors have no statute that explicitly criminalizes doxxing. Every federal doxxing case gets charged under a neighboring offense. The tools available are the Interstate Communications Act, the Computer Fraud and Abuse Act, and cyberstalking provisions. Each was designed for different conduct and carries different evidentiary requirements. The choice of charge depends on which element of the doxxing incident is easiest to prove. In a stalking case you prove a pattern of harassment. In a computer fraud case you prove unauthorized access. Neither is a clean fit for publishing someone's address online.

Congress has conceded the gap in its own legislative findings. H.R.8927 states that "no comprehensive Federal statute currently prohibits this conduct." That is not a criticism from outside. It is the House acknowledging that the existing toolkit was not built for doxxing as a primary offense.

The Kaetz case shows how this plays out in practice. William Kaetz was originally charged with threatening to assault and kill a federal judge and with making interstate threats. He pleaded guilty under 18 U.S.C. § 119 for posting the judge's home address. He received 16 months in federal prison. The sentence came in 2021, with appellate proceedings running through 2024. What matters here is the structure. The doxxing charge functioned as a plea vehicle, not as the lead count. Doxxing showed up as a secondary instrument attached to a larger threat case.

How state laws have filled the gap — and how unevenly they do it

States have stepped in, but not in any uniform way. As of June 2025, the Council of State Governments documents 54 enacted bills across multiple states since the early 2000s. Three states (Alabama, California, and Illinois) have established doxxing as a standalone crime with an explicit statutory definition. Fourteen additional states have criminalized the conduct without using the term "doxxing" at all. Same behavior, different legal label, different evidentiary requirements.

Arizona and Connecticut took a narrower path. They amended existing harassment, threatening, or stalking statutes to cover doxxing conduct rather than creating standalone offenses. Connecticut SB 989 in 2021 extended second-degree stalking to include certain electronic disclosures of personal identifiable information. If you are doxxed in Connecticut, you are relying on a stalking statute that was stretched to fit.

The remedies available also vary by state. Some states make doxxing solely a criminal offense. Others, including California and Washington, let victims pursue both criminal charges and civil damages at the same time. Illinois provides civil damages under the Civil Liability for Doxing Act but relies on general criminal statutes like cyberstalking and harassment rather than a standalone doxxing crime. So in Illinois you can sue, but the criminal charge would come from a statute that was not written for doxxing.

Who gets protected is another axis of variation. Most states protect all individuals. Seven states (Alabama, Colorado, Delaware, Minnesota, New Jersey, Oklahoma, and Pennsylvania) limit anti-doxxing protections to specific categories of public officials such as judicial officers, law enforcement, and election officials. Delaware's protections extend only to judicial officers, defined as active, formerly active, or retired judges and justices, and their family members. A private citizen in Delaware has no dedicated doxxing protection at all.

Washington's HB 1335 from 2023 shows what more precise drafting looks like. It requires publication without consent, intent or knowledge that the information will be used to harm, and that the individual actually suffers physical injury, significant economic injury, mental anguish, fear of serious bodily injury or death, or a substantial life disruption. All three elements must be established. That is a high bar, but it is at least a clear one.

What prosecution actually looks like when charges are brought

The federal doxxing cases that have produced convictions have one thing in common. The doxxing gets prosecuted as part of a larger pattern of threatening or violent conduct, not as an isolated act of information disclosure. United States v. Raygoza, Brown, and Carmona Samane from 2025 is an indictment, not a conviction. Three defendants were indicted on two counts: conspiracy and publicly disclosing the personal information of a federal ICE agent. They allegedly followed the agent home, livestreamed the pursuit, and posted an address near his home online. Each count carries up to five years in the U.S. District Court for the Central District of California. Notice what made this chargeable. It was not just the address. It was the pursuit. The livestream. The physical proximity.

United States v. Alan W. Filion from 2025 shows the same pattern more starkly. Filion was sentenced to 48 months in prison after orchestrating more than 375 swatting calls across the country, in some cases using text-to-speech generators to obscure his identity. Each call began with a doxxed home address as the operational input. Doxxing was charged and prosecuted as the predicate act that enabled a wave of physical harm. The address was not the crime. What the address enabled was.

The pattern across these cases is consistent. Prosecution succeeds when there is documented physical escalation: a pursuit, a swatting call, a credible threat. That escalation ties the information disclosure to a concrete harm. Cases where the disclosure causes fear but no physical incident are substantially harder to charge. A content analysis of 82 judicial opinions on doxxing found courts encounter the issue across four recurring contexts: First Amendment challenges, personal jurisdiction disputes, judicial transparency questions, and using doxxing as evidence of harassment patterns. Doxxing rarely stands alone as the sole legal issue in a case. It arrives attached to something else.

Where the First Amendment creates a fault line that statutes cannot easily cross

The First Amendment places a genuine ceiling on how broadly doxxing can be criminalized. That ceiling is not a technicality. It is the reason vague or expansive statutes face serious legal risk. Sharing publicly available information (court records, property ownership, voter registration) is generally protected. It becomes criminal only when intent to harass or harm is established. The line prosecutors must prove is one of mental state, not conduct.

That creates the core tension. Doxxing campaigns frequently use only open-source data assembled without any technical breach. The act of assembly and publication is legal until intent is proven. And intent is a standard that is difficult to establish before harm has already occurred. You cannot prosecute someone for what they were about to cause. You have to wait for the damage to show up, then work backward to prove what they meant.

Civil-liberties advocates push back on broad anti-doxxing statutes for a reason. They argue these laws risk chilling journalism, whistleblowing, and public oversight of officials. The concern sharpens when the "victim" is a government actor and the "doxxer" is a journalist or activist disclosing conduct of public concern. The same act looks different depending on who is doing it and why.

The Nashville Mayor incident makes the tension concrete. The Senate's Protecting Law Enforcement from Doxxing Act was introduced in direct response to a mayor's office publicly releasing the identities of ICE and DHS agents after ICE enforcement operations in Nashville. Supporters called it accountability. Critics called it doxxing. Same disclosure. Same facts. Two completely different legal and political readings. That is the fault line, and no statute has found a stable way to stand on it.

How pending federal legislation attempts to resolve the gap — and what it would actually change

Both chambers of Congress have introduced anti-doxxing legislation. Both bills take a narrow approach that would extend protection only to a defined class of officials rather than resolving the broader federal gap. H.R.8927, the Stop the Doxx Act, was introduced May 20, 2026, by Rep. Josh Gottheimer (D-NJ-5) and referred to the House Committee on the Judiciary. It would amend Title 18 to prohibit doxxing of law enforcement officers, prosecutors, and judges, defined as "covered public servants," and their immediate family members. Penalties range from up to 10 years for a first offense to up to 30 years if a first offense results in bodily injury or death, or up to 40 years if a second or subsequent offense results in bodily injury or death. The bill also creates a civil cause of action. A covered public servant or immediate family member who is a victim may sue in federal district court for damages, injunctive relief, and attorney's fees. S.1952, the Protecting Law Enforcement from Doxxing Act, was introduced by Senator Marsha Blackburn (R-TN) on June 4, 2025, and referred to the Senate Judiciary Committee. As of the sources used here, neither bill has been enacted into law.

The shared architecture of both bills is a deliberate legislative choice. Protecting a specific class rather than all individuals sidesteps the First Amendment concerns a general federal doxxing ban would face. A bill protecting only judges and police officers does not threaten journalism the way a bill protecting everyone would. But that choice has a cost. If either bill passes, millions of private-sector targets, journalists, healthcare workers, and ordinary individuals would remain without a dedicated federal remedy. Congress can fix the gap for the people it is most worried about without fixing it for everyone else.

Why the enforcement timeline is the deepest structural problem current law cannot solve

The fundamental problem with doxxing law is not the absence of penalties. It is the absence of prevention. Every current mechanism operates after exposure has occurred. The harm compounds in hours. The law moves in weeks. CybelAngel's April 2026 analysis frames it directly: doxxing laws require proof of malicious intent, take weeks to enforce, and can do nothing about content already circulating. The enforcement timeline rarely matches the damage timeline.

The luigiwasright.com and theceodatabase.com incident from April to May 2025 shows what that gap means in practice. Both sites published full names, business emails, mobile numbers, compensation details, and LinkedIn profiles of executives from companies across a wide range of industries. The sites were live for only a brief period before going offline. But the data was archived, mirrored, and remains indexed. A legal takedown, even if it had been immediate, would not have contained the information. Once it is out, it is out.

That is the implication for organizations. Legal frameworks are accountability tools, not protection tools. The gap between when a doxxing campaign begins and when legal action produces results is structurally unbridgeable through prosecution alone. The practical protection question is what monitoring and response capacity exists before and during an exposure event.

This is where security-focused content strategy intersects with the legal reality. Vendors and practitioners who understand the threat landscape know that legal recourse and proactive intelligence are not alternatives. They address different points in the attack timeline. Communicating that distinction clearly is itself a mark of domain credibility. You do not choose between calling a lawyer and watching for the attack. You do both, and you understand that only one of them can actually stop the damage from spreading.