> It feels a very, very small step away from doxxing to me.

What small step is that? Looks like a textbook case of doxxing to me.

This isn't his first time doing it, either.

https://itwire.com/security/infosec-researchers-slam-ex-wapo...

I was personally unaware of these stories, and am slightly disgusted by the fact that I used to think Krebs was a fairly stand-up guy.

Doxxing someone because of a bad book review? I guess I shouldn't be surprised he's now doxxing someone based on a loose thread with no evidence.

I would have thought someone who has been swatted before would realize the dangers of releasing someones personal address to outrage-hungry vigilantes.

Some people claim that the coinhive story had some unnecessary doxxing aswell:

https://krebsonsecurity.com/2020/03/annual-protest-to-fight-... (see comments)

The users of said image board do a yearly fundraiser to protest against the unnecessary doxxing. The first one was started by a random user.

He also doxxed a guy who registered a bunch of domains defensively. He didn't even really apologize, just updated the story a few days later. [1] I called it out here prior to the update. [2]

1. https://krebsonsecurity.com/2020/04/whos-behind-the-reopen-d...

2. https://twitter.com/cyberingcc/status/1252460981546090496

That is just embarrassingly petty - I've just lost a little more respect for the guy.

> Researching and publicly broadcasting private or identifying information (especially personally identifying information) about an individual or organization.

Yeah this is definitionally doxxing

It's not one step away from doxxing at all -- in this case Lucky225 is not an unnamed source, that is actually his real legal name per his twitter [1] and the FCC database entry for his ham radio license (not linking that)

[1] https://twitter.com/lucky225/status/1258503072323526657

Well, I think they meant doxxing Joe, but also seems to be doxxing Lucky225 as you noted.

Once you look at Lucky225's Ham then you get an address. Of course, what is somewhat interesting is their listed address actually is located at Colorado's Division of Central Services building, which very interestingly is a way to obtain a confidential mail forwarding address. It says it is only to be used by victims of stalking/violence/harassment but who knows how well that is enforced: https://www.colorado.gov/pacific/dcs/acp-faq

Either way, I think SexyCyborg (well-known Maker) is quite right to call out HAM license as a vector for getting doxxed.

> Either way, I think SexyCyborg (well-known Maker) is quite right to call out HAM license as a vector for getting doxxed.

The ham license process itself is the doxxing, not a vector to it. The FCC is the one doing the public publishing of identifying information.

I lost a lot of respect for krebs a while ago when he doxxed a minor. I haven't followed him much since, so I don't know how repeatedly he has offended, but this doesn't surprise me.

+1.

serious media outlets generally don't name suspects untill they are convicted.

This is a rule that we as a society have established after generations of experience with how media works.

Then we get "social media", and all the old rules get thrown out... So, how long will it take to reinvent the same rules for this new platform?

There is also a link in the comments on that page to a very comprehensive doxxing of j0e and his family members.

100% right. Krebs is useful but an attention whore and an asshole to boot. He couldn't resist the temptation. All he should have done is share his findings with investigators but hey: clicks and the mortgage > ethics.

He might just be inferring what he believes rather than an out right allegation. You are right though, I would consider this to be doxxing.

> Added to which he has somebody in the comments essentially calling for the death penalty over this

Don't feed the trolls. If anything we've seen a lot of praise for this person. That has probably been the most responsible hack when you think about it.

It's doxxing. My question is why is that a bad thing in this case?

Zero tolerance policies don't make any sense to me.

On the off-chance that you're serious - doxxing someone who is suspected to be linked to a crime is staggeringly irresponsible, because you are then effectively convicting them in the court of public opinion. If they are innocent, but you have not only levelled accusations at them, but provided ways to access them, then you are partially responsible for what others choose to do with that information.

And by the way, even if the suspect is guilty, he/she might be a small cog in a much bigger engine, and by doxxing him/her the minds behind the fraud would be alerted then enter lowest profile mode, shutting everything down and making them extremely difficult to capture.

Doxxing can be a good thing only when authorities can't be trusted, which is the case for example of police violence and racism, where they're clearly protected by a corrupt system; in this case making their actions public becomes a public service. But in the above and other similar cases, think twice before publishing information that could undermine an investigation, even though they're properly checked and accurate.

Isn’t most crime journalism the same?

Three examples from the front page of the NY post right now.

I am having a hard time figuring out how to distinguish this and the OP doxxing. The organizationS fact-checking process? Solidness of the evidence?

> Allegations were made against longtime radio broadcaster Larry Michael (retired Wednesday), director of pro personnel Alex Santos (fired last week), assistant director of pro personnel Richard Mann II (fired last week), former COO Mitch Gershman (left in 2015) and former president of business operations Dennis Greene (left in 2018).

> Chanice Reyes, 24, was busted around 5 a.m. Thursday, sources said, when cops investigated a strong smell of marijuana coming from a car near City Hall, where anti-police activists have been gathering in recent weeks.

> Tory Lanez, whose real name is Daystar Peterson, was the person who allegedly shot Megan Thee Stallion following a dispute inside his vehicle Sunday morning, Page Six has learned.

There isn't a difference. Newspapers seem to dox people with impunity. It doesn't make it right, nor desirable, nor an excuse for others to follow suit.

The number of lives ruined by false allegations that have been amplified through press/journalists is disgusting.

It is in the United States. In other countries until conviction only initials are used. This to avoid ruining people's lives (or even endangering them) in case an allegation turns out not to be true.

We don't even do initials here for regular people. Usually it's some vague age and gender. Maybe ethnicity if relevant.

One difference is that these people are being accused by civil authorities --not some "rando" who moonlights as cyberpolice. He's not acting in an official capacity and doesn't have the imprimatur of the state.

I didn’t look closely but the first example I think is a non-state accusation. But interesting line to attempt to draw.

I look at the media as a counter to the power of the state. So I worry about an arrangement where media can’t name people without state approval. But perhaps my view is archaic?

I get what you're saying but the state here is often the official record for things. These kinds of government records are open and searchable in most cases. And to some extent they answer to the governed. You can get a new DA, mayor, etc. You can't fire an internet sleuth.

> Three examples from the front page of the NY post right now.

So does the NY Times, cf. the whole Slate Star Codex failure...

Because doxxing as a strategy has a nasty habit of ruining the lives of people that turn out to be innocent. Skipping legal process and all that.

> In this case?

After the Boston marathon bombing, Redditors thought they found one of the responsible terrorist. He wasn't.

Because the person he is doxxing isn't behind this. Unnamed telco source is not credible or is a rectangle swimming pools being used as a fingerprint.

> Because the person he is doxxing isn't behind this.

Don't think you can say that with certainty. It looks like a fairly solid series of deductions.

Maybe because the person he is pointing to may herself become a target of attacks/harassment other. If he (or she) is really the perpetrator, he should ideally be arrested and convicted. But it may also not be him.

I'm not sure I understand your comment actually.

Because... Because it's not confirmed?

Because it leads to harassment and harm. Which gets particularly bad when it's likely a false accusation at this point.

See https://en.wikipedia.org/wiki/Sunil_Tripathi for an example that should make your blood boil

Do you also support vigilante justice?

I never understood the whole doxing thing... the actions you take in this world are real. You can't take them back. You don't get to be anonymous just because you wish to be or because you frequent hacker sub-cults where doxing is some holy transgression. Bad op sec is bad op sec. Nothing more, nothing less.

If Krebs got it wrong, well, he can suffer the consequences of that, too.

>If Krebs got it wrong, well, he can suffer the consequences of that, too.

And, if he got it wrong, the innocent person he doxxed has to suffer the (potentially much more harsh) consequences of someone else's irresponsible actions. While Krebs begins working on his next story, and if we're lucky, posts an "oopsie" comment.

How can you justify that as okay?

If you believe the story, the people who are pointed to were already being looked for for arrest. Don't buy the poor innocent narrative too quickly.

It just happens that their last actions affected powerful figures and the US government so they might actually be some real international effort to arrest them now.

What I stated is not exclusive to this story.

People's home addresses and names should not be released to the public until a legal conviction has been ascertained. This has nothing to do with "innocent narrative". It has everything to do with due process, which is a foundation many countries entire law systems are founded upon.

The legal process is innocent until proven guilty. You seem to be advocating for guilty until proven innocent, with a side of public vigilante justice as the punishment.

If doxxing innocent (reminder: you are innocent until /proven/ guilty) people is the norm... And allowing vigilante justice is okay... We are in a very dangerous place.

You don't have to look far for numerous cases of innocent people having their lives ruined, or sometimes literally snuffed out, due to situations exactly like this.

Doxxing is not a crime, that's my point. And I am in no way interested in making it one. Innocent people should remain innocent until proven guilty and the rest of our god-forsaken species should figure out how to grow up and treat people with compassion and respect.

If what Krebs is doing in this case impacts the dude in any tangible and negative way he should sue Krebs for liable. That would be interesting.

Do you think Krebs got it wrong?

But regardless, harassment is harassment. If the public starts harassing the dude, even if he is guilty, they're just as guilty of their own offenses. Two wrongs don't make a right.

> Do you think Krebs got it wrong?

This is irrelevant, how can you have a fair justice system if the mob has already condemned the defender.

I don't want a mob to condemn anyone. A mob should not be condemning anyone, ever. Why is the baseline assumption that a public accusation must be followed by swift and undue internet mob justice? That's what's fucked up if you ask me.

He has in the past, and his response has been to delete the tweets but not offer an apology, or retraction. So when those tweets are re-posted, and/or screenshotted, there is no way to tell that the information is incorrect.

The problem is that the named person will also suffer if Krebs got it wrong. Furthermore it isn't uncommon these days for people to overreact and mob up against the person. We have a justice system to deal with this. We shouldn't have thousands of random people on the internet punishing them based on loose evidence.

I guess I just don't think we should plan society around the assumption that the internet will overreact and take justice into its own hands, which is not in fact justice. Why can't we hold people on the internet accountable for harassment?

That is an orthogonal concern. We should hold people accountable harassment. But I don't see the need to put someone in a position where they are likely to be harassed. The upsides of putting someones name out there seem tiny and the downsides are obvious, so why do it?

because you put ppl at risk without any benefit. you could easily as said I believe I know who did this and I've turned that information over to the authorities.

what does the public or kerp gain by putting it out in public when you dont know.

yes he (kerp) can be held accountable (and should be hit immediately with a defamation lawsuit if hes wrong) but not everyone has the resources to do that.

look at reddit and boston bomber the person they accused killed himself..

> look at reddit and boston bomber the person they accused killed himself..

Do we know this was due to the Reddit misidentification? His body was found on April 23, after being accused on April 18, but he had been missing since March 16. I've never seen a definitive order of events given.

(I've no doubt such accusations _could_ lead to such horrible outcomes, but I'm not sure if we know they did here with certainty)

Like a lot of terms doxing can mean different things. Sometimes it means holding people accountable and sometimes it means releasing the home address and workplace of a person misidentified as a wrongdoer by an internet mob.

A recent example was the biker misidentified as a man who assaulted a child putting up posters.

https://www.bbc.com/news/technology-52978880

And I would hold the people who acted on partial information accountable for their actions. Harassment is wrong regardless of whether you think someone is guilty of something or not. The internet needs to grow up.

Out of curiosity.. “the people who acted on partial information” who you say you would hold accountable. Does that include the people who chose to publicly dox him based upon an incorrect identification?

You're missing the nuance. Doxxing is not a crime nor is it a call to action. Do news stations censor the names of alleged criminals or even suspects out of some juvenile fear that a mob is going to rise up and take swift extra-judicial action? No. People are free to allege whatever they want. And in the case of Krebs, it happens to be his job. Reasonable citizens should not harass, threaten, or otherwise harm an innocent-until-proven-guilty person. Taking up an internet moniker does not enter you into some sacred contract with society whereby you shall never be exposed. I'm sick of treating issues like the rest of the world is a cesspool of ravenous lunatics and they can't be trusted to act like adults. Like there's a global expectation of ill intent. I know recent times have demonstrated otherwise but it's no excuse. We need to hold people who actually abuse others accountable for their actions not tread lightly around them because they are scary. Full disclosure for all. Full accountability for all. Confront the boggy-people.

since you think personal privacy is useless and your fine with personal information being out there can I get your real name, address and phone number plz?

My handle is not anonymous or even pseudonymous. You can easily find me.

The actions you take in this world are real yes, but the scale at which the internet enables retribution is unprecedented. If you punch someone in the street maybe three people will beat you up. If you punch someone online, tens of thousands of people might pile on and start kicking.

There's a certain symmetry to that, though. You fuck up on the world stage then you suffer a world of consequences. Anyway, I would sincerely hope people are more mature than to start harassing a dude that some security has-been decided to name as the perpetrator. You're not allow to harass and threaten someone just because they're suspected of being guilty of some crime.

Uhh.. have you ever been on Twitter? That's like half the activity there, people dog piling on others based on circumstantial, if any, evidence of perceived slights or wrongdoing.

Sure, people _shouldn't_, but they overwhelmingly _do_, which has real, tragic consequences. People with platforms must take care or they cause tangible harm to others.

Yes. This is called liable and it's illegal in the US. I don't know about international liable laws.. but if such a concept exists, the kid should sue Krebs if he experiences tangible negative consequences of Krebs' accusations.

have you ever used the internet??

But the risk to the target outweighs the potential benefit to the doxxer. Consequences can be unequal. And if the doxee ends up being the perpetrator, then the bad things were already on their way via the legal system.