Yes of course using a priveleged position to dox someone is condemnable. I'll admit, I missed where Joshua Benton managed to identify Francesca Viola.

However that wasn't what I was taking issue with in the parent comment.

I think it's reasonable to expect however that:

- Journalists should be able to discuss each others views

- People who work at tech platforms should not dox their users (without a warrant)

- There is an acceptable point where an employer can fire their employees for what views they express in their private life.

So in all, is what Joshua did wrong here? I'd say so, but only because he doxxed a user. Is what the University did wrong here? It sucks where the information came from, but probably not. But even if you were to argue that there was, I find what Joshua did here to be largely immaterial towards that point, it's only how her employer chooses to react that is relevant.

You can’t ethically separate cause and effect in this case though.

If I wanted to analyse the ethics of the whole situation, no of course I can't.

But I can say that an unethical decision on the part of one party spurred on an ethical response from another.

If a robber breaks into a house a pedophile and discovers illicit material, are the police unethical for following up on that lead?

It's weird, but I remember a completely different consensus on journalists publishing and using "hacked" information just last year.

Abusing one's admin position to dox someone is not really distinguishable from any principled position against publishing hacked information.

It's weird to me that this ethical consideration seems to be something that can be ignored whenever convenient.

Was this information "hacked" from the US government or a corporation? We've frequently seen dumps of information from corporations and governments that could not be acquired legally but leveraging them is, IMO, a net good. There is no "person" that's being harmed, just a company's profits.

They doxxed a person, and allegedly misattributed racist comments to the wrong person based on that info which was gathered without authorization from Disqus.

That probably shouldn't rise to a CFAA violation, but there was a supposed ethical standard around publishing hacked information, so it's a bit weird to see that ethical consensus come and go so easily.

He's not a Disqus employee. He used the moderation tools on Nieman Lab's Disqus install.

That isn't remotely the same thing - he wasn't an admin at Disqus, he was an admin on the Disqus instance at their own website. She went to his website, commented horrible things under an anonymous account, and he exposed her as a person in a position of trust. That's not even close to approaching an abuse like the CEO of Google doxxing your gmail account.

She didn't comment horrible things on his website, only a critique of an article. He took offense to that, de-anonymized her by abusing the moderation system and looked for distasteful comments elsewhere.

I won't speak to the legality of it because I'm not qualified, but it's morally reprehensible.

That is not necessarily the order these things happened in.

He could have

1. Taken offense to this comment/taken interest in what else this user comments (which you can do without any admin tools)

2. Seen the islamophobic/xenophobic comment

3. De-anonymized the user

In this version the de-anonymization is related to the more repugnant comments, not the initial critique.

How is it different? It’s a misuse of the information he had access to. He was within his rights to ban her but not to dox her (and Disqus should not have exposed email addresses to site admins).

How is it a misuse? If you had a blog with a comment system and someone wrote horrible things, it's well within your rights to see who they are based on their registration and publish a post naming and shaming them. These are all 1st amendment protected activities. Free speech in the US is an extraordinarily broad right for very good reason. She's claiming defamation (which is one of the limits on free speech) but it's very likely bullshit given she admitted to writing the rest of the posts, just not the overtly racist ones all showing up under her account.

Take the internet away and it's even more obviously protected. If you ran a newspaper and occasionally published letters from readers, and if a racist letter showed up with a vaguely obfuscated address that was easily traceable, it would be well within your rights to write an article about the person in a position of power who sent your newspaper racist rantings.

The journalist likely violated Disqus's terms of service but in no way does that give the professor grounds to sue him.

>If you had a blog with a comment system and someone wrote horrible things, it's well within your rights to see who they are based on their registration and publish a post naming and shaming them.

I've been surfing everything from Usenet to webboards and other internet comment facilities for 25 years, how come I've never seen it? Typically the routine goes: cosmetic blocking (hiding, disemvoweling), account block, email block, ip block, then whack-a-mole for the truly persistently annoying.

Have you, and can you link to it if so?

Personally, I find it in very bad taste.

In the abstract sure, but say you're the journalist in question and you discover that a professor at a major university thinks all "muslims are scum" -- is it worse taste to say "too bad about that" and do nothing or take just the barest of steps to ID her and make sure she doesn't have authority over any muslim students without them knowing about her mindset?

It's the manner of discovery that's in bad taste, abusing your position that comes with back-end disqus access.

There's a reason certain forms of evidence are inadmissible in court.

(The professor's also at fault for not anonymizing herself better, of course.)

Then-professor Francesca Viola used her institutional email to login to Disqus. This proved to be extremely problematic for her institution, Temple University.

A professor naturally speaks with the authority of their corresponding institution, whether they or the institution likes it that way. A professor is also often in a position of leadership as they supervise the fate of students.

> A professor naturally speaks with the authority of their corresponding institution

Does she though? She had every reason to believe her choice of email address would remain private.

By a similar token, I am currently working for <REDACTED> (on lunch break) and using a computer belonging to said entity. If you managed to work out what <REDACTED> is, would I retroactively be considered to be speaking for it?

If you are a mere student who was later uncovered to be an unsavory Twitter person, do you speak for the institution? In some ways you do, and in some ways you don't — whether or not you or the institution likes it that way. Similarly, if you are a judge or lawyer and you're later found making unsavory statements about ethnic defendants, do you speak for the institution of law? That is up to the public to decide.

Credibility and reputation aren't precisely in anyone's hands.