By Andrew McCleskey and Destiny Vergara
An acrimonious feud between fans of Nicki Minaj and Megan Thee Stallion has shone a light on a growing doxxing epidemic — a form of cyberharassment that’s affected more than 10 million Americans.
When Milka Derisma posted a 60-second video to TikTok in late January spoofing the outlandish lyrics of rapper Nicki Minaj’s most recent single, “Big Foot,” she assumed the Internet would be in on the joke. But the 32-year-old content creator from Orlando had no idea that, 24 hours later, she’d have stirred up a hornets’ nest that would turn her life upside down.
Sitting in her bedroom, Derisma — who counts an audience of about 73,000 followers — cringed on camera while listening to a rendition she’d made of the new track. The song includes verses intended to belittle a female rapper with whom Minaj has long shared a tumultuous rivalry: Megan Thee Stallion.
In the rough-and-tumble culture of hip-hop, it’s not unheard of for artists like Minaj or Stallion, or their loyal fans, to exchange insults. But Derisma didn’t anticipate that her post, which was viewed more than two million times in a month, would unleash an outpouring of vitriol from an incensed army of Minaj supporters calling themselves the “Barbz.” Within hours, the comments section of her video had devolved into a cesspool of backlash and warnings that she would pay the price for disrespecting the rapper they anointed as their queen.
That was just the tip of the iceberg.
The next day, someone leaked Derisma’s phone number on X (the platform formerly known as Twitter), and the situation really went nuclear. A legion of angry Barbz started blowing up Derisma’s phone with dozens of denigrating calls, texts, and voicemails.
What happened to Derisma is one episode in a growing epidemic of doxxing, a form of cyberbullying in which individuals’ personal details, like phone numbers and home addresses, are shared publicly without their consent. Doxxing can take place on virtually any digital platform, from social networks like X and Facebook to messaging services like WhatsApp. The effect on victims is often harrowing and potentially dangerous, since online threats from doxxing can quickly bleed into the real world.
Doxxing has been weaponized on the internet for years, but the feud between members of Minaj and Stallion’s fan bases highlights how it’s become tougher to contain. Roughly 11 million Americans say they’ve directly experienced doxxing, according to a study released in February by SafeHome.org. The Hurricane reviewed more than 15 TikTok videos made by people like Derisma, who said they’d been doxxed by the Barbz in late January. (Representatives for both Minaj and Stallion did not respond to requests for comment.)
The escalation in doxxing comes amid a simultaneous surge in cyberharassment. Last year, 52% of Americans experienced online harassment — a 12% jump from the year prior — according to a report from the Anti-Defamation League. The ADL hasurged officials to outlaw doxxing; helped lawmakers, including a Florida state senator, draft anti-doxxing legislation; and called on social networks to ratchet up their enforcement efforts.
Now, legislators in states including Illinois, Kentucky, Oregon and Texas are evaluating or rolling out measures to battle doxxing. Some of their efforts are hitting snags, and victims say the time for solutions has long passed. The Hurricane spoke to lawyers, digital-privacy experts and social-media creators who said they’d been doxxed. All agreed that social networks should adopt a more forceful approach to contain the fallout — but also called on government officials to update laws they say are troublingly outdated, or empower law enforcement to crack down.
For Derisma, getting doxxed has left deep scars. Some who bombarded her likened her appearance to monkeys, dinosaurs and Aunt Jemima. One unknown caller shouted into the phone: “Is this Milka? How dare you speak about Nicki Minaj, you stupid bitch,” she told the Hurricane in a February interview, sharing screenshots of messages she received to verify her account. Her overtures to local police for help have gone unanswered, she said.
“To have my number and personal information leaked — it feels like a violation,” Derisma said. “My fear is that someone is going to get hurt, and that’s when law enforcement is going to start asking questions.”
Doxxing attacks are increasingly directed on larger scales using more sophisticated techniques
The reasons why people engage in doxxing aren’t always clear, but a 2017 study from researchers at NYU and the University of Illinois at Chicago offers clues about its allure for perpetrators. Primary motivations the researchers identified included a desire to gain domination and control over victims, as well as the pursuit of revenge against someone for a perceived slight or wrongdoing. Victims are left to navigate the trail of destruction that’s left behind.
In the past, doxxing attacks were typically orchestrated by lone individuals, limiting the damage they could create. Now, entire groups may be involved, meaning that fighting doxxing is less like swatting flies and more like battling a Hydra. For every threat that’s neutralized, two more aggressors seem to spring up to prolong victims’ suffering. Some perpetrators leak victim’s private information in secretive chat rooms on platforms like Discord, making it harder for moderators to detect.
Since the start of the pandemic, as users’ sensitivity to digital privacy risks has increased, demand for products from tech firms like DeleteMe — which offers tools to cleanse customers’ personal information from hundreds of websites — has skyrocketed. “Targeting people on social media has become a team sport,” John Gilmore, DeleteMe’s head of research, told the Hurricane, estimating that the company has grown by roughly 500% over that period.
January’s doxxing spree by some of Minaj’s fans has reignited a debate over who’s accountable for stopping the practice. Celebrities appear to bear some of the responsibility, at least when their supporters are involved.
Over the years, Minaj has been accused of fanning the flames of online furor. In 2021, she posted two reporters’ personal details on Instagram who were looking into statements she’d made about the Covid-19 vaccine and issued threats against one who tried to speak with a member of her family in Trinidad. But on Instagram last November, she instructed the Barbz not to threaten individuals on her behalf, adding that she doesn’t condone antagonizing others on or off the Internet.
Other celebrity fandoms — ranging from Taylor Swift’s “Swifties” to Ariana Grande’s “Arianators” — have also reportedly engaged in doxxing or cyber harassment. Meanwhile, the practice has reared its head in connection with fraught political clashes in recent months, too.
Following Hamas’ October 7 attack on Israel and the ensuing invasion of Gaza, the conservative group Accuracy in Media deployed special vehicles retrofitted with large screens to multiple college campuses, including Columbia University and the University of Pennsylvania. The personal details of numerous students who signed a letter holding the Israeli government responsible for the conflict were plastered on the vehicles’ screens as a form of punishment. Following the trucks’ first appearance at Columbia in late October, the university joined forces with nearby Barnard College to launch a resource group aimed at safeguarding students and faculty from doxxing.
In a letter that month to students, a senior Columbia official called out doxxing directly. “This malicious activity, including the placement of trucks that circulate around our campus displaying pictures and names of our students, is aimed at intimidating our affiliates and sowing division within our community,” Keren Yahri-Milo, the dean of Columbia’s School of International and Public Affairs, wrote.
Why doxxing has proven so hard to control
Some countries, like Australia and the Netherlands, are weighing laws or have already implemented bans on doxxing. So, why have measures to prevent it in the US proven so elusive?
For starters, federal legislators in Congress haven’t succeeded in developing legal solutions for doxxing. Aside from a few specific groups like elected officials, members of the military, jurors or informants in federal investigations, most social-media users have no federal protection if their contact information is leaked, experts say.
In 2016, a Democratic congresswoman introduced a proposed law designating the publication of others’ personal information “with the intent to threaten, intimidate, harass, or stalk” a crime punishable by up to five years in prison. The bill never made it out of committee.
Without proving an intent to cause harm, most victims’ claims are dead in the water, experts note, even in states that have statutes addressing doxxing. Perpetrators can try invoking a variety of defenses — like pointing out that websites such as WhitePages or RocketReach make the phone numbers, email or home addresses, and family connections of millions of people widely accessible. It may be unethical to disseminate such information against someone’s wishes — but it’s not necessarily illegal.
And then there’s the freedom-of-speech argument. “One person’s doxxing might be another’s First Amendment right,” Sam Terilli, a former media law professor at University of Miami’s School of Communication and ex-general counsel at the Miami Herald, told The Hurricane. Plus, many doxxers are anonymous, obfuscating attempts to identify and charge perpetrators.
Further complicating the issue, doxxers’ techniques are rapidly metamorphosing, leaving decades-old laws from nascent eras of the Internet in desperate need of an overhaul. Terilli pointed to Section 230 of the 1996 Communications Decency Act, which essentially absolves publishers of responsibility for users’ content. The law has left the power to decide how to crack down on doxxing in the hands of Silicon Valley tech giants — not Washington watchdogs.
“The world has changed in the last 25 years, and it doesn’t make sense the way it’s currently written,” Terilli said of Section 230. “If you’re getting threatening or obscene phone calls and things are being sent to your house because you’ve been doxxed, that is a harm, and that too ought to be criminal.”
A clear strategy to end doxxing appears far off
Nationwide, there are signs that state and local legislators want to ramp up their efforts. In recent years, roughly a dozen states have adopted some form of anti-doxxing legislation.
In January, Tina Polsky, a Florida state senator, introduced SB-920 into the Tallahassee legislature. Sponsored by the ADL, the bill would build upon the Sunshine State’s criminal statute against cyberstalking — which could slap convicted doxxers with a fine up to $1,000 and a year behind bars — by enabling victims to sue alleged doxxers for damages in civil court.
But it appears unlikely that SB-920 will see the light of day. Polsky — a Democrat representing parts of Palm Beach and Broward counties — told the Hurricane via email she doubts the bill will pass, since it wasn’t heard by a committee before the legislative session ended this month.
As federal and state legislators play hot potato, people like Erick Louis, a 26-year-old content creator in Orlando, say their patience is wearing thin. Like Derisma, Louis became a victim of doxxing by the Barbz in late January after posting a 19-second video to his more than one million followers on TikTok. In the recording, circus music played in the background as lyrics from Minaj’s diss track scrolled on screen, and Louis made a series of disparaging faces.
After the video’s release, it didn’t take long for a deluge of threats and slurs — some of which Louis characterized as racist or homophobic — to flood in. Someone sent a pizza to his family’s house. The calls and FaceTime requests seemed endless, he said.
Louis said he reported the incident to a division of the FBI concerned with cyber crimes but added that he’s grown fed up waiting for action. (A spokesperson for the FBI declined to provide specifics on Louis’ claim, saying the agency’s policy is to refrain from commenting on any investigation that may be underway.) He blamed law enforcement’s apparent malaise on the idea that doxxing is just an extension of cyberbullying, as opposed to something more insidious. “That framing doesn’t properly emphasize the severity of doxxing,” he added.
Despite victims’ frustrations, a clear strategy to deal with doxxing appears far off. Not even digital-privacy experts are on the same page about exactly who should tackle it or how.
DeleteMe’s Gilmore doesn’t think social networks are up to the task by themselves. They’re sorely lacking content-moderation resources, he said, calling their anti-doxxing guidelines “mostly fluff” in practice. “In most cases, the policies are unenforceable because there are millions of people using these platforms,” he continued, adding that they don’t have enough administrators on hand to monitor everyone’s posts.
But Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation, believes social-media companies can marshal stronger tech solutions against doxxing than lawmakers stymied by bureaucratic gridlock. Now is the moment for these companies to face the rising tide of doxxing head-on, she warned, since the problem is only getting worse.
“Normalizing this behavior and treating it as a ‘fans will be fans’ kind of thing is quite dangerous,” Galperin said. “These are actions that have real-life consequences.”
They’re consequences that victims like Derisma and Louis have experienced firsthand. And, until better solutions to end doxxing are in place, countless other social-media users like them will remain sitting ducks.