Legislators in Utah have proposed a law that would bring serious criminal penalties for those who post others' private information online with the intent to harass.
HB 225 would amend the state's existing cybercrime laws to add provisions against the distribution of personal information.
The bill, floated by state representative David Lifferth, would bring penalties for obtaining and disclosing information for the purpose of harassment, or "doxxing" – up to a third-degree felony, carrying a maximum of five years in prison.
Among the personally identifiable information protected in the bill is phone numbers, addresses, social security and state ID numbers, places of employment, and possibly even a photograph or personal likeness.
"Doxxing" has become one of the more popular forms of harassment online. A user posts the personal contact information of someone – including home address, phone number and in some cases details about family members – for others to use to contact and directly harass the target.
The doxxing provision is just one of several measures pitched in the law. Lifferth also included new rules to punish those who participate in denial-of-service attacks, falsely reporting serious crimes or emergencies with a computer, and misusing a system even with permission.
While the law would aim to crack down on the harassment of individuals, experts worry it could also stifle free speech. In a column for the Washington Post, law professor Eugene Volokh (UCLA School of Law) suggests Utah is pondering a law that might not even be constitutional.
"The list isn't limited to material that is solely or chiefly usable 'to access a person's financial resources' – names and places of employment are also usable for many other purposes," Volokh argued.
"Again, if the bill were limited to Social Security numbers and perhaps a few other items, it might be constitutional, but it is much broader than that." ®