Doxing with a Dual Role
Criminal Liability for Doxing Perpetrators

The right to freely express opinions and criticisms in public is still far from reality. Society cannot yet breathe easily, as doxing has become a frightening threat.

Doxing is the act of disseminating someone’s personal data on the internet without their consent. This information can include employment, phone numbers, home addresses, educational background, and even the identities of family members.

Several individuals have already suffered from this. Ni Luh Angela, a journalist at Bisnis Indonesia, was doxed in June 2024. As quoted from Tempo on Friday (13/6/2025), the perpetrator created a narrative accusing her of producing an article using manipulated data.

The journalist had written an article on the rise in import value of products from Israel to Indonesia. The article was published on June 20, 2024, in the economics section of Bisnis.com.

On Tuesday, June 25, 2024, the perpetrator uploaded content questioning the article’s contents, including screenshots of the victim’s social media. They accused her of using invalid data.

The band Sukatani also experienced doxing and intimidation. The band’s guitarist and vocalist were arrested by the Cyber Crime Unit of the Central Java Regional Police on February 20, 2025.

Suspicions of intimidation intensified when guitarist Muhammad Syifa Al Lutfi, aka Alectroguy, and vocalist Novi Citra Indriyati, aka Twister Angel, announced the withdrawal of their song “Bayar Bayar Bayar” through a video uploaded to their Instagram. For the first time, the faces of the Sukatani duo were revealed to the public, having previously always performed wearing masks.

“With this, I urge all social media users who have our song titled Bayar Bayar Bayar to delete and remove all videos using our song. Because if there are risks in the future, it will no longer be the responsibility of the band Sukatani,” said Syifa in the video.

Another case befell Indonesia Corruption Watch (ICW) researcher Diky Anandya, who received threats after his personal data was exposed. The doxing occurred after ICW publicly commented on President Jokowi being nominated as one of the most corrupt figures by the Organized Crime and Corruption Reporting Project (OCCRP).

On the same day as ICW’s statement, the account @volt_anonym reportedly spread Diky’s personal data, including his name, national identification number, home address, place and date of birth, phone number, type of phone used, and his last known location complete with a Google Maps link.

New media and pop culture expert from Universitas Muhammadiyah Surakarta (UMS), Rina Sari Kusuma, S.Sos., M.I.Kom., condemned the doxing. “When we expose someone’s personal data with malicious, repressive intent, it becomes something that cannot be justified,” said Rina on Friday (13/6/2025).

Doxing targeting journalists is inappropriate as it restricts journalistic freedom as guaranteed by the Press Law. The journalist’s role in gathering and disseminating news can be severely hampered if they are subjected to threats from aggrieved parties.

The same concern applies to researchers and the general public. Doxing can cause people to hesitate in voicing their opinions or publishing critical analyses in public.

“Doxing becomes a nightmare for those who want to drive positive change but are afraid to speak up for fear of having their private data leaked without consent,” she added.

Even so, Indonesians have not run out of ways to speak up. One method of delivering criticism more subtly is through metaphor. Examples include code words like “Konoha,” “Wakanda,” “Parcok,” “Parjo,” and “Mulyono.”

“That’s more of a strategy to avoid appearing overly critical. It’s about flipping the argument so it’s not seen as insulting,” said the UMS communication science lecturer.


Doxing with a Dual Role

Like a double-edged sword, doxing is often used to enforce “justice” and social sanctions, for instance, targeting perpetrators of sexual violence, corruption, and other legal violations. The goal is to impose public shaming. “Doxing and cancel culture are closely related,” said Rina.

Both serve as instruments of social control driven by the public. According to Rina, doxing is one way for people to seek pseudo-justice by watching offenders become targets of online scorn.

“For netizens who lack institutional power, these two methods (doxing and cancel culture) are what they can resort to,” she continued. “There’s a sense of satisfaction in it.”

The doxing case involving Mario Dandy, who assaulted David Ozora, is one example. Publicly shared information exposed the identity of Mario’s father, Rafael Alun Trisambodo. Through the data unearthed by netizens, Rafael was found to be involved in bribery and money laundering.

More recently, Christiano Pengarapenta Pengidahan Tarigan, a student at the Faculty of Economics and Business, Universitas Gadjah Mada (UGM), was doxed after hitting and killing Argo Ericko Achfandi, a student at UGM’s Faculty of Law. Christiano did not immediately face legal consequences after the accident.

Uncontrollable outrage on social media led to the exposure of Christiano’s personal data. The hashtag #JusticeForArgo trended across platforms. Netizens also dug into and spread information about the occupation and identity of Christiano’s father, Setia Budi Tarigan.

Rina viewed both of these as examples of cyber vigilante acts, taking justice into one’s own hands on the internet. Doxing becomes a weapon for framing someone’s identity through a specific lens of public perception.

“Exposing someone’s identity is a way to strip them bare in public. Even if the police haven’t taken action, the people already have,” Rina quipped.


Read more: Cancel Culture and Public Accountability for Celebrities

Criminal Liability for Doxing Perpetrators

A civil law expert from UMS, Diana Setiawati, S.H., LLM., condemned the act of doxing individuals who try to express their opinions on social media, as well as journalists who report critically on government policies.

Diana stated that doxing violates Article 8 of the Press Law, which guarantees legal protection for journalists in carrying out their professional duties.

“When a journalist becomes a victim of doxing, whether due to their work, investigative reports, or expressed opinions, they are entitled to legal protection from the state,” Diana explained.

Not only does doxing violate the Press Law, it also breaches Articles 20 and 21 of the Personal Data Protection Law (UU PDP), which mandate that data controllers must obtain consent from data subjects before processing or disseminating their personal data.

“Doxing can be categorized as a violation of a data subject’s rights, particularly their right to privacy and control over their personal data,” she added.

Doxing has the potential to harm victims in many ways, psychologically, socially, economically, and even physically. Article 65 of the PDP Law also includes a clause on “Gaining personal or third-party benefits.” This means doxing can be used to gain political advantage, damage reputations, or serve the interests of specific groups. Wha

Sanctions for violators of the PDP Law are outlined in Articles 67–73. These sanctions apply to perpetrators who cause harm to data subjects. They include imprisonment of up to five years and/or a maximum fine of IDR 5 billion. 

“So, doxing perpetrators can be prosecuted under Articles 67–73 of the PDP Law, depending on whether harm was caused,” she explained.

Although the government has shown a normative commitment to protecting personal data through the enactment of the PDP Law in 2022, in practice, enforcement of the law, particularly against doxing, remains weak and inconsistent.

According to Diana, there are two main reasons for this. First, the lack of a fully functional supervisory authority for personal data protection, as mandated by the PDP Law. Second, the limited capacity of law enforcement officers in handling digital cases that require adaptation to new issues such as doxing.

“In addition to strengthening institutions and derivative regulations, public education about data rights must also be expanded so that people become more aware of the importance of data protection and are empowered to report if they fall victim,” she stressed.


Writer: Gede Arga Adrian

Translator: Farizal Luqman Majid

Editor: Al Habiib Josy Asheva

Research

image-featured
23 May 2026

Magical and mystical delusions are among the symptoms that can emerge in schizophrenia patients. Understanding them requires a careful therapeutic communication approach to uncover what lies beneath.

sdgs-label
sdgs-badge
sdgs-badge
image-featured
11 April 2026

Sometimes you may want a clause to be applied to a query only if something else is true.

sdgs-label
sdgs-badge
image-featured
6 March 2026

Disaster management must be aligned with disaster communication that is fast, accurate, and empathetic toward victims. This supports recovery efforts and delivers certainty for the public.

sdgs-label
sdgs-badge

UMS Newsletter

Nothing’s more special than reading curated news just for you.
Subscribe to the UMS Newsletter for free today.

Explore our newsworthy articles on ums.ac.id

icon

Research

Featured articles unpacking research by UMS lecturers.

icon

Global Pulse

In-depth articles featuring infographics.

icon

Academia Star

Profiles of outstanding UMS lecturers and students.

icon

Alumni Stories

Inspiring stories of UMS alumni building their careers.