Is Doxxing a Federal Crime? Penalties Under § 119

Doxxing is a federal crime under enacted federal law only in the specific setting covered by 18 U.S.C. § 119. The statute does not create a general federal doxxing offense for every private person whose address, phone number, or personal email is posted online. It protects a defined class of public-duty participants and their immediate family members, and it requires proof that the disclosure was made with the prohibited intent or knowledge described in the statute. The maximum penalty is a fine, imprisonment for up to five years, or both, for each count charged under § 119.[1]

This is a reference record, not advice on any particular incident. The federal question is not answered by asking whether the conduct feels like doxxing in ordinary internet speech. It is answered by walking the facts through the statutory elements: who was exposed, what information was disclosed, how it was made public, what intent or knowledge can be proved, and whether prosecutors can charge additional federal offenses alongside § 119.

The federal doxxing test starts with § 119

Section 119 is short enough that its limits matter. It punishes a person who knowingly makes restricted personal information about a covered person, or that covered person’s immediate family member, publicly available when the disclosure is made with the required threatening, intimidating, inciting, or crime-facilitation intent or knowledge.[1]

That structure is why a quick answer to “is doxxing a federal crime?” can mislead. Section 119 is real criminal law, but it is not triggered by doxxing as a social label. It is triggered by a narrower statutory combination.

Who is protected is the first hard boundary

The statute protects people performing or connected to public duties that Congress singled out as vulnerable to intimidation and retaliatory exposure. The list includes categories that many readers expect — judges and law enforcement officers — and categories that are easier to overlook, such as jurors, court officers, informants, witnesses, and immediate family members.[1]

The immediate-family protection is not a decorative addition. In a doxxing incident, pressure often moves sideways: a judge’s spouse, a law enforcement officer’s child, a witness’s household, or an informant’s relatives can become leverage points. Section 119 recognizes that dynamic, but only by tying the family member to a covered person. It does not turn every family doxxing episode into a federal § 119 case.

That is the ethical boundary a federal reference should keep visible. A wealthy property owner, corporate executive, influencer, journalist, neighbor, or ordinary private person can be doxxed in a way that is frightening and dangerous. Unless the person falls within § 119’s covered class, or another federal statute independently applies, the federal § 119 answer is still no. For that private-person gap, the more relevant comparison is the site’s separate record on legal consequences of doxing wealthy property owners.

Restricted personal information is listed, not open-ended

Section 119 defines “restricted personal information” by list. It includes a Social Security number, home address, home phone number, mobile phone number, personal email, and home fax number.[1]

• Social Security number
• Home address
• Home phone number
• Mobile phone number
• Personal email
• Home fax number

That list is narrower than modern privacy anxiety. License plates, school names, social media handles, photographs, travel routines, employer names, geolocation traces, and family-member identifiers may matter enormously in a real safety assessment. But a § 119 analysis should not quietly add those items to the statutory definition unless another charged statute supplies the missing element.

This is also where many public-facing explanations lose precision. Posting a judge’s home address is a cleaner § 119 fact pattern than posting a judge’s public biography. Publishing a federal officer’s mobile number is different from criticizing the officer by name. Publishing a witness’s personal email with violent encouragement is different from reporting that the witness testified. The hard question is not whether the post is ugly; it is whether the post contains restricted personal information as Congress defined it, and whether the required intent or knowledge can be proved.

The intent element does real work

Section 119 does not punish disclosure of restricted personal information in isolation. The government must connect the public disclosure to one of the statute’s mental-state routes: intent to threaten, intimidate, or incite the commission of a crime of violence against the covered person or immediate family member, or knowledge that the information will be used to facilitate a crime of violence against that person.[1]

The first route looks to what the disclosure was meant to do: threaten, intimidate, or incite violence. The second route can matter when the defendant’s own words are less direct but the circumstances support knowledge that the information will be used by someone else to facilitate a crime of violence. In either route, prosecutors need proof beyond the bare existence of an online post.

Evidence can come from the post’s wording, surrounding comments, prior messages, timing, target selection, coordination with others, following or surveillance, and the presence of threats. The federal cases that look strongest are rarely just screenshots of an address. They tend to include conduct that shows why the address was posted and what the poster expected or wanted to happen next.

The five-year maximum is per count, and § 119 often travels with other charges

A § 119 conviction carries a possible fine, imprisonment for not more than five years, or both.[1] That sentence is often quoted as if it answers the whole penalty question. It does not. The better question is whether prosecutors charge one § 119 count, multiple § 119 counts, a conspiracy count, or additional threat, retaliation, stalking, or obstruction-related statutes.

The result is that “five years” can be both accurate and incomplete. It is accurate as the statutory maximum for a single § 119 count. It is incomplete when the indictment includes multiple counts or separate statutes with their own penalties. The charging instrument, not the label “doxxing,” is what determines the actual exposure range.

Why judges and court personnel received renewed statutory attention

The Daniel Anderl Judicial Security and Privacy Act supplies important enactment context. Congress passed the Act in December 2022 after the killing of Daniel Anderl, the son of U.S. District Judge Esther Salas, in an attack tied to the public availability of judicial personal information.[2] That history explains why judicial home information is not treated as just another privacy concern in federal law.

The safety context is also measurable, with limits. U.S. Marshals Service protective-investigation statistics show threats to federal judges rising from 403 in FY2022 to 564 in FY2025, involving 396 unique judges in FY2025. For FY2026, the Marshals Service had recorded 383 threats against 286 unique judges through July 15, 2026.[3]

Those figures are not doxxing statistics. They count threats and protective investigations involving federal judges. Doxxing can be one tactic inside that threat environment, but the Marshals Service data should not be inflated into a count of § 119 incidents.

What the 2022–Q3 2026 enforcement record shows

The visible enforcement record since 2022 is not broad consumer privacy enforcement. It is concentrated where § 119 would be expected to matter: federal judges, federal law enforcement officers, and public-duty participants whose home or contact information can become a tool for intimidation.

The ICE-agent prosecution in the Central District of California

In 2025, the U.S. Attorney’s Office for the Central District of California announced a two-count federal indictment against three women — Heidy Raygoza, Amber Brown, and Rosa Carmona Samane — alleging conspiracy and public disclosure of an ICE agent’s personal information after the defendants followed the agent from home to work and livestreamed the conduct. The DOJ release described the charged exposure as carrying up to five years in federal prison per count.[4]

That case shows why charge stacking is not an academic footnote. The alleged doxxing was embedded in physical following, coordination, and public broadcasting. Those facts go to the government’s account of intent and to why a conspiracy count can sit beside the § 119 disclosure count. The case is especially relevant for ICE-officer matters; the site’s deeper record on federal felony consequences for doxing an ICE officer covers that subset more directly.

The Santa Monica ICE-attorney complaint

The same district also announced the arrest of a Santa Monica man on a federal criminal complaint alleging that he doxxed and harassed an ICE attorney.[5] A complaint is an allegation, not a conviction. Its significance for a § 119 reference is narrower: it shows federal prosecutors treating disclosure-plus-harassment allegations involving immigration-enforcement personnel as a live federal charging category.

Judicial-address cases: Kaetz and the caution around secondary summaries

Available case summaries identify U.S. v. Kaetz as a 2024 § 119 guilty-plea matter involving the posting of a federal judge’s home address, with a 16-month sentence.[6] If used in litigation research or client reporting, that summary should be checked against the docket and sentencing materials. For this reference, the point is limited but important: a judge’s home address falls squarely inside the covered-person and restricted-information framework when the remaining elements are proved.

Curcio is weaker as a public benchmark on the materials available here. It appears in secondary discussion as a § 119 complaint-stage matter.[6] Without a verified DOJ release or docket record in the research set, it should be treated as a lead for verification, not as a sentencing or outcome example.

Cosko as an earlier charge-stacking benchmark

Jackson Cosko’s 2018 prosecution remains useful as an earlier benchmark for politically charged doxxing and charge stacking, rather than as a clean model for every § 119 case.[6] Its lesson is not that every online exposure of an official produces the same indictment. It is that when personal-information publication is paired with unauthorized access, threats, retaliation, obstruction, or related conduct, the federal case can become much larger than the doxxing count standing alone.

Consumer doxxing data does not expand federal coverage

There is a large public-safety problem outside § 119. SafeHome.org’s September 2025 consumer research estimated that 11.7 million U.S. adults had been doxxed.[7] That figure is useful as a consumer-research signal about prevalence and fear; it is not a government count, and it does not show that those incidents were federal crimes.

For ordinary private victims, the legal path may run through state doxxing statutes, stalking laws, harassment laws, restraining-order systems, civil claims, platform rules, employer policies, or federal statutes aimed at threats, stalking, computer intrusion, extortion, or swatting. A swatting incident, for example, can create catastrophic consequences even when the doxxing statute is not the central charge; the site’s record on the Pima County swatting shooting claim is the better reference for that adjacent risk.

The practical federal boundary

A disciplined § 119 review should start with four questions. First, is the exposed person a covered person, or an immediate family member of one? Second, was the information actually restricted personal information as the statute defines it? Third, was it knowingly made publicly available? Fourth, can the government prove the required intent to threaten, intimidate, or incite violence, or knowledge that the information would be used to facilitate a crime of violence?

If any of those answers fails, § 119 may fail even when the conduct is dangerous. If all of them fit, the five-year-per-count maximum is only the starting point for exposure analysis. The indictment may add conspiracy, retaliation, cyberstalking, interstate-threat, obstruction, computer-crime, or other counts depending on the conduct around the disclosure.

That is the correct federal answer: § 119 is an enacted federal doxxing crime, increasingly visible in cases involving judges and federal law enforcement, but it is not a general federal doxxing law for the public at large.

References

1. 18 U.S. Code § 119 - Protection of individuals performing certain official duties, Cornell Legal Information Institute.
2. Congress Passes Daniel Anderl Judicial Security and Privacy Act, United States Courts, December 16, 2022.
3. Protective Investigations Threat Statistics, U.S. Marshals Service.
4. Federal Grand Jury Charges Three Women Following ICE Agent from Home to Work and Livestreaming It, U.S. Attorney’s Office, Central District of California.
5. Santa Monica Man Arrested on Federal Criminal Complaint Alleging He Doxxed and Harassed, U.S. Attorney’s Office, Central District of California.
6. Federal Doxing Crimes, Eisner Gorin LLP.
7. Doxxing & Online Harassment Research, SafeHome.org, September 2025.