So you found out your long-time partner cheated, or someone stole your parking spot at the mall on a weekend. You’re angry, upset, and you have the ‘receipts’ – what Internet users call digital evidence – to help validate your claims.
It could be a dashcam clip, screenshots of intimate conversations, or incriminating photos.
You decide the world should know, so you record a video for TikTok or post a photo dump on Instagram, sharing your ‘receipts’. You also include some names, workplace details or vehicle number plate.
The post goes viral. The Internet sides with you, and comments pour in with disparaging comments aimed at the person who crossed you.
Then reality hits.
In Malaysia, it usually starts with a formal notice from a lawyer, warning that sharing personal details online – names, workplaces, or vehicle number plates – can be considered harassment.
The notice makes it clear that leaving the post up could lead to legal consequences, whether through civil claims or police involvement.
Lawyer Harneshpal Singh Bhullar, who often receives enquiries from prospective clients after they’ve been served legal notices for things they have posted online, says one of the first questions he asks is: “Why did you have to post this?”
Harneshpal says people often don’t realise that their posts can get them into legal trouble for causing distress or harassment by exposing someone’s personal information online, a practice commonly known as doxxing.
Doxxing as a crime
In Malaysia, it is now a crime under Section 507E of the Penal Code for anyone to publish or circulate another person’s identity information without consent, knowing that it could cause harassment or distress. If found guilty, they can be punished with up to three years in prison, a fine or both.
Lawyer Bryan Lui believes Section 507E of the Penal Code was introduced to “confront a reality that is becoming impossible to ignore” – namely that online conduct is being widely used to cause fear, distress, reputational damage and danger without physical confrontation.
He says prior to these amendments, most such incidents would fall under traditional laws on threats, defamation, or misuse of communications.
“Sections 507B to 507D now criminalise threatening, abusive, or insulting communications that cause harassment, distress, fear, or alarm. Section 507E builds upon this framework by addressing a specific and powerful escalation tactic: the publication of identity information to intensify harm,” Lui adds.
According to Lui, lawmakers have come to recognise that once personal details are released into a hostile online environment, harassment becomes uncontrollable – spreading rapidly through reposts, comment threads, and offline consequences.
“The provision is both protective and preventive, designed to stop harm before it becomes irreversible,” he says.
Lui and Harneshpal are both co-managing partners at a law firm in Kuala Lumpur that specialises in defamation. On doxxing, Harneshpal says it is now recognised as a form of bullying.
“The law has recognised physical bullying since the Penal Code existed in 1976 and even before but never explicitly bullying that is devoid of physical harm. But this provision specifically assists in combating such bullying both in physical and digital platforms,” he adds.
Lui says that identity information is defined broadly under Section 507G and it includes details such as names, photographs, phone numbers, addresses, vehicle numbers, workplaces, family details, or anything that can identify a person.
If you believe a person’s identity information from their LinkedIn profile is fair game for public sharing, think again.
“The law doesn’t require the information to be private or illegally obtained as even publicly available details can be unlawful if weaponised. For example, reposting a business registration record during an online dispute alongside hostile commentary could count as doxxing if it exposes the person to harassment or fear,” he adds.
Similarly, everyday online actions such as sharing screenshots or posting call-out videos can expose users to legal trouble. Lui says a common scenario involves relationship disputes where one party accuses a former partner of infidelity. In this process, the person makes a post revealing personal details.
“Even where the allegations are believed to be true, the exposure can trigger public harassment and distress which is precisely the harm Section 507E aims to prevent,” he adds.
What about dashcam footage exposing reckless driving? Lui says while users may upload these videos to raise awareness about road safety; posts that reveal number plates, identify the driver in captions, or include commenters sharing personal information can quickly cross the line into doxxing.
“Viral ‘call-out’ posts are also increasingly common such as accusing shop staff, delivery riders, neighbours, or strangers of misconduct and encouraging the public to share or ‘teach them a lesson’.
“These posts often ignite online mob behaviour, which Sections 507B to 507F were specifically enacted to curb,” says Lui.
Harneshpal recalls that when clients try to defend their online posts, one of the most frequent lines he hears is: “‘I’m just being real...’. They often try to justify why they posted in the first place. Sometimes, there is a lack of remorse,” he says.
Lui observes that doxxing is not always driven by malice.
“Often it comes from oversharing, seeking validation, or wanting closure in public. But the law does not distinguish between emotional posting and harmful consequences,” he adds.
Amplifying anger
University of Nottingham Malaysia professor in digital media and communications Prof Dr Joanne Lim says the online call out poster starts with a sense of moral outrage, and social media sets the stage for them to immediately act on that feeling.
“Participation is easy: you comment, stitch, repost, or add ‘receipts.’ It becomes a social performance, not just a complaint. The danger is how quickly it can shift from criticising behaviour to targeting a person.
“Once names, faces, workplaces, or number plates are exposed, the post stops being about the issue and becomes networked punishment and the crowd does the rest,” Prof Lim adds.
As platforms are built around an attention economy, she says, posts that rile or outrage users tend to get high engagement.
“Outrage is simple, emotionally ‘activating’, and it invites response, which is exactly what pushes content into wider circulation. Algorithmic visibility rewards participation, not carefulness,” she adds.
The features that make platforms feel ‘interactive’ such as stitching videos, reposting quotes or leaving comments make disputes scalable, which is how one clip becomes a chain reaction of content.
“This is where context collapse happens. A relationship dispute or a driving incident that should have stayed bounded becomes searchable, remixable, and shareable to audiences with no relationship to the original situation, but plenty of willingness to judge it.
“And once that happens, mediated visibility becomes weaponised: identity details get pulled into the open and travel far beyond what the original poster anticipated,” she adds.
Lim believes that there is a “real everyday legal consciousness gap” in terms of how people think the law works versus what it is trying to prevent.
“Many users still define doxxing narrowly such as only if you post an address, identity card number or phone number, while identification online often happens through so-called breadcrumbs: names, faces, handles, workplace uniforms, number plates, family links, screenshots,” she says.
There is also what Lim explains as “moral licensing” where users frame their postings as a need to warn others or to believe that some people deserve the online vitriol.
“That framing makes people feel justified, so legal risk feels distant or irrelevant,” she says.
What happens offline
Clients seeking legal recourse after being allegedly defamed or harassed online often tell lawyers Harneshpal and Lui that they feel angry.
“Victims are usually seeking to have the offending content removed and to prevent further dissemination,” says Harneshpal, adding that some also pursue damages for emotional or financial harm.
IMU University Clinical Skills & Simulation Centre director and senior lecturer Dr Juliet Mathew has seen how public exposure or online shaming can be deeply distressing for the person being targeted where emotional reactions can include shame, fear and in severe cases, depression or post-traumatic stress.
“Over the past decade, I have observed an increasing number of individuals seeking counselling or professional support after being doxxed or publicly shamed. These sessions often focus on emotional containment, regaining a sense of safety, and rebuilding social confidence,” says Dr Mathew, who also specialises in counselling and providing mental health support.
Prof Lim says the impact of doxxing can escalate into networked harassment – repeated attacks, stalking, exposure of family members’ information, workplace consequences and ongoing fear for the victim.
“I must emphasise that reputational economies matter here. A screenshot is a durable object as it outlives deletion. So, the damage can become long-term and infrastructural because it changes how someone is searchable, employable, and socially legible. It also affects relationships: family stress, isolation, social withdrawal, and real mental harm,” she adds.
Unfortunately, Prof Lim says people underestimate the harm because online cruelty feels distributed. With the harm not being immediately visible on screen, it’s easy for most users to forget that the target is managing fear and fallout offline.
“Section 507G explicitly recognises ‘harm’ broadly (including psychological and reputational harm), which aligns with what we see sociologically, which is that this is not trivial,” she adds.
Dr Mathew is concerned that repeated exposure to online shaming can normalise aggressive behaviour and desensitise empathy for witnesses or participants.
“Liking, commenting, or sharing may seem harmless, but it can perpetuate harm, reinforce viral outrage culture, and erode social restraint. I often see this on social media, where netizens take the ‘high road’ yet respond harshly and brutally to a trending post.
“Over time, this shifts online culture toward reactive judgment rather than reflective understanding,” she says.
When to seek help for doxxing
Lui says immediate evidence preservation is the most important first step where victims should capture screenshots of posts, comments, usernames, URLs, timestamps and any threatening messages.
“This includes evidence of how widely the content has spread. A police report should be lodged promptly, especially where distress, fear, or safety concerns arise. Reports should also be made to social media platforms for takedown,” he says.
He adds that early legal advice is also critical for lawyers to assess offences under Sections 507B to 507F and advise on possible civil remedies such as defamation.
“In serious situations, adjusting privacy settings, alerting family members, and avoiding direct engagement with harassers can help reduce further escalation,” Lui adds.
Police in Malaysia have also made it clear that doxxing will not be treated lightly.
In a Jan 25 statement, Inspector-General of Police Datuk Seri Mohd Khalid Ismail emphasises the act of spreading, disclosing or displaying a person’s personal information without consent – including residential address, telephone number, identification number and family details – is unlawful and unacceptable under any circumstances.
Communications Minister Datuk Fahmi Fadzil echoes the IGP’s views, urging doxxing victims to file a police report or complaint with the Malaysian Communications and Multimedia Commission (MCMC), in an interview with the media on Jan 29.
In most cases, Harneshpal says, harassers who receive a legal notice to remove offending content usually comply to avoid potential legal consequences and compensation.
“Most of the time, we hear them say they were not aware that what they did was wrong. But I feel we live in a time now where saying ‘I don’t know...’ is no longer an excuse,” he adds.
Dr Mathew says posters can experience anxiety, stress guilt or even regret when the situation escalates.
“Especially when backlash, legal threats or online harassment arise. The escalation often brings consequences that the initiator may not have anticipated,” she adds.
Responsible online expression should focus on conduct instead of identity where Lui says users should share experiences without attaching names, faces, or traceable details. Faces and number plates should be blurred. Screenshots should remove usernames and personal information.
“If behaviour involves safety concerns, fraud, or misconduct, reporting to authorities such as the Road Transport Department, Securities Commission or seeking legal advice for personal affairs, is more effective than crowdsourcing punishment online,” adds Lui.
Dr Mathew hopes more people would consider the potential legal and most importantly, psychological consequences before they post any content online.
“Responsible use requires balancing the urge for immediate action with empathy, caution, and legal awareness,” she says.
Prof Lim says users must remember that social media is not due process, it’s a visibility machine.
“I always come back to two questions: Am I trying to reduce harm, or increase punishment? And, if I’m wrong, what damage am I causing? That pause is often the difference between responsible speech and irreversible harm.”
For Lui, being online is simply part of modern life.
“Using information responsibly is part of being a decent human – and staying on the right side of the law,” he concludes.
