Under 18 U.S.C. 119, it is a federal felony to knowingly publish the home address, phone number, Social Security number, or other restricted personal information of a federal official, juror, witness, or their immediate family with intent to threaten, intimidate, or incite violence. A conviction carries up to five years in federal prison and fines that can reach $250,000 for an individual. The statute targets a narrow slice of conduct, not every disclosure of personal data, and the line between the two turns on intent.
What the Statute Prohibits
The law reaches conduct through two separate paths. Under the first, you face charges if you publish restricted personal information with the direct intent to threaten, intimidate, or incite a crime of violence against a covered person or their family. Under the second, you face charges if you publish that information knowing and intending that someone else will use it to threaten, intimidate, or carry out violence. The second path catches the person who feeds information to a hostile audience while claiming no responsibility for what follows.1Office of the Law Revision Counsel. 18 USC 119 – Protection of Individuals Performing Certain Official Duties
Both paths require the defendant to have acted “knowingly,” meaning with awareness that the information was being made public and awareness of what it was. Posting a judge’s home address on social media because you disagree with a ruling is not automatically a crime. Posting it alongside language urging others to “pay her a visit” almost certainly is. Accidental disclosure, or sharing without any awareness of the target’s status, falls short of what prosecutors must prove.
Who Counts as a Covered Person
Section 119 protects four categories of people, plus their immediate families:
- Federal officers and employees, including members of the uniformed services, while engaged in or targeted because of their official duties. This category comes from 18 U.S.C. 1114 and sweeps in everyone from FBI agents to IRS auditors to postal workers.2Office of the Law Revision Counsel. 18 USC 1114 – Protection of Officers and Employees of the United States
- Grand and petit jurors, witnesses, and officers of any federal court, including those serving before a U.S. magistrate judge.
- Informants and witnesses in federal criminal investigations or prosecutions.
- State or local government employees whose information is published because they participated in or assisted a federal criminal investigation.
The last category is easy to overlook. A local police detective who assists the FBI on a drug trafficking case picks up federal protection under this statute, and so does the detective’s family. “Immediate family” is defined by cross-reference to 18 U.S.C. 115 and covers a spouse, parent, sibling, or child, along with anyone else in the household related by blood or marriage.1Office of the Law Revision Counsel. 18 USC 119 – Protection of Individuals Performing Certain Official Duties
Private citizens, celebrities, corporate executives, and state officials with no federal-case connection are not covered. Publishing their personal information may violate state doxxing laws or other federal statutes, but 18 U.S.C. 119 does not apply.
What Counts as Restricted Personal Information
The statute defines restricted personal information as a short, specific list of identifiers tied to a particular person:
- Social Security number
- Home address
- Home phone number
- Mobile phone number
- Personal email address
- Home fax number
The list is narrower than many people expect. Workplace addresses, vehicle registration, financial account numbers, and photographs are not on it. Publishing a judge’s official courthouse address, for example, would not trigger this statute because the courthouse is a public facility, not a home. The law focuses on information that leads directly to where someone lives and how to reach them personally.1Office of the Law Revision Counsel. 18 USC 119 – Protection of Individuals Performing Certain Official Duties
Each item must also be “identifiable to” the individual. A phone number sitting in a spreadsheet with no names attached would not qualify unless prosecutors can show it was presented in a way that linked it to the covered person.
Penalties
A conviction carries a maximum of five years in federal prison, a fine, or both. Under the general federal fine statute, an individual convicted of a felony faces a fine ceiling of $250,000. If an organization is convicted, the ceiling rises to $500,000.3Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
An alternative fine provision can push the number higher. If the defendant profited from the offense, or the victim suffered a financial loss, the court can impose a fine of up to twice the gain or twice the loss, whichever is greater. Someone who published a judge’s home address as part of a paid harassment campaign could face a fine calculated from whatever they earned.
Federal sentencing guidelines give judges a framework for landing somewhere in the zero-to-five-year range. Factors that push sentences higher include whether the disclosure produced actual threats or physical harm, whether the defendant targeted multiple officials, and whether the conduct was part of a broader harassment campaign. Restitution is also on the table. Federal courts can order defendants to cover a victim’s out-of-pocket costs, which in doxxing cases might include relocation or security system installation.
Does the First Amendment Protect This Kind of Speech
Publishing information is expression, and any statute that punishes it will face constitutional scrutiny. The Supreme Court has long held, however, that “true threats” fall outside the First Amendment’s protection.
In Counterman v. Colorado (2023), the Court clarified the mental state prosecutors must prove in true-threats cases. The government must show that the defendant had “some subjective understanding of his statements’ threatening nature,” and recklessness meets that bar. A person is reckless when they consciously disregard a substantial risk that their communications will be viewed as threatening violence. Prosecutors do not need to show the speaker specifically wanted to frighten the target.4Supreme Court of the United States. Counterman v. Colorado, No. 22-138
Section 119 already requires proof of specific intent to threaten, intimidate, or incite violence, which is a higher bar than recklessness. If prosecutors can prove the statute’s intent element, a First Amendment challenge is unlikely to succeed. The harder cases sit at the margins, where someone publishes an official’s address in the course of political commentary without explicit calls for violence. Context drives those outcomes: who the audience is, how the information is framed, and whether reasonable people would read the post as encouragement to harm.
How Defendants Typically Push Back
Lack of Intent
The prosecution’s biggest hurdle is usually proving what was going on in the defendant’s head. If the information was shared as part of routine work, journalism, or public records research, the government’s case has a gap. Defense attorneys lean on context: the defendant’s other communications, the platform where the information appeared, whether accompanying language suggested hostility, and whether the defendant had ties to anyone likely to act on the disclosure. Digital forensics and communication records drive these cases on both sides.
Information Already Public
Another approach challenges whether the information was truly “restricted” in any meaningful sense. If a judge’s home address already appears in publicly accessible property records, or a phone number sits in an online directory, the defense can argue the defendant did not make anything public that was not already out there. The strength of this argument depends on how accessible the information actually was and whether the defendant added context, such as “here’s where Judge X sleeps,” that turned otherwise benign data into a targeting tool.
Misidentification
In cases built around online postings, proving who actually published the information can be harder than it looks. Shared devices, compromised accounts, VPN use, and anonymous platforms all create room for reasonable doubt about attribution.
How Long Prosecutors Have to Bring Charges
Federal prosecutors have five years from the date of the offense to bring charges under 18 U.S.C. 119. This is the default limitations period for non-capital federal crimes under 18 U.S.C. 3282, and Section 119 does not set a different window.5Office of the Law Revision Counsel. 18 USC Chapter 213 – Limitations
The clock starts when the information is made publicly available, not when the victim discovers it or when harm occurs. When posts stay live for years, courts have not squarely addressed under Section 119 whether each day of continued availability restarts the clock, though a continuing-violation theory has extended limitations periods in other federal contexts.
Where This Statute Stops and Others Pick Up
Section 119 is not the only tool against doxxing. In 2022, Congress passed the Daniel Anderl Judicial Security and Privacy Act, named after the son of federal Judge Esther Salas, who was killed in 2020 when a disgruntled litigant found the family’s home address online. The Anderl Act prohibits federal agencies from posting the personal information of active, senior, recalled, or retired federal judges and their immediate families, and it bars commercial data brokers from selling, trading, or licensing that information. It also gives judges a private right of action, so they can sue in civil court without waiting for federal prosecutors to file charges.6Congress.gov. S.2340 – Daniel Anderl Judicial Security and Privacy Act of 2021
State law fills other gaps. As of mid-2025, at least 19 states have enacted criminal doxxing statutes. Most protect all individuals, not just government officials, and typically criminalize the unauthorized disclosure of personal information with intent to harass or cause harm. Seven states limit protection to specific categories of public officials such as judges, law enforcement officers, and election workers. Because federal and state systems operate independently, a single act of doxxing can trigger prosecution under both Section 119 and a state statute without raising double jeopardy concerns.