Introduction
In our last lesson, we built your "first-hour" triage checklist, a critical tool for containing the chaos of an online attack. One of the core steps in that checklist was documentation—a rapid, preliminary capture of evidence. Today, we elevate that step from a crisis response action into a systematic, robust protocol. The goal is no longer just to grab what you can in the heat of the moment, but to establish a formal process for documenting harassment that will stand up to scrutiny from platforms, employers, and even legal authorities.
This lesson's objective is to establish a protocol for documenting harassment to support reporting to platforms or authorities. For this, we will move beyond simple screenshots and think like a researcher. Given your background in operations research and statistics, you can conceptualize this protocol as designing a data collection and management system. The quality, structure, and integrity of the data you collect will directly determine the effectiveness of any subsequent action you take. A disorganized folder of screenshots is just noise; a well-documented log is evidence.
From Reactive Screenshots to Proactive Evidence Logging
The triage checklist from our last lesson is for surviving the initial storm. The protocol we build today is for the calm that follows, when you can methodically build a case. Systematic documentation serves several crucial functions:
- Pattern Recognition: A structured log allows you to analyze harassment over time, identifying patterns of escalation, recurring perpetrators, or coordinated activity (dog-piling). This transforms individual incidents into a demonstrable campaign of targeted harassment.
- Admissibility: For platform moderators or law enforcement, context and authenticity are everything. A proper log provides timestamps, URLs, and a clear narrative that is far more compelling and actionable than isolated, out-of-context images.
- Emotional Distancing: The act of transferring raw, abusive content into a structured, impersonal log is a powerful psychological tool. It turns a personal attack into a data point, helping you process it objectively and reducing its emotional impact.
- Efficiency: When you need to report an abuser or file a complaint, having all the evidence neatly organized, logged, and ready to go saves you the trauma of having to relive the harassment by digging through old messages and posts.
The core idea is to treat every instance of harassment as a data point to be captured with rigor and consistency.
Your Harassment Documentation Protocol
This protocol consists of four key components: a defined toolkit, a list of what to document, a structured log, and a principle of complete evidence. We will draw heavily from the expert guidance in PEN America's Online Harassment Field Manual.
This guide from the Online Harassment Field Manual is the foundational text for our protocol. It provides a clear, actionable framework for what to document and how. As you read, focus on the specific types of information they recommend capturing for different platforms and the rationale behind creating a structured log.
Please read the entire guide, starting from the introduction to understand the importance of this process. Pay special attention to the following sections: The section on delegation, which reinforces our previous discussion on activating a support network. The crucial advice on documenting your own responses, even if they are unfavorable. The detailed breakdown of what to document for emails, social media, and texts. The technical guidance on how to take screenshots and capture full pages. The final section on logging harassment, which introduces the concept of a structured abuse log.
Now, let's operationalize the advice from this guide into a personal protocol tailored to your needs.
1. The Toolkit: Your Documentation Arsenal
Have these tools set up and ready to use:
- A Secure, Dedicated Folder: Use a cloud service like Google Drive or Dropbox, and name it something neutral (e.g., "Social Media Records"). Inside, create a subfolder for each incident, timestamped like we did in the triage lesson (e.g.,
2023-11-05_IG_Comment_Harassment). - Full-Page Screenshot Tool: For capturing long comment threads or entire profiles, install a browser extension like GoFullPage, as recommended in the reading. This is far better than stitching multiple screenshots together.
- Spreadsheet Software: Google Sheets, Excel, or a similar program will serve as your master harassment log.
- Screen Recorder: For video-based harassment (e.g., in an Instagram Story or live stream), use your computer or phone's built-in screen recording function.
2. The Data Points: What to Capture for Each Incident
For every piece of harassing content, you must capture a complete record. Based on the PEN America guide, your goal is to save:
- The Content: A screenshot or screen recording of the abusive post, comment, or message.
- The Perpetrator: The username and a screenshot of their profile page.
- The Location: The URL of the specific post or a link to the user's profile.
- The Time: The date and time the content was posted. Most platforms show this. If not, record the time you saw it.
- The Context: Capture the surrounding conversation. For a comment, this means screenshotting your original post and the comments above the abusive one. This proves the harassment was unprovoked or demonstrates the context of the exchange.
This structured approach is one of the key protective strategies you can employ. "Document Everything" is not just about saving the abuse, but saving it in a way that creates a coherent and undeniable record.
3. The Log: Your Master Evidence Sheet
This is where your analytical skills come into play. Your spreadsheet log transforms a folder of image files into a searchable, sortable database of evidence. Create a spreadsheet with the following columns:
Incident_ID |
Date |
Time |
Platform |
Type_of_Abuse |
Perpetrator_Username |
URL_to_Abuse |
URL_to_Profile |
Evidence_File_Name |
Notes |
|---|---|---|---|---|---|---|---|---|---|
001 |
11/5/23 | 21:45 | Threatening Language | user123 |
[URL] |
[URL] |
001_user123.png |
"Comment on bikini top post. Said 'I'll find you.'" | |
002 |
11/6/23 | 09:10 | Character Assassination | anon_critic |
[URL] |
[URL] |
002_anon_critic.png |
"Tweet misrepresenting my views on polyamory. Tagged other community members." |
- Incident_ID: A unique number for each entry. This helps you link your notes to the specific evidence files.
- Type_of_Abuse: Categorize it. Is it a direct threat? Doxxing? Hate speech? Character assassination? This helps in identifying patterns.
- Evidence_File_Name: Name your screenshot file with the same ID for easy cross-referencing (e.g.,
001_user123.png). - Notes: This is for qualitative data. Did the user delete the comment later? Was this part of a pile-on? Is this the 5th time this user has done this?
This log is now your primary tool for reporting. When you report a user to Instagram, you can say, "This user has engaged in a pattern of targeted harassment. Please see incidents 001, 005, and 012 in my attached documentation." This is exponentially more effective than a single report.
4. The Principle of Complete Evidence
The PEN America guide gives a critical piece of advice: document everything, including your own replies. It can be tempting to delete an angry response you regret and only save the abuse directed at you. Do not do this. Legally and strategically, a manipulated or incomplete record can be used to completely discredit your case. It suggests you have something to hide.
Owning the entire exchange shows integrity and confidence in your position. It communicates that even if you were "mean to your cyberbullies," their actions constituted harassment and crossed a line. Your goal is not to prove you are a perfect victim, but to prove you were a targeted one.
This principle is directly echoed in the experiences of others in high-risk online spaces. The following guide, written for sex workers, highlights a similar documentation-first approach when removing unwanted content online.
Digital security guide for sexworkers - Projet Evasions
This guide provides a real-world example of documentation as a prerequisite for taking action. It's written from the perspective of someone managing a high-risk identity where documentation is not just for reporting but for personal safety and control over one's digital footprint.
Please read the section Takedown Requests. Focus on the process: Ava first finds the content, asks a friend for support, and then makes screenshots before submitting any removal forms. Also, note how the guide reinforces our protocol by pointing out that even when using disappearing messages, one should keep a backup in case things go wrong.
The example of Ava shows that in any situation where your online content can be weaponized—whether it's content about your lifestyle or your lingerie designs—a "document first, act second" policy is the professional standard for self-protection.
Conclusion
Today, we've formalized your approach to documenting online harassment, moving from a reactive scramble to a proactive, systematic protocol. This structured approach is your best defense and your most powerful tool for escalation.
Key Takeaways:
- A documentation protocol is a data management system. Its purpose is to create a body of high-integrity evidence for pattern recognition and reporting.
- Your protocol should include a toolkit, a clear process for capturing key data points (content, perpetrator, location, time, context), and a structured log to make the evidence searchable and analyzable.
- Always adhere to the principle of complete evidence, documenting the entire exchange, including your own responses, to maintain credibility.
- The "document first, act second" approach is a best practice used by professionals and activists who operate in high-risk online environments.
You now have a system for containing an attack (the triage checklist) and a system for building a case from the evidence (the documentation protocol). But a case is only useful if you have a plan for how to use it. When should you respond publicly? When should you engage in silent reporting? When is it best to do nothing at all?
In our next lesson, we will address these questions by formulating a communication strategy for responding to character attacks, including the critical criteria for deciding when to engage versus when to remain silent.