Start With Conduct, Not The Word Harassment
Harassment laws differ by state and setting. Some focus on threats, repeated communication, alarming conduct, protected characteristics, workplace behavior, school behavior, or online conduct. A factual account should therefore identify the words and acts rather than assume one legal label covers everything.
One offensive comment may violate a platform or workplace policy without being a crime. A campaign involving threats, impersonation, repeated contact, false reports, doxxing, or coordinated targeting can present a different level of harm.
Sources: FBI: Threat Intimidation GuideU.S. Department of Justice: Stalking
Online And Offline Conduct Often Belong To The Same Campaign
A person may use texts, calls, social media, email, review sites, workplace complaints, mail, deliveries, in-person appearances, and third parties. Organizing evidence by event reveals coordination that is easy to miss when each platform is viewed alone.
Impersonation and doxxing can trigger harassment by strangers. Preserve the original post, account, URL, audience, replies, and resulting contacts. A screenshot of one abusive reply does not explain who initiated the campaign or how far it spread.
- Direct threats and conditional threats.
- Repeated contact after a clear request to stop.
- Release of addresses, phone numbers, work locations, or private images.
- Impersonation, fake profiles, forged messages, and false reports.
- Recruiting or encouraging other people to make contact.
Sources: FBI: Threat Intimidation GuideSPARC: Identifying Stalking Behaviors
A Threat Should Be Recorded Word For Word
Do not summarize “they threatened me” when the exact statement is available. Save the full wording, account or number, date, time, context, attachment, and what happened next. Note references to weapons, locations, schedules, family, prior violence, deadlines, or information the sender should not know.
A threat can be serious even when it is framed as a joke, prediction, song lyric, meme, or statement about what someone else might do. At the same time, context matters. Preserve the surrounding conversation rather than extracting only the most alarming line.
Sources: FBI: Threat Intimidation Guide
Preserve Before Blocking, Reporting, Or Deleting
Platforms can remove posts, suspend accounts, or hide messages after a report. Capture the content and identifiers first when doing so does not increase danger. Keep original emails and voicemails, export full conversations, and save files in a controlled folder with a simple index.
Do not crop away usernames, timestamps, URLs, headers, or context. If the content is changing rapidly, a screen recording can show the path to the post, but the original link and file remain important.
- Account display name and unique handle or profile URL.
- Phone number, email address, message header, or platform identifier.
- Exact content with date, time, and time zone.
- Audience, shares, replies, and people who received the content.
- Platform report number, police report number, and response received.
Sources: SPARC: Stalking Documentation Log
Anonymous Does Not Mean Untraceable, But Attribution Takes Evidence
A username, writing style, or timing coincidence may suggest a person but rarely proves identity alone. Attribution can involve account records, login data, devices, reused images, payment information, recovery details, witness knowledge, and conduct only the sender would know. Much of that information requires platform cooperation or legal process.
Do not publicly accuse a suspected person while the evidence is incomplete. A false attribution can harm an uninvolved person, provoke retaliation, and give the actual sender time to change methods.
Sources: FBI: Threat Intimidation GuideCISA: Reporting Cybercrime
The Response Should Match The Setting And Risk
A workplace, school, landlord, platform, police department, attorney, or court addresses different parts of the problem. Provide each one with a concise chronology and the evidence relevant to its authority. A platform policy report may remove content but will not create a criminal case; a police report may document threats but will not automatically stop workplace retaliation.
When danger is immediate, call 911. When conduct is persistent but not immediate, keep connecting reports to the same pattern and document the effect on work, school, housing, travel, health, and safety.
Sources: FBI: Threat Intimidation GuideU.S. Department of Justice: Stalking
Public Arguments Usually Produce More Noise Than Proof
Replying publicly can spread the content, alert the sender to evidence collection, expose private facts, and make it harder for an outside reviewer to distinguish the original conduct from the conflict that follows. A long counter-campaign can also become evidence in its own right.
Choose a contact rule, preserve violations, and keep public communication limited to what the safety and reporting plan requires. Correcting a necessary factual record is different from engaging the harasser repeatedly.
Sources: SPARC: Stalking Risk And Safety
Harassment Becomes Stalking When The Broader Pattern And Fear Elements Are Present
Harassment and stalking can overlap. Repeated messages may be harassment; the same messages combined with following, surveillance, location knowledge, threats, and unwanted appearances may form a stalking course of conduct. Preserve all connected events rather than assigning each to a separate problem.
The labels can change as conduct escalates. Update the safety plan and reports when the person gains access, changes channels, involves others, appears in person, or moves from humiliation to threats.
Sources: SPARC: Identifying Stalking BehaviorsU.S. Department of Justice: Stalking
Keep One Master Chronology And Build Short Reports From It
A workplace, school, platform, landlord, police department, attorney, and court may each need a different slice of the same conduct. Maintain one private master chronology with every incident, original file, witness, report number, and effect. Then prepare a shorter factual summary for the recipient instead of rebuilding the story from memory each time. This keeps dates and wording consistent without overwhelming a reviewer with unrelated material.
Each short report should identify the current concern, the most relevant earlier incidents, the action requested, and where the supporting evidence can be found. Retain the response, case or ticket number, and any promised next step in the master file. When the behavior changes channels or settings, the connected chronology prevents each organization from seeing only an isolated message.
Sources: SPARC: Stalking Documentation LogFBI: Threat Intimidation Guide
Questions People Ask About Harassment
Is one abusive message criminal harassment?
It may violate policy or another law, but harassment offenses often depend on threats, intent, repetition, or context. Preserve the message and describe the conduct without assuming the charge.
Should a person delete harassment after reporting it to a platform?
Keep an independent copy first. Platform access can disappear after content removal or account suspension.
Can police identify an anonymous account?
Sometimes, but attribution may require preserved platform records and legal process. A username or writing style alone is usually not enough.
What is the difference between harassment and stalking?
They can overlap. Stalking generally requires a repeated course of conduct directed at a person that causes legally defined fear or safety concern. Harassment is broader and varies by setting and jurisdiction.
Should family and friends reply to defend the target?
Usually not without a plan. Group replies can expand the conflict, reveal information, contaminate evidence, and create additional targets.