The battle over white-supremacist and extremist content surged into the tangled pipelines of the Web on Monday, as rival tech firms jockeyed for primacy and knocked the 8chan message board and other hate sites offline.
In the end, it was a largely unknown British-based provider of server hardware that put an end, if only temporarily, to 8chan. The anonymous message board had become notorious for promoting the kind of vile extremism echoed in a racist screed that was posted on the site minutes before the attack in El Paso, which left 22 people dead. Officials suspect the alleged shooter posted the manifesto, though they are still investigating its source.
The British firm’s action also knocked offline the neo-Nazi site Daily Stormer, which had defied takedown efforts since the Charlottesville white-supremacist demonstration in 2017.
"We took a clear pledge in making the Internet a safer place for all, and we would continue to cut entire infrastructure for any party we identify as facilitating mass shootings and extreme hate speech with intolerable consequences,” said Maria Sirbu, an executive at Voxility, the tech firm that blocked 8chan from the computer servers that powered the site.
“Someone needs to get to the core of [these] actions, and today this someone happened to be us,” she added. “Hopefully tomorrow it will be someone else.”
The calls to close down 8chan had begun within hours of the El Paso shooting when the site’s founder, Fredrick Brennan, told The Washington Post that the site needed to be shut down. On Sunday, the online guardian service that had long shielded 8chan from cyber attacks abandoned it, and the site disappeared, only to reappear when another company agreed to provide those services.
That’s when Voxility stepped in and cut off its services to that company.
Three mass shootings this year began with a hateful screed on 8chan. Its founder calls it a terrorist refuge in plain sight.
The modern Internet is a baffling maze of decentralized technical machines, each of them specialized to the task: domain registrars to handle website names and addresses; hosting services to store and deliver data; security firms to handle the flow of traffic and defend against attack. A single website can depend on dozens of various firms, all with differing policies, business initiatives and moral codes.
That interlocking dance often plays out seamlessly behind the scenes. But in rare cases such as 8chan’s, when public anger runs high, the leaders of those specialized tools can react in unpredictable ways and find themselves able to take action in the absence of clear laws over how extremist speech should be countered or controlled.
U.S. regulators have stepped carefully around the Internet’s fever swamps, worried about First Amendment speech protections, and U.S. law offers companies strong protections from legal liability for the content their users post. Some companies have also been reluctant to closely police content online in a way that would open them to allegations of heavy-handedness or censorship, or affect their bottom line.
“This is an area when no one really wants to take full responsibility, so the issues get pushed further and further down the tech stack,” said Lindsay Gorman, a fellow for emerging technology at the advocacy group Alliance for Securing Democracy.
“These takedowns end up being done on a case-by-case basis, often when there’s public attention, as opposed to in a consistent way,” she said. But that also means that every website is only as secure as its most vulnerable link: “You have so many layers of the Internet ecosystem, and so many levers to pull.”
One of 8chan’s most important partners was Cloudflare, which offers protections against site-crippling attacks. Its decision to drop 8chan on Sunday followed months of outrage and was capped by a day of public anguish by the company’s chief, Matthew Prince, who deemed the website a “cesspool of hate.” It “won’t fix hate online. It will almost certainly not even remove 8chan from the Internet,” Prince wrote in a blog post. “But it is the right thing to do.”
Proving Prince right, Cloudflare was quickly replaced by a company offering similar services, BitMitigate, whose rules offer wide leniency to its clients. “We leave law enforcement to the experts and will not stop service to any of our clients unless by final court order,” it says in its terms of service. The site has also held itself up as a bastion of free-speech protections for sites too objectionable for others to support, calling itself a “non-discriminatory” provider of “bulletproof . . . protection with a proven commitment to liberty."
But online data first noticed by Alex Stamos, a former Facebook security chief now running the Stanford Internet Observatory, revealed early Monday that the Vancouver, Wash.-based BitMitigate had only a fraction of Cloudflare’s server capacity. It depended on renting equipment from Voxility to stay afloat.
For Voxility, a U.K.-headquartered firm with an office in San Francisco, the decision to cut off BitMitigate came almost immediately. Though relatively unknown, Voxility provides the servers, routers and other key Internet hardware used to run data centers and tech firms around the world.
It’s “totally against our policy,” Sirbu said. “As soon as we were notified . . . we proceeded with [completely] removing” BitMitigate from their network. She said Voxility was making a “firm stand” and urged other Internet authorities to take more action toward “keeping the Internet a safer place.”
BitMitigate’s parent company, Epik, based outside Redmond, Wash., has loudly criticized what it calls “digital censorship” efforts designed to “incapacitate practitioners of lawful free speech.” The hosting and domain-name firm gained notoriety last year after backing the far-right site Gab.
Epik chief Rob Monster wrote Monday that the company had not solicited 8chan’s business but was now helping manage some of the site’s technical needs and was further evaluating whether to offer it other services, including a defense against cyberattacks. “We enter into a slippery slope when we start to limit speech that makes us uncomfortable,” Monster wrote.
8chan looks like a terrorist recruiting site after the New Zealand shootings. Should the government treat it like one?
The services provided by Cloudflare and BitMitigate form a key element of the Internet’s backbone. They help sites boost their speed, connect to users and guard against vigilante strikes such as distributed denial of service, or DDoS, attacks, in which hackers flood a site with traffic to knock it offline.
For 8chan, a site that has attracted no small number of online enemies through its years of promoting racist, sexist and offensive content, those services have helped ensure its survival. The site is largely independent from the advertising, hosting and technical giants that form the infrastructure for other websites and that can sometimes exert pressure on objectionable clients.
While they were beginning the shift to BitMitigate’s service early Monday, 8chan’s administrators said that viewers could expect minimal downtime as servers updated around the world, and they called the rocky transition “just a bump in the road.” The site’s “nerve center,” which shows the board’s active threads, included a message: “The heartbeat of 8chan is strong.”
But as the day progressed, 8chan’s top administrator, Ron Watkins, the son of the site’s owner Jim Watkins, announced that the site’s problems were worse than expected. He did not respond to requests for comment, but wrote in tweets that the site’s leaders were pursuing unnamed “strategies” to bring 8chan back online. If the deadlock continued, Watkins tweeted that he would consider bringing 8chan online without a shield against attacks, “like Ishmael in the Pequod."
In the hours before the site disappeared, some 8chan posters voiced fear and resignation over what they said was the site’s imminent demise. One board leader encouraged readers to migrate to a new refuge on a sister site “due to prevailing conditions of general reactionary rampancy and the unfavorable present conditions of this site.”
But many other 8chan posters said they were defiant against what they described as another attack in the online culture wars.
"I am skipping work tomorrow to sit on MS PAINT all f---ing day to create a red pill for normies,” wrote one poster, referring to a driving principle of the site’s most extremist “politically incorrect” board: creating memes that are so shocking or persuasive they will convert mainstream audiences to their side.
“WHEN 8CHAN GOES OFFLINE, EVERYONE’S GOING OUTSIDE AND SHOOTING,” another poster wrote. Those posts, and all others on 8chan, were minutes afterward knocked offline.
The takedowns showed how some companies have grown more emboldened in recent years about their sense of online responsibility. Prince, the Cloudflare chief, had wrestled with his previous decision to drop the Daily Stormer after the Charlottesville violence, telling employees, “I woke up in a bad mood and decided someone shouldn’t be allowed on the Internet. No one should have that power.” BitMitigate stepped in then to keep Daily Stormer online.
By Sunday night, Prince no longer voiced such reservations, terminating 8chan’s service with a fiery blog post saying its “lawlessness” had “contributed to multiple horrific tragedies. Enough is enough.”
Deirdre Mulligan, a faculty director of the Berkeley Center for Law & Technology, said one of the reasons companies such as Cloudflare and Voxility have such power is that speech online is treated differently than speech in the physical world. While real-world speech is protected by the First Amendment, she said, “these [Internet] things that operate like public spaces are privately owned.”
Groups that want to set up websites are reliant on private companies to ensure their sites can be reached. As such, she said, there may not always be “a corner for them to set up a soapbox and spread their vitriol."
Jay Greene contributed to this report.