Internet security company BitMitigate appears to have been knocked offline after its primary server provider, Voxility, objected to BitMitigate’s decision to provide security services to the website 8chan.
BitMitigate — originally founded in Vancouver and now a subsidiary of Seattle-based domain registration company Epik — began working with 8chan on Sunday, a short time after fellow security company CloudFlare cut off service for the website. In a blog post on Sunday, CloudFlare CEO Matthew Prince said his company had dropped 8chan because the site has been used by multiple white nationalists as a platform to spread their messages when committing terrorist attacks.
The suspect in Saturday’s mass shooting at a Walmart in El Paso, Texas — which killed 22 people and injured more than two dozen others — appears to have posted a manifesto on 8chan right before the attack. The suspects in the March attack on two mosques in Christchurch, New Zealand, and the April attack on a synagogue in California appear to have similarly posted hate-filled screeds to 8chan shortly beforehand.
CloudFlare and BitMitigate both offer protection from Distributed Denial of Service (DDoS) attacks, a type of cyberattack in which a website is bombarded with an overwhelming number of connection requests with the goal of crashing its servers. Without Cloudflare’s support, 8chan went down almost immediately, according to multiple media reports.
On Sunday, a twitter account purported to belong to 8chan co-owner Ron Watkins acknowledged that Cloudflare had dropped the site and in a subsequent tweet he stated that 8chan would be switching to BitMitigate. Watkins’ subsequent tweets indicated that 8chan had gotten at least partially back online by early Monday morning.
But later in the morning, internet infrastructure provider Voxility announced that it would be cutting off support for BitMitigate and its parent company Epik in response to the decision to provide service to 8chan.
“We do not tolerate hate speech in any form,” Voxility spokeswoman Maria Sirbu said in an email. “This is a firm stand from our team, and we will not reinstall services for Epik/BitMitigate under (any) circumstances.”
Epik and BitMitigate rented dedicated servers from Voxility, Sirbu said, and used them to sell hosting services to third parties. She said Voxility learned approximately three weeks ago that Epik was providing services for neo-Nazi website The Daily Stormer, and responded by cutting access to IP addresses related to the website.
After learning that BitMitigate had begun providing security services for 8chan, Voxility made the decision to cut Epik’s access off entirely and drop them as a client, Sirbu said.
Bitmitgate’s security services also ran on server space rented from Voxility, according to BitMitigate founder and former owner Nicholas Lim, so Voxility’s decision will halt all of the subsidiary’s operations unless Epik decides to seek out an alternate server host and is able to find one.
By late Monday morning, 8chan had gone down again, and BitMitigate’s own website was also unreachable — likely a result of Voxility’s decision, Lim said.
Epik bought BitMitigate in February, and Lim initially joined Epik as the company’s chief technology officer, but he told the Columbian on Monday that he has left that role and now works for Epik on a third-party contractor basis through a separate company he owns called Vanwa Tech.
Lim said he no longer directly controls BitMitigate and was not involved in the decision to provide services to 8chan. It will be up to Epik to decide whether to find a new server provider for BitMitigate, he said — although he acknowledged that he would likely be contracted to implement the switch if Epik decided to pursue it.
Epik did not immediately reply to a request for comment.
BitMitigate’s history
Lim, a Vancouver resident, founded BitMitigate in 2017. The company is a small player in the cybersecurity field compared to CloudFlare, but it has grown quickly — in February, Lim stated that he employed a team of more than 10 people and the company’s client websites received a combined 50 million page views per month on average.
This isn’t the first time BitMitigate has received attention for its choice of clients. In August 2017, BitMitigate began providing security services for The Daily Stormer after CloudFlare dropped the site for posting an article mocking Heather Heyer, the woman killed during protests in Charlottesville, Va., earlier that month.
In an article posted on BitMitigate’s website at the time, Lim stressed that his company did not create or endorse any of The Daily Stormer’s content, but he condemned the idea of corporations having the power to regulate or censor content.
Epik has its own history of controversial clients — most notably Gab, a social media site that doesn’t ban hate speech. Epik became the new domain registrar for Gab in November 2018 after other services dropped the site when it was revealed that the alleged perpetrator of the October 2018 attack on the Tree of Life synagogue in Pittsburgh was a frequent Gab user.
In a blog post, Epik CEO Rob Monster offered a rationale similar to the one Lim gave regarding The Daily Stormer — he described the decision as a nonpartisan free speech issue, and argued that “de-platforming” actions taken by other providers and others were tantamount to “digital censorship.”
But in a January post on its Hatewatch blog, the Southern Poverty Law Center wrote that Monster’s willingness to host Gab and similar websites means that he is “cornering the market on websites where hate speech is thriving.”
The balance between allowing free speech and enabling white supremacy has been an ongoing discussion in the internet industry and community.
After Cloudflare dropped The Daily Stormer — the first time the company had ever cut a client off from its services — Prince said the decision was a difficult one and expressed discomfort with the notion of online service companies acting as arbiters for content.
Prince reiterated that position in his blog post about 8chan, and said the company hoped to see political action taken to define the obligations for web service companies, rather than leaving them to try to figure out a framework on their own.
“Cloudflare is not a government,” he wrote. “While we’ve been successful as a company, that does not give us the political legitimacy to make determinations on what content is good and bad. Nor should it. Questions around content are real societal issues that need politically legitimate solutions.”
