Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Trump Media auditor charged by SEC with ‘massive fraud’

Biden honors distinguished Americans; Trump back in N.Y. court

Google’s empire is massive. A judge will soon rule if it’s a monopoly.

Israel’s offensive is destroying Gaza’s ability to grow its own food

Riot police and over 2,000 arrests: A look at 2 weeks of campus protests

‘It’s been abused’ Rep. McCaul on motion to vacate threat

An I bond is now at 4.28 percent. Are they still a good deal?

Use these 6 points to say no to a college you and your kid can’t afford

How this new rule protects retirement savers from costly advice

On Press Freedom Day, little to celebrate for Hong Kong’s journalists

Young Georgians want to be part of Europe. Their government is in the way.

Taxes are inevitable. Paying to prepare them doesn’t have to be.

What’s the best bus to New York? We tested 5 for comfort and value.

You asked: Do I need a passport for my cruise?

Adaptive equipment is making national parks more inclusive

The Capitals, a team in transition, know what they want this offseason

Is Pastis as good as our food critic thought? He sent spies to find out.

Nationals can’t solve Nate Eovaldi, drop series finale to Rangers

The New York Times, alone in its outrage over access to Biden

Wait, what is Stephen A. Smith talking about? Find out with our quiz.

Stephen A. Smith would like even more of your attention

Teen grabs wheel when driver passes out and school bus veers into traffic

Cat climbed into Amazon return box, found alive 630 miles away

Brave Little Hunter is free: Baby orca escapes lagoon for open seas

Ask Amy: Should I be the best man if I think the bride is abusive?

Carolyn Hax: Husband keeps pushing modest spouse to wear sexier clothes

Miss Manners: Host eats luxurious breakfast, leaves cereal for guest

Hope Hicks witnessed nearly every Trump scandal. Now she must testify.

State laws measure if a woman is close enough to death for an abortion

Journalism in India is under assault

The dangerous new call for regime change in Beijing

Ukrainian men abroad voice anger over pressure to return home to fight 

Big Tech news and how to take control of your data and devices

See more coverage in your recommendations

Technology

Tips delivered to your inbox twice weekly

The Tech Friend newsletter

Business and Tech alerts

Get the weekly Campaign Moment newsletter

Set alerts for major election developments

Election 2024

The Campaign Moment newsletter

Politics alerts

Saul Loeb

Epik long has been the favorite Internet company of the far-right, providing domain services to QAnon theorists, Proud Boys and other instigators of the Jan. 6 attack on the U.S. Capitol — allowing them to broadcast hateful messages from behind a veil of anonymity.

But that veil abruptly vanished last week when a huge breach by the hacker group Anonymous dumped into public view more than 150 gigabytes of previously private data — including user names, passwords and other identifying information of Epik’s customers.

Extremism researchers and political opponents have treated the leak as a Rosetta Stone to the far-right, helping them to decode who has been doing what with whom over several years. Initial revelations have spilled out steadily across Twitter since news of the hack broke last week, often under the hashtag #epikfail, but those studying the material say they will need months and perhaps years to dig through all of it.

“It’s massive. It may be the biggest domain-style leak I’ve seen and, as an extremism researcher, it’s certainly the most interesting,” said Megan Squire, a computer science professor at Elon University who studies right-wing extremism. “It’s an embarrassment of riches — stress on the embarrassment.”

Epik hack reveals the link between crytpo scammers and domain purchases

Epik, based in the Seattle suburb of Sammamish, has made its name in the Internet world by providing critical Web services to sites that have run afoul of other companies’ policies against hate speech, misinformation and advocating violence. Its client list is a roll-call of sites known for permitting extreme posts and that have been rejected by other companies for their failure to moderate what their users post.

Online records show those sites have included<b> </b><a href="https://www.washingtonpost.com/technology/2019/08/05/defiant-chan-vowed-fight-saying-its-heartbeat-is-strong-then-tech-firm-knocked-it-offline/" target="_blank">8chan</a>, which was dropped by its providers after hosting the manifesto of a gunman who killed 51 Muslims in Christchurch, New Zealand, in 2019; <a href="https://www.washingtonpost.com/technology/2018/10/31/silicon-valley-elite-social-media-hate-radicalization-that-led-gab/" target="_blank">Gab</a>, which was dropped for hosting the antisemitic rants of a gunman who killed 11 people in a Pittsburgh synagogue in 2018; and Parler, which was dropped due to lax moderation related to the Jan. 6 Capitol attack.

Monica Rodman

Sarah Hashemi

TheDonald’s owner speaks out on why he finally pulled plug on hate-filled site

Epik also provides services to a network of sites devoted to extremist QAnon conspiracy theories. Epik briefly hosted the neo-Nazi site Daily Stormer in 2019 after acquiring a cybersecurity company that had provided it with hosting services, but Epik soon canceled that contract, according to news reports. Epik also stopped supporting 8chan after a short period of time, the company has said.

Earlier this month, Epik also briefly provided service to the antiabortion group Texas Right to Life, whose website, ProLifeWhistleblower.com, was <a href="https://www.washingtonpost.com/nation/2021/09/06/texas-abortion-ban-website/" target=_blank>removed by the hosting service GoDaddy</a> because it solicited accusations about which medical providers might be violating a state abortion ban.

An Epik attorney said the company stopped working with the site because it violated company rules against collecting people’s private information. Online records show Epik was still the site’s domain registrar as of last week, though the digital tip line is no longer available, and the site now redirects to the group’s homepage.

Epik founder Robert Monster’s willingness to provide technical support to online sanctuaries of the far-right have made him a regular target of anti-extremism advocates, who criticized him for using Epik’s tools to republish the Christchurch gunman’s manifesto and live-streamed video the killer had made of the slaughter.

Monster also used the moment as a marketing opportunity, saying the files were now “effectively uncensorable,” according to screenshots of his tweets and Gab posts from the time.<b> </b>Monster also urged Epik employees to watch the video, which he said would convince them it was faked, <a href="https://www.bloomberg.com/news/features/2021-04-14/qanon-daily-stormer-far-right-have-been-kept-online-by-nick-lim-s-vanwatech" target=_blank>Bloomberg News reported.</a>

Monster has defended his work as critical to keeping the Internet uncensored and free, aligning himself with conservative critics who argue that leading technology companies such as Facebook, Twitter, Amazon and YouTube have gone too far in policing content they deem inappropriate.

Biden’s domestic terrorism strategy details unprecedented focus on homegrown threats

Monster did not respond to requests for comment from The Washington Post. But he said in an email to customers two days after hackers announced the breach that the company had suffered an “alleged security incident” and asked customers to report back any “unusual account activity.”

“You are in our prayers today,” Monster wrote last week, as news of the hack spread. “When situations arise where individuals might not have honorable intentions, I pray for them. I believe that what the enemy intends for evil, God invariably transforms into good. Blessings to you all.”

Since the hack, Epik’s security protocols have been the target of ridicule among researchers, who’ve marveled at the site’s apparent failure to take basic security precautions, such as routine encryption that could have protected data about its customers from becoming public.

The files include years of website purchase records, internal company emails and customer account credentials revealing who administers some of the biggest far-right websites. The data includes client names, home addresses, email addresses, phone numbers and passwords left in plain, readable text. The hack even exposed the personal records from Anonymize, a privacy service Epik offered to customers wanting to conceal their identity.

8chan vowed to fight on, saying its ‘heartbeat is strong.’ Then a tech firm knocked it offline.

Similar failings by other hacked companies have drawn scrutiny from the Federal Trade Commission, which has probed companies such as dating site Ashley Madison for failing to protect their customers’ private data from hackers. FTC investigations have <a href="https://www.washingtonpost.com/news/the-switch/wp/2016/12/14/ashley-madison-owner-agrees-to-pay-1-6-million-to-settle-u-s-investigations/" target=_blank>resulted in settlements</a> imposing financial penalties and more rigorous privacy standards.

“Given Epik’s boasts about security, and the scope of its Web hosting, I would think it would be an FTC target, especially if the company was warned but failed to take protective action,” said David Vladeck, a former head of the FTC’s consumer protection bureau, now at Georgetown University Law Center. “I would add that the FTC wouldn’t care about the content — right wing or left wing; the questions would be the possible magnitude and impact of the breach and the representations … the company may have made about security.”

Researchers poring through the trove say the most crucial findings concern the identities of people hosting various extremist sites and the key role Epik played in keeping material online that might otherwise have vanished from the Internet — or at least the parts of the Internet that are easily stumbled upon by ordinary users.

Ashley Madison owner agrees to pay $1.6 million to settle U.S. investigations

“The company played such a major role in keeping far-right terrorist cesspools alive,” said Rita Katz, executive director of SITE Intelligence Group, which studies online extremism. “Without Epik, many extremist communities — from QAnon and white nationalists to accelerationist neo-Nazis — would have had far less oxygen to spread harm, whether that be building toward the Jan. 6 Capitol riots or sowing the misinformation and conspiracy theories chipping away at democracy.”

The breach, first <a href="https://twitter.com/stevanzetti/status/1437482759241469958" target=_blank>reported</a> by the freelance journalist Steven Monacelli, was made publicly available for download last week alongside a note from Anonymous hackers saying it would help researchers trace the ownership and management of “the worst trash the Internet has to offer.”

After the hackers’ announcement, Epik initially said it was “not aware of any breach.” But in a rambling, three-hour <a href="https://www.youtube.com/watch?v=aZ9MFts28XI" target=_blank>live-stream</a> last week, Monster acknowledged there had been a “hijack of data that should not have been hijacked” and called on people not to use the data for “negative” purposes.

“If you have a negative intent to use that data, it’s not going to work out for you. I’m just telling you,” he said. “If the demon tells you to do it, the demon is not your friend.”

Several domains in the leak are associated with the far-right Proud Boys group, which is known for violent street brawls and involvement in the Jan. 6 attack on the Capitol and was <a href="https://www.washingtonpost.com/business/technology/facebook-takes-down-accounts-tied-to-roger-stone/2020/07/08/64ad31e4-c166-11ea-8908-68a2b9eae9e0_story.html" target=_blank>banned by Facebook</a> in 2018 as a hate group.

Trump’s ‘stand by’ remark puts the Proud Boys in the spotlight

A Twitter account, @epikfailsnippet, that is posting unverified revelations from the leaked data, included a thread purporting to expose administrators of the Proud Boys sites. One man who was identified by name as administrator of a local Proud Boys forum was said to be an employee of Drexel University. The university said he hasn’t worked at Drexel since November 2020.

Technology news site the <a href="https://www.dailydot.com/debug/ali-alexander-epik-hack-web-domains-capitol-riot/" target=_blank>Daily Dot</a> reported that <a href="https://www.washingtonpost.com/nation/2021/01/13/ali-alexander-capitol-biggs-gosar/" target=_blank>Ali Alexander</a>, a conservative political activist who played a key role in spreading false voter fraud claims about the 2020 presidential election, took steps after the Jan. 6 siege to obscure his ownership of more than 100 domains registered to Epik. Nearly half reportedly used variations of the “Stop the Steal” slogan pushed by Alexander and others. Alexander did not reply to requests for comment from the Daily Dot or, on Tuesday, from The Post.

Extremism researchers urge careful fact-checking to protect credibility, but the data remains tantalizing for its potential to unmask extremists in public-facing jobs.

Emma Best, co-founder of Distributed Denial of Secrets, a nonprofit whistleblower group, said some researchers call the Epik hack “the Panama Papers of hate groups,” a comparison to the leak of more than 11 million documents that exposed a rogue offshore finance industry. And, like the Panama Papers, scouring the files is labor intensive, with payoffs that could be months away.

“A lot of research begins with naming names,” Best said. “There’s a lot of optimism and feeling of being overwhelmed, and people knowing they’re in for the long haul with some of this data.”

Finalist for the Livingston Award in 2022. Member of the "Pegasus Project" team that won a George Polk Award in 2021. 

University of Florida

Drew Harwell is a reporter for The Washington Post covering technology. He was a member of an international reporting team that won a George Polk Award in 2021.

Drew Harwell

Connecticut College

Craig Timberg is a deputy managing editor for The Washington Post. Since joining The Post in 1998, he has been a reporter, editor and foreign correspondent, and he contributed to The Post’s Pulitzer Prize-winning coverage of the National Security Agency and the Jan. 6, 2021, attack on the U.S. Capitol.

Craig Timberg

Nieman Fellow, 2009, Harvard University

Overseas Press Club Hal Boyle Award for coverage of Iraq (McClatchy team)

George Polk Award for coverage of Syria (McClatchy team)

National religion reporting awards including the Wilbur, the Goldziher Prize and Religion News Association

University of Oklahoma, BA in mass communications

Hannah Allam covers extremism and domestic terrorism as part of the National Security team.