Cloudflare: Cybersecurity, or Complicity?

TL;DR It's both.

The tech company Cloudflare, whose motto is “Helping build a better Internet”, has often proved instrumental to the success of hate forums by providing anonymity to these spaces while claiming to remain neutral stakeholders.

As described by ProPublica in May 2017:

The operations of such extreme sites are made possible, in part, by an otherwise very mainstream internet company — Cloudflare. Based in San Francisco, Cloudflare operates more than 100 data centers spread across the world, serving as a sort of middleman for websites — speeding up delivery of a site’s content and protecting it from several kinds of attacks. […]

Getting booted around from service to service can make it hard to run a hate site, but Cloudflare gives the sites a solid footing.

Cloudflare’s CEO posted the following screed to the company’s blog in 2013, where it has remained ever since:

A website is speech. It is not a bomb. There is no imminent danger it creates and no provider has an affirmative obligation to monitor and make determinations about the theoretically harmful nature of speech a site may contain. —Matthew Prince

While Cloudflare professes to take a neutral stance, offering merely the technical backbone to keep websites up and secure, the company's associations muddy this claim of impartiality. Not only did Cloudflare once support Kiwi Farms—a forum notorious for harassment, doxing, and stalking vulnerable individuals—it also currently supports OnAForums, a cauldron of criminal activity that has led to a family being swatted over 40 times with little recourse.

These business relationships call into question Cloudflare's commitment to corporate responsibility, even as it insists on its role as a neutral internet service provider.

The veneer of neutrality Cloudflare maintains is more than just a corporate fig leaf—it's a rhetorical maneuver that serves dual purposes. On one hand, it allows the company to stake a claim as a "public utility," an essential service that should never be unplugged. On the other, this supposed impartiality also functions as an ideological lifeline for online spaces that are breeding grounds for hate and criminal behavior.

The illusion of neutrality isn't just self-serving; it actively fuels and legitimizes platforms that engage in harmful and illegal activities.

Empty platitudes from Cloudflare’s 2022 Impact Report.

While Cloudflare eventually decided to stop taking money from Kiwi Farms and 8chan in the face of overwhelming public pressure, as noted by Protocol, their executives didn’t really want to:

Multiple times in the post, the executives said terminating service to such sites represents a "dangerous precedent."

The Associated Press reported in September 2022 that Kiwi Farms had registered an alternate domain name through the Russian equivalent to Cloudflare, DDoS-Guard, in the event the site was deplatformed:

KiwiFarms.ru is registered to and protected by the Russian company DDoS-Guard, whose customers have in the past included Russian government websites including the Defense Ministry and cybercriminal forums where stolen credit cards are bought and sold.

Last year, DDoS-Guard protected the pro-Trump social media website Parler.com for a time after Amazon withdrew hosting services.

KiwiFarms.ru was registered on July 12, suggesting Moon, was aware Cloudflare could drop his site and thus created a backup plan.

By offering services like protection from cyberattacks and masking the website’s actual IP address, companies like Cloudflare and DDoS-Guard (another fig leaf, this time for the Kremlin) essentially enable their customers to operate with a greater degree of security.

However, the key methodology they employ to prevent sites from being taken offline by excess traffic also serves as a defacto anonymizing layer limiting the public from knowing where—in which country and on which network—a website is actually hosted.

This ties into the debate over the role of tech companies in policing or moderating harmful online content, especially when that content has potentially dangerous real-world consequences.

As previously stated by academic Nicholas Weaver on Twitter and republished in The Register:

Cloudflare's excuse for protecting Kiwifarms is bullshit: Their "Security" product is content-delivery with DOS protection and hiding the real host. Cloudflare's continued support for Kiwifarms despite the obvious violations of Cloudflare's own ToS is a deliberate act:

Cloudflare explicitly supports Kiwi Farms and their speech. It isn't being neutral here, it is advocating and supporting a forum that is dancing all over the Brandenburg line, actively inciting imminent lawless action.

Actively choosing to host platforms that are known to incubate extremist ideologies make companies like Cloudflare complicit in the outcomes of that extremism.