Cloudflare tries to explain why it protects far-right forums that stalk and harass victims

On Wednesday content delivery network Cloudflare published a blog post explaining the circumstances under which abusive websites are eligible for service, just as a storm is brewing on that very topic.

Penned by CEO Matthew Prince and VP Alissa Starzak, global head of public policy, the post is titled "Cloudflare's abuse policies & approach." It tries to clarify why the company sometimes moderates abusive content and sometimes doesn't.

Cloudflare's policy tour doesn't address the post's timing, but it coincides with a campaign to convince the internet infrastructure biz to stop supporting Kiwi Farms, which those against the site describe as "a far-right hate forum where users create and participate in threads dedicated to the harassment of online figures, primarily featuring neuro-divergent and transgender individuals."

In 2019, following the mass shooting at a Christchurch mosque, New Zealand authorities had the country's ISPs block Kiwi Farms in response to site owner Joshua Moon's refusal to turn over data on posts related to the shooting.

More recently, Kiwi Farms has been linked to the harassment and doxing of trans streamer Clara Sorrenti, known as @keffals on Twitter and Twitch, who has been organizing with sympathetic members of the internet community to pressure Cloudflare to stop providing services to the forum.

Sorrenti not only had her personal information dug up and posted online, trolls sent armed police to her home in a swatting attack and had her arrested and detained for hours. When she sought refuge in a hotel, Kiwi Farms posters figured out where she was from a photo she shared, and let her know by sending pizza repeatedly to her room, forcing her to move from Airbnb to Airbnb rentals.

In years past, Cloudflare dropped other customers for hateful content, including neo-Nazi site The Daily Stormer (2017) and notorious message board 8chan (2019). But the company continues to provide security – its reverse proxy service – that helps Kiwi Farms defend against denial of service attacks and keeps the web forum online.

To hear Prince and Starzak tell it, Cloudflare has different standards for different products. It has an Acceptable Hosting Policy for hosted content, but doesn't apply those rules to its security offerings.

"Hosting products are those products where Cloudflare is the ultimate host of the content," said Prince and Starzak. "This is different from products where we are merely providing security or temporary caching services and the content is hosted elsewhere."

Prince and Starzak argue that Cloudflare's security service can be compared to a government-regulated common carrier, even though internet services are regulated differently than communication services. Phone-based harassment is one-to-one and is punishable under the Federal Communications Act.

"Just as the telephone company doesn't terminate your line if you say awful, racist, bigoted things, we have concluded in consultation with politicians, policy makers, and experts that turning off security services because we think what you publish is despicable is the wrong policy," their post says. "To be clear, just because we did it in a limited set of cases before doesn’t mean we were right when we did. Or that we will ever do it again."

Not impressed

In response to Cloudflare's canned statement, Nicholas Weaver, senior researcher of networking and security at UC Berkeley's International Computer Science Institute, dismissed the corporation's rationalization.

"Cloudflare's excuse for protecting Kiwi Farms is bullshit: Their 'Security' product is content-delivery with DOS protection and hiding the real host," Weaver said via Twitter. "Cloudflare's continued support for Kiwi Farms despite the obvious violations of Cloudflare's own ToS is a deliberate act."

He continued, "Cloudflare explicitly supports Kiwi Farms and their speech. It isn't being neutral here, it is advocating and supporting a forum that is dancing all over the Brandenburg line, actively inciting imminent lawless action."

Alejandra Caraballo, clinical instructor at Harvard Law School's Cyberlaw Clinic, offered a similar response to Cloudflare's post.

"Cloudflare wants dead trans people," Caraballo said via Twitter. "This is their legacy by working with Kiwi Farms. They are knowingly complicit in the cyberstalking, harassment, and threatening of trans people to the point of suicide. They offer the protections that enable this to happen."

Those arguing for human rights have often invoked the phrase "silence is complicity," or a variation on that theme, to encourage active opposition to injustice. In his advocacy last year for COVID-19 Hate Crimes Act US President Joe Biden urged people to speak out against hatred. "Silence is complicity," he said.

The Register asked Cloudflare to respond to Weaver's condemnation of the company's behavior, to explain how Kiwi Farms is not in violation of the company's Terms of Service, and to enumerate which injustices it will address and which it will ignore.

Cloudflare has not responded. ®