Cloudflare changes abuse policy but refuses to “censor the Internet”

Network operator Cloudflare came under fire last week from ProPublica, which wrote a lengthy article arguing that the Internet company “helps serve up hate on the Web.” According to ProPublica, Cloudflare does this by providing service to any website operator and failing to provide anonymity to people who complain about racist or otherwise abusive online content.

In response, Cloudflare has changed its abuse-reporting system to allow for anonymous complaints. But the company says it still has no intention of taking steps that it says would effectively censor the Internet.

Cloudflare co-founder and CEO Matthew Prince discussed the controversy and the company’s response in a blog post yesterday. Cloudflare’s abuse reporting system tells people using it that “Cloudflare will forward all abuse reports that appear to be legitimate to the responsible hosting provider and to the website owner.” By submitting a report, the submitter is consenting to have their information released to the website owner or hosting provider, the disclaimers say.

Cloudflare assumed that people who submit abuse reports would read and understand these disclaimers, but it turns out that people “were surprised that we forwarded their full abuse report to the host who then, in some cases, could forward it to the site owner,” Prince wrote.

As ProPublica wrote:

Cloudflare also has an added appeal to sites such as The Daily Stormer [a neo-Nazi site]. It turns over to the hate sites the personal information of people who criticize their content. For instance, when a reader figures out that Cloudflare is the Internet company serving sites like The Daily Stormer, they sometimes write to the company to protest. Cloudflare, per its policy, then relays the name and e-mail address of the person complaining to the hate site, often to the surprise and regret of those complaining.

This has led to campaigns of harassment against those writing in to protest the offensive material. People have been threatened and harassed.

Starting later this week, Prince wrote, people who submit abuse reports to Cloudflare “will have the choice of whether to do so anonymously.” The abuse reporting system allows people to report threats and child sexual-abuse material.

Prince said he is concerned that the new anonymous reports might create other problems.

“Anonymous reporting opens a new vector for malicious actors to submit false reports and harass Cloudflare customers,” he wrote. “In addition, for responsible Cloudflare customers who want to act on reports, anonymous reports may make it more difficult for them to gather more information from the reporter, which may make it more difficult for well-informed action to be taken to address the issue.”

But on balance, Cloudflare seems to think that allowing anonymous reports is the best solution for now. The company expects that it will continue to need to make changes to its abuse-reporting system “as new problems arise.”

No Internet censorship

Prince also gave what he called his “final thoughts on censoring the Internet.” ProPublica’s article compared the policies of Cloudflare to the policies of hosting providers such as Rackspace and GoDaddy, which have refused to host certain content. But Cloudflare is not a hosting provider, Prince pointed out.

“The best way to fight hateful speech is with more speech.”

Specifically, Cloudflare operates a global network that improves performance of websites and protects them from DDoS attacks and other security threats. The company offers a free tier and several paid plans. Cloudflare does not “store the definitive copy” of websites, so websites wouldn’t necessarily go offline even if Cloudflare decided not to serve a specific customer, Prince wrote.

But Cloudflare terminating customers could make it harder for websites to withstand attacks designed to take them offline. The Cloudflare service hides the location of a website’s hosting provider so that attackers cannot target the host directly.

“Cloudflare is more akin to a network than a hosting provider,” Prince wrote. “I’d be deeply troubled if my ISP started restricting what types of content I can access. As a network, we don’t think it’s appropriate for Cloudflare to be making those restrictions either.”

Although Cloudflare executives and employees disagree with the content of some websites that use Cloudflare services, Prince argued that the political beliefs and biases of companies should not “determine what can and cannot be online,” especially “as more and more of the Internet sits behind fewer and fewer private companies.”

“From time to time, an organization will sign up for Cloudflare that we find revolting because they stand for something that is the opposite of what we think is right,” Prince wrote. “Usually, those organizations don’t pay us. Every once in a while one of them does. When that happens, it’s one of the greatest pleasures of my job to quietly write the check for 100 percent of what they pay us to an organization that opposes them. The best way to fight hateful speech is with more speech.”