Cloudflare tries to explain why it protects far-right forums that stalk and harass victims On Wednesday content delivery network Cloudflare published a blog post explaining the circumstances under which abusive websites are eligible for service, just as a storm is brewing on that very topic. Penned by CEO Matthew Prince and VP Alissa Starzak, global head of public policy, the post is titled "Cloudflare's abuse …
Yeah, mea culpa. I was trying to write and edit two pieces at once, as we've got a rush of interesting pieces to get out.
I could have sworn trolls thought she was in either UK or Canada, and when I saw London, I assumed UK when I edited in that paragraph. That was stupid - I hate making mistakes.
It was fixed pretty quick. Don't forget to email corrections@theregister.com if you spot anything wrong.
C.
Not at all. They are saying Cloudflare should not support a site that openly harasses, doxxes, trolls, etc. innocent parties. Are you arguing they should be required to continue providing support for them to defend against DoS attacks unless there is another company willing to provide a similar service to them?
If I owned a vacant lot on a major intersection and I let people put up yard signs to advocate for their pet cause, political candidate etc. but someone started putting up pro Nazi signs should I not tell them to take a hike unless there is some assurance they'll find somewhere else willing to let them place their signs?
Cloudflare shouldn't be required to do anything.
Your analogy is a little off, since Cloudflare aren't hosting, they're just preventing illegal attacks against the site. It's more like arguing that the provider of the software that the site runs on should stop providing security updates.
Cloudflare is in a tough position here, but has staked out a rational and nuanced policy to balance both its responsibilities and liability. The lines they have drawn amount to: we will not host or amplify this content, nor will we assist those who wish to erase it from the internet to do so in an extrajudicial manner.
They are in the right there. Just as the trolls at Kiwi Farms shouldn't be doxxing people and harassing them, those that want them shut down just because they say so have plenty of legal avenues they aren't using here. The only almost salient point was that it makes it harder to pin the IP of the publishing server at a purely technical level, which is also irrelevant as they can reveal that with a court order. The sites activity and history give them ample grounds to work through the system, that's not what they are asking for. They want to be able to take direct action themselves, sans safeguards or oversight, instead of letting the people who's job it is to investigate, prosecute, and sanction criminals in either the operators or the victims jurisdictions. They are in essence vigilantes.
The investigation into the swatting incidents they spawned may end up shutting them down, but I'd rather we draw a line where we don't get in the habit of suppressing controversial speech without a legal investigation or court proceeding. Due process and all that. That is separate from nailing those involved for harassment and other criminal actions they have taken or concealed.
As a bonus thought, chasing them off a host providing the minimum of service and which can point the Feds to which server to raid to get evidence, redirect traffic to or through law enforcement, etc etc might be helping the trolls more than it hurts them.
For the most part, I actually agree with you, even as a trans person who has been on the receiving end of hate over the years.
However, the key problem which hasn't been solved... in many arenas, not just this one... is that the legal process takes a considerable amount of time. In that time, people have died, companies have gone bust, the consequences have reached points which can never be undone even if the courts find in favour of the injured party.
Cloudflare, and others like them, can't plead innocent here IMHO. The site is actively engaging in harassment with the aim, (of some of its users) of getting people to commit suicide. This goes well beyond freedom of speech and Cloudflare has no defence, in my eyes, for not dropping this site like a hot potato.
Brass tacks, is your grievance with Cloudflare their mere association or their prevention of crime against the criminal (or however you perceive KF)? Going further, if Cloudflare discontinued their protection and no DoS attack took place, would the criminal operators of botnets be morally failing for not turning their illegal capabilities towards the KF servers?
My main grievance is that they are protecting the people from being identified. I believe that with Cloudflare's protection, it's not possible to identify the actual hosting company and thus preventing legal process being served. It's also protecting the actual hosting company's reputation by keeping them out of the firing line, and that's prolonging any proper legal action, I believe.
> My main grievance is that they are protecting the people from being identified. I believe that with Cloudflare's protection, it's not possible to identify the actual hosting company and thus preventing legal process being served. It's also protecting the actual hosting company's reputation by keeping them out of the firing line, and that's prolonging any proper legal action, I believe.
They're not protecting anyone from lawful requests. All it takes is a valid court order and I'm sure they'll turn over that information. That's how legal process works, so is no impediment to instigating legal action. To ask for an extrajudicial path, in my opinion, aids only unlawful vigilante action.
Yet it seems to me that your real greivance isn't with companies preventing people being identified, it's what you identified earlier:
> However, the key problem which hasn't been solved... in many arenas, not just this one... is that the legal process takes a considerable amount of time.
So I would say advocating for a more expeditious legal process should perhaps be the focus of more energy in these cases!
There's nothing stopping Cloudflare from making it known who the customer is, while they still enjoy the protection against DDoS, etc. The two are not mutually exclusive. The fact that it requires an extra step to make a lawful request to Cloudflare first, exacerbates the issue.
The argument put forward that Cloudflare is a carrier is also a problem, because in telephone, email, etc. the party responsible can be identified. (caller ID, IP address, etc.) In the case of Cloudflare, it's not so straightforward and they are then a party to the issue at hand by dint of protection of the identity... and then adding time to the speed of progress.
So if you say advocating for a more expeditious legal process, wouldn't you say Cloudflare making public knowledge who is behind/hosting the site would be a step forward in that?
> There's nothing stopping Cloudflare from making it known who the customer is, while they still enjoy the protection against DDoS, etc.
Well not really. If the details of the customer are known, then the DDoS protection is ineffective because the attackers will just bypass Cloudflare and DDoS the customer directly instead.
> So if you say advocating for a more expeditious legal process, wouldn't you say Cloudflare making public knowledge who is behind/hosting the site would be a step forward in that?
No. Setting aside that that would be bypassing, rather than expediting, the justice system, any speed improvement would then be predicated on the cooperation of corporations. Which means that speed of justice becomes proportional to the PR impact of the case on a corporation's bottom line, rather than all people being equal in the eyes of the law.
Initiating a case again "John Doe" takes as much time as bringing a case against a named person or corporation, and getting a court to order disclosure of the real identity of an anonymous party in a legal case is most of the time the smallest of fries in terms of time usage.
Well not really. If the details of the customer are known, then the DDoS protection is ineffective because the attackers will just bypass Cloudflare and DDoS the customer directly instead.
They'd have to DDoS the whole hosting company with all IP's that they operate, and the hosting company can firewall any incoming traffic that isn't from cloudflare. Not practical, so I don't accept that as defence of not saying who the customer is.
Thank you for taking the time to reply. Their DNS privacy registrar is still clearly available and taking a legal order to them would render the site inaccessible. The IP of the host is necessarily obscured because otherwise it would be the DoS equivalent of putting a secure lock on a gate with no fence either side of it.
It's an interesting discussion, and one I think the industry/politicians/police need to have and bottom out.
The equivalent of a secure lock on a gate with no fence either side, is not necessarily the situation. A firewall at the recipients end that ditches all packets except those from Cloudflare should certainly hold against the kind of vigilante band of people that might want to attack... but even then, a notice as to who the end host is would be enough to be able to make progress without having to reveal a precise IP address.
After all, the only people I can see benefiting from this is people who know that they're likely to breach/host breaches of various laws before they even set up their forums. After all, if the people running the forums didn't allow this kind of conversation to happen on the services they run, then we wouldn't be having this discussion now. Open to being corrected on this, of course.
Thank you for continuing the discussion. The issue I can see with this approach is that it requires all customers on the host to then engage Cloudflare for protection or move to a different host, which strikes me as being somewhere between terrorism and extortion.
I can understand why pursuing hosts matches real-world intuition more closely but I think that domain name providers make more sense as the target for law enforcement. Indeed, this is what's been done against piracy (domain name seizure) so there's a precedent. I also understand the desire for urgency but I don't think the Internet would benefit overall from something that would enable the heckler's veto.
Thank you most kindly for the discussion.
If the hosting company restricted customers needing cloudflare to particular host servers, and those who didn't on others, then I believe that might be a feasible way around the issue.
I see what you're saying about the domain name, but it is possible to use a domain registered in another country and point the records to Cloudflare services... thus making it difficult for law enforcement to act against domain names very easily. Indeed if the victim is in another country again, then that requires different countries law enforcement to talk/act together and that all adds to the time.
I believe that if the hosting companies knew that they would be named by cloudflare, then they wouldn't take on toxic web sites and would be cautious in dealing with people who have history of running similar web sites that were shut down; stopping them from having a second bite of the cherry. Prevention being better than cure, etc.
I can see the technical merit in that but, again, think that's imposing upon a host based upon what are ultimately illegal actions.
I agree that there are international issues associated with domain name providers but those equally apply to hosts. I would say forcing a bad actor to change domain name has more impact on their operations than forcing a host change (since, from the user's perspective, a host change will still have the same URL).
I believe that, provided the content is legal, hosts shouldn't be fearful of hosting content. However, I recognise that this is impractical and people have the right to complain so I'm happy to settle for hosts not having to face illegal actions from vigilantes over legal content, with the freedom to take protective steps. I'm given pause for thought by the countries where I would be executed for my faith (specifically, lack of) or sexual orientation having populations numbering in the hundreds of millions. The law in the west may be weak against what the members of Kiwi Farm are accused of, but it is non existent in protecting corporations from pressure from less tolerant lands that might see communities that cater to my lifestyle shut down.
Cloudflare does what makes Cloudflare money. They're somewhat like a digital arms dealer. They shield businesses from the very criminals they shield from discovery.
Reg Mods - I did send you evidence of Cloudflare shielding criminals, as you requested in the past. Many more examples are available in Spamhaus and online forums. Besides, it would make a great story if Cloudflare accused The Register of hosting slanderous content in the comments section, as you fear may happen.
I had not had to endure 13 1/2 years (Summer 2002-Jan 2016) of "Bush = Hitler", followed by (Feb 2016 - present) of Trump being the new Hitler, I might be willing to listen to these claims. This is not the only data point. I'm too exhausted to even really be bothered much, other than to morn the Republic, when the next one happens.
If you want to drive modern Nazi's from the public internet, I ask that you first give a definition of Nazi that doesn't boil down to "whomever I say it is".
Because I believe I have ample cause to fear that I'm on the list of people to be driven off the internet.
> I ask that you first give a definition of Nazi that doesn't boil down to "whomever I say it is".
What about: I want the government to remove/discourage/exterminate group X because they are inherently inferior to group Y which I happen to have been born into,
ps. If you are thinking. I think that and I'm not a Nazi, I have news for you !
> What about: I want the government to remove/discourage/exterminate group X because they are inherently inferior to group Y which I happen to have been born into,
> ps. If you are thinking. I think that and I'm not a Nazi, I have news for you !
If you are thinking "I don't think that", then I likely have news for you.
Criminals, addicts, gamblers, prostitutes, Democrats, Republicans, Tories, toffs, plebs, the rich, the poor, capitalists, socialists, communists, or even Nazis themselves?
Everyone thinks themselves better than some other groupings, and exceedingly few actively wish to safeguard the rights of even those they despise.
Which is clearly a crime, rather than a free speech issue. Therefore do Cloudflare wish to knowingly provide services to a site that knowingly encourages such criminality? It's that knowledge that means that any claim to "neutral carrier" status doesn't hold up - any decision you make on whether or not to subsequently provide services to that site is definitely a decision on whether you care about the morality of doing so or not, and what you decide will say a lot about your company.
Section 230 has NOTHING to do with this.
Section 230 allows service providers to moderate some content without being responsible to moderate all content. Section 230 means that Twitter can kick out racists without being a publisher responsible for all content posted.
Without Section 230, comment sections on American sites would either go away completely or become a racist troll free-for-all, with no hope of any useful discussion whatsoever.
Section 230 keeps the internet alive.
If crimes are occurring, it's the job of law enforcement to stop them. The only way that the site stops operating if only Cloudflare (and other providers of similar services) drop them is through a crime (DoS) taking place; their activities don't make it any harder for law enforcement agencies to take appropriate action.
Actually my phone company contract says:
"The Customer is obliged to use the Service in compliance with the laws and regulations in force and the General Terms and Conditions. Any different use of the Service configures non-fulfillment by the Customer, with automatic termination of the Contract"
So if they know I'm using my line in such ways to commit a crime they have full rights to terminate my contract. Not so much people actually use their phone lines in such a way exactly because they can easily tracked.
These people (as in the people who try to get these sites dropped by service providers) are going to find out what tortious interference is.
Carry on with the insanity and lies.
Also smol PSA: Keffals isn't under attack because of Kiwi Farms, Keffals in under attack because Keffals is Keffals - go watch Keffals for yourself and figure it out for yourself.
Far right extremism get a lot of protection when it is a real danger and kill people in many countries.
Far right is responsible for massacres on many continents. Pinochet, Franco, Tōjō, Papadópoulos, Videla, Stroessner, Pétain, Montt and others have killed scores of people. But some still believe that allowing the people supporting their actions and propagating their ideas should be protected. That's nonsense. Al qaeda's free speech is not protected, far right extremists shouldn't be protected either.
== Bring us Dabbsy back! ==
Stalin, Mao, Pol Pot, Ceausescu... 'far'left', just stop it with the 'the left creates monsters too' bs. People who use the 'communism' schtick to justify why they should be dictators are not 'far left', they're simply opportunist thugs. Similarly Communism isn't 'far left', its just another way of hoodwinking the masses. I'm surprised you left Hitler out with his National 'Socialism' in your tripe.
"When she sought refuge in a hotel, Kiwi Farms posters figured out where she was from a photo she shared"
This is what an attention whore looks like.
If this forum of words is such a problem, why is the best example of a person with a problem (you did choose the best example right?) one who clearly revels in the controversy itself?
> For what you said to be true, posting a photo on one's Twitter blog would be sufficient to categorize them an "attention whore".
Nope.
You seem to have missed the part about her supposedly being in hiding. Posting selfies on Twitter is the opposite of laying low. It's the kind of thing someone would do if they valued attention more than their own safety.
That is, assuming they were ever really hiding, and weren't just doing it for the media attention it got them.
The U.S. has a law specifically for this. 18 U.S. Code § 1038 - False information and hoaxes.
https://www.law.cornell.edu/uscode/text/18/1038
I'm sure other countries have similar laws.
Cloudfare is thus aiding and abetting and is not immune to prosecution nor lawsuits.
You can talk smack all you want, but when it causes real harm to people, your right to talk that smack, ends.
...along with swatting laws and filing a false police report.
I'm not so optimistic.
Remember the party affiliation of most judges in the US and remember the direction the Supreme Court there as lead them on.
I can't imagine any court punishing CloudFlare for causing harm to trans-folk whether by direct support or by inaction.
The Justice Department might do something but once it gets as far as SCOTUS everything will be resolved in CloudFlare's favour.
Added to that, the Supreme Court under Justice Roberts is also the most business-friendly court in the last 100 years.
I hate that right and wrong are decided in capricious corporate policy, when we are meant to have the law to decide these things. It allows groupthink (which can get it wrong!) or whoever controls the purse strings, to decide who can us what regardless of whether a crime has or has not been committed!
I might not like so-and-so, for any number of reasons, but if an individual or company is not causing harm as per the constraints of the law, companies should do business with whomever. They should be forced to, in fact. Without a crime and legal constraints business transactions should not be questioned as 'hate speech'. One man's terrorist is another man's freedom fighter, and all that.
If you move from law to the court of public opinion to judge these things, you then move into total subjectivity. This will not work. 'Hate' won't disappear, understandings will not magically occur. If the idea is that power needs to be tyrannical in deplatforming hate, and it should torment alternative opinions, the only outcome will be great divisiveness, hate and misunderstandings - which, of course, is what we have seen in recent years.
Quote: "I hate that right and wrong are decided in capricious corporate policy, when we are meant to have the law to decide these things.
The law does not dictate what is right and wrong, it dictates was is legal and illegal. They are not the same thing.
There are plenty of laws in place that many, if not most, people would consider wrong or immoral.
If Cloudfare are guilty for being involved in Kiwi Farm's activities, then so should their ISP, and the phone company that provides the backbone, and the browsers used to browse the website. That the trans activists go after Cloudfare is partially because it's an easy target and partially for the publicity. The trans activists are just doing this to get publicity, knowing that Cloudfare won't bodge. The best thing Cloudfare can do is ignore the activists as bowing to them will just mean more legal attacks.
I am all for free speech that isn't designed to harass or worse certain individuals. Maybe I should yell "fire" the next time I'm at the cinema and say the stampede that I caused is OK as I was only exercising my right to "free speech".
Whatever happened to Facebook's "exclusion court"? Just wondering.
Seems to me that Cloudflare have a stricter set of rules for hosting and more lax for other services (with their common carrier argument on those)
A quick web search shows me Discord use Cloudflare as a DDN
Doxing is against Discord T&Cs ... but it happens.
Doxing occurs on all sorts of platforms e.g. Twitter, FB etc, again against their T&Cs, but happens.
I have zero clue what kiwi farms is like, but it appears from web searches that it claims to be legal (though it encourages unpleasant behaviour) and does not ban doxing.
https://kiwifarms.net/help/how-is-the-kiwi-farms-legal/
IANAL so no clue!
However, if the legality thing is true then I can see why Cloudflare provide them their product.
I don't like what I have read about Kiwi Farms, I don't like lots of web sites, but if they're legal I'm not going to clamour for them to be closed down as free speech is a thing (I know lots of people would dislike many of my views such as being pro choice, pro gun control etc.* & would love to close down sites in favour of such things)
* I'm not US but giving those as examples as we are talking about US rules typically.
How is this a left or right thing?
We have a group of a$$hats using a website to coordinate attacks on people they don't like for some reason.
It doesn't matter who the target is, this should not happen.
It could be a far-left site targeting far-right individuals, and the argument would still be the same. It's immoral and illegal, so shouldn't be happening.
Criticism of illegal actions by the far-right does not actually make someone far-left.
You've just demonstrated the mindset of the stupid. You treat any criticism of "your side" to be an attack, justified or not.
You are defending the actions of these people, because in your mind, anyone who criticises must be "far-left" (an insult in your eyes)
It's funny - I hear left-wing commentators criticise Biden etc when it's due, but you don't get the rest on the left suddenly accusing them of being "far right".
Rightwingers are tribal morons. You should stick to sports. Blindly supporting a political party under any circumstance leads to fascism.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
