Summary:
In 2017, Cloudflare, a web infrastructure and website security company, came under media scrutiny for hosting a U.S. based, self-proclaimed neo-Nazi website, The Daily Stormer. Despite numerous complaints to Cloudflare about The Daily Stormer promoting hate speech and inciting and promoting violence, Cloudflare refused to terminate its service provision. The company noted taking such a step would run contrary to its values of preserving freedom of expression and raised questions about whether taking action would align with its role as an infrastructure service provider.
Cloudflare, operating since 2009, offers services such as a content delivery network (CDS), and protection from several cyber threats including Distributed Denial of Service (DDoS) attacks—where hundreds of computers make requests to a website at once, overwhelming and bringing it down. Nearly 10% of all web page requests go through its servers, and in 2021 it had over 119 million customers. Cloudflare’s primary role is offering protection to websites.
Since its inception, Cloudflare has taken a libertarian approach, prioritizing freedom of speech and neutrality due to the role of its services in the infrastructure layer of the internet. Its co-founder and CEO Matthew Prince explained the company’s stance on free speech as follows: “A website is speech. It is not a bomb.” He further insisted that speech on a website does not necessarily result in imminent danger. Prince also noted that the nature of Cloudflare’s services mean that if it were to censor websites or deny its services, this would—at best—only slow a website’s performance and increase its vulnerabilities to attack rather than lead to its removal. That is, the site’s content would and could remain accessible regardless of Cloudflare’s refusal to provide services.
Prince’s assertion that a website is speech and not a bomb was challenged in May 2017 in a ProPublica article about Cloudflare’s role in providing The Daily Stormer security protection. Cloudflare had received numerous complaints about the nature of content on the site, including explicit content promoting white supremacy, anti-Semitism, Islamophobia, and misogyny. As part of its policies at the time, Cloudflare passed on these complaints and details of the complainants to The Daily Stormer. ProPublica also noted that The Daily Stormer’s founder, Andrew Anglin, had written in a blog post that he and others would “take revenge” against those who had reported his website: “there will be consequences.” This led to the complainants being doxxed on the website and a wave of subsequent harassment campaigns from its readers.
Soon afterwards Cloudflare updated its abuse policy, allowing complainants the option to no longer provide their identity and contact information.
In August 2017, The Daily Stormer actively promoted the Unite the Right Rally in Charlottesville, with Anglin writing an article about the death of anti-racism protester Heather Heyer entitled “Woman Killed in Road Rage Incident was a Fat, Childless 32-Year-Old Slut.” Hours later, GoDaddy, one of the Web’s largest domain registrars, announced it was canceling the site’s service for violating its terms of service policy by promoting and inciting violence. According to reports and a screenshot of the registration posted on Twitter, The Daily Stormer then transferred its domain name to Google. Shortly afterwards, Google announced that it, too, would distance itself from the site. Cloudflare was one of the last infrastructure companies that continued to provide services to The Daily Stormer.
Resolution:
After GoDaddy and Google refused to provide its services to The Daily Stormer, an anonymous user commented on the website: “They succeeded in everything except Cloudflare, whom I hear are secretly our /our people/ at the upper echelons.” The implication that Cloudflare was a secret supporter of their ideology led the company to stop providing its services to The Daily Stormer. In a blog post, CEO Matthew Prince explained why the company had decided it could no longer take a neutral position about the nature of the content on the site. He also explained why censorship of this nature was dangerous given Cloudflare’s unique role in the stack, outlining the challenges for a company like his in undertaking content policing. The Electronic Frontier Foundation (EFF), described the situation as “fraught,” but also cautioned that “any tactic used now to silence neo-Nazis will soon be used against others, including people whose opinions we agree with.” As for The Daily Stormer, it has bounced around the world searching for hosts but still remains active.
Company considerations:
- What are a company’s legal obligations in reviewing and/or moderating content on websites that it hosts and/or provides services for?
- Should infrastructure providers go beyond their legal obligations and proactively review and/or moderate content? If so, what kind of support (e.g., fiscal, personnel) is required?
- When it comes to the type of content a company allows, how detailed should acceptable use policies be?
- How might U.S. companies operating globally, establish freedom of expression norms for their platforms and/or services?
- What is the role of infrastructure companies in policing content? Does it matter where a company is in the stack?
- What are the tradeoffs and potential consequences infrastructure companies should be aware of when they start policing content?
Issue considerations:
- Should companies at different levels of the stack—from social media platforms to infrastructure providers to Internet Service Providers—have different responsibilities when it comes to the types of content they host or enable?
- Should infrastructure providers pursue active content moderation in the same way as social media platforms? What could some of the challenges be? Are these insurmountable?
- How appropriate is taking a content neutral approach when content may be “lawful but awful”?
- What are the unanticipated knock-on effects of infrastructure service providers like Cloudflare moderating and/or censoring content? What kind of precedent does Cloudflare’s decision set?
Written by Tasneem Akhtar, March 2022.