Cloudflare stops services to 'revolting' hate site
Escalation of targeted threats is an 'emergency' that required 'dangerous' decision 'we are not comfortable with,' says CEO
Cloudflare has decided to stop providing its services to Kiwi Farms, just days after defending the site's eligibility for its services.
Kiwi Farms is an online forum that frequently features vicious harassment of minority communities and individuals. Some members have even organised real-world harassment, doxing, and swatting of targets they hate. Three suicides are credibly linked to hateful harassment initiated by Kiwi Farms members.
Harassment on the forums led to a campaign asking Cloudflare to drop the site, in the public interest.
Revolting content alone does not create an emergency situation that necessitates the action we are taking today
Cloudflare last week responded to that campaign with an explanation that its policies mean it would continue serving the forums.
"Hosting products are those products where Cloudflare is the ultimate host of the content," wrote CEO Matthew Prince and VP Alissa Starzak at the time. "This is different from products where we are merely providing security or temporary caching services and the content is hosted elsewhere."
On Sunday, Prince announced that Cloudflare had stopped serving Kiwi Farms.
“This is an extraordinary decision for us to make and, given Cloudflare's role as an Internet infrastructure provider, a dangerous one that we are not comfortable with,” Prince wrote, adding: “However, the rhetoric on the Kiwifarms [sic] site and specific, targeted threats have escalated over the last 48 hours to the point that we believe there is an unprecedented emergency and immediate threat to human life unlike we have previously seen from Kiwifarms or any other customer before.”
Price said Cloudflare's decision was based on the escalation of threats posted to Kiwi Farms, not the campaign to have the company deny service to the forum.
“Kiwifarms has frequently been host to revolting content. Revolting content alone does not create an emergency situation that necessitates the action we are taking today,” Prince wrote.
- Twilio, Cloudflare just two of 135 orgs targeted by Oktapus phishing campaign
- Cloudflare: Someone tried to pull the Twilio phishing tactic on us too
- Akamai: We stopped record DDoS attack in Europe
- Apple network traffic takes mysterious detour through Russia
"We are also not taking this action directly because of the pressure campaign," Prince wrote on Sunday, saying that Cloudflare has "empathy for its organizers" but the company is "committed as a security provider to protecting our customers even when they run deeply afoul of popular opinion or even our own morals."
"However, as the pressure campaign escalated, so did the rhetoric on the Kiwifarms site. Feeling attacked, users of the site became even more aggressive. Over the last two weeks, we have proactively reached out to law enforcement in multiple jurisdictions highlighting what we believe are potential criminal acts and imminent threats to human life that were posted to the site."
Prince said the decision leaves Cloudflare's abuse policies unaltered, and lamented having to make the decision in the absence of "a mechanism when there is an emergency threat to human life for infrastructure providers to work expediently with legal authorities in order to ensure the decisions we make are grounded in due process."
"Unfortunately, that mechanism does not exist and so we are making this uncomfortable emergency decision alone," the CEO wrote.
Prince added that he expected the decision would see Kiwi Farms find another provider, a prediction that has come to pass: Kiwi Farms has moved to a Russian domain and found another DDoS prevention service. The Register spent a few seconds on the site to verify it can be accessed and immediately found a thread disputing Prince's account of Cloudflare's assessment of escalated threats appearing on the forum. ®