Pulling the ripcord perilously close to impact

Cloudflare claims that its mission is to "build a better Internet." Yet, its actions to protect the neo-Nazi site Kiwi Farms for almost a decade have ensured a hostile internet for members of many marginalized groups. Cloudflare's content policy and its reporting policies are ineffective and potentially even harmful. For the past decade, Cloudflare's customers have indirectly supported the harm that Cloudflare's hateful clients perpetuate.

Transgender people have pressed Cloudflare for years on this matter. All of these efforts were met with silence. However, the most recent attempt with Clara "Keffals" Sorrenti's #DropKiwifarms campaign has unfolded differently. After weeks of pressure, Cloudflare published a public explanation for maintaining access to Kiwi Farms on August 31st, 2022. But these justifications proved to be nothing more than a smokescreen for potentially deadly outcomes.

Indeed, just three days later on September 3, 2022, Cloudflare abruptly took the site down and admitted that it had observed not just "abhorrent", but "potential criminal acts and imminent threats to human life" that it stated were no longer an acceptable risk. Transgender people should not have to be the canaries in the coalmine for what is and is not acceptable risk in the eyes of a corporation led by cisgender people. We should be consulted from the beginning, rather than cut out of the loop. Additionally, involving law enforcement (who have historically ignored violence against us or perpetuated it themselves) does not absolve Cloudflare of a responsibility to warn us directly and protect us.

Three transgender people have died from sustained harassment campaigns enacted by Kiwi Farms. Countless unknown others may have silently taken their lives after being unable to find work or support due to Kiwi Farms. We have been warning Cloudflare for years that Kiwi Farms intentionally causes serious emotional distress, calls in false police reports to incite SWATting, and openly clamours for the murder of transgender people.

I welcome Cloudflare's action to deplatform Kiwi Farms, but it comes years too late to save any of the countless victims. In fact, Cloudflare has explicitly reaffirmed their earlier statement that they intend to protect similar hate sites that have the self-restraint to stay just shy of the Brandenburg line of imminent threat. Cloudflare has claimed:

That providing their anti-denial of service and caching capabilities to all is necessary to protect minorities against authoritarian censorship.
That they believe that they can "offset" any harms caused by hateful customers with donations to charities that support the targets of those hateful customers.
That they are a responsible service provider because they have a strong enforcement policy against content that they host rather than protect, proxy, or cache.
That it's inevitable someone will host it, so it may as well be them.

None of these claims hold up under scrutiny. Cloudflare must take stronger responsibility for what they enable going forward, rather than continuing to avoid accountability.

"Equal service" does not create equality of outcomes.

Cloudflare claims they are a neutral service provider that provides equal protection to everyone. For instance, they say that I, as a trans person, have a right to free Cloudflare protection just as sites like Kiwi Farms have a right to Cloudflare protection. However "equal" in this instance does not create equity of outcomes—because not all speech is equal. Speech that is just magnifying or creating new online harassment doesn't facilitate the expression of free speech. Instead, it intimidates marginalised people from having a voice. If Cloudflare is going to protect speech that incites violence toward specific named targets, no amount of amplification of speech by those targets or donations to charities can "offset" the harm.

Cloudflare's claims about only offering the minimum viable "protection" against attacks are untrue. It not only shields origin hosts from malicious requests, but also lowers the cost to serve abusive image and video materials by orders of magnitude by serving them from edge caching instead of forcing the origin to pay the true cost of each request.

Furthermore, Cloudflare has already chosen not to protect sex workers, when it abruptly took down Switter, the Mastodon for sex workers. Expecting us to defend Cloudflare's stance on Kiwi Farms because it might help sex workers or other hypothetical future groups targeted by authoritarian idealogues is neither fair nor just, and does nothing for free speech.

There is nothing stopping Cloudflare from having a simple policy of not doing business with organisations who appear on the Southern Poverty Law Center's list of hate groups. Kiwi Farms is on that list.

What could Cloudflare do differently? If Cloudflare says that it wants to create a better internet, how could Cloudflare actually create a better internet? What works for actually promoting access to speech, for everyone, and not just for those who already hold the most structural power?

Improving access to speech and the ability of people like myself in marginalised communities to speak up has to start with physical safety for us. If it is not safe to speak in the first place, then I'm not going to be worried about denial of service attacks—I'm just worried about whether or not I'm going to become the target of violence or even murdered for my existence.

Hate offsets don't work.

Cloudflare states it makes donations toward appropriate charities of any revenue received from customers that use its services to incite hatred. This is fallacious in several ways:

First, and foremost, harms cannot simply be offset by financial contributions. This claim is essentially stating they can pay an amount of money (that they determine) in order for Kiwi Farms to have the right to harm people. Not only is this an admission of the harm that is caused, it is claiming that ethics is only a matter of money and offsets.

Second, Cloudflare claims the harm is proportional to the revenue received from the customers in question. For instance, Kiwi Farms' sole purpose is to terrorise marginalized people, yet they paid almost nothing ($20/month) for Cloudflare's DDoS protection and custom error page service. As has been documented in numerous articles and reports, Kiwi Farms tears apart the lives of individuals, as well as the transgender and neurodivergent communities as a whole. They pick apart every aspect of their victims' lives and try to get everyone to dissociate themselves from victims. This makes it harder for people to offer or seek out support for fear of becoming the next victim, or for fear of Kiwi Farms targeting people they become close to.

Some harms simply cannot be undone. The harassment and bullying people have endured has led to suicide. No donation to charity can possibly make restitution for the taking of a life. Claiming that it does is unethical.

No one is left to take responsibility if Cloudflare won't.

Cloudflare's Acceptable Use Policy for its hosting services states: "We may remove or disable access to content that we believe [...] Is otherwise illegal, harmful, or violates the rights of others, including content that discloses sensitive personal information, incites or exploits violence against people or animals, or seeks to defraud the public."

Why is it that such content is unacceptable when hosted directly on Cloudflare's own servers, but is something they vehemently defend when they can pass off responsibility onto someone else? If Cloudflare isn't going to stand by its own policies as written, they should change the verbiage; because it's clear as day that doxxing, causing harm, and violating the rights of others is not supported by their terms of service, yet they insist on inherently supporting this content by not removing it.

Currently, Cloudflare's abuse reporting procedure for cached content simply forwards the content of the report (whether for illegal content, violence, etc.) to the backend. Only very recently has the option to remove contact information been added. Cloudflare doesn't appear to act upon these reports internally, which means if someone is being targeted by Kiwi Farms and they report it, details on what material they found to violate their safety or privacy go straight to the Kiwi Farms owner.

Cloudflare simply washes their hands of any further damage and harassment that could, and mostly likely will, occur. In doing so, Cloudflare has abdicated responsibility for policing content to the very people who are perpetuating harm on marginalised communities.

Hosting hate is not an inevitable and necessary evil.

No single entity can nor should be the arbiter of what stays online. Cloudflare is either a monopoly and should be regulated as such, or it is merely one of many players that can be free to take down content knowing that if it makes a mistake, the market will correct itself and provide.

When dropping Kiwi Farms, Cloudflare predicted that Kiwi Farms "will most likely find other infrastructure that allows them to come back online". However, less than three days later, Kiwi Farms' Russian DDoS protection provider abruptly terminated service, citing terms of service violations. As of today, September 5th, 2022, Kiwi Farms remains consigned to Tor and is frequently inaccessible entirely. Cloudflare was indeed the only service keeping Kiwi Farms so easily accessible; despite its protestations that many other providers would provide the same service if it didn't.

Conclusion

Cloudflare has been acting against the interests of its paying customers and shareholders by subsidizing neo-Nazi hate groups in their violent campaigns. Cloudflare's management and board of directors have a fiduciary duty to protect shareholder interests, not to defend the founder's amoral stances on "freedom of expression." While trans people may be marginally safer today following this one-time policy exception, I worry about Cloudflare's possible future complicity in the genocide of another minority group, when it refuses to pull the plug on yet another hateful site.

While Cloudflare eventually caved to the public pressure and risk of damage to their reputation from a terrorist incident being attributable to them; they've made clear that they intend to enable those who facilitate terrorism. Cloudflare's shareholders, employees, and users should be appalled at the deadly outcomes their leadership has knowingly enabled.

How many lives is an acceptable price for one man's ideology?

What I have clearly shown is that if speech is truly dangerous, and not merely repulsive, that a just outcome can be achieved when none of the providers in the market are willing to subsidise the costs of keeping it online.

Thus, I respectfully dissent from Cloudflare's policies and discourage others from using its services.

Liz Fong-Jones, #DropKiwifarms