Cloudflare tries to explain why it protects far-right forums that stalk and harass victims
- Reference: 1661975707
- News link: https://www.theregister.co.uk/2022/08/31/cloudflare_kiwi_farm/
- Source link:
Penned by CEO Matthew Prince and VP Alissa Starzak, global head of public policy, [1]the post is titled "Cloudflare's abuse policies & approach." It tries to clarify why the company sometimes moderates abusive content and sometimes doesn't.
Cloudflare's policy tour doesn't address the post's timing, but it coincides with a campaign to convince the internet infrastructure biz to stop supporting Kiwi Farms, which those against the site [2]describe as "a far-right hate forum where users create and participate in threads dedicated to the harassment of online figures, primarily featuring neuro-divergent and transgender individuals."
[3]
In 2019, following the mass shooting at a Christchurch mosque, New Zealand authorities had the country's ISPs block Kiwi Farms in response to site owner Joshua Moon's refusal to turn over data on posts related to the shooting.
[4]
[5]
More recently, Kiwi Farms has been linked to the harassment and doxing of trans streamer Clara Sorrenti, known as @keffals on Twitter and Twitch, who has been organizing with sympathetic members of the internet community to pressure Cloudflare to stop providing services to the forum.
Sorrenti not only had her personal information dug up and posted online, trolls sent armed police to her home in a swatting attack and had her arrested and detained for hours. When she sought refuge in a hotel, Kiwi Farms posters [6]figured out where she was from a photo she shared, and let her know by sending pizza repeatedly to her room, forcing her to move from Airbnb to Airbnb rentals.
[7]
In years past, Cloudflare dropped other customers for hateful content, including neo-Nazi site The Daily Stormer ( [8]2017 ) and notorious message board 8chan ( [9]2019 ). But the company continues to provide security – its [10]reverse proxy service – that helps Kiwi Farms defend against denial of service attacks and keeps the web forum online.
To hear Prince and Starzak tell it, Cloudflare has different standards for different products. It has an [11]Acceptable Hosting Policy for hosted content, but doesn't apply those rules to its security offerings.
"Hosting products are those products where Cloudflare is the ultimate host of the content," said Prince and Starzak. "This is different from products where we are merely providing security or temporary caching services and the content is hosted elsewhere."
[12]
Prince and Starzak argue that Cloudflare's security service can be compared to a government-regulated common carrier, even though internet services are regulated differently than communication services. Phone-based harassment is one-to-one and is [13]punishable under the Federal Communications Act.
"Just as the telephone company doesn't terminate your line if you say awful, racist, bigoted things, we have concluded in consultation with politicians, policy makers, and experts that turning off security services because we think what you publish is despicable is the wrong policy," their post says. "To be clear, just because we did it in a limited set of cases before doesn’t mean we were right when we did. Or that we will ever do it again."
Not impressed
In response to Cloudflare's canned statement, Nicholas Weaver, senior researcher of networking and security at UC Berkeley's International Computer Science Institute, dismissed the corporation's rationalization.
"Cloudflare's excuse for protecting Kiwi Farms is bullshit: Their 'Security' product is content-delivery with DOS protection and hiding the real host," Weaver said [14]via Twitter . "Cloudflare's continued support for Kiwi Farms despite the obvious violations of Cloudflare's own ToS is a deliberate act."
He [15]continued , "Cloudflare explicitly supports Kiwi Farms and their speech. It isn't being neutral here, it is advocating and supporting a forum that is dancing all over the [16]Brandenburg line, actively inciting imminent lawless action."
[17]Cloudflare punts far-right hate-hole 8chan off the internet after 30 slayed in US mass shootings
[18]Cloudflare speaks out amid allegations it safeguards banned terror gangs' websites
[19]Google, EFF back Cloudflare in row over pirate streams
[20]Parler games: Social network for internet rejects sues Amazon Web Services for pulling plug on hosting
Alejandra Caraballo, clinical instructor at Harvard Law School's Cyberlaw Clinic, offered a similar response to Cloudflare's post.
"Cloudflare wants dead trans people," Caraballo said [21]via Twitter . "This is their legacy by working with Kiwi Farms. They are knowingly complicit in the cyberstalking, harassment, and threatening of trans people to the point of suicide. They offer the protections that enable this to happen."
Those arguing for human rights have often invoked the phrase "silence is complicity," or a variation on that theme, to encourage active opposition to injustice. In his advocacy last year for COVID-19 Hate Crimes Act US President Joe Biden urged people to speak out against hatred. "Silence is complicity," [22]he said .
The Register asked Cloudflare to respond to Weaver's condemnation of the company's behavior, to explain how Kiwi Farms is not in violation of the company's Terms of Service, and to enumerate which injustices it will address and which it will ignore.
Cloudflare has not responded. ®
Get our [23]Tech Resources
[1] https://blog.cloudflare.com/cloudflares-abuse-policies-and-approach/
[2] https://www.dropkiwifarms.net/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yw-Z9gXtlgD7TZvklq@C8wAAAMA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yw-Z9gXtlgD7TZvklq@C8wAAAMA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yw-Z9gXtlgD7TZvklq@C8wAAAMA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://globalnews.ca/news/9068032/twitch-streamer-trans-woman-clara-sorrenti-keffals-doxxed-again/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yw-Z9gXtlgD7TZvklq@C8wAAAMA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2017/08/16/cloudflare_ceo_daily_stormer/
[9] https://www.theregister.com/2019/08/05/cloudflare_stops_services_to_8chan/
[10] https://www.cloudflare.com/learning/cdn/glossary/reverse-proxy/
[11] https://www.cloudflare.com/trust-hub/abuse-approach/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yw-Z9gXtlgD7TZvklq@C8wAAAMA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://www.law.cornell.edu/uscode/text/47/223
[14] https://twitter.com/ncweaver/status/1565006772078669824
[15] https://twitter.com/ncweaver/status/1565006774138089472
[16] https://www.law.cornell.edu/wex/brandenburg_test
[17] https://www.theregister.com/2019/08/05/cloudflare_stops_services_to_8chan/
[18] https://www.theregister.com/2018/12/19/cloudflare_terror_groups/
[19] https://www.theregister.com/2022/06/21/cloudflare_google_eff_piracy/
[20] https://www.theregister.com/2021/01/11/parler_sues_aws/
[21] https://twitter.com/Esqueer_/status/1564987193428418561
[22] https://twitter.com/POTUS/status/1373061783355858956
[23] https://whitepapers.theregister.com/
Fixed
Yeah, mea culpa. I was trying to write and edit two pieces at once, as we've got a rush of interesting pieces to get out.
I could have sworn trolls thought she was in either UK or Canada, and when I saw London, I assumed UK when I edited in that paragraph. That was stupid - I hate making mistakes.
It was fixed pretty quick. Don't forget to email corrections@theregister.com if you spot anything wrong.
C.
What's the desired outcome?
It seems like the criticisms are a tacit admission of a desire to perform an illegal attack or, at least, a desire for one to happen. Without Cloudflare, the site is still present on the Internet, it's just more vulnerable to these attacks.
Re: What's the desired outcome?
Not at all. They are saying Cloudflare should not support a site that openly harasses, doxxes, trolls, etc. innocent parties. Are you arguing they should be required to continue providing support for them to defend against DoS attacks unless there is another company willing to provide a similar service to them?
If I owned a vacant lot on a major intersection and I let people put up yard signs to advocate for their pet cause, political candidate etc. but someone started putting up pro Nazi signs should I not tell them to take a hike unless there is some assurance they'll find somewhere else willing to let them place their signs?
Weaver and Caraballo are wrong, but why let subtlety get in the way of hyperbole
Cloudflare is in a tough position here, but has staked out a rational and nuanced policy to balance both its responsibilities and liability. The lines they have drawn amount to: we will not host or amplify this content, nor will we assist those who wish to erase it from the internet to do so in an extrajudicial manner.
They are in the right there. Just as the trolls at Kiwi Farms shouldn't be doxxing people and harassing them, those that want them shut down just because they say so have plenty of legal avenues they aren't using here. The only almost salient point was that it makes it harder to pin the IP of the publishing server at a purely technical level, which is also irrelevant as they can reveal that with a court order. The sites activity and history give them ample grounds to work through the system, that's not what they are asking for. They want to be able to take direct action themselves, sans safeguards or oversight, instead of letting the people who's job it is to investigate, prosecute, and sanction criminals in either the operators or the victims jurisdictions. They are in essence vigilantes.
The investigation into the swatting incidents they spawned may end up shutting them down, but I'd rather we draw a line where we don't get in the habit of suppressing controversial speech without a legal investigation or court proceeding. Due process and all that. That is separate from nailing those involved for harassment and other criminal actions they have taken or concealed.
As a bonus thought, chasing them off a host providing the minimum of service and which can point the Feds to which server to raid to get evidence, redirect traffic to or through law enforcement, etc etc might be helping the trolls more than it hurts them.
Cloudflare$
So essentially the blog post is just an advert seeking to encourage people on all sides to use Cloudflare to promote their stupidity. Most likely Cloudflare is just looking at their income options.
Re: Cloudflare$
Cloudflare does what makes Cloudflare money. They're somewhat like a digital arms dealer. They shield businesses from the very criminals they shield from discovery.
Reg Mods - I did send you evidence of Cloudflare shielding criminals, as you requested in the past. Many more examples are available in Spamhaus and online forums. Besides, it would make a great story if Cloudflare accused The Register of hosting slanderous content in the comments section, as you fear may happen.
If only
I had not had to endure 13 1/2 years (Summer 2002-Jan 2016) of "Bush = Hitler", followed by (Feb 2016 - present) of Trump being the new Hitler, I might be willing to listen to these claims. This is not the only data point. I'm too exhausted to even really be bothered much, other than to morn the Republic, when the next one happens.
If you want to drive modern Nazi's from the public internet, I ask that you first give a definition of Nazi that doesn't boil down to "whomever I say it is".
Because I believe I have ample cause to fear that I'm on the list of people to be driven off the internet.
Correction
Sorrenti was SWATted at her home in London, Ontario, Canada. Not in Blighty.
Please carry on.