Cloudflare Denies Business to Organized Griefing and Targeted Harrassment Website Kiwi Farms ⇥ blog.cloudflare.com

The topics of this story unfortunately but necessarily include targeted harassment and suicide.

Ben Collins and Kat Tenbarge, reporting for NBC News on Friday this week:

Kiwi Farms is an internet message board known for being an epicenter of vicious, anti-trans harassment campaigns. It has operated for nearly a decade with the backing of some tech companies that refuse to drop services for it. But now, as the site’s users launch a wave of anti-trans attacks, a trans Twitch streamer targeted by Kiwi Farms is spearheading an unprecedented campaign to take down the fringe website.

Clara Sorrenti and those supporting her are hoping to open up Kiwi Farms to debilitating virtual attacks by demanding Cloudflare, one of its internet security service vendors, drop the site. Cloudflare has so far refused to budge.

Matthew Prince and Alissa Starzak of Cloudflare on Wednesday:

Some argue that we should terminate these services to content we find reprehensible so that others can launch attacks to knock it offline. That is the equivalent argument in the physical world that the fire department shouldn’t respond to fires in the homes of people who do not possess sufficient moral character. Both in the physical world and online, that is a dangerous precedent, and one that is over the long term most likely to disproportionately harm vulnerable and marginalized communities.

Today, more than 20 percent of the web uses Cloudflare’s security services. When considering our policies we need to be mindful of the impact we have and precedent we set for the Internet as a whole. Terminating security services for content that our team personally feels is disgusting and immoral would be the popular choice. But, in the long term, such choices make it more difficult to protect content that supports oppressed and marginalized voices against attacks.

Alex Stamos in a Twitter thread posted early Saturday critical of Cloudflare’s stance:

Cloudflare is not just a shield standing in front of KF, stopping attacks. Cloudflare reaches out to the KF origin host, likely* at a RU bulletproof hosting provider, and makes thousands of copies of the site that are then stored physically (in RAM) very close to end users.

*Another benefit Cloudflare provides KF is anonymization of the origin host, so while the blog post talks about hosting as the appropriate place to enforce more aggressive content moderation the practical impact is that CF makes hosting in non-responsive providers practical.

Prince announced the discontinuation of Cloudflare’s provision of security services to Kiwi Farms later on Saturday:

This is an extraordinary decision for us to make and, given Cloudflare’s role as an Internet infrastructure provider, a dangerous one that we are not comfortable with. However, the rhetoric on the Kiwifarms site and specific, targeted threats have escalated over the last 48 hours to the point that we believe there is an unprecedented emergency and immediate threat to human life unlike we have previously seen from Kiwifarms or any other customer before.

It is unclear to me what threats, specifically, prompted Cloudflare to reverse its de facto support of Kiwi Farms’ worldwide availability. As usual for forums, there are many discussion areas, but its user base has long treated it as a platform for organizing targeted attacks, often focusing on marginalized and vulnerable people. Campaigns on the website have been a factor in the suicides of three people.

I do not understand why Cloudflare is making this out to be more complicated than it actually is. The question has always been pretty simple: does Cloudflare want to have a business relationship with Kiwi Farms? That is it. It is not a slippery slope. The demands for Cloudflare to act are not coming from a government; it is a public campaign focusing on those most affected by large-scale harassment organized on Kiwi Farms. But Prince is spinning this into a debate about free speech and whether it is right for the company to be making a decision about what to defend online.

The idea that Cloudflare is being the good guy and taking the heat of DDoS attacks against legitimate if abhorrent speech is, frankly, hogwash. The justification Prince laid out in the Wednesday Cloudflare post is, I think, an elaborate framework that disguises simpler questions.

Cloudflare should absolutely be standing up for oppressed people the world over — and it frequently does. If a civil rights activist is relying on its services for preventing an attack by those in greater positions of power, I celebrate Cloudflare’s efforts. But Kiwi Farms is objectively not that. It is a small but committed gathering of people who are dedicated to making the lives worse of already marginalized people. That Prince would rather people discuss their differences rather than DDoS websites like Kiwi Farms is a red herring — and, frankly, an offensive one at that. Without Cloudflare’s protection, Kiwi Farms may become more susceptible to electronic attacks, though there are several service providers Kiwi Farms could choose from. With Cloudflare’s protection, Kiwi Farms’ targets face real-life targeted attacks on their person.

It is painfully difficult to keep anything truly disconnected from the internet. Even if every commercial hosting provider has denied someone service, they could still build their own server and be their own host. Cloudflare’s decision does not mean the end of Kiwi Farms just as — as Prince points out — hate sites like the Daily Stormer and 8kun still exist after Cloudflare’s discontinuation of service to each of them. But there is no reason to legitimize these sites by treating a business relationship as a civil rights issue. Maybe you think the continued availability of these websites really is an issue of free speech; I disagree, but I see where that argument comes from. But Cloudflare does not have to help these websites succeed. Nobody has that obligation.