After Dropping neo-Nazis, U.S. Cyber Firm Now Pressured to Stop Working With Hamas

Israeli advocacy group says Cloudflare is violating U.S. anti-terror laws by providing services to Palestinian militant group, threatens lawsuit if company does not drop it

A man typing on a laptop computer (illustrative).
Daniel Acker/Bloomberg

Cloudflare, the U.S. company already under fire for providing anti-hacking services to far right and neo-Nazi websites, is now facing pressure from Israeli activists to drop Hamas and other Palestinian militant groups from its client list.

A right-wing legal advocacy organization, Shurat HaDin, announced Wednesday that it has sent a letter to Cloudflare CEO Matthew Prince, demanding that his company “immediately terminate any and all accounts and services provided to these terrorist groups.”

Cloudflare’s suite of services help optimize websites and deflect attempts to bring them down by distributed denial of service (DDoS) cyberattacks. These assaults work by attempting to overwhelm the target’s servers with requests, forcing it to buckle under the pressure and render it inoperable to visitors.

The San Francisco-based company boasts a large client base, which until recently included neo-Nazi website The Daily Stormer. Based on information publicly available on Whois (an internet registry lookup service), Cloudflare continues to work with Richard Spencer – the white supremacist behind altright.com – and 4chan, the anonymous bulletin board whose political section is a central space for white supremacists. It also provides services to the websites of both Hamas and the group’s military wing, Iz al-Din al-Qassam.

A longtime advocate of net neutrality, Prince surprised many with his August 16 decision to drop The Daily Stormer, which was also booted off hosting service GoDaddy and rejected by Google.

Seemingly refuting the idea that he made the move in response to public pressure for companies to sever ties with white supremacist websites and personalities, Prince wrote in a blog post that the decision was based on the Daily Stormer’s “claim that we were secretly supporters of their ideology.”

This was a reversal from Prince’s previous position on private industry censorship. On May 7, for example, he wrote he was “concerned that the political beliefs and biases of those organizations will determine what can and cannot be online.”

Prince is at pains to take steps against websites that many consider offensive, noting in his August 16 post that after this decision, “make no mistake, it will be a little bit harder for us to argue against a government somewhere pressuring us into taking down a site they don’t like.”

The Cloudfare security message users encounter on the Iz al-Din al-Qassam website
Screenshot

Cloudflare did not respond to repeated requests for comment from Haaretz.

Shurat HaDin is not seeking to challenge Cloudflare on the issue of freedom expression, but rather on U.S. law. In her letter to Prince, the group’s founder, lawyer Nitsana Darshan-Leitner, states that the firm’s provision of support to sites operated by Hamas “could render your company both criminally and civilly liable under America’s Anti-Terrorism law.”

She added: “We reserve the right to take immediate legal action and pursue all available remedies against Cloudflare without any further notice.”

At the core of its case, Darshan-Leitner cites a 1995 executive order issued by former President Bill Clinton to the Treasury. The order designated Hamas, Palestinian Islamic Jihad, the Popular Front for the Liberation of Palestine and others as terrorist groups, and prohibited the provision of support for them by U.S. entities.

While there may be some debate over whether Hamas should be allowed to air its political statements online, a senior lawyer at Shurat HaDin told Haaretz that the organization’s letter includes Hamas’ political and military wings because “it’s not really demarcated between the groups. Really it’s one organization.”

But Shurat HaDin’s argument may not be so cut-and-dried. David Balto, a former Federal Trade Commission official in the Clinton administration, said he did not think the Treasury will enforce the executive order in Cloudflare’s case.

The question also arises of why, if Cloudflare has been in violation of the order for years, it has not yet been prosecuted. The senior lawyer at Shurat HaDin, who asked not to be named in line with the organization’s policies, said “criminal prosecutions are at the discretion of the prosecutor. If there is some type of government policy that they are not bringing the case against everyone who is violating the law, we can only speculate why the government would not pursue a particular violator.” It is possible the government could have a full docket or it could be a political decision.

In the event that pushing for a criminal case is not feasible if Cloudflare does not respond positively to the letter, Shurat HaDin may opt for a civil case – an area in which the organization has significant experience. It has primarily brought cases against Palestinian groups, including the Palestinian Authority and Hamas, on behalf of American victims of terror. The senior lawyer told Haaretz that “a decision about whether to bring a suit against Cloudflare has not yet been made.”

Prince, meanwhile, is no stranger to the controversy surrounding his company’s relations with Hamas. In 2012, he told Reuters that “both sides have an absolute right to tell their story.” Claiming that he is doing no harm by providing the militant group with cyberdefense for its website, he explained at the time, “We’re not providing material support for anybody. We’re not sending money, or helping people arm themselves.”

Cloudflare does indeed have clients on both sides of the conflict, including the provision of proxy services for Prime Minister Benjamin Netanyahu’s personal website. The Israel Defense Forces is reportedly a Cloudflare customer, as are other Israeli websites that are often the targets of anti-Israeli hackers.

Cloudflare appears to be trying to position itself as a neutral party online, supporting sites whose messages it says it may personally find abhorrent. But as it plays a greater role in the way the public accesses the web – with Prince acknowledging that his firm facilitates “around 10 percent of internet requests” – it may become harder for companies such as Cloudflare to play Switzerland.

What concerns free speech advocates is the ability of hackers – and increasingly governments – to knock their enemies offline, thereby controlling what speech will be heard. Websites operating without the protection of services like Cloudflare, Akamai and others may not find themselves online for very long if they voice controversial ideas.

The Electronic Frontier Foundation, a nonprofit that advocates for civil liberties in the digital space, responded to a request for comment by directing Haaretz to its recent blog post on internet intermediaries removing websites and the impact of that on free speech. In “Fighting Neo-Nazis and the Future of Free Expression,” EFF states: “Even for free speech advocates, this situation is deeply fraught with emotional, logistical, and legal twists and turns. All fair-minded people must stand against the hateful violence and aggression that seems to be growing across our country. But we must also recognize that on the Internet, any tactic used now to silence neo-Nazis will soon be used against others, including people whose opinions we agree with.”

Since the violence at the white supremacist rally in Charlottesville, Virginia, on August 12, there has been a rapid taking down of hateful websites by service providers, including GoDaddy, Google and others. These companies have received public adoration for denying their services to racist websites, observing that remaining “neutral” is not an option for those in the hyper-connected internet industry.

The latest to fall was the longest-running neo-Nazi website, Stormfront. After being online for 22 years, it was finally taken down last Friday when its hosting service, Network Solutions, announced that it was dropping the site after facing mounting public pressure.

Darshan-Leitner told Haaretz that her group’s letter was not related to recent events in Charlottesville. “We are not asking Cloudflare to shut down websites on the basis of politics or offensive speech,” she said. “With regard to Hamas and other designated terrorist organizations, there is no decision for the company to make. The law is clear.”