Nearly one week after his company, Cloudflare, decided to part ways with a particularly controversial customer, CEO Mathew Prince doesn’t really feel like anything has been settled.
The decision to drop The Daily Stormer from its network, which protects websites of all stripes against site-killing traffic from distributed denial-of-service (DDoS) attacks, came after a particularly fragile weekend in the current state of the nation in which a woman was killed while protesting white supremacists. The editorial decision of the Daily Stormer — for all your Neo-Nazi content needs — to mock the victim disgusted a rather large segment of people, and several technology companies decided they were done providing tech services to Nazis.
Prince has been quite vocal in the week since that decision, defending his company’s actions but also expressing concern about the erosion of free speech principles on the internet. The people and companies that built the World Wide Web in the 1990s wanted to believe that the internet was the antidote to censorship: “The Net interprets censorship as damage and routes around it,” John Gilmore, one of the founders of the Electronic Frontier Foundation (EFF) famously said.
In 2017, however, we’re using a very different internet, one almost completely controlled by a dozen or so huge companies. You’re probably well aware of how much time you spend on some of their services, but unless you’re responsible for managing a web business, you probably don’t know how many times the content you’ve seen on your screen has passed through Cloudflare’s networks.
That puts Cloudflare in a vital place as society and tech grapple with the notion of whether hate speech is protected speech. Rallies aside, most of that speech takes place over the internet, and we might have passed the point where it’s nearly impossible for someone to express their views without the tacit approval of the tech companies that provide services to content creators.
GeekWire chatted with Prince this week to get his thoughts on how we got into this mess, and what we need to do to get out of it. A lightly edited version (let’s all appreciate the irony) of our conversation follows below.
GeekWire: I’m not really here to re-litigate the The Daily Stormer decision but more to look forward. You’ve proposed that an industry group or some sort of public process should be used to make these decisions. And what do you think that should look like?
Matthew Prince: Well, I don’t know if it’s an industry group that should make make the decision on a case by case basis. I do think that it’s really important that we stop for a second and think about what parts of the internet stack should and should not be regulating — maybe that’s the nice word, censoring is a slightly more loaded word — internet content. And it’s not an easy, easy question.
A lot of the debate was, you know, “do you support Nazis or not?” Which isn’t a very useful conversation of course; of course Cloudflare doesn’t support Nazis, and you know I find the content repugnant.
But we need to think about where the right place for any kind of regulation or or control is. And I think that the Google example is a really good example of how of how complicated this is. So Google says, “you can’t use the registrar” two days before we (pull our services). But Google runs a lot of other services as well.
They run an ISP. And they didn’t block access to the site on the ISP. They run a DNS service, the largest DNS service, and they don’t block access to that across their recursive DNS service. They run the largest browser in the world. They didn’t push out an update that said you can’t go to this web site, which again they do for malware all the time. They have the technical ability to do that and they didn’t withdraw the listings from search.
I’m not criticizing Google for that. In fact, most of those (decisions), I think if I were in the same position I would have made the same choices for all those, because it doesn’t seem right if your browser is picking and choosing what content you can go to.
But it could. And make no mistake that at some point, whether it’s an angry Twitter mob or a repressive government, someone’s going to try to get Google to make that choice. And if you think that that they should be (deciding), then let’s have that conversation and come up with a framework where that makes sense. If you think they shouldn’t, we need to do the same thing because at some point you need to have someone like EFF going out and saying, “listen, let’s think about this first.” And if you go back prior to prior to Wednesday, there just weren’t a lot of people that were talking about what the risks are to internet infrastructure making content or regulatory decisions.
I am not sure whether what we did with respect to The Daily Stormer was the right decision but I am extremely happy that we’re at least having a conversation about it now. Whatever policy we end up with after this is all done, hopefully it has more legitimacy because it wasn’t decided, you know in a room in CloudFlare’s office by a handful of our executives. It was decided in consultation with our customers, internet content creators, internet consumers, civil society organizations ranging from the EFF and the ACLU on one side to the Southern Poverty Law Center on the other. Just the mere act of having that conversation makes the policy more transparent and if it is more transparent it has more legitimacy.
GeekWire: Have you started a kind of process that you’re describing, reaching out to other groups? You’re doing a ton of these (interviews). But I was wondering if you’d actually like, you know, formed any kind of group or made outreach to various groups like the ones you described?
Prince: Nothing that has a name; there’s nothing that would have t-shirts. When the EFF wrote their piece, I reached out to them and said, “I really appreciate the fact that you criticized us.” Because I think we deserve criticism and scrutiny and that’s part of it. We have for quite some time been talking to the folks at Southern Poverty Law Center about about concerns they have about the speech that’s online.
GeekWire: Do you think any content should be regulated, outside of things that are clearly illegal? Let’s stick to things that are not explicitly illegal. Do you think the tech industry, you know, up and down that stack, has a responsibility regulate content?
Prince: I think the answer to that depends on where you are in the stack. I also think the more that you have concentration, or the less competition that you have in a space, the more risk there is to tech companies exercising some editorial control over what is flowing through through their networks. I think that that’s that’s a question that each tech company has to make for themselves.
Obviously illegal content is illegal content, and what’s illegal is different in different jurisdictions. There are things that are illegal in Germany that are not illegal in Poland, and there are things that are illegal in the U.K. that are not illegal in the U.S.. One other factor in deciding who should regulate what is how coarse versus how fine grained can their regulation be.
If a piece of content is illegal in Germany, we can make sure that that content isn’t accessible in Germany but it still in neighboring countries. Something like making a decision about, you know, whether someone can register a domain, that’s all or nothing. If a government says that domain must not be registered, then they are effectively regulating globally. On the other hand, there are lots of different registrars. So there’s there’s more competition in that space.
Again, I don’t know what the right answer is. I can see lots of perspectives on this. This is a debate we’ve been having internally at CloudFlare since at least 2011, when LulzSec signed up for our service and we thought, gosh, do we want to be protecting this? We had a debate about that. There’s been a bunch of things that have come up and this is a debate we have internally. What I’m happy about in all of this that now the debate that we’ve been having for six years internally, people are having externally as well. And I’m hopeful that whatever policy we come up with at the end of this, having one through that debate, I’m hopeful that policy will have more legitimacy.
I am a giant free speech advocate. But I also think that one, that doesn’t apply to private companies, so private companies can make whatever decisions they want, and then two, it is a uniquely American concept and CloudFlare ends up operating today in about 70 countries around the world, the vast majority of which don’t have any speech protections any similar to what we enjoy in the United States and we have to operate in all of those places. In all of those places, though, there is a concept of due process that you should be able to know the rules of the game before you participate in it. But there should be transparency. There should be accountability to the people who are making decisions.
I worry that if you have a small cabal of 10-ish tech executives that can choose what content can and cannot be online … You know, obviously no one’s going to complain when it’s Neo-Nazis; you get thank-you cards when you kick Neo-Nazis off your service. But over time the political perspectives and the economic interests of those companies will creep into what their editorial decisions are unless we stand up and say, hey, you know it’s not right for the network company to be listening in on the content and making choices on whether or not it goes through. And that may be a very different decision than if you’re Facebook or YouTube, which are much further up the stack and have a lot more visibility and have had a much more direct relationship with their consumers and therefore maybe have more legitimacy when they’re making what are effectively editorial decisions.
GeekWire: It sounds to me like you think there needs to be a law or some sort of legal authority or guidelines under which companies can meet these positions. It just seems to me that without any kind of legal guidelines these companies are just going to make these decisions based on public opinion. Which sometimes can be really good and sometimes can be really bad.
Prince: We have existing laws that regulate what content is legal and illegal. And I think that for somebody that’s as deep in the infrastructure stack as CloudFlare, I think that the safest place, and the place it is likely to have the least negative impact long term for content decisions to be made, is through those legal systems and legal processes. If we as a society decide that what the Daily Stormer is doing is so abhorrent that it shouldn’t be done, that it shouldn’t be online, then we can regulate that in different ways.
And there have been examples of new types of content that the internet has created: I would point to something like revenge porn, which is a new problem that emerged. It was surfaced through political processes, and now there are laws that make it make it illegal. And that then gives a way of taking down that kind of content in a way which was politically sanctioned and follows some sort of a politically legitimate process.
If you have 10 percent of all internet requests flowing through your network, you’re bound to have have things on the network that will be the sorts of things that really upsets some people.
GeekWire: I find CloudFlare’s position in this whole thing kind of interesting because you’re not actually hosting the content. Are people entitled to DDoS protection services?
Prince: I think we’re a private company and we can make whatever determinations we want. For a long time our argument was, listen, it doesn’t make sense to kick customers off our network because doing so doesn’t make the content go away. It just makes it slower and more vulnerable to attack. And that’s true, but what’s changed I think somewhat recently is that the size and scale of the attacks has dramatically increased and the cost of launching this attacks has dramatically decreased, where, you know, with a credit card you can knock just about any any site off off the internet pretty quickly.
In this case, the pressure over the weekend by a handful of people that we were pushing us to drop Daily Stormer from network our were actually a bunch of vigilante hackers who said, if you drop these guys, then we will DDoS them off the internet. That kind of vigilante justice seems seems really dangerous, if it’s a big group of hackers who are the ones that are effectively making the censorship decisions. I worry about that.
And then at the same time I worry that if the Internet has become such a sort of Wild West/vigilante hacker place, where anyone who says anything even remotely controversial will come under attack, it may be–
GeekWire: That sounds like Twitter.
Prince: That’s why Twitter requires a thick skin to be a user. Which means that it’s probably less of a mass media platform as a result.
But if you need to have a network that is at the scale of CloudFlare in order to put content online today, I think that just magnifies the potential risks. Because they’re just there aren’t that many networks that are that are as big as we are.
Google obviously has one. Facebook obviously has one, Microsoft obviously has one, but there is a list of 10-ish companies that can can really survive the open waters of the unfiltered internet. And putting control of content into the tech executives behind these companies strikes me as potentially very dangerous, even as one of those executives.
GeekWire: I guess this from where I sit it’s just always been the way. Google been making these decisions for well over a decade now.
Prince: Yeah, but I guess I my days on the internet go back to the mid-90s, when you really could start from nothing in your garage and build something big. I wonder if we’ve crossed a point where you can’t do that unless you’re using a cloud player or using Amazon or using a Microsoft using a Google. And I think that if we have crossed that half point then that’s potentially risky for the internet.
GeekWire: Well, in my opinion we crossed that line years ago. But I know what you mean, philosophically. I go pretty far back on the Internet too, but the most most of the country does not. Broadband didn’t crack the 50 percent penetration point until what, like, 2004 or 5 or something like that? (It was between 2007 and 2008.)
Prince: Well, certainly within the last eight years we built CloudFlare. The question is, could you start from scratch and build another CloudFlare today and if not, then then that defines the window of time. Somewhere in that period time we may have them we may crossed that threshold and if that’s the case, if private companies have become the public square, I think there is a question over what additional duties they may owe the public in general.
GeekWire: You’ve been talking about this a lot and it sounds like you are in the process of developing internal policies for how you want to handle these things going forward. Is there anything you can tell me about that, if you have a time frame associated with that?
Prince: This has been an ongoing conversation for a long time. The first policy was that we’d comply with the laws of the U.S., and as we expanded globally, we complied the laws in the jurisdictions in which we which we operated. We’re constantly evolving how we comply with those laws and one of the things that I think we’re struggling to figure out now is if one country says something is illegal and another country doesn’t, how do we make sure that we respect the law in one place but that those laws don’t extend beyond the borders of that place. That’s a surprisingly tricky, both technical and policy(wise) question.
From a, use our moral judgment (standpoint), I think the reason that we’re having this conversation is that the decision around The Daily Stormer was an exception to that. Now I can make an argument to say that we kicked them off because they they had alleged that we were supporters of theirs, or that they had harassed people who are submitting abuse complaints or lots of those things, but I think that’s a little bit hand-waving. If they had been a blog about shoes online, we would have cut them a lot more slack than we did. And if that’s the case, then that means that our feeling toward their content influenced our decision: which is the opposite of being neutral. I think that they are the exception that that shows why it’s so important to have to have rules.
We’re thinking about what what those rules will be going forward. I don’t know what the outcome of that is and I don’t think it’s right to say, here’s the specific time frame during which will will make that decision. I do think that it will be an organic and iterative process, just like it has been for the last seven years. We’re constantly adapting that we our what our policies are, and what’s healthy about it this time is that we now have input from a set of stakeholders and in the process hopefully that means that we will house have an outcome that has a lot more legitimacy because it’s been transparent.