Ethics View: Cloudflare in Russia
By Minhaj Miah
Amidst the 2022 Russian invasion of Ukraine, over a thousand companies committed to withdraw from the country. According to a Yale School of Management database as of the 4th of July 2022, 305 have completed this withdrawal, while 243 continue to operate in Russia as normal despite their promises [1]. There appears to be a financial incentive to this move, with CELI Research Insights finding equity markets to be rewarding companies for leaving Russia, while punishing those who remained, ignoring the asset write-downs and lost revenue [2].
In spite of the markets valuing the reputational damage of remaining in Russia to be significant, some companies remain. One such company is Cloudflare, which continues to have a presence in Russia.
What’s Cloudflare?
Cloudflare is a California-based, American content delivery network and DDoS (Distributed Denial of Service) mitigation company, acting as a reverse proxy between a website’s visitor and the Cloudflare customer’s hosting provider.
Cloudflare’s Purpose
Cloudfare reports to be on a mission to help build a better internet, increasing speeds alongside the security of websites.
As part of its mission to help aid speed of access, it has data centers in 270 cities globally across the world [3]. Furthermore, it provides essential services in security through protecting sites from malicious activity such as “DDoS attacks, malicious bots, and other nefarious intrusions.” [4] Alongside this, it provides a free DNS service to users which, can be used on any device to protect data from being analyzed.
Cloudflare’s ‘Project Galileo’ commits to providing free security to “important, yet vulnerable targets” [5]. This alludes to websites which are often political in nature, such as voices of political dissent, as well as humanitarian organizations. Often such websites are under attack from a much more well-resourced entity, such as their respective national governments. Operating on a limited budget, these voices of dissent are thus generously aided by Cloudflare’s free services.
Given its strong mission-statement and commitment to the protection of the internet, for both users and websites themselves, Cloudflare appears to be a company committed to maintaining a high ethical standard. Its involvement in ‘Project Galileo’ especially implies this inference. Its direct protection of political opponents of national governments, for example, evidence commitment to the protection of freedom of speech. The Sarawak Report, for example, and its exposé of corruption and cronyism in Malaysia, involving the Prime Minister and several other senior ministers, was protected by Project Galileo. The entire exposé was hosted online and came under attack during the 2011 elections in Malaysia.
Presence in Russia
Regarding its presence in Russia, Cloudflare continues to provide services in general. These services are the content delivery, alongside DDoS mitigation. Essentially, the company serves to protect websites and ensures their presence on the internet remains unchallenged. Cloudflare does not have any offices or employees in Russia and claims to pay no taxes or fees to the Russian Government [6].
Considering Cloudflare’s commitment to supporting those attacked, the decision of the company to remain active in Russia may initially appear surprising. This was certainly the stance taken by Ukraine Digital Minister Mykhailo Fedorov. He made the claims that Cloudflare was “continuing to enable Moscow”, and it ought to pull out of Russia [7]. The Minister pointed out Cloudflare was protecting Russian websites. Cloudflare’s response implied this protection to be a positive; fearing a further entrenchment of “the interests of the Russian government to control the internet in Russia.” [8]
The company is not, however, totally indifferent to sanctions. Rather, it has committed to complying with the new sanctions as announced; closing off access to its network and systems in Russia, alongside terminating customers tied to sanctions [9]. “This includes clients related to Russian influence campaigns and the Russian-affiliated Donetsk and Luhansk governments”.
Protection of Russian Internet Access
The underlying disagreement between the Ukrainian digital minister and Cloudflare appears to be around the morality of protecting Russian websites. While Mykhailo Fedorov posits this to be negative and a protection of Russian government interests, Cloudflare takes the opposite stance.
Context is important in determining which stance is most appropriate. Over the past 5 years the Russian Government had been tightening its control over the Internet in Russia, from legislation allowing the government to monitor and block internet activity, to the establishment of an exclusively Russian DNS [10]. Through this, Russian access to a free internet has been significantly under risk, with the government gaining the ability to disconnect citizens from the global internet. As yet, this ability has not yet been exercised. Since the Russian invasion of Ukraine, however, government agencies switched to Russian hosting services, reducing reliance on non-Russian providers. Further, infringing on free Internet access, officials have targeted social media sites as well as Russian language news outlets based outside the country.
The effect of this repression on the public is seen in the popularity of apps aimed at bypassing blocks of these sites. ‘1.1.1.1’ is in fact Cloudflare’s own WARP, protecting internet traffic with encryption. Further, Cloudflare’s data for Russian user DNS requests show them to be using this service to access news sources from outside of Russia. It can thus be concluded that restricting Russian access of the internet, withdrawing Cloudflare’s services, further isolate the Russian people [11]. They would be limited in access to impartial reporting.
In sum, Cloudflare’s approach seems decided by a firm belief in the good of the internet. In a 2020 letter from Cloudflare’s founders, they describe the Internet as ‘a force for good worth fighting to defend [12].’ This may be reflected in their commitment to maintaining Russian access.
Nature of DDoS Attacks
The threat of attacks on media is a decidedly real one. These attacks more typically global and focus on gaming/gambling sites, and banking and financial services. It is atypical for news sites to face these attacks [13].
In Russia and Ukraine, however, this is not the case. In Ukraine, Broadcast Media companies were the most targeted. The top 5 industries were all related to the circulation of news and media. In Russia, Online Media was the third most targeted industry, topped by Banking and Financial Services.
Given the real threat of cyber-attacks on the access to news, Cloudflare’s work appears imperative, and its status in Russia appears justified. The attacks on Banking and Financial services further present another element of the story, and another justification for the presence of Cloudflare in the country.
It appears Cloudflare’s security role also is critical to a country’s financial service provision. This is a service which impacts the day-to-day lives of numerous ordinary Russian citizens. With an inflation rate of above 15%, and the rapid rise in cost of living, aggravated by sanctions, Cloudflare thus plays an important part in helping the general public [14].
The Stance of Other Companies
Cloudflare is not the sole tech company to remain in Russia, nor is it the largest. Apple and Google also continue to operate and support their app stores in Russia. These three companies based in California do so with an apparent commitment to providing Russia’s citizens access to free and fair news.
This move is supported by activists and officials alike, a US State Department spokesperson commenting on Cloudflare’s continued presence in Russia as “critical to maintain the flow of information to the people of Russia” [15].
Justifications for Calls to Withdraw
Calls for companies to withdraw from Russia can be placed in two categories. They may be called to withdraw out of a regard for the direct impact of their services and goods on the war. A company dealing arms, for example, will be directly helping facilitate the war, as would a company aiding Russian supply-lines. Many may also justify their calls for the withdrawal of companies by way of their indirect impact on the Russian war. Most commonly, indirect impacts concern taxes and fees to the Russian government. Thus, these companies would play a part in funding the war effort potentially, while their withdrawal and thus the withdrawal of these taxes would be seen as beneficial to the anti-war movement.
Direct Impact
Numerous companies have ceased operations in Russia in response to the war, due to a sense of corporate social responsibility. This appears obviously applicable to many companies, such as those helping to facilitate the war, perhaps through provision of financing or arms. The merits of such an exit from Russia are, however, less clear for companies whose goods produced do not directly have an impact on the conflict. It’s difficult to state definitively that Cloudflare’s services provide any direct benefit to the belligerents.
In their provision of protection to anti-war sites, and neutral reporting, the service that Cloudflare provides in Russia appears contrary to the war-effort. Rather than facilitating the war, its services appear to hinder it, by strengthening the opposition. Using the criteria of the direct impact of a companies’ goods and services, Cloudflare seems justified in remaining in Russia.
It must, however, be noted Cloudflare does not exclusively support anti-war sites. Rather, it also protects sites such as TopWar.ru, a Russian-biased pro-war news site. It is important to not overstate this role, however. Russia has been in the process of switching state-owned agencies to its own native infrastructure providers. This means that, given the absence of Cloudflare, the Russian websites would still be protected and accessible, while anti-war news sites would not.
Indirect Impact
For companies whose goods and services do not have a direct impact on the war, such as Cloudflare, the argument is made they should still withdraw due to the indirect benefit they provide to the State and therefore the war. This could be through their payment of taxes, or to the general positive impact they have on the economy and thus government revenues and spending, of which a great portion goes towards its military. This argument is well-grounded, with war tax resistance present through history. Henry David Thoreau in his 1849 essay Civil Disobedience endorsed this method of protest as a means for “instigating governmental change” [16]. Theoretically tax payment is therefore a sound criterion by which the merits of a company’s status in Russia can be measured.
Cloudflare’s indirect benefit to the government budget is questionable. It makes clear in a recent blog post it has “minimal sales and commercial activity in Russia”, lacking a corporate entity there, and stress it is “not paying taxes or fees to the Russian government.” [17] Given the criteria of the indirect impact companies have through taxes, it appears again Cloudflare is justified to remain operating in Russia.
An Inconsistent Standard?
The basis for the call to withdraw from Russia is opposition to the war. This already assumes the war to be a moral evil. This proposition may over-simplify a complex issue [18]. When questioning the ethics of Cloudflare’s decision, one must consider the role companies are expected to play in taking moral positions. Their stances are especially relevant when placed in context: it is generally not normal for corporations to take a moral position regarding wars as they have with Ukraine. Typically, corporations exhibit neutrality because they are profit-motivated actors. Companies’ approach in Ukraine does seem to suggest ulterior motives for the withdrawal from Russia. Perhaps the bonus from positive public perception outweighs the profits from continuing to operate.
Cloudflare, however, appears to take a more neutral stance. While it remains operating in Russia, it condemns the war. Cloudflare’s response is one which prioritizes freedoms. The freedom of Russians to access a free internet, where they can be informed by unbiased news. The company condemns the war verbally, its actions support the triumph of truth.
In sum, Cloudflare appears justified in its continued presence in Russia. Its mission is to help build a better internet, and the company commits itself to protecting the vulnerable. In this regard, Cloudflare appears to have been acting in accordance with the company’s code of ethics. Its role in Russia can be seen by the popularity of its own WARP in Russia. The service it provides has been of utmost importance in ensuring Russians are able to access free internet and news. Underlying the continued provision of services is a belief the best ally to a fair outcome is a body of well-informed Russians, who may go on to influence the actions of the Russian Government.
Bibliography
The Editorial Board. “Companies should follow through on pledges to leave Russia“ The Financial Times. 4 Jul. 2022 https://www.ft.com/content/cc1c12a5-29fd-4d58-8e5f-6258fb15e11e
CELI Research Insights. “Chief Executive Leadership Institute Research Insights: “It Pays to Leave Russia” Yale. 17 May 2022 https://som.yale.edu/story/2022/chief-executive-leadership-institute-research-insights-it-pays-leave-russia
Cloudflare “What is Cloudflare” Cloudflare blog. https://www.cloudflare.com/en-gb/learning/what-is-cloudflare/
Cloudflare “Project Galileo” Cloudflare blog https://www.cloudflare.com/en-gb/galileo/
Prince, Matthew. “Steps we’ve taken around Cloudflare’s services in Ukraine, Belarus, and Russia“ Cloudflare blog. 7 March 2022 https://blog.cloudflare.com/steps-taken-around-cloudflares-services-in-ukraine-belarus-and-russia/
Jack, Victor and Anderlini, Jamil “Ukraine accuses SAP and Cloudflare of enabling Russia’s war effort” Politico. 23 May 2022 https://www.politico.eu/article/sap-cloudflare-enable-russia-war-effort-ukraine-digital-minister-fedorov/
Prince, Matthew. “What Cloudflare is doing to keep the Open Internet flowing into Russia and keep attacks from getting out“ Cloudflare blog. 2 April 2022 https://blog.cloudflare.com/what-cloudflare-is-doing-to-keep-the-open-internet-flowing-into-russia-and-keep-attacks-from-getting-out/
Signitaries in “Letter to U.S. government: Do not disrupt internet access in Russia or Belarus” AccessNow 18 Mar. 2022 https://www.accessnow.org/letter-us-government-internet-access-russia-belarus-ukraine/
Prince, Matthew and Zatlyn, Michelle “A letter from Cloudflare’s founders“ Cloudflare blog. 27 Sept. 2022 https://blog.cloudflare.com/a-letter-from-cloudflares-founders-2020/
Beshaireh, Bashar. “Cloudflare reports Q2 2022 DDoS attack trends” Zawya. 5 Aug. 2022 https://www.zawya.com/en/press-release/research-and-studies/cloudflare-reports-q2-2022-ddos-attack-trends-x3erqlfs
Cawthorne, Andrew. “Russian consumer prices dip again as cenbank rate meeting looms” Reuters. 20 Jul. 2022 https://www.reuters.com/markets/europe/russian-consumer-prices-dip-again-cenbank-rate-meeting-looms-2022-07-20/
Menn, Joseph. “Apple and Google app stores remain available in Russia. Activists and officials say that’s a good thing.” The Washington Post. 16 Mar. 2022 https://www.washingtonpost.com/technology/2022/03/16/apple-google-cloudflare-russia/
Conscience Online. “War Tax Resistance” https://conscienceonline.org.uk/about/war-tax-resistance/
Mearsheimer, John. “John Mearsheimer on why the West is principally responsible for the Ukrainian crisis” The Economist. 19 Mar. 2022 https://www.economist.com/by-invitation/2022/03/11/john-mearsheimer-on-why-the-west-is-principally-responsible-for-the-ukrainian-crisis
Endnotes
[1] The Editorial Board. “Companies should follow through on pledges to leave Russia“ The Financial Times. 4 Jul. 2022 https://www.ft.com/content/cc1c12a5-29fd-4d58-8e5f-6258fb15e11e
[2] CELI Research Insights. “Chief Executive Leadership Institute Research Insights: “It Pays to Leave Russia” Yale. 17 May 2022 https://som.yale.edu/story/2022/chief-executive-leadership-institute-research-insights-it-pays-leave-russia
[3] Cloudflare “What is Cloudflare” Cloudflare blog. https://www.cloudflare.com/en-gb/learning/what-is-cloudflare/
[4] Ibid.
[5] Cloudflare “Project Galileo” Cloudflare blog https://www.cloudflare.com/en-gb/galileo/
[6] Prince, Matthew. “Steps we’ve taken around Cloudflare’s services in Ukraine, Belarus, and Russia“ Cloudflare blog. 7 March 2022 https://blog.cloudflare.com/steps-taken-around-cloudflares-services-in-ukraine-belarus-and-russia/
[7] Jack, Victor and Anderlini, Jamil “Ukraine accuses SAP and Cloudflare of enabling Russia’s war effort” Politico. 23 May 2022 https://www.politico.eu/article/sap-cloudflare-enable-russia-war-effort-ukraine-digital-minister-fedorov/
[8] Ibid.
[9] Prince, Matthew. “Steps we’ve taken around Cloudflare’s services in Ukraine, Belarus, and Russia“ Cloudflare blog. 7 March 2022 https://blog.cloudflare.com/steps-taken-around-cloudflares-services-in-ukraine-belarus-and-russia/
[10] Prince, Matthew. “What Cloudflare is doing to keep the Open Internet flowing into Russia and keep attacks from getting out“ Cloudflare blog. 2 April 2022 https://blog.cloudflare.com/what-cloudflare-is-doing-to-keep-the-open-internet-flowing-into-russia-and-keep-attacks-from-getting-out/
[11] Signitaries in “Letter to U.S. government: Do not disrupt internet access in Russia or Belarus” AccessNow 18 Mar. 2022 https://www.accessnow.org/letter-us-government-internet-access-russia-belarus-ukraine/
[12] Prince, Matthew and Zatlyn, Michelle “A letter from Cloudflare’s founders“ Cloudflare blog. 27 Sept. 2022 https://blog.cloudflare.com/a-letter-from-cloudflares-founders-2020/
[13] Beshaireh, Bashar. “Cloudflare reports Q2 2022 DDoS attack trends” Zawya. 5 Aug. 2022 https://www.zawya.com/en/press-release/research-and-studies/cloudflare-reports-q2-2022-ddos-attack-trends-x3erqlfs
[14]Cawthorne, Andrew. “Russian consumer prices dip again as cenbank rate meeting looms” Reuters. 20 Jul. 2022 https://www.reuters.com/markets/europe/russian-consumer-prices-dip-again-cenbank-rate-meeting-looms-2022-07-20/
[15] Menn, Joseph. “Apple and Google app stores remain available in Russia. Activists and officials say that’s a good thing.” The Washington Post. 16 Mar. 2022 https://www.washingtonpost.com/technology/2022/03/16/apple-google-cloudflare-russia/
[16] Conscience Online. “War Tax Resistance” https://conscienceonline.org.uk/about/war-tax-resistance/
[17] Prince, Matthew. “What Cloudflare is doing to keep the Open Internet flowing into Russia and keep attacks from getting out“ Cloudflare blog. 2 April 2022 https://blog.cloudflare.com/what-cloudflare-is-doing-to-keep-the-open-internet-flowing-into-russia-and-keep-attacks-from-getting-out/
[18] Mearsheimer, John. “John Mearsheimer on why the West is principally responsible for the Ukrainian crisis” The Economist. 19 Mar. 2022 https://www.economist.com/by-invitation/2022/03/11/john-mearsheimer-on-why-the-west-is-principally-responsible-for-the-ukrainian-crisis