Tag Archives: Legal

Changing the industry with CISA’s Secure by Design principles

2024-03-04 Kristina Galicova

Post Syndicated from Kristina Galicova original https://blog.cloudflare.com/secure-by-design-principles

The United States Cybersecurity and Infrastructure Agency (CISA) and seventeen international partners are helping shape best practices for the technology industry with their ‘Secure by Design’ principles. The aim is to encourage software manufacturers to not only make security an integral part of their products’ development, but to also design products with strong security capabilities that are configured by default.

As a cybersecurity company, Cloudflare considers product security an integral part of its DNA. We strongly believe in CISA’s principles and will continue to uphold them in the work we do. We’re excited to share stories about how Cloudflare has baked secure by design principles into the products we build and into the services we make available to all of our customers.

What do “secure by design” and “secure by default” mean?

Secure by design describes a product where the security is ‘baked in’ rather than ‘bolted on’. Rather than manufacturers addressing security measures reactively, they take actions to mitigate any risk beforehand by building products in a way that reasonably protects against attackers successfully gaining access to them.

Secure by default means products are built to have the necessary security configurations come as a default, without additional charges.

CISA outlines the following three software product security principles:

Take ownership of customer security outcomes
Embrace radical transparency and accountability
Lead from the top

In its documentation, CISA provides comprehensive guidance on how to achieve its principles and what security measures a manufacturer should follow. Adhering to these guidelines not only enhances security benefits to customers and boosts the developer’s brand reputation, it also reduces long term maintenance and patching costs for manufacturers.

Why does it matter?

Technology undeniably plays a significant role in our lives, automating numerous everyday tasks. The world’s dependence on technology and Internet-connected devices has significantly increased in the last few years, in large part due to Covid-19. During the outbreak, individuals and companies moved online as they complied with the public health measures that limited physical interactions.

While Internet connectivity makes our lives easier, bringing opportunities for online learning and remote work, it also creates an opportunity for attackers to benefit from such activities. Without proper safeguards, sensitive data such as user information, financial records, and login credentials can all be compromised and used for malicious activities.

Systems vulnerabilities can also impact entire industries and economies. In 2023, hackers from North Korea were suspected of being responsible for over 20% of crypto losses, exploiting software vulnerabilities and stealing more than $300 million from individuals and companies around the world.

Despite the potentially devastating consequences of insecure software, too many vendors place the onus of security on their customers — a fact that CISA underscores in their guidelines. While a level of care from customers is expected, the majority of risks should be handled by manufacturers and their products. Only then can we have more secure and trusting online interactions. The ‘Secure by Design’ principles are essential to bridge that gap and change the industry.

How does Cloudflare support secure by design principles?

Taking ownership of customer security outcomes

CISA explains that in order to take ownership of customer security outcomes, software manufacturers should invest in product security efforts that include application hardening, application features, and application default settings. At Cloudflare, we always have these product security efforts top of mind and a few examples are shared below.

Application hardening

At Cloudflare, our developers follow a defined software development life cycle (SDLC) management process with checkpoints from our security team. We proactively address known vulnerabilities before they can be exploited and fix any exploited vulnerabilities for all of our customers. For example, we are committed to memory safe programming languages and use them where possible. Back in 2021, Cloudflare rewrote the Cloudflare WAF from Lua into the memory safe Rust. More recently, Cloudflare introduced a new in-house built HTTP proxy named Pingora, that moved us from memory unsafe C to memory safe Rust as well. Both of these projects were extra large undertakings that would not have been possible without executive support from our technical leadership team.

Zero Trust Security

By default, we align with CISA’s Zero Trust Maturity Model through the use of Cloudflare’s Zero Trust Security suite of services, to prevent unauthorized access to Cloudflare data, development resources, and other services. We minimize trust assumptions and require strict identity verification for every person and device trying to access any Cloudflare resources, whether self-hosted or in the cloud.

At Cloudflare, we believe that Zero Trust Security is a must-have security architecture in today’s environment, where cyber security attacks are rampant and hybrid work environments are the new normal. To help protect small businesses today, we have a Zero Trust plan that provides the essential security controls needed to keep employees and apps protected online available free of charge for up to 50 users.

Application features

We not only provide users with many essential security tools for free, but we have helped push the entire industry to provide better security features by default since our early days.

Back in 2014, during Cloudflare’s birthday week, we announced that we were making encryption free for all our customers by introducing Universal SSL. Then in 2015, we went one step further and provided full encryption of all data from the browser to the origin, for free. Now, the rest of the industry has followed our lead and encryption by default has become the standard for Internet applications.

During Cloudflare’s seventh Birthday Week in 2017, we were incredibly proud to announce unmetered DDoS mitigation. The service absorbs and mitigates large-scale DDoS attacks without charging customers for the excess bandwidth consumed during an attack. With such announcement we eliminated the industry standard of ‘surge pricing’ for DDoS attacks

In 2021, we announced a protocol called MIGP (“Might I Get Pwned”) that allows users to check whether their credentials have been compromised without exposing any unnecessary information in the process. Aside from a bucket ID derived from a prefix of the hash of your email, your credentials stay on your device and are never sent (even encrypted) over the Internet. Before that, using credential checking services could turn out to be a vulnerability in itself, leaking sensitive information while you are checking whether or not your credentials have been compromised.

A year later, in 2022, Cloudflare again disrupted the industry when we announced WAF (Web Application Firewall) Managed Rulesets free of charge for all Cloudflare plans. WAF is a service responsible for protecting web applications from malicious attacks. Such attacks have a major impact across the Internet regardless of the size of an organization. By making WAF free, we are making the Internet safe for everyone.

Finally, at the end of 2023, we were excited to help lead the industry by making post-quantum cryptography available free of charge to all of our customers irrespective of plan levels.

Application default settings

To further protect our customers, we ensure our default settings provide a robust security posture right from the start. Once users are comfortable, they can change and configure any settings the way they prefer. For example, Cloudflare automatically deploys the Free Cloudflare Managed Ruleset to any new Cloudflare zone. The managed ruleset includes Log4j rules, Shellshock rules, rules matching very common WordPress exploits, and others. Customers are able to disable the ruleset, if necessary, or configure the traffic filter or individual rules. To provide an even more secure-by-default system, we also created the ML-computed WAF Attack Score that uses AI to detect bypasses of existing managed rules and can detect software exploits before they are made public.

As another example, all Cloudflare accounts come with unmetered DDoS mitigation services to protect applications from many of the Internet’s most common and hard to handle attacks, by default.

As yet another example, when customers use our R2 storage, all the stored objects are encrypted at rest. Both encryption and decryption is automatic, does not require user configuration to enable, and does not impact the performance of R2.

Cloudflare also provides all of our customers with robust audit logs. Audit logs summarize the history of changes made within your Cloudflare account. Audit logs include account level actions like login, as well as zone configuration changes. Audit Logs are available on all plan types and are captured for both individual users and for multi-user organizations. Our audit logs are available across all plan levels for 18 months.

Embracing radical transparency and accountability

To embrace radical transparency and accountability means taking pride in delivering safe and secure products. Transparency and sharing information are crucial for improving and evolving the security industry, fostering an environment where companies learn from each other and make the online world safer. Cloudflare shows transparency in multiple ways, as outlined below.

The Cloudflare blog

On the Cloudflare blog, you can find the latest information about our features and improvements, but also about zero-day attacks that are relevant to the entire industry, like the historic HTTP/2 Rapid Reset attacks detected last year. We are transparent and write about important security incidents, such as the Thanksgiving 2023 security incident, where we go in detail about what happened, why it happened, and the steps we took to resolve it. We have also made a conscious effort to embrace radical transparency from Cloudflare’s inception about incidents impacting our services, and continue to embrace this important principle as one of our core values. We hope that the information we share can assist others in enhancing their software practices.

Cloudflare System Status

Cloudflare System Status is a page to inform website owners about the status of Cloudflare services. It provides information about the current status of services and whether they are operating as expected. If there are any ongoing incidents, the status page notes which services were affected, as well as details about the issue. Users can also find information about scheduled maintenance that may affect the availability of some services.

Technical transparency for code integrity

We believe in the importance of using cryptography as a technical means for transparently verifying identity and data integrity. For example, in 2022, we partnered with WhatsApp to provide a system for WhatsApp that assures users they are running the correct, untampered code when visiting the web version of the service by enabling the code verify extension to confirm hash integrity automatically. It’s this process, and the fact that is automated on behalf of the user, that helps provide transparency in a scalable way. If users had to manually fetch, compute, and compare the hashes themselves, detecting tampering would likely only be done by a small fraction of technical users.

Transparency report and warrant canaries

We also believe that an essential part of earning and maintaining the trust of our customers is being transparent about the requests we receive from law enforcement and other governmental entities. To this end, Cloudflare publishes semi-annual updates to our Transparency Report on the requests we have received to disclose information about our customers.

An important part of Cloudflare’s transparency report is our warrant canaries. Warrant canaries are a method to implicitly inform users that we have not taken certain actions or received certain requests from government or law enforcement authorities, such as turning over our encryption or authentication keys or our customers’ encryption or authentication keys to anyone. Through these means we are able to let our users know just how private and secure their data is while adhering to orders from law enforcement that prohibit disclosing some of their requests. You can read Cloudflare’s warrant canaries here.

While transparency reports and warrant canaries are not explicitly mentioned in CISA’s secure by design principles, we think they are an important aspect in a technology company being transparent about their practices.

Public bug bounties

We invite you to contribute to our security efforts by participating in our public bug bounty hosted by HackerOne, where you can report Cloudflare vulnerabilities and receive financial compensation in return for your help.

Leading from the top

With this principle, security is deeply rooted inside Cloudflare’s business goals. Because of the tight relationship of security and quality, by improving a product’s default security, the quality of the overall product also improves.

At Cloudflare, our dedication to security is reflected in the company’s structure. Our Chief Security Officer reports directly to our CEO, and presents at every board meeting. That allows for board members well-informed about the current cybersecurity landscape and emphasizes the importance of the company’s initiatives to improve security.

Additionally, our security engineers are a part of the main R&D organization, with their work being as integral to our products as that of our system engineers. This means that our security engineers can bake security into the SDLC instead of bolting it on as an afterthought.

How can you help?

If you are a software manufacturer, we encourage you to familiarize yourself with CISA’s ‘Secure by Design’ principles and create a plan to implement them in your company.

As an individual, we encourage you to participate in bug bounty programs (such as Cloudflare’s HackerOne public bounty) and promote cybersecurity awareness in your community.

Let’s help build a better Internet together.

All you need to know about the Digital Services Act

2024-02-19 Petra Arts http://blog.cloudflare.com/author/petra/

Post Syndicated from Petra Arts http://blog.cloudflare.com/author/petra/ original https://blog.cloudflare.com/digital-services-act

February 17th, 2024 marked the entry into force of a landmark piece of European Union (EU) legislation, affecting European users who create and disseminate online content as well as tech companies who act as “intermediaries” on the Internet. I am talking of course about the EU Digital Services Act, or DSA for short. The DSA was first proposed in December 2020, and is meant to update a 20-year-old law called the EU e-commerce Directive, which provides important safeguards and legal certainty for all businesses operating online. The principles of that legal framework, most notably the introduction of EU-wide rules on intermediary liability, are still of major importance today. The DSA is a landmark piece of European legislation because it also sets out, for the first time, enhanced regulatory requirements for (large) digital platforms, thus affecting the entire Internet ecosystem.

At Cloudflare, we are supportive of the longstanding legal frameworks both in Europe and other parts of the world that protect Internet companies from liability for the content that is uploaded or sent through their networks by their users, subscribers or customers. These frameworks are indispensable for the growth of online services, and have been essential in the growth of online applications, marketplaces and social networks.

What’s the Digital Services Act all about?

The EU Digital Services Act consists of two main parts: First, the DSA maintains the strong liability protections for intermediary services that have existed in Europe for over 20 years, and modernizes them, including by giving explicit recognition of supporting Internet services. Services which perform important roles in the functioning of the Internet, such as CDNs, reverse proxies and technical services at the DNS level were not explicitly mentioned in the EU e-commerce Directive at the time. The DSA, in recital 28, recognises that those services, along with many others, are part of the fundamental fabric of the Internet and deserve protection against liability for any illegal or infringing content. This marks an important clarification milestone in EU law.

Secondly, the DSA establishes varying degrees of due diligence and transparency obligations for intermediary services that offer services in the EU. The DSA follows a ‘staggered’ or ‘cumulative’ approach to those obligations and the different services it applies to. This ranges from a number of detailed obligations for the largest platforms (so-called “Very Large Online Platforms” or VLOPs, such as the Apple App Store, Facebook, TikTok, and YouTube), down to less extensive but still impactful rules for smaller platforms, hosting services and Internet intermediaries. What is really important to note with regard to the different service providers that are impacted is that the DSA clearly distinguishes between (technical) intermediary services, “mere” hosting services, and “online platforms”, with the latter category having a number of additional obligations under the new law. Online platform services are considered as hosting services which store information at the request of the recipients of the service, with the important additional role of also disseminating that information to the public.

This proportionate approach is in line with Cloudflare’s view of the Internet stack and the idea that infrastructure services are distinct from social media and search services that are designed to curate and recommend Internet content. This principle of a targeted, proportionate response to the matter is also embedded in the DSA itself. Recital 27 states that “(…) any requests or orders for [such] involvement should, as a general rule, be directed to the specific provider that has the technical and operational ability to act against specific items of illegal content, so as to prevent and minimise (sic) any possible negative effects on the availability and accessibility of information that is not illegal content”. This is an important provision, as principles of proportionality, freedom of speech, and access to information should be safeguarded at all times when it relates to online content.

What do the new rules mean for Cloudflare?

As a provider of intermediary services, Cloudflare has engaged with European policymakers on the topic of intermediary liability for a number of years. From the start of the legislative process on the proposed DSA in 2020 we have contributed extensively to public consultations, and have shared our views on the proposed DSA with lawmakers in Brussels.

In many ways, the final version of the law reflects our existing practices. We have long taken the position, for example, that our intermediary services should have different rules than our hosting services, as is anticipated under the DSA. We have taken a few additional measures to ensure compliance with DSA requirements. For instance, we’ve announced a new legal representative in the EU and point of contact for the purposes of the DSA.

Cloudflare has strongly believed in transparency reporting for a long time, and we have issued transparency reports twice a year since 2013. We recognize that the DSA includes some new requirements around transparency reporting, some of which match with our current reports and processes, and others that do not. We will be revising our transparency reporting, to reflect the DSA’s requirements, beyond our existing documentation. We have also taken steps to confirm that our limited hosting services comply with DSA requirements.

The EU Digital Services Act, because of its enhanced regulatory requirements for (large) digital platforms, represents a significant change to the Internet ecosystem. Cloudflare feels nonetheless well-prepared to address the different requirements that came into force on February 17, 2024, and we look forward to having positive and constructive conversations with relevant European regulators as they start to work on the enforcement of the new law.

Reflecting on the GDPR to celebrate Privacy Day 2024

2024-01-26 Emily Hancock http://blog.cloudflare.com/author/emily-hancock/

Post Syndicated from Emily Hancock http://blog.cloudflare.com/author/emily-hancock/ original https://blog.cloudflare.com/reflecting-on-the-gdpr-to-celebrate-privacy-day-2024

Just in time for Data Privacy Day 2024 on January 28, the EU Commission is calling for evidence to understand how the EU’s General Data Protection Regulation (GDPR) has been functioning now that we’re nearing the 6th anniversary of the regulation coming into force.

We’re so glad they asked, because we have some thoughts. And what better way to celebrate privacy day than by discussing whether the application of the GDPR has actually done anything to improve people’s privacy?

The answer is, mostly yes, but in a couple of significant ways – no.

Overall, the GDPR is rightly seen as the global gold standard for privacy protection. It has served as a model for what data protection practices should look like globally, it enshrines data subject rights that have been copied across jurisdictions, and when it took effect, it created a standard for the kinds of privacy protections people worldwide should be able to expect and demand from the entities that handle their personal data. On balance, the GDPR has definitely moved the needle in the right direction for giving people more control over their personal data and in protecting their privacy.

In a couple of key areas, however, we believe the way the GDPR has been applied to data flowing across the Internet has done nothing for privacy and in fact may even jeopardize the protection of personal data. The first area where we see this is with respect to cross-border data transfers. Location has become a proxy for privacy in the minds of many EU data protection regulators, and we think that is the wrong result. The second area is an overly broad interpretation of what constitutes “personal data” by some regulators with respect to Internet Protocol or “IP” addresses. We contend that IP addresses should not always count as personal data, especially when the entities handling IP addresses have no ability on their own to tie those IP addresses to individuals. This is important because the ability to implement a number of industry-leading cybersecurity measures relies on the ability to do threat intelligence on Internet traffic metadata, including IP addresses.

Location should not be a proxy for privacy

Fundamentally, good data security and privacy practices should be able to protect personal data regardless of where that processing or storage occurs. Nevertheless, the GDPR is based on the idea that legal protections should attach to personal data based on the location of the data – where it is generated, processed, or stored. Articles 44 to 49 establish the conditions that must be in place in order for data to be transferred to a jurisdiction outside the EU, with the idea that even if the data is in a different location, the privacy protections established by the GDPR should follow the data. No doubt this approach was influenced by political developments around government surveillance practices, such as the revelations in 2013 of secret documents describing the relationship between the US NSA (and its Five Eyes partners) and large Internet companies, and that intelligence agencies were scooping up data from choke points on the Internet. And once the GDPR took effect, many data regulators in the EU were of the view that as a result of the GDPR’s restrictions on cross-border data transfers, European personal data simply could not be processed in the United States in a way that would be consistent with the GDPR.

This issue came to a head in July 2020, when the European Court of Justice (CJEU), in its “Schrems II” decision¹, invalidated the EU-US Privacy Shield adequacy standard and questioned the suitability of the EU standard contractual clauses (a mechanism entities can use to ensure that GDPR protections are applied to EU personal data even if it is processed outside the EU). The ruling in some respects left data protection regulators with little room to maneuver on questions of transatlantic data flows. But while some regulators were able to view the Schrems II ruling in a way that would still allow for EU personal data to be processed in the United States, other data protection regulators saw the decision as an opportunity to double down on their view that EU personal data cannot be processed in the US consistent with the GDPR, therefore promoting the misconception that data localization should be a proxy for data protection.

In fact, we would argue that the opposite is the case. From our own experience and according to recent research², we know that data localization threatens an organization’s ability to achieve integrated management of cybersecurity risk and limits an entity’s ability to employ state-of-the-art cybersecurity measures that rely on cross-border data transfers to make them as effective as possible. For example, Cloudflare’s Bot Management product only increases in accuracy with continued use on the global network: it detects and blocks traffic coming from likely bots before feeding back learnings to the models backing the product. A diversity of signal and scale of data on a global platform is critical to help us continue to evolve our bot detection tools. If the Internet were fragmented – preventing data from one jurisdiction being used in another – more and more signals would be missed. We wouldn’t be able to apply learnings from bot trends in Asia to bot mitigation efforts in Europe, for example. And if the ability to identify bot traffic is hampered, so is the ability to block those harmful bots from services that process personal data.

The need for industry-leading cybersecurity measures is self-evident, and it is not as if data protection authorities don’t realize this. If you look at any enforcement action brought against an entity that suffered a data breach, you see data protection regulators insisting that the impacted entities implement ever more robust cybersecurity measures in line with the obligation GDPR Article 32 places on data controllers and processors to “develop appropriate technical and organizational measures to ensure a level of security appropriate to the risk”, “taking into account the state of the art”. In addition, data localization undermines information sharing within industry and with government agencies for cybersecurity purposes, which is generally recognized as vital to effective cybersecurity.

In this way, while the GDPR itself lays out a solid framework for securing personal data to ensure its privacy, the application of the GDPR’s cross-border data transfer provisions has twisted and contorted the purpose of the GDPR. It’s a classic example of not being able to see the forest for the trees. If the GDPR is applied in such a way as to elevate the priority of data localization over the priority of keeping data private and secure, then the protection of ordinary people’s data suffers.

Applying data transfer rules to IP addresses could lead to balkanization of the Internet

The other key way in which the application of the GDPR has been detrimental to the actual privacy of personal data is related to the way the term “personal data” has been defined in the Internet context – specifically with respect to Internet Protocol or “IP” addresses. A world where IP addresses are always treated as personal data and therefore subject to the GDPR’s data transfer rules is a world that could come perilously close to requiring a walled-off European Internet. And as noted above, this could have serious consequences for data privacy, not to mention that it likely would cut the EU off from any number of global marketplaces, information exchanges, and social media platforms.

This is a bit of a complicated argument, so let’s break it down. As most of us know, IP addresses are the addressing system for the Internet. When you send a request to a website, send an email, or communicate online in any way, IP addresses connect your request to the destination you’re trying to access. These IP addresses are the key to making sure Internet traffic gets delivered to where it needs to go. As the Internet is a global network, this means it’s entirely possible that Internet traffic – which necessarily contains IP addresses – will cross national borders. Indeed, the destination you are trying to access may well be located in a different jurisdiction altogether. That’s just the way the global Internet works. So far, so good.

But if IP addresses are considered personal data, then they are subject to data transfer restrictions under the GDPR. And with the way those provisions have been applied in recent years, some data regulators were getting perilously close to saying that IP addresses cannot transit jurisdictional boundaries if it meant the data might go to the US. The EU’s recent approval of the EU-US Data Privacy Framework established adequacy for US entities that certify to the framework, so these cross-border data transfers are not currently an issue. But if the Data Privacy Framework were to be invalidated as the EU-US Privacy Shield was in the Schrems II decision, then we could find ourselves in a place where the GDPR is applied to mean that IP addresses ostensibly linked to EU residents can’t be processed in the US, or potentially not even leave the EU.

If this were the case, then providers would have to start developing Europe-only networks to ensure IP addresses never cross jurisdictional boundaries. But how would people in the EU and US communicate if EU IP addresses can’t go to the US? Would EU citizens be restricted from accessing content stored in the US? It’s an application of the GDPR that would lead to the absurd result – one surely not intended by its drafters. And yet, in light of the Schrems II case and the way the GDPR has been applied, here we are.

A possible solution would be to consider that IP addresses are not always “personal data” subject to the GDPR. In 2016 – even before the GDPR took effect – the Court of Justice of the European Union (CJEU) established the view in Breyer v. Bundesrepublik Deutschland that even dynamic IP addresses, which change with every new connection to the Internet, constituted personal data if an entity processing the IP address could link the IP addresses to an individual. While the court’s decision did not say that dynamic IP addresses are always personal data under European data protection law, that’s exactly what EU data regulators took from the decision, without considering whether an entity actually has a way to tie the IP address to a real person³.

The question of when an identifier qualifies as “personal data” is again before the CJEU: In April 2023, the lower EU General Court ruled in SRB v EDPS⁴ that transmitted data can be considered anonymised and therefore not personal data if the data recipient does not have any additional information reasonably likely to allow it to re-identify the data subjects and has no legal means available to access such information. The appellant – the European Data Protection Supervisor (EDPS) – disagrees. The EDPS, who mainly oversees the privacy compliance of EU institutions and bodies, is appealing the decision and arguing that a unique identifier should qualify as personal data if that identifier could ever be linked to an individual, regardless of whether the entity holding the identifier actually had the means to make such a link.

If the lower court’s common-sense ruling holds, one could argue that IP addresses are not personal data when those IP addresses are processed by entities like Cloudflare, which have no means of connecting an IP address to an individual. If IP addresses are then not always personal data, then IP addresses will not always be subject to the GDPR’s rules on cross-border data transfers.

Although it may seem counterintuitive, having a standard whereby an IP address is not necessarily “personal data” would actually be a positive development for privacy. If IP addresses can flow freely across the Internet, then entities in the EU can use non-EU cybersecurity providers to help them secure their personal data. Advanced Machine Learning/predictive AI techniques that look at IP addresses to protect against DDoS attacks, prevent bots, or otherwise guard against personal data breaches will be able to draw on attack patterns and threat intelligence from around the world to the benefit of EU entities and residents. But none of these benefits can be realized in a world where IP addresses are always personal data under the GDPR and where the GDPR’s data transfer rules are interpreted to mean IP addresses linked to EU residents can never flow to the United States.

Keeping privacy in focus

On this Data Privacy Day, we urge EU policy makers to look closely at how the GDPR is working in practice, and to take note of the instances where the GDPR is applied in ways that place privacy protections above all other considerations – even appropriate security measures mandated by the GDPR’s Article 32 that take into account the state of the art of technology. When this happens, it can actually be detrimental to privacy. If taken to the extreme, this formulaic approach would not only negatively impact cybersecurity and data protection, but even put into question the functioning of the global Internet infrastructure as a whole, which depends on cross-border data flows. So what can be done to avert this?

First, we believe EU policymakers could adopt guidelines (if not legal clarification) for regulators that IP addresses should not be considered personal data when they cannot be linked by an entity to a real person. Second, policymakers should clarify that the GDPR’s application should be considered with the cybersecurity benefits of data processing in mind. Building on the GDPR’s existing recital 49, which rightly recognizes cybersecurity as a legitimate interest for processing, personal data that needs to be processed outside the EU for cybersecurity purposes should be exempted from GDPR restrictions to international data transfers. This would avoid some of the worst effects of the mindset that currently views data localization as a proxy for data privacy. Such a shift would be a truly pro-privacy application of the GDPR.

¹ Case C-311/18, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems.
² Swire, Peter and Kennedy-Mayo, DeBrae and Bagley, Andrew and Modak, Avani and Krasser, Sven and Bausewein, Christoph, Risks to Cybersecurity from Data Localization, Organized by Techniques, Tactics, and Procedures (2023).
³ Different decisions by the European data protection authorities, namely the Austrian DSB (December 2021), the French CNIL (February 2022) and the Italian Garante (June 2022), while analyzing the use of Google Analytics, have rejected the relative approach used by the Breyer case and considered that an IP address should always be considered as personal data. Only the decision issued by the Spanish AEPD (December 2022) followed the same interpretation of the Breyer case. In addition, see paragraphs 109 and 136 in Guidelines by Supervisory Authorities for Tele-Media Providers, DSK (2021).
⁴ Single Resolution Board v EDPS, Court of Justice of the European Union, April 2023.

Goodbye, section 2.8 and hello to Cloudflare’s new terms of service

2023-05-16 Eugene Kim

Post Syndicated from Eugene Kim original http://blog.cloudflare.com/updated-tos/

Goodbye, section 2.8 and hello to Cloudflare’s new terms of service

Earlier this year, we blogged about an incident where we mistakenly throttled a customer due to internal confusion about a potential violation of our Terms of Service. That incident highlighted a growing point of confusion for many of our customers. Put simply, our terms had not kept pace with the rapid innovation here at Cloudflare, especially with respect to our Developer Platform. We’re excited to announce new updates that will modernize our terms and cut down on customer confusion and frustration.

A bit of background on our legal terms of service

We want our terms to set clear expectations about what we’ll deliver and what customers can do with our services. But drafting terms is often an iterative process, and iteration over a decade can lead to bloat, complexity, and vestigial branches in need of pruning. Now, time to break out the shears.

Snip, snip

To really nip this in the bud, we started at the source–the content-based restriction housed in Section 2.8 of our Self-Serve Subscription Agreement:

Cloudflare is much, much more than a CDN, but that wasn’t always the case. The CDN was one of our first services and originally designed to serve HTML content like webpages. User attempts to serve video and other large files hosted outside of Cloudflare were disruptive on many levels. So, years ago, we added Section 2.8 to give Cloudflare the means to preserve the original intent of the CDN: limiting use of the CDN to webpages.

Over time, Cloudflare’s network became larger and more robust and its portfolio broadened to include services like Stream, Images, and R2. These services are explicitly designed to allow customers to serve non-HTML content like video, images, and other large files hosted directly by Cloudflare. And yet, Section 2.8 persisted in our Self-Serve Subscription Agreement–the umbrella terms that apply to all services. We acknowledge that this didn’t make much sense.

To address the problem, we’ve done a few things. First, we moved the content-based restriction concept to a new CDN-specific section in our Service-Specific Terms. We want to be clear that this restriction only applies to use of our CDN. Next, we got rid of the antiquated HTML vs. non-HTML construct, which was far too broad. Finally, we made it clear that customers can serve video and other large files using the CDN so long as that content is hosted by a Cloudflare service like Stream, Images, or R2. This will allow customers to confidently innovate on our Developer Platform while leveraging the speed, security, and reliability of our CDN. Video and large files hosted outside of Cloudflare will still be restricted on our CDN, but we think that our service features, generous free tier, and competitive pricing (including zero egress fees on R2) make for a compelling package for developers that want to access the reach and performance of our network.

Here are a few diagrams to help understand how our terms of service fit together for various use cases.

Customer A is on a free, pro, or business plan and wants to use the CDN service:

Customer B is on a free, pro, or business plan and wants to use the Developer Platform and Zero Trust services:

Customer C is on a free, pro, or business plan and wants to use Stream with the CDN service and Magic Transit with the CDN service:

Quality of life upgrades

We also took this opportunity to tune up other aspects of our Terms of Service to make for a more user-first experience. For example, we streamlined our Self-Serve Subscription Agreement to make it clearer and easier to understand from the start.

We also heard previous complaints and removed an old restriction on benchmarking–we’re confident in the performance of our network and services, unlike some of our competitors. Last but not least, we renamed the Supplemental Terms to the Service-Specific Terms and gave them a major facelift to improve clarity and usability.

Users first

We’ve learned a lot from our users throughout this process, and we are always grateful for your feedback. Our terms were never meant to act as a gating mechanism that stifled innovation. With these updates, we hope that customers will feel confident in building the next generation of apps and services on Cloudflare. And we’ll keep the shears handy as we continue to work to help build a better Internet.

Three new winners of Project Jengo, and more defeats for the patent troll

2023-01-17 Ethan Park

Post Syndicated from Ethan Park original https://blog.cloudflare.com/three-new-winners-of-project-jengo-and-more-defeats-for-the-patent-troll/

Three new winners of Project Jengo, and more defeats for the patent troll

Project Jengo is a Cloudflare effort to fight back against patent trolls by flipping the incentive structure that has encouraged the growth of patent trolls who extract settlements out of companies using frivolous lawsuits. We do this by asking the public to identify prior art that can invalidate any of the patents that a troll holds – not just the ones that are asserted against Cloudflare.

Since we launched Project Jengo over five years ago, we’ve given out over $135,000 to individuals who helped us find prior art to invalidate patents owned by patent trolls. By invalidating those patents – many of which are so blatantly marginal or broad that they never should have been granted in the first place – we hope to decrease the amount of harassment and frivolous lawsuits that patent trolls bring against innovative technology companies.

Today, we’re excited to announce three new Project Jengo winners. These individuals have helped us push forward our effort to take down patent trolls, and continue to fight trolling in favor of innovation.

The patent troll

The current case involves a patent troll called Sable Networks who asserted four patents that generally describe a flow-based router or a mechanism for identifying and penalizing misbehaving flows against Cloudflare. We’ve implemented Project Jengo against Sable on those four patents and their six other patents, which they haven’t asserted against Cloudflare. Today’s recipients have helped us in that fight.

And we continue to fight Sable Networks before the Court and the U.S. Patent Office as well. We have a major case update in that regard as the U.S. Patent Office agreed that most of the claims from Sable’s ’593 patent should have never been issued in the first place, which means Sable is down to two patents in their lawsuit against Cloudflare. More on that later, but first, here are the three winners from Chapters 4, 5, and 6 of Project Jengo!

Chris Wheeler from Georgia, who has a patent of his own

We are excited to announce Chris Wheeler as the winner of the 4th chapter of Project Jengo! Chris is the CTO and a co-founder of a software startup in Macon, Georgia called Tier2 Technologies, and he is now $5,000 richer!

When we asked where he had heard about Project Jengo, Chris told us:

“I heard about Project Jengo from one of your blog posts. I often read your blog on my phone from my children’s bedroom at night while I’m waiting for them to fall asleep. I’m a huge fan of Cloudflare and use your services myself extensively.”

As for why he submitted, Chris holds a patent, and submitted to Project Jengo in part because he was “drawn to the idea of helping protect the integrity of the patent system.”

Chris submitted a paper titled “A Framework for Alternate Queueing: Towards Traffic Management by PC-UNIX Based Routers” as prior art to Sable’s ’932 patent. This paper was published in 1998. On the other hand, Sable’s ’932 patent was filed in 2002 and is alleged to cover routers utilizing aggregate flow blocks that include tunnel-specific information for selected network paths. The aggregate flow blocks are also alleged to store statistics pertaining to the selected network paths. This paper, published nearly four years prior to the filing of the ’932 patent, describes a PC-UNIX based router that implements a FreeBSD Alternate Queueing (ALTQ) driver with traffic management functionalities to select network paths. ALTQ traffic management uses queueing disciplines based on stored statistical analysis of selected paths for network traffic, and this is a great prior art reference to the ’932 patent.

His breakdown of his submission is interesting too:

“When I saw the claims in 6,977,932 I immediately thought ‘They are just describing QoS in a weird convoluted way’ and I knew QoS had existed long before the patent date of 2002. I have used the ALTQ packet scheduler in pfSense a lot in the past throughout my career, and that was the first thing that came to my mind. I did a quick Google search for ‘ALTQ’ and found the oldest reference I could find, which was from 1998.”

We appreciate his efforts, as he managed to find useful prior art from four years before the patent in question. Thank you, Chris!

Peter’s first foray into patent law makes him $5,000 richer!

Additionally, we are awarding $5,000 to Peter S. for finding us a valuable thesis paper! This is Peter’s first foray into patent law, and we are so thankful for his time and effort.

The thesis of Rena Whei-Ming Yang found by Peter describes the solution of the ʼ593 patent almost five years before Sable even filed for the patent! The ʼ593 patent is the Sable patent concerning the detection of “bad” flows. Yang—years before Sable—developed the same thing: “This thesis studies a means of using such mechanisms to identify nonadaptive network flows, and proposes a protocol to push this information, along with penalization responsibility, towards the flows’ sources.” What Sable calls “bad,” Yang labels “nonadaptive.” The important thing is that Yang’s work predates the ’593 patent’s alleged new solutions by years, making it a great find. Thank you, Peter!

David who hopes the Patent Office will adopt new technologies for better examinations

Finally, we are excited to announce the winner from the 6th Chapter of Project Jengo, and that is David H. who is receiving a $5,000 prize! David’s background is in accounting/finance, but became interested in patents and IP back in 2010. He heard about Project Jengo through a LinkedIn post and thought it was an excellent idea, so he put his search skills to task.

David identified U.S. Patent No. 6,859,438 for us, which is a patent entitled “Policy Based Quality of Service.” This ’438 patent discloses the same “quality of service” (or QoS) technology claimed in Sable’s ’431 patent, with one important difference: the disclosure of the ’438 patent dates back to an application filed on February 3, 1998, but the disclosure in the ’431 patent wasn’t filed until (at the earliest), April 19, 2000. So the technology explained in the ’438 patent—a flexible, policy-based, mechanism for managing, monitoring, and prioritizing traffic within a network and allocating bandwidth to achieve true QoS—beat Sable to the punch on the “new” switching technology claimed in the ’431 patent that purports to provide a previously “unavailable” degree of quality of service, by more than two years! Excellent find, David!

He also shared his thoughts on the current state of the U.S. patent system:

“The US Patent Office continues to issue patents that are likely invalid on a number of grounds with a large proportion to big tech. The USPTO has a nice fee generating business, being able to get paid issuing patents and subsequently canceling them in post grant proceedings. I am hopeful the USPTO adopts new technology to aid examiners in their prosecution efforts.”

Thank you, David!

* * *

Congratulations and our deep gratitude to all three winners from Chapters 4-6 of Project Jengo. Remember, we have committed \$100,000 to this prior art search, and we still have $50,000 to give out! The search is still ongoing, so please help us beat the patent troll by submitting prior art references here. The submission deadline for Chapter 7 is January 31, 2023, so don’t delay your search!

Case updates: Another patent thrown out of the case, and the few remaining claims further whittled down

When Sable sued us almost two years ago in March 2021, they accused us of infringing four different patents, which included a total of 134 claims. We previously shared how we successfully killed off one of the four patents, known as the ’932 patent.

Today, we have more great news to share. The U.S. Patent Office agreed with us that all the claims from the ’593 patent that Sable asserted against us are invalid. This means we were able to get yet another patent – the ’593 patent – dropped out of Sable’s case against us.

A single U.S. patent usually has somewhere around 10 to 20 claims (here’s a Wiki page explaining what a “claim” is in patents), but Sable’s ’593 patent included a whopping number of claims – 44 to be exact. As we previously shared back in January 2022, the Patent Office ruled that we would likely be successful in invalidating all 44 claims of the ’593 patent and instituted a trial proceeding known as inter partes review (IPR). Since then, Sable voluntarily canceled 17 of the claims – presumably because they themselves knew those claims were invalid. Of the remaining 27 claims, the Patent Office determined that 23 claims were invalid. Because none of the four surviving claims – which escaped invalidation only by virtue of a procedural technicality – are part of Sable’s case against us, the ’593 patent is no longer asserted against us. And given the record we have established before the Patent Office, we don’t think Sable will try asserting those four surviving claims from the ’593 patent against any of our peer companies. But even if Sable does, they should be able to leverage what we’ve done and kill off the patent completely.

Our victory was covered by multiple legal news outlets such as Bloomberg Law and Law360 (unfortunately, subscription required). A special shoutout to our attorney Jim Day of Farella Braun + Martel, who fought hard to get rid of these toxic claims that should have never been issued! With two patents completely out of the case, there are now only two patents at issue in Sable’s case against us.

We have even more good news to share! In October 2022, the Court found nine claims from one of the two remaining patents – the ’431 patent – to be invalid for failure to meet certain statutory requirements. This means Sable only has 14 claims from two patents in the case. Considering that we started this journey with Sable asserting 131 claims from four patents against us, we are proud of what we have accomplished thus far. We successfully persuaded the Court and the Patent Office to cancel, or forced Sable to voluntarily cancel, almost 90% of those 131 claims. Those victories not only help us in our case against Sable, they will also protect all innovative companies from being accused frivolously of infringing those invalid claims.

Our trial is scheduled for November 2023, but we will have more updates for you before then. Stay tuned, and remember to go look for prior art references to help us in our fight against this patent troll!

Blocking Kiwifarms

2022-09-04 Matthew Prince

Post Syndicated from Matthew Prince original https://blog.cloudflare.com/kiwifarms-blocked/

Blocking Kiwifarms

We have blocked Kiwifarms. Visitors to any of the Kiwifarms sites that use any of Cloudflare’s services will see a Cloudflare block page and a link to this post. Kiwifarms may move their sites to other providers and, in doing so, come back online, but we have taken steps to block their content from being accessed through our infrastructure.

This is an extraordinary decision for us to make and, given Cloudflare’s role as an Internet infrastructure provider, a dangerous one that we are not comfortable with. However, the rhetoric on the Kiwifarms site and specific, targeted threats have escalated over the last 48 hours to the point that we believe there is an unprecedented emergency and immediate threat to human life unlike we have previously seen from Kiwifarms or any other customer before.

Escalating threats

Kiwifarms has frequently been host to revolting content. Revolting content alone does not create an emergency situation that necessitates the action we are taking today. Beginning approximately two weeks ago, a pressure campaign started with the goal to deplatform Kiwifarms. That pressure campaign targeted Cloudflare as well as other providers utilized by the site.

Cloudflare provides security services to Kiwifarms, protecting them from DDoS and other cyberattacks. We have never been their hosting provider. As we outlined last Wednesday, we do not believe that terminating security services is appropriate, even to revolting content. In a law-respecting world, the answer to even illegal content is not to use other illegal means like DDoS attacks to silence it.

We are also not taking this action directly because of the pressure campaign. While we have empathy for its organizers, we are committed as a security provider to protecting our customers even when they run deeply afoul of popular opinion or even our own morals. The policy we articulated last Wednesday remains our policy. We continue to believe that the best way to relegate cyberattacks to the dustbin of history is to give everyone the tools to prevent them.

However, as the pressure campaign escalated, so did the rhetoric on the Kiwifarms site. Feeling attacked, users of the site became even more aggressive. Over the last two weeks, we have proactively reached out to law enforcement in multiple jurisdictions highlighting what we believe are potential criminal acts and imminent threats to human life that were posted to the site.

Legal process

While law enforcement in these areas are working to investigate what we and others reported, unfortunately the process is moving more slowly than the escalating risk. While we believe that in every other situation we have faced — including the Daily Stormer and 8chan — it would have been appropriate as an infrastructure provider for us to wait for legal process, in this case the imminent and emergency threat to human life which continues to escalate causes us to take this action.

Hard cases make bad law. This is a hard case and we would caution anyone from seeing it as setting precedent. The policies we articulated last Wednesday remain our policies. For an infrastructure provider like Cloudflare, legal process is still the correct way to deal with revolting and potentially illegal content online.

But we need a mechanism when there is an emergency threat to human life for infrastructure providers to work expediently with legal authorities in order to ensure the decisions we make are grounded in due process. Unfortunately, that mechanism does not exist and so we are making this uncomfortable emergency decision alone.

Not the end

Finally, we are aware and concerned that our action may only fan the flames of this emergency. Kiwifarms itself will most likely find other infrastructure that allows them to come back online, as the Daily Stormer and 8chan did themselves after we terminated them. And, even if they don’t, the individuals that used the site to increasingly terrorize will feel even more isolated and attacked and may lash out further. There is real risk that by taking this action today we may have further heightened the emergency.

We will continue to work proactively with law enforcement to help with their investigations into the site and the individuals who have posted what may be illegal content to it. And we recognize that while our blocking Kiwifarms temporarily addresses the situation, it by no means solves the underlying problem. That solution will require much more work across society. We are hopeful that our action today will help provoke conversations toward addressing the larger problem. And we stand ready to participate in that conversation.

Cloudflare’s abuse policies & approach

2022-08-31 Matthew Prince

Post Syndicated from Matthew Prince original https://blog.cloudflare.com/cloudflares-abuse-policies-and-approach/

Cloudflare's abuse policies & approach

Cloudflare launched nearly twelve years ago. We’ve grown to operate a network that spans more than 275 cities in over 100 countries. We have millions of customers: from small businesses and individual developers to approximately 30 percent of the Fortune 500. Today, more than 20 percent of the web relies directly on Cloudflare’s services.

Over the time since we launched, our set of services has become much more complicated. With that complexity we have developed policies around how we handle abuse of different Cloudflare features. Just as a broad platform like Google has different abuse policies for search, Gmail, YouTube, and Blogger, Cloudflare has developed different abuse policies as we have introduced new products.

We published our updated approach to abuse last year at:

https://www.cloudflare.com/trust-hub/abuse-approach/

However, as questions have arisen, we thought it made sense to describe those policies in more detail here.

The policies we built reflect ideas and recommendations from human rights experts, activists, academics, and regulators. Our guiding principles require abuse policies to be specific to the service being used. This is to ensure that any actions we take both reflect the ability to address the harm and minimize unintended consequences. We believe that someone with an abuse complaint must have access to an abuse process to reach those who can most effectively and narrowly address their complaint — anonymously if necessary. And, critically, we strive always to be transparent about both our policies and the actions we take.

Cloudflare’s products

Cloudflare provides a broad range of products that fall generally into three buckets: hosting products (e.g., Cloudflare Pages, Cloudflare Stream, Workers KV, Custom Error Pages), security services (e.g., DDoS Mitigation, Web Application Firewall, Cloudflare Access, Rate Limiting), and core Internet technology services (e.g., Authoritative DNS, Recursive DNS/1.1.1.1, WARP). For a complete list of our products and how they map to these categories, you can see our Abuse Hub.

As described below, our policies take a different approach on a product-by-product basis in each of these categories.

Hosting products

Hosting products are those products where Cloudflare is the ultimate host of the content. This is different from products where we are merely providing security or temporary caching services and the content is hosted elsewhere. Although many people confuse our security products with hosting services, we have distinctly different policies for each. Because the vast majority of Cloudflare customers do not yet use our hosting products, abuse complaints and actions involving these products are currently relatively rare.

Our decision to disable access to content in hosting products fundamentally results in that content being taken offline, at least until it is republished elsewhere. Hosting products are subject to our Acceptable Hosting Policy. Under that policy, for these products, we may remove or disable access to content that we believe:

Contains, displays, distributes, or encourages the creation of child sexual abuse material, or otherwise exploits or promotes the exploitation of minors.
Infringes on intellectual property rights.
Has been determined by appropriate legal process to be defamatory or libelous.
Engages in the unlawful distribution of controlled substances.
Facilitates human trafficking or prostitution in violation of the law.
Contains, installs, or disseminates any active malware, or uses our platform for exploit delivery (such as part of a command and control system).
Is otherwise illegal, harmful, or violates the rights of others, including content that discloses sensitive personal information, incites or exploits violence against people or animals, or seeks to defraud the public.

We maintain discretion in how our Acceptable Hosting Policy is enforced, and generally seek to apply content restrictions as narrowly as possible. For instance, if a shopping cart platform with millions of customers uses Cloudflare Workers KV and one of their customers violates our Acceptable Hosting Policy, we will not automatically terminate the use of Cloudflare Workers KV for the entire platform.

Our guiding principle is that organizations closest to content are best at determining when the content is abusive. It also recognizes that overbroad takedowns can have significant unintended impact on access to content online.

Security services

The overwhelming majority of Cloudflare’s millions of customers use only our security services. Cloudflare made a decision early in our history that we wanted to make security tools as widely available as possible. This meant that we provided many tools for free, or at minimal cost, to best limit the impact and effectiveness of a wide range of cyberattacks. Most of our customers pay us nothing.

Giving everyone the ability to sign up for our services online also reflects our view that cyberattacks not only should not be used for silencing vulnerable groups, but are not the appropriate mechanism for addressing problematic content online. We believe cyberattacks, in any form, should be relegated to the dustbin of history.

The decision to provide security tools so widely has meant that we’ve had to think carefully about when, or if, we ever terminate access to those services. We recognized that we needed to think through what the effect of a termination would be, and whether there was any way to set standards that could be applied in a fair, transparent and non-discriminatory way, consistent with human rights principles.

This is true not just for the content where a complaint may be filed but also for the precedent the takedown sets. Our conclusion — informed by all of the many conversations we have had and the thoughtful discussion in the broader community — is that voluntarily terminating access to services that protect against cyberattack is not the correct approach.

Avoiding an abuse of power

Some argue that we should terminate these services to content we find reprehensible so that others can launch attacks to knock it offline. That is the equivalent argument in the physical world that the fire department shouldn’t respond to fires in the homes of people who do not possess sufficient moral character. Both in the physical world and online, that is a dangerous precedent, and one that is over the long term most likely to disproportionately harm vulnerable and marginalized communities.

Today, more than 20 percent of the web uses Cloudflare’s security services. When considering our policies we need to be mindful of the impact we have and precedent we set for the Internet as a whole. Terminating security services for content that our team personally feels is disgusting and immoral would be the popular choice. But, in the long term, such choices make it more difficult to protect content that supports oppressed and marginalized voices against attacks.

Refining our policy based on what we’ve learned

This isn’t hypothetical. Thousands of times per day we receive calls that we terminate security services based on content that someone reports as offensive. Most of these don’t make news. Most of the time these decisions don’t conflict with our moral views. Yet two times in the past we decided to terminate content from our security services because we found it reprehensible. In 2017, we terminated the neo-Nazi troll site The Daily Stormer. And in 2019, we terminated the conspiracy theory forum 8chan.

In a deeply troubling response, after both terminations we saw a dramatic increase in authoritarian regimes attempting to have us terminate security services for human rights organizations — often citing the language from our own justification back to us.

Since those decisions, we have had significant discussions with policy makers worldwide. From those discussions we concluded that the power to terminate security services for the sites was not a power Cloudflare should hold. Not because the content of those sites wasn’t abhorrent — it was — but because security services most closely resemble Internet utilities.

Just as the telephone company doesn’t terminate your line if you say awful, racist, bigoted things, we have concluded in consultation with politicians, policy makers, and experts that turning off security services because we think what you publish is despicable is the wrong policy. To be clear, just because we did it in a limited set of cases before doesn’t mean we were right when we did. Or that we will ever do it again.

But that doesn’t mean that Cloudflare can’t play an important role in protecting those targeted by others on the Internet. We have long supported human rights groups, journalists, and other uniquely vulnerable entities online through Project Galileo. Project Galileo offers free cybersecurity services to nonprofits and advocacy groups that help strengthen our communities.

Through the Athenian Project, we also play a role in protecting election systems throughout the United States and abroad. Elections are one of the areas where the systems that administer them need to be fundamentally trustworthy and neutral. Making choices on what content is deserving or not of security services, especially in any way that could in any way be interpreted as political, would undermine our ability to provide trustworthy protection of election infrastructure.

Regulatory realities

Our policies also respond to regulatory realities. Internet content regulation laws passed over the last five years around the world have largely drawn a line between services that host content and those that provide security and conduit services. Even when these regulations impose obligations on platforms or hosts to moderate content, they exempt security and conduit services from playing the role of moderator without legal process. This is sensible regulation borne of a thorough regulatory process.

Our policies follow this well-considered regulatory guidance. We prevent security services from being used by sanctioned organizations and individuals. We also terminate security services for content which is illegal in the United States — where Cloudflare is headquartered. This includes Child Sexual Abuse Material (CSAM) as well as content subject to Fight Online Sex Trafficking Act (FOSTA). But, otherwise, we believe that cyberattacks are something that everyone should be free of. Even if we fundamentally disagree with the content.

In respect of the rule of law and due process, we follow legal process controlling security services. We will restrict content in geographies where we have received legal orders to do so. For instance, if a court in a country prohibits access to certain content, then, following that court’s order, we generally will restrict access to that content in that country. That, in many cases, will limit the ability for the content to be accessed in the country. However, we recognize that just because content is illegal in one jurisdiction does not make it illegal in another, so we narrowly tailor these restrictions to align with the jurisdiction of the court or legal authority.

While we follow legal process, we also believe that transparency is critically important. To that end, wherever these content restrictions are imposed, we attempt to link to the particular legal order that required the content be restricted. This transparency is necessary for people to participate in the legal and legislative process. We find it deeply troubling when ISPs comply with court orders by invisibly blackholing content — not giving those who try to access it any idea of what legal regime prohibits it. Speech can be curtailed by law, but proper application of the Rule of Law requires whoever curtails it to be transparent about why they have.

Core Internet technology services

While we will generally follow legal orders to restrict security and conduit services, we have a higher bar for core Internet technology services like Authoritative DNS, Recursive DNS/1.1.1.1, and WARP. The challenge with these services is that restrictions on them are global in nature. You cannot easily restrict them just in one jurisdiction so the most restrictive law ends up applying globally.

We have generally challenged or appealed legal orders that attempt to restrict access to these core Internet technology services, even when a ruling only applies to our free customers. In doing so, we attempt to suggest to regulators or courts more tailored ways to restrict the content they may be concerned about.

Unfortunately, these cases are becoming more common where largely copyright holders are attempting to get a ruling in one jurisdiction and have it apply worldwide to terminate core Internet technology services and effectively wipe content offline. Again, we believe this is a dangerous precedent to set, placing the control of what content is allowed online in the hands of whatever jurisdiction is willing to be the most restrictive.

So far, we’ve largely been successful in making arguments that this is not the right way to regulate the Internet and getting these cases overturned. Holding this line we believe is fundamental for the healthy operation of the global Internet. But each showing of discretion across our security or core Internet technology services weakens our argument in these important cases.

Paying versus free

Cloudflare provides both free and paid services across all the categories above. Again, the majority of our customers use our free services and pay us nothing.

Although most of the concerns we see in our abuse process relate to our free customers, we do not have different moderation policies based on whether a customer is free versus paid. We do, however, believe that in cases where our values are diametrically opposed to a paying customer that we should take further steps to not only not profit from the customer, but to use any proceeds to further our companies’ values and oppose theirs.

For instance, when a site that opposed LGBTQ+ rights signed up for a paid version of DDoS mitigation service we worked with our Proudflare employee resource group to identify an organization that supported LGBTQ+ rights and donate 100 percent of the fees for our services to them. We don’t and won’t talk about these efforts publicly because we don’t do them for marketing purposes; we do them because they are aligned with what we believe is morally correct.

Rule of Law

While we believe we have an obligation to restrict the content that we host ourselves, we do not believe we have the political legitimacy to determine generally what is and is not online by restricting security or core Internet services. If that content is harmful, the right place to restrict it is legislatively.

We also believe that an Internet where cyberattacks are used to silence what’s online is a broken Internet, no matter how much we may have empathy for the ends. As such, we will look to legal process, not popular opinion, to guide our decisions about when to terminate our security services or our core Internet technology services.

In spite what some may claim, we are not free speech absolutists. We do, however, believe in the Rule of Law. Different countries and jurisdictions around the world will determine what content is and is not allowed based on their own norms and laws. In assessing our obligations, we look to whether those laws are limited to the jurisdiction and consistent with our obligations to respect human rights under the United Nations Guiding Principles on Business and Human Rights.

There remain many injustices in the world, and unfortunately much content online that we find reprehensible. We can solve some of these injustices, but we cannot solve them all. But, in the process of working to improve the security and functioning of the Internet, we need to make sure we don’t cause it long-term harm.

We will continue to have conversations about these challenges, and how best to approach securing the global Internet from cyberattack. We will also continue to cooperate with legitimate law enforcement to help investigate crimes, to donate funds and services to support equality, human rights, and other causes we believe in, and to participate in policy making around the world to help preserve the free and open Internet.

Arkansas engineer wins round 3 of Project Jengo, and Cloudflare continues to win at the Patent Office

2022-05-05 Will Valle

Post Syndicated from Will Valle original https://blog.cloudflare.com/arkansas-engineer-wins-round-3-of-project-jengo-and-cloudflare-continues-to-win-at-the-patent-office/

Arkansas engineer wins round 3 of Project Jengo, and Cloudflare continues to win at the Patent Office

We are excited to announce another Project Jengo winner, and provide you with an important update on our fight against Sable Networks.

As a reminder, Project Jengo is Cloudflare’s efforts to flip the incentive structure that has encouraged the growth of patent trolls that seek to leverage overbroad and unpracticed patents to extract settlements from operating entities. We do this by refusing to settle patent cases brought against us by trolls, and instead, use a crowdsourced bounty to identify prior art that undermines the value of the troll’s patents, and not just the ones asserted against Cloudflare. This is the second iteration of Project Jengo, which is focused on a patent troll called Sable.

Even though the case against Sable has been active for over a year now, and we’ve already achieved some great results, we haven’t let up the pressure. We’re now also giving out Cloudflare T-shirts to new Project Jengo participants – all you need to do is submit prior art related to any of the Sable patents this year and the first 100 participants with a U.S. mailing address will receive a Cloudflare t-shirt.

$5,000 to Project Jengo’s round three winner!

We have already awarded $30,000 so far to winners of the Sable-focused Project Jengo. Last quarter, we awarded $10,000 to a former R&D engineer from Rennes, France who heard about Project Jengo through Hacker News. This round, we are excited to announce that we’ll be awarding Curtis Carter with $5,000!

In explaining why he participated in Project Jengo, Curtis said:

“As a maintainer/contributor for several open source projects (NuGetDefense being my main project), I’m always afraid some troll is going to attack one of my projects or a project I contribute to, and I may not be able to afford stopping it.”

That is why we started Project Jengo – to help support and protect innovators against malicious patent trolls. They hinder innovation of productive companies, and trade in fear as currency. As Curtis highlighted, the future is brighter without trolls:

“I think what you are doing is for the good of future generations, and I’m proud I got to participate even if I hadn’t won anything.”

Developers and innovators should not work in fear that trolls will target them for frivolous settlements. The patent system was built to promote innovation, not destroy it.

Not only does Curtis maintain NuGetDefense (a known vulnerability scanner for the .Net NuGet ecosystem), he’s also an engineer at Tech Friends, Inc., a software development company that he claims is the best employer for software developers in Northeast Arkansas. Impressively, he is self-taught.

“This was the first time in a while that I dug into old research documents and patents. Honestly, the people who originally put this stuff together were often brilliant, and their work is a joy to read (even if it’s a bit dry).”

As for his submission, Curtis Carter took on the challenge of finding prior art for United States Patent No. 8,085,775, an over broad patent that Sable owns and generally covers a mechanism for identifying, classifying, and controlling flows over a network.

Sable chose not to assert that patent against Cloudflare in our ongoing litigation. The prior art he found specifically addresses “methods, apparatuses and systems directed to a flow-based, traffic-classification-aware data collection and reporting system…” according to its abstract (US Patent No. 7,385,924). Furthermore, the prior art Curtis found pre-dates Sable’s patent by just over three years.

Curtis’s discovery has the added benefit of teaching many concepts to the narrower ’593 patent that Sable is asserting in the lawsuit. The narrower patent specifically addresses a method for identifying and penalizing misbehaving flows in a network. Side note: the patent is so old that its background description references some ancient applications:

“With the advent of file sharing applications such as KaZaA, Gnutella, BearShare, and Winny, the amount of peer-to-peer (P2P) traffic on the Internet has grown immensely in recent years.”

The prior art found by Curtis demonstrates TCP’s use of a sliding window scheme in which flow control is exercised over incoming flows. This is exactly the type of flow control both patents purport to cover. Furthermore, we were impressed with Curtis’ efforts to find prior art related to one of the narrower patents owned by Sable – well done, Mr. Carter!

As for what his discovery looks like, take a look at the first sentence of the patent’s abstract to get an idea.

Methods, apparatuses and systems directed to a flow-based, traffic-classification-aware data collection and reporting system that combine flow-based data collection technologies with enhanced traffic classification functionality to allow for analysis and reporting into aspects of network operations that prior art systems cannot provide.

If you haven’t won yet, don’t be discouraged. We have committed \$100,000 to this prior art search, so we still have \$65,000 to give out!

Sable has one less weapon in its arsenal as it admits defeat on a patent!

As part of our fight against Sable, we’ve been involved in a year-long process before the US Patent Office called Inter Partes Review (or “IPR”) with the goal of invalidating patents held by Sable Networks. You can check out our blog post from 2017 that outlines how the IPR process works. In our last blog post, we were pleased to announce that the Patent Office agreed to institute IPR on some of Sable’s patents. Today, we’re even happier to announce that we’ve officially killed off Sable’s ‘932 patent.

Once the Patent Office agrees to review the validity of a patent, the owner of the patent typically files a brief defending the validity of its patent (because if you own it you should think it’s valid, right?). But in this case, instead of explaining to the Patent Office why its ’932 patent is valid (or why Cloudflare is wrong), Sable simply decided to voluntarily cancel all claims of the patent. Since there is no claim left for the Patent Office to review, the IPR should be terminated soon, and we’ve effectively obtained the full relief requested!

This is a big win for anyone concerned with abuse of the patent system, including all the companies that Sable Networks previously attacked with this patent, including Dell, Cisco Systems, Hewlett Packard, Palo Alto Networks, Juniper Networks, Aruba Networks, amongst others. Yes, as absurd as it sounds, this patent has been used by Sable Networks to help squeeze out settlements from numerous productive technology companies. This victory means that Sable has one less patent to try to leverage in its attempts to abuse the patent system.

Coinbase announces that it will fight back against patent trolls

As we mentioned in our February blog post, part of our goal with Project Jengo is to spread the word that targets of these trolls can and should fight back and win. That’s why we were thrilled to see a recent blog post from Coinbase announcing that the company is following Cloudflare’s lead when it comes to pushing back on patent trolls. Trolls count on easy targets to fund their operations through settlements, so it’s great news that a major company like Coinbase has made clear that it will refuse to capitulate and will instead fight back.

Please keep your submissions coming!

We could not have gotten to this point without the help of the many Project Jengo participants. We have received hundreds of prior art references on Sable’s ten patents, and we have used many of those references in our efforts to kill off the patents that Sable asserted against us.

Thank you to everyone who has participated in Project Jengo for supporting the broader community and helping us take down a patent troll. If you haven’t participated yet, please consider submitting to our prior art contest.

The deluge of digital attacks against journalists

2022-05-03 Andie Goodwin

Post Syndicated from Andie Goodwin original https://blog.cloudflare.com/the-deluge-of-digital-attacks-against-journalists/

“A free press can, of course, be good or bad, but, most certainly without freedom, the press will never be anything but bad.”
― Albert Camus

The deluge of digital attacks against journalists

Since its founding in 1993, World Press Freedom Day has been a time to acknowledge the importance of press freedom and call attention to concerted attempts to thwart journalists’ essential work. That mission is also embedded in the foundations of our Project Galileo, which has a goal of protecting free expression online — after the war in Ukraine started, applications to the project increased by 177% in March 2022 alone.

In Uruguay today, UNESCO’s World Press Freedom Day Global Conference is underway, with a 2022 theme of “Journalism under Digital Siege.”

It is a fitting and timely theme.

While the Internet has limitless potential to make every person a publisher, bad actors — both individuals and governments — routinely deploy attacks to silence free expression. For example, Cloudflare data illustrate a trend of increased cyber attacks since the invasion of Ukraine, and journalists are frequent targets. Covering topics such as war, government corruption, and crime makes journalists vulnerable to aggression online and offline. Beyond the issue of cyber attacks, Russian authorities’ decision to block websites they find objectionable has hindered citizens’ ability to access news.

The UNESCO report Threats that Silence: Trends in the Safety of Journalists spotlights the methods that criminals use to interfere with press freedom, including hacking (such as to steal confidential data) and digital attacks (one example is DDoS attacks to overwhelm a site with traffic).

Traffic spikes and news cycles

Web traffic closely follows world events, and sudden increases in interest in a topic can leave sites struggling to adjust. For example, during and after the Oscars, movie news sites like Variety and The Hollywood Reporter see drastic changes in traffic. This year, the day after the Oscars, DNS requests rose to 1,200% more than usual.

We spot the same trend during elections. As polling stations closed for the recent French presidential race, traffic to news sites rose 142% while citizens tracked results.

In wartime, ensuring the availability of a wide variety of news sources is vital so that citizens can access information relevant to their safety. In an April blog post, we highlighted Russian authorities’ decisions to block news websites. Meanwhile, traffic to several Western media outlets rose as Russian citizens sought out international sources.

Take a look at the DNS traffic from Russia to one well-known US newspaper:

DNS traffic from Russia for a large French news source also grew enormously:

Keeping journalists online

As previously discussed on our blog, Project Galileo was born from a mistake we made during the Russian invasion of Crimea in 2014. Because of an attack, we stopped proxying traffic of an independent newspaper in Ukraine that had been covering the ongoing Russian invasion, and the site went offline. That day prompted reflection on how we could truly live up to our mission to help build a better Internet.

Particularly during wartime, news publishers need proper resources to prevent bad actors from knocking websites offline and to manage traffic spikes. As part of Project Galileo, we provide free security and performance services to journalists, humanitarian groups, and civil rights organizations around the world. Independent media and journalism organizations make up a majority of the domains protected under the project.

The number of cyber attacks on journalists is staggering. When we examined traffic data last year, we found that journalism and media sites protected under Project Galileo are subject to over 30 million cyber attacks per day.

To identify candidates for participation in Project Galileo, we partner with dozens of free speech, public interest, and civil society organizations, including Fourth Estate, Free Press, Reporters Sans Frontières, and Institute for War & Peace Reporting.

According to W. Jeffrey Brown, founder of Fourth Estate, “The right to freedom of expression and information is an essential element of free and democratic societies. Historically, times of war and conflict are rife with weaponized misinformation, disinformation, and propaganda. The work of the free press is essential in providing people with accurate, timely, and trustworthy information: news that saves lives and property and shines a light on war crimes and human rights abuses.”

Get to know Project Galileo participants

Since many of these organizations are particularly vulnerable and subject to backlash, we do not publicly discuss participants unless we receive explicit permission. We also have never removed an organization from protection in the face of political pressure.

Below are some journalism-related organizations that have agreed to publicly talk about their participation. Check out these case studies to see what makes journalism in the digital era so challenging:

How to join Project Galileo

Applications to Project Galileo have skyrocketed since the invasion began, with many coming from organizations within Ukraine and neighboring countries. We are rapidly onboarding sites dedicated to journalism, human rights, and nonprofits that are organizing refugee efforts.

Know a site that could use our help? Public interest groups can quickly apply online, and we engage our partners to identify the at-risk websites that can benefit from the project.

Organizations spotlighting chilling effects and on-the-job dangers

Our Project Galileo partners are excellent resources for understanding the challenges journalists face, both in Ukraine and the rest of the world. Here are a few examples:

Committee to Protect Journalists: Examine data on the deadly risks for journalists; CPJ finds that at least 27 journalists were killed in 2021 because of their work.
Access Now: Get security tips and view regular updates on how the invasion of Ukraine is affecting freedom of expression online.
Reporters Sans Frontières: View the interactive 2021 World Press Freedom Index. It incorporates criteria including media independence, transparency, and legislative frameworks.
Institute for War & Peace Reporting: Learn about the dangers of covering the war in Ukraine.
Center for International Media Assistance: See how news outlets are leveraging encrypted messaging apps to reach audiences in developing countries and emerging democracies.
Council of Europe: Read the new annual report by the Council of Europe Platform for the Protection of Journalism and the Safety of Journalists; it notes that 2021 was the deadliest year for journalists in Europe since 2015.

Coming up

The eighth anniversary of Project Galileo is just weeks away. Stay tuned for case studies highlighting new and long-time participants as well as updated data from Cloudflare Radar. And for a look back at 2021 highlights from Project Galileo, download our Impact Report.

Introducing the Customer Metadata Boundary

2021-12-07 Jon Levine

Post Syndicated from Jon Levine original https://blog.cloudflare.com/introducing-the-customer-metadata-boundary/

Introducing the Customer Metadata Boundary

Data localisation has gotten a lot of attention in recent years because a number of countries see it as a way of controlling or protecting their citizens’ data. Countries such as Australia, China, India, Brazil, and South Korea have or are currently considering regulations that assert legal sovereignty over their citizens’ personal data in some fashion — health care data must be stored locally; public institutions may only contract with local service providers, etc.

In the EU, the recent “Schrems II” decision resulted in additional requirements for companies that transfer personal data outside the EU. And a number of highly regulated industries require that specific types of personal data stay within the EU’s borders.

Cloudflare is committed to helping our customers keep personal data in the EU. Last year, we introduced the Data Localisation Suite, which gives customers control over where their data is inspected and stored.

Today, we’re excited to introduce the Customer Metadata Boundary, which expands the Data Localisation Suite to ensure that a customer’s end user traffic metadata stays in the EU.

Metadata: a primer

“Metadata” can be a scary term, but it’s a simple concept — it just means “data about data.” In other words, it’s a description of activity that happened on our network. Every service on the Internet collects metadata in some form, and it’s vital to user safety and network availability.

At Cloudflare, we collect metadata about the usage of our products for several purposes:

Serving analytics via our dashboards and APIs
Sharing logs with customers
Stopping security threats such as bot or DDoS attacks
Improving the performance of our network
Maintaining the reliability and resiliency of our network

What does that collection look like in practice at Cloudflare? Our network consists of dozens of services: our Firewall, Cache, DNS Resolver, DDoS protection systems, Workers runtime, and more. Each service emits structured log messages, which contain fields like timestamps, URLs, usage of Cloudflare features, and the identifier of the customer’s account and zone.

These messages do not contain the contents of customer traffic, and so they do not contain things like usernames, passwords, personal information, and other private details of customers’ end users. However, these logs may contain end-user IP addresses, which is considered personal data in the EU.

Data Localisation in the EU

The EU’s General Data Protection Regulation, or GDPR, is one of the world’s most comprehensive (and well known) data privacy laws. The GDPR does not, however, insist that personal data must stay in Europe. Instead, it provides a number of legal mechanisms to ensure that GDPR-level protections are available for EU personal data if it is transferred outside the EU to a third country like the United States. Data transfers from the EU to the US were, until recently, permitted under an agreement called the EU-U.S. Privacy Shield Framework.

Shortly after the GDPR went into effect, a privacy activist named Max Schrems filed suit against Facebook for their data collection practices. In July 2020, the Court of Justice of the EU issued the “Schrems II” ruling — which, among other things, invalidated the Privacy Shield framework. However, the court upheld other valid transfer mechanisms that ensure EU personal data won’t be accessed by U.S. government authorities in a way that violates the GDPR.

Since the Schrems II decision, many customers have asked us how we’re protecting EU citizens’ data. Fortunately, Cloudflare has had data protection safeguards in place since well before the Schrems II case, such as our industry-leading commitments on government data requests. In response to Schrems II in particular, we updated our customer Data Processing Addendum (DPA). We incorporated the latest Standard Contractual Clauses, which are legal agreements approved by the EU Commission that enable data transfer. We also added additional safeguards as outlined in the EDPB’s June 2021 Recommendations on Supplementary Measures. Finally, Cloudflare’s services are certified under the ISO 27701 standard, which maps to the GDPR’s requirements.

In light of these measures, we believe that our EU customers can use Cloudflare’s services in a manner consistent with GDPR and the Schrems II decision. Still, we recognize that many of our customers want their EU personal data to stay in the EU. For example, some of our customers in industries like healthcare, law, and finance may have additional requirements. For that reason, we have developed an optional suite of services to address those requirements. We call this our Data Localisation Suite.

How the Data Localisation Suite helps today

Data Localisation is challenging for customers because of the volume and variety of data they handle. When it comes to their Cloudflare traffic, we’ve found that customers are primarily concerned about three areas:

How do I ensure my encryption keys stay in the EU?
How can I ensure that services like caching and WAF only run in the EU?
How can ensure that metadata is never transferred outside the EU?

To address the first concern, Cloudflare has long offered Keyless SSL and Geo Key Manager, which ensure that private SSL/TLS key material never leaves the EU. Keyless SSL ensures that Cloudflare never has possession of the private key material at all; Geo Key Manager uses Keyless SSL under the hood to ensure the keys never leave the specified region.

Last year we addressed the second concern with Regional Services, which ensures that Cloudflare will only be able to decrypt and inspect the content of HTTP traffic inside the EU. In other words, SSL connections will only be terminated in Europe, and all of our layer 7 security and performance services will only run in our EU data centers.

Today, we’re enabling customers to address the third and final concern, and keep metadata local as well.

How the Metadata Boundary Works

The Customer Metadata Boundary ensures, simply, that end user traffic metadata that can identify a customer stays in the EU. This includes all the logs and analytics that a customer sees.

How are we able to do this? All the metadata that can identify a customer flows through a single service at our edge, before being forwarded to one of our core data centers.

When the Metadata Boundary is enabled for a customer, our edge ensures that any log message that identifies that customer (that is, contains that customer’s Account ID) is not sent outside the EU. It will only be sent to our core data center in the EU, and not our core data center in the US.

What’s next

Today our Data Localisation Suite is focused on helping our customers in the EU localise data for their inbound HTTP traffic. This includes our Cache, Firewall, DDoS protection, and Bot Management products.

We’ve heard from customers that they want data localisation for more products and more regions. This means making all of our Data Localisation Products, including Geo Key Manager and Regional Services, work globally. We’re also working on expanding the Metadata Boundary to include our Zero Trust products like Cloudflare for Teams. Stay tuned!

In a win for the Internet, federal court rejects copyright infringement claim against Cloudflare

2021-10-07 Patrick Nemeroff

Post Syndicated from Patrick Nemeroff original https://blog.cloudflare.com/in-a-win-for-the-internet-federal-court-rejects-copyright-infringement-claim-against-cloudflare/

In a win for the Internet, federal court rejects copyright infringement claim against Cloudflare

Since the founding of the Internet, online copyright infringement has been a real concern for policy makers, copyright holders, and service providers, and there have been considerable efforts to find effective ways to combat it. Many of the most significant legal questions around what is called “intermediary liability” — the extent to which different links in the chain of an Internet transmission can be held liable for problematic online content — have been pressed on lawmakers and regulators, and played out in courts around issues of copyright.

Although section 230 of the Communications Decency Act in the United States provides important protections from liability for intermediaries, copyright and other intellectual property claims are one of the very few areas carved out of that immunity.

A Novel Theory of Liability

Over the years, copyright holders have sometimes sought to hold Cloudflare liable for infringing content on websites using our services. This never made much sense to us. We don’t host the content of the websites at issue, we don’t aggregate or promote the content or in any way help end users find it, and our services are not even necessary for the content’s availability online. Infrastructure service providers like Cloudflare are not well positioned to solve problems like online infringement.

Also, while we cannot prevent online infringement, we’ve set up abuse processes to assist copyright holders address the issue by connecting them with the hosting providers and website operators actually able to take such content off the Internet.

But the combination of decades-old copyright statutes and rapidly innovating Internet services has left some copyright holders believing they might have a viable claim against us. Add in the fact that statutory damage provisions in the United States copyright law were not written with the Internet in mind and seemingly allow for the possibility of astronomical damage awards when content is transmitted online at scale. So it’s not altogether surprising that plaintiffs are sometimes tempted to try their luck suing Cloudflare.

A Novel Theory Rejected

Yesterday, in Mon Cheri Bridals, LLC v. Cloudflare, Inc., the United States District Court for the Northern District of California rejected one such lawsuit, granting Cloudflare’s motion for summary judgment and concluding that no reasonable jury could find Cloudflare liable for the alleged copyright infringement at issue.

The plaintiffs in the case sell wedding dresses online, and they asserted that other websites illegally used their copyrighted pictures of the dresses while selling knockoff dresses. In a quirk of US copyright law, most fashion designs are not copyright protected, while pictures of those designs can be protected. Rather than pursue their claims against the website operators, their hosting providers, or any of the numerous other service providers necessary to their business, the plaintiffs targeted Cloudflare, seeking to hold us liable for contributory copyright infringement on the grounds that the websites at issue used our CDN and pass-through security services, most of them for free.

The district court rejected that claim, holding that merely providing CDN and pass-through security services to the websites did not make Cloudflare responsible for their alleged infringement. The court explained that Cloudflare’s services were not necessary to and did not “significantly magnify” any infringement. It also recognized that Cloudflare cannot eliminate infringement by websites using its CDN services, because “removing material from a cache without removing it from the hosting service would not prevent the direct infringement from occurring.” Finally, the court observed that Cloudflare’s abuse reporting system is designed to put copyright holders in the same position they would be if the websites at issue were not using our services, by connecting copyright holders with the hosting providers and website operators actually able to effectively address the issue. Notably, the court decided the case solely on the contributory infringement issue, and it did not even reach our independent arguments that we are protected from any liability by the Digital Millennium Copyright Act’s safe harbors.

Moving forward with clarity

Obviously, we agree with the district court’s reasoning, and we hope it goes a long way towards discouraging these types of claims in the future. Throughout this case, we’ve worked closely with our attorneys at Fenwick & West who have demonstrated great skill and diligence. We plan to continue to fight other lawsuits of this nature. We have long understood that different types of services have different abilities and responsibilities to address online infringement, and we designed our abuse process with that in mind. Broader recognition of those principles will allow us to “help build a better Internet” by providing security and reliability services without being dragged into every dispute between third parties and someone who uses our services. We think that will be better for the Internet.

The First Three Winners from Cloudflare’s Project Jengo 2 Share $20,000

2021-08-18 Ethan Park

Post Syndicated from Ethan Park original https://blog.cloudflare.com/project-jengo-2-first-three-winners/

The First Three Winners from Cloudflare’s Project Jengo 2 Share $20,000

This past April we announced the revival of Project Jengo in response to a patent troll called Sable Networks that sued Cloudflare even though our technology and products are nothing like what’s described in Sable’s patents. This is only one part of Sable’s larger campaign against innovative technology companies — Sable sued five other technology companies earlier this year, and had sued seven other technology companies under the same patents last year.

Just as we have done in the past, we decided to fight back rather than feed the troll — which would only make it stronger. You see, unlike Cloudflare and other operating companies that were sued, Sable Networks isn’t in the business of providing products and services to the market. Rather, it exists to extract settlements out of productive companies that are creating value to the society.

Project Jengo is a prior art search contest where we ask the Cloudflare community for help in finding evidence (“prior art”) that shows Sable’s patents are invalid because they claim something that was already known at the time the patent application was filed. We committed $100,000 in cash prizes to be shared by the winners who were successful in finding such prior art.

The first chapter of this contest has now ended, and we received almost 400 prior art references on Sable’s ten patents. And over 80% of those references were submitted to kill off the four patents that Sable asserted against us. Let me first say thank you to everyone who submitted these! Here at Cloudflare, we are constantly energized and motivated by the support from our community, and we are heartened by our community’s participation in Project Jengo.

Three winners = $20,000 in total cash prizes (so far)

We reviewed every eligible submission and scored them based on the strength of the prior art reference(s), difficulty, the story provided by the entrant, and the clarity and thoroughness of the explanation. Today, we are announcing the selection of three great submissions as cash prize winners in this round. The first winner will receive \$10,000, and the other two will each receive \$5,000.

Keep ’em coming

As you’ll recall, Sable is using a set of patents from the early 2000’s related to a flow-based router called Apeiro, which was never widely adopted and eventually failed in the marketplace over a decade ago. Sable is now stretching those patents way beyond what they were meant to cover. Sable’s flawed reading of these patents extends infringement to basic routing and switching functionality known long before any alleged invention date, including “conventional routers” from the 2000s that routed each packet independently without any regard to flows. The way Sable is interpreting its patents so broadly and the fact that Sable has gone after numerous technology companies selling a wide range of different products worry us — by its current standard, Sable could target anyone using a router, and that would include anyone with a WiFi router in their home. You can help stop this madness by participating in this contest and finding prior art on any of Sable’s ten patents that we’ve identified — not just on the four patents that Sable asserted against us.

The contest is ongoing, and we still have $80,000 to give out. The sooner you send us quality prior-art references, the more helpful they will be in invalidating Sable’s patents, so please make your submissions here as soon as possible. Already made a submission, but you aren’t one of the three winners today? It isn’t over — we will consider your submission again when we announce our next round of winners in November (and you can, of course, also enter a new and better submission). We have many more rounds to go as long as Sable’s case is pending against us, which means earlier submissions benefit from being considered in multiple rounds of this contest, so please don’t delay and make your submission now.

If this were a boxing match, then we would still be in the first round, sparring in the ring, with Sable up against the ropes. So jump in, win some cash, and help us KO Sable Networks.

Matthew M. “can’t stand blockers to true American ingenuity” and now has $10,000

IETF RFC 2702 (Requirements for Traffic Engineering Over MPLS)

This document is one of the 17 prior-art references sent to us by Matthew M. We are highlighting the Internet Engineering Task Force (“IETF”) Request for Comments (“RFC”) 2702. An RFC is something like a step in an industry-wide brainstorming session where an idea or ideas are floated to others in the industry with the aim of building something great everyone can use. The RFC found by Matthew M. is a good example of the process in which engineers from MCI Worldcom are building on the work of engineers from companies like Cisco, IBM, Juniper, and Ascend. All of these companies were well aware of the concepts Sable is now trying to claim its patents cover, including “micro-flows,” label-switched paths, and the basic concept of choosing a path through the network based on QoS information in a packet. The IETF’s records of these industry-wide brainstorming sessions are great evidence of Sable’s overreaching interpretations of its patents.

As for the winner, Matthew has a degree in Computer Networking & Cybersecurity, and manages a small team of developers at a FinTech company. Like most Project Jengo participants, he wasn’t motivated solely by the money. He told us, “I quickly learned just how vague you can make a patent and it’s quite disgusting.” We agree! Matthew shared that he thinks patent trolls “provide no value to society and only exist to strip true business men and women of their hard-earned craft.” He underscored this point when we reached out to congratulate him on the $10,000 prize:

I can’t stand blockers to true American ingenuity and patent trolls stand to destroy hard-earned work using minuscule technicalities in our broken justice system. I am happy to do my part in helping Cloudflare get the upper hand in this lawsuit and hopefully flip it on its head and take down Sable Networks altogether.

Matthew also highlighted the tremendous damage that patent trolls can do to companies and innovation:

I think patent trolls are one of the biggest stiflers of innovation. Companies like Cloudflare could be spending all their time working on new products that provide value but instead, they must allocate resources to fight off cowardly lawsuits like this one.

This submission will be put to good use in our fight against Sable, and we were happy to award Matthew with his prize money. We smiled when Matthew exclaimed he was “speechless” after finding out that he won. Congratulations, Matthew!

Pedro S. enjoyed a trip down memory lane and now gets to enjoy $5,000

Ascend/Cascade products and software implementing IETF RFC 1953 (Ipsilon Flow Management Protocol Specification for IPv4)

This winning submission also included an RFC from the IETF. These records from the important work of the IETF members ensure Sable won’t be able to take credit for things it simply didn’t invent. The neat thing about RFC 1953 is that the submitter connected it with actual products from companies called Ipsilon Networks, Inc. and Ascend Communications. There appear to be similarities between those products and the technology Sable is now claiming to have made, like the inventions of the ’919 patent. The problem for Sable is that Ipsilon and Ascend appear to have done it first! Ipsilon and Ascend were acquired by other companies so finding details about their innovative products and technology may be difficult, but we’re going to try. It may be that the submitter or someone reading this post can help.

The submission came from Pedro S., who heard about Project Jengo on the Security Now podcast. Pedro has spent 20 years in various technical roles, including a position at Ascend Communications in the 1990’s where he became familiar with their products. Today he is working at a cybersecurity company in the Bay Area. When asked why he chose to participate, he bluntly responded with “I hate patent trolls — I also enjoyed the trip down memory lane as some of the stuff I submitted comes from my days at Lucent.” We are happy to hear he enjoyed participating in the fight! We’re enjoying it too, thanks to the participation of folks like Pedro.

Congratulations, Pedro!

Stephen “learned a LOT” and earned $5,000

United States Patent No. 7,107,356 (Translator for enabling logical partitioning of a network switch)

This submission pointed us to U.S. Patent No. 7,107,356 (“’356 patent”) for its relevance to Sable’s U.S. Patent No. 7,630,358 (Mechanism for implementing multiple logical routers within a single physical router). The ’358 patent hasn’t been asserted against Cloudflare (at least not yet), and this is a good example of the enthusiasm of our community to comprehensively search for prior art relevant to both Sable’s currently asserted patents and those it may use to sue other companies later down the road. The ’356 patent found by our final winner in this round of Project Jengo carefully describes the guts of a router, and this relatively straight-forward patent makes short work of Sable’s overreaching claims of invention. Rest assured, if Sable is looking to assert the ’358 patent against Cloudflare or some other company down the road, our community is well-prepared to meet the challenge.

The submission comes from Stephen F., a web developer at a managed IT company working on custom websites. When his IT coworker shared the Project Jengo announcement in the office chat, he decided to participate. Stephen has never done prior art search before, but he was eager to participate and spent an entire day looking for prior art:

I’m submitting because I love Cloudflare and how it has made my life easier as a web developer … I’ve had to learn a lot more about routing and patent law today, and spent several hours looking at documents, scholarly journals, etc.

Even though this was his first time researching something like this, he understood the importance of beating Sable Networks:

I stand firmly against patent trolls like Sable, and decided to spend my day looking into prior art for the sake of Cloudflare’s continued success.

Not only did Stephen understand the importance of beating Sable, he also understood the challenges in doing a prior art search, but that didn’t stop him! We admire his tenacity and are impressed with his efforts, and some of the challenges he had to overcome during his search:

I needed to find where the patents could have been stolen/read from each other and what the offending points of the patents would be. During my research I learned a LOT about patent law, which was pretty challenging!

Congratulations, Stephen!

All the references we’ve received are now available

We received almost 400 prior art references thus far, and as promised we are making them public. As a reminder, we are collecting prior art on any of the patents owned by Sable, not just the ones asserted against Cloudflare. You can go to the webpage we’ve set up to see them, and we hope this information is of use to anyone who is sued by Sable down the road.

The fight continues

Project Jengo continues to capture the attention of tech media. It’s important to us to keep the narrative alive — the more awareness we can spread about the true harm of patent trolls, the more likely we are to inspire other well-resourced companies to refuse to capitulate. If we do this together, we’re far more likely to set a new standard, and ultimately, find the antidote to the ever-growing number of patent trolls that plague productive companies. If we enter the battle alone we are strong, but if we fight together we are unstoppable! Here’s what we’ve seen since our initial blog post was published (news outlets appear to be just as enthusiastic as we are!):

“Cloudflare offers $100,000 for prior art to nuke networking patents a troll has accused it of ripping off,” – The Register
“Instead of just saying it wouldn’t settle, Cloudflare set out to completely destroy the patent troll who sued it, ” – Techdirt
“The idea is to deal a big enough blow to Sable that not only is its case against Cloudflare hobbled but also future cases against other entities.” – Techcrunch

Litigation update — where are we five months in?

It has been five months since Sable Networks sued us in Waco, Texas, and we want to share a quick update on the litigation front. Since then, we have filed four petitions with the U.S. Patent and Trademark Office for inter partes review (“IPR”), seeking to invalidate the four asserted patents. As we previously explained, IPR is a procedure for challenging the validity of a patent before the U.S. Patent and Trademark Office, and it is supposed to be faster and cheaper than litigating before a U.S. district court. Of course, faster and cheaper are relative — it still takes about 18 months to invalidate a patent using this procedure, and the filing fees alone for the four petitions were over $200,000. It is easy to see how the exorbitant cost involved in patent litigation allows patent trolls to flourish and why so many companies are willing to quickly settle.

Aside from the IPRs, our litigation is moving forward in district court. Sable served us with its preliminary infringement contentions, which are supposed to explain why it believes we infringe its four asserted patents, and we will be serving our preliminary invalidity contentions to Sable soon.

Sable went after six companies this year, and two of them have already settled and dropped out of the fight. We will continue to fight against Sable, and we hope to see our peers continue fighting against this patent troll with us. Please stay tuned for our next update in three months!

How to Build a Global Network that Complies with Local Law

2020-12-11 Alissa Starzak

Post Syndicated from Alissa Starzak original https://blog.cloudflare.com/global-network-that-complies-with-local-law/

How to Build a Global Network that Complies with Local Law

We’ve spent a lot of time over the course of this week talking about Cloudflare engineers building technical solutions to improve privacy, increase control over data, and thereby, help our customers address regulatory challenges. But not all challenges can be solved with engineering. We sometimes have to build policies and procedures that anticipate our customers’ concerns. That has been an approach we’ve used to address government and other legal requests for data throughout the years.

Governments around the world have long had an interest in getting access to online records. Sometimes law enforcement is looking for evidence relevant to criminal investigations. Sometimes intelligence agencies are looking to learn more about what foreign governments or actors are doing. And online service providers of all kinds often serve as an access point for those electronic records.

For service providers like Cloudflare, though, those requests can be fraught. The work that law enforcement and other government authorities do is important. At the same time, the data that law enforcement and other government authorities are seeking does not belong to us. By using our services, our customers have put us in a position of trust over that data. Maintaining that trust is fundamental to our business and our values.

These tensions are compounded by the fact that different governments have different standards for the protection of personal data. The United States, for example, prohibits companies from disclosing the content of communications — including to non-U.S. governments — in all but certain legally defined circumstances. The European Union, which has long considered the privacy of communications and the protection of personal data to be fundamental human rights, protects all EU personal data through the General Data Protection Regulation (GDPR). Although these protections overlap in certain respects, they differ both in their scope and whom they protect.

The differences between legal frameworks matter, particularly when it comes to whether legal requests for information from foreign governments are determined to be consistent with privacy requirements. In recent years, for example, the Court of Justice of the European Union (CJEU) has concluded on multiple occasions that U.S. legal restrictions on gathering data, along with certain voluntary commitments like the Privacy Shield, or its predecessor, the U.S.-EU Safe Harbor, are not adequate to comply with EU privacy requirements, largely because of U.S. laws that allow legal authorities to collect information on non-U.S. citizens for foreign intelligence purposes. Indeed, the European Data Protection Board (EDPB) has taken the position that a U.S. criminal law request for data — outside of a legal process in which countries in the EU maintain some control over the information being produced — is not a legitimate basis for the transfer of personal data subject to GDPR.

At heart, these are fights over when it is appropriate for one government to use legal orders or other legal processes to access data about another country’s citizens. And these are not just fights happening in Europe. Although their policy responses are not consistent, an increasing number of countries now see access to their citizens’ data as a national security concern. From our perspective, these battles between nation-states are battles between giants. But they were also foreseeable.

Preparing Policies for Battles Between Giants

Cloudflare has long had policies to address concerns about access to personal data, both because we believe it’s the right thing to do and because the conflicts of law we are seeing today seemed inevitable. As a global company, with customers, equipment, and employees in many countries, we understand that different countries have different legal standards. But when there is a conflict between two different legal standards, we default to the one that is most privacy-protective. And we always require legal process. Because once you have opened the gate to data, it can be difficult to close.

Beginning with our very first transparency report detailing law enforcement requests for data in 2013, we’ve made public commitments about how we approach requests for data and public statements about things we have never done. We call the public statements about things we have never done warrant ‘canaries’, with the idea that they serve a signaling function to the outside world. They are a public statement that we would not take these actions willingly, and a mechanism to convey information — by removal of the statement from the site — that we might otherwise be restricted from disclosing. . We’ve also committed to challenge any legal order seeking to have us break these commitments, in court if necessary. Our goal was to be very clear — not only to our customers but to governments around the world — about where we were drawing our lines.

Regulatory entities have started to recognize the value of privacy commitments, particularly when they can be enforced by contract. Indeed, the commitments we have included in our transparency reports for years are exactly the types of commitments the European Commission has recommended be included in its draft Standard Contractual Clauses for compliance with the GDPR.

Cloudflare’s warrant canaries

As a security company, we know that maintaining control over access to our networks is an absolute imperative. That is why our security team has focused on access controls, logging, and monitoring, and goes through multiple third-party assessments per year. We want to ensure that our customers understand that there is no exemption in those controls for law enforcement or government actors. That’s why we state both that Cloudflare has never installed law enforcement software or equipment anywhere on our network, and that we have never provided any government organization a feed of our customers’ content transiting our network.

Cloudflare believes that strong encryption — both for content and metadata — is necessary for privacy online. If a country is seeking to prevent a foreign intelligence service from accessing its citizens’ personal information, the first step should be encryption of that personal information. But customers and regulators also need to be confident that the encryption itself is trustworthy. So we have commitments that we have never turned over our encryption or authentication keys, or our customers’ encryption or authentication keys, to anyone, and that we have never weakened, compromised, or subverted our encryption at the request of law enforcement or any other third party.

Cloudflare’s other commitments go to the integrity of the Internet itself. We do not believe that our systems should be exploited to lead people to sites that they did not intend to visit or to alter the content they get online. Therefore, we’ve publicly stated that we have never modified customer content or modified the intended destination of DNS responses at the request of law enforcement or another third party.

Providing Our Customers with Notice of Government Requests

Cloudflare has long believed that our customers deserve notice when anyone — including a law enforcement agency or other government actor — uses legal process to request their data so that they can challenge the request. Indeed, we have had a policy of providing notice to our customers since our earliest days as a company. In 2014, we worked with the Electronic Frontier Foundation to bring a legal challenge to a National Security Letter that restricted our ability to disclose the receipt of the letter to anyone. The court finally ruled that we were allowed to publicly disclose the NSL after three long years of litigation.

Although we recognize that there might be some circumstances in which it might be appropriate for law enforcement to temporarily restrict disclosure to preserve the viability of an investigation, we believe that the government should be required to justify any non-disclosure provision, and that any non-disclosure provision should be explicitly time-limited to the minimum time necessary for the purpose at hand. Because U.S. courts have suggested that indefinite non-disclosure orders raise constitutional problems, the U.S. Department of Justice issued guidance in 2017 instructing federal prosecutors to limit non-disclosure orders to no longer than a year, except in exceptional circumstances.

That has not, however, stopped all U.S. law enforcement from seeking indefinite non-disclosure orders. Indeed, we have received at least 28 non-disclosure orders since 2017 that did not include an end date. Working with the American Civil Liberties Union (ACLU), Cloudflare has threatened litigation when we have received such indefinite non-disclosure orders. In each case, the government has subsequently inserted time limits on the non-disclosure requirements in those orders, allowing us to provide our customers notice of the requests.

Addressing Conflicts of Law

Maintaining compliance with laws like GDPR, particularly in the face of legal orders that might put us in the difficult position of being required to violate it, requires involving the courts. A service provider like Cloudflare can ask a court to quash legal requests because of a conflict of law, and we have committed, both in our public statements, and contractually in our Data Processing Addendum, that we would take that step if necessary to avoid such a conflict. Our view is that the conflict should be pushed back where it belongs — between the two governments that are fighting over who should be entitled to access information.

Conclusion

Ultimately, addressing the challenges associated with running a global network that complies with different privacy laws around the world requires coming back to the values that we have championed since our earliest days as a company. Be principled and transparent, respect privacy, require due process, and provide customers with notice so that they can make their own decisions about their data.

What do “secure by design” and “secure by default” mean?

Why does it matter?

How does Cloudflare support secure by design principles?

Taking ownership of customer security outcomes

Application hardening

Zero Trust Security

Application features

Application default settings

Embracing radical transparency and accountability

The Cloudflare blog

Cloudflare System Status

Technical transparency for code integrity

Transparency report and warrant canaries

Public bug bounties

Leading from the top

How can you help?

What’s the Digital Services Act all about?

What do the new rules mean for Cloudflare?

Location should not be a proxy for privacy

Applying data transfer rules to IP addresses could lead to balkanization of the Internet

Keeping privacy in focus

A bit of background on our legal terms of service

Snip, snip

Quality of life upgrades

Users first

The patent troll

Chris Wheeler from Georgia, who has a patent of his own

Peter’s first foray into patent law makes him $5,000 richer!

David who hopes the Patent Office will adopt new technologies for better examinations

Case updates: Another patent thrown out of the case, and the few remaining claims further whittled down

Escalating threats

Legal process

Not the end

Cloudflare’s products

Hosting products

Security services

Avoiding an abuse of power

Refining our policy based on what we’ve learned

Regulatory realities

Core Internet technology services

Paying versus free

Rule of Law

$5,000 to Project Jengo’s round three winner!

Sable has one less weapon in its arsenal as it admits defeat on a patent!

Coinbase announces that it will fight back against patent trolls

Please keep your submissions coming!

Traffic spikes and news cycles

Keeping journalists online

Get to know Project Galileo participants

How to join Project Galileo

Organizations spotlighting chilling effects and on-the-job dangers

Coming up

Metadata: a primer

Data Localisation in the EU

How the Data Localisation Suite helps today

How the Metadata Boundary Works

What’s next

A Novel Theory of Liability

A Novel Theory Rejected

Moving forward with clarity

Three winners = $20,000 in total cash prizes (so far)

Keep ’em coming

Matthew M. “can’t stand blockers to true American ingenuity” and now has $10,000

IETF RFC 2702 (Requirements for Traffic Engineering Over MPLS)

Pedro S. enjoyed a trip down memory lane and now gets to enjoy $5,000

Ascend/Cascade products and software implementing IETF RFC 1953 (Ipsilon Flow Management Protocol Specification for IPv4)

Stephen “learned a LOT” and earned $5,000

United States Patent No. 7,107,356 (Translator for enabling logical partitioning of a network switch)

All the references we’ve received are now available

The fight continues

Litigation update — where are we five months in?

Preparing Policies for Battles Between Giants

Cloudflare’s warrant canaries

Providing Our Customers with Notice of Government Requests

Addressing Conflicts of Law

Conclusion

The collective thoughts of the interwebz