Cloudflare customers reportedly include foreign terrorist groups under US sanctions

Most consumers don't know about it, but Cloudflare is a tech giant that helps keep a huge portion of the internet running. According to a report from the Huffington Post, at least seven of its customers are under sanctions by the US Treasury Department, and six are on the US Department of State's list of foreign terrorist groups.

One of the groups named in the report is the Taliban, which isn't on the State Department's foreign terrorism group list. Also named in the report are several Palestinian groups, al-Shabaab and the Kurdistan Workers' Party, all of which are on the list. The designation is meant to make things like international commerce and travel harder for the groups on the list.

"Designations of foreign terrorist groups expose and isolate these organizations, deny them access to the US financial system, and create significant criminal and immigration consequences for their members and supporters," the State Department says on its website.

What's more, the Treasury Department's sanctions, which apply to all seven groups, are meant in part to prevent US businesses from providing services to foreign terrorist groups. A Treasury Department spokeswoman said the department doesn't comment on individual matters that involve US companies doing business with sanctioned groups or any potential enforcement actions. The State Department didn't immediately respond to a request for comment.

Cloudflare's general counsel, Doug Kramer, told CNET the company has a process for checking whether a potential customer is sanctioned by the Treasury Department. What's more, if it finds any current customers are already on the sanctions list, it'll end services to them. Kramer declined to confirm whether the groups were clients, saying it's company policy not to name customers. The Huffington Post reported that it learned the groups were Cloudflare customers after asking independent experts to evaluate the groups' websites.

"It's a very difficult task and one that a lot of tech companies have struggled with," Kramer said, "because there's not always a one-to-one correlation between a domain name and a specific group."

Cloudflare manages requests by web users to visit its clients' websites, among other services. It doesn't host websites. If hackers want to take down a website by overwhelming it with requests, something called a DDoS attack, Cloudflare can stop them. The list of customers is one example of how major tech companies, as they take over more and more of the internet's infrastructure, can end up providing services for groups that promote violence and extremist ideas.

It's an issue the company has faced in the past. Cloudflare faced scrutiny in August 2017 for providing -- and then ending -- services to the neo-Nazi site the Daily Stormer. The controversy started after other web service companies, like GoDaddy and Google, removed their support for the website a few days earlier, in the aftermath of the Charlottesville demonstration and death of counter-protester Heather Heyer. The Daily Stormer published an offensive article about Heyer, and tech companies began to stop providing the website with internet services.

At the time, Cloudflare CEO Matthew Prince said in a statement the company doesn't pick and choose its customers based on their ideological beliefs. However, the Daily Stormer had gone too far by spreading rumors that Cloudflare supported its neo-Nazi ideology, he said.

"Our terms of service reserve the right for us to terminate users of our network at our sole discretion," Prince said.

At the same time, Prince called his own company's decision "dangerous," saying it could open the door to a less free internet governed by large companies.

"Without a clear framework as a guide for content regulation, a small number of companies will largely determine what can and cannot be online," he said.

Kramer said Cloudflare still takes the same approach it did in the case of the Daily Stormer. The company won't pick and choose its customers based on content alone.

"We've continued to take the position that we think there's much more harm than good to be done if we start to decide what content should be up and what shouldn't," Kramer said.

The company will comply with sanctions from the Treasury Department, he said, adding, "We don't want to go beyond the determinations of what government officials and regulators think."

Infowars and Silicon Valley: Everything you need to know about the tech industry's free speech debate.

CNET Magazine: Check out a sample of the stories in CNET's newsstand edition.