Military Audit: Cloudflare

This is a document-drafting task from a provided research memo, not code/creative work requiring brainstorming - proceeding directly with the audit draft.

Cloudflare - Military Domain Audit

Direct Defence Contracting & Procurement

No public evidence identified of any contract, tender, or memorandum of understanding between Cloudflare and the Israeli Ministry of Defense (IMOD), the IDF, the Israel Prison Service, or the Israel Border Police, based on general web search, review of the SIBAT directory landing page, and a DSCA/FMS notification search. Cloudflare’s own “Cloudflare for Defense and Intelligence” page describes engagement with the US Department of Defense, including the SHIELD IDIQ contract, but contains no reference to Israeli defense or security-body contracting ¹. Cloudflare does not appear among the entries visible on the SIBAT Defense and HLS Directory landing page, which lists categories such as aerospace, naval, land forces, electronics, optronics, military inventory, HLS, and civil defense/NBC, none of which contained a cloud/CDN/cybersecurity vendor entry ². A documented but non-contractual instance of service use occurred during “Operation Pillar of Defense” in 2012, when the IDF reportedly moved its website onto Cloudflare’s service to withstand cyberattacks; this reflects ad hoc defensive use of a commercially available reverse-proxy/CDN product rather than a procurement contract, and the status of any ongoing relationship since is unknown ³. Separately, then-Prime Minister Netanyahu’s official website (netanyahu.org.il) also used Cloudflare’s reverse-proxy service as of 2014, a government (not defense-specific) use of a standard commercial product whose current status is unknown ³.

Dual-Use Products & Tactical Variants

No public evidence identified that Cloudflare manufactures or markets ruggedized, tactical, or mil-spec hardware variants; Cloudflare is a cloud/network-services provider offering CDN, DDoS mitigation, and Zero Trust products, and no product line was identified as purpose-built for kinetic or tactical military use. No public evidence identified of any export licence application, end-user certificate, or government export-control review specific to Cloudflare sales to Israeli defence or security end-users. Cloudflare’s general-purpose CDN, Zero Trust, and DDoS-mitigation services constitute dual-use civilian internet infrastructure, and absent evidence of purpose-built kinetic or targeting functionality, this product class falls outside the Military domain boundary as defined for this audit.

Heavy Machinery, Construction & Infrastructure

No public evidence identified. Cloudflare has no identified physical construction, machinery, or vehicle presence, consistent with its business model as an internet-infrastructure and cloud-services company; this conclusion draws on general web search and review of NGO/UN settlement-equipment reporting sources, including the Who Profits and AFSC Investigate databases, neither of which returned a Cloudflare entry ⁴⁵.

Supply Chain Integration with Defence Primes

No public evidence identified of any component, sub-system, or manufacturing-service supply relationship between Cloudflare and Elbit Systems, Israel Aerospace Industries, Rafael Advanced Defense Systems, or IMI Systems/Elbit Land, based on searches combining Cloudflare with each named prime. No public evidence identified of joint development, co-production, or technology-transfer agreements between Cloudflare and Israeli defence firms. Cloudflare does maintain at least one commercial channel partnership in Israel: CYBERcom, an Israeli IT/cybersecurity integrator, announced becoming a Cloudflare partner, though this is a general commercial reseller relationship with no defence-prime nexus identified ⁶.

Logistical Sustainment & Base Services

No public evidence identified of any Cloudflare service contract - catering, transport, fuel, facilities, or telecom - supporting IDF bases, training facilities, or detention centres, whether in the West Bank, the Golan Heights, East Jerusalem, the Negev, or elsewhere in Israel. No public evidence identified of shipping, freight, or port-handling contracts connecting Cloudflare to Israeli defence logistics or arms shipments; this category is not applicable to Cloudflare’s business model as an internet-infrastructure company.

Munitions, Weapons Systems & Strategic Platforms

No public evidence identified of any role by Cloudflare as manufacturer, integrator, or component supplier for lethal platforms, munitions, or strategic defence systems, including Iron Dome, David’s Sling, Arrow, fighter aircraft, tanks, warships, or ballistic missiles, based on searches combining Cloudflare with each named system. No patents held by Cloudflare relating to military targeting, weapons delivery, or drone weapons systems were identified in general web and patent-search results.

Export Licensing, Regulatory & Legal History

In May 2019, Cloudflare voluntarily disclosed to the US Office of Foreign Assets Control (OFAC) that its services had been used by, or for the benefit of, entities on OFAC’s Specially Designated Nationals list, including parties tied to counter-terrorism and counter-narcotics sanctions programs and entities affiliated with comprehensively sanctioned governments, with a small number of those entities having made payments to Cloudflare ⁷⁸⁹¹⁰. Cloudflare separately submitted a voluntary self-disclosure to the US Census Bureau regarding incorrect electronic export information on hardware exports ⁷. OFAC’s investigation was reported as continuing through at least July 2020, with no Israel-specific nexus identified in these disclosures and no more recent public update located on final resolution ⁷. Cloudflare has publicly discussed the difficulty of applying sanctions regimes to internet infrastructure in its own blog commentary ¹¹. In November 2024, Cloudflare was named as a defendant in a US Antiterrorism Act civil lawsuit brought by victims and families of the 18 November 2014 Har Nof (Kehilat Bnei Torah) synagogue attack in Jerusalem, alleging that Cloudflare knowingly provided cybersecurity/CDN services to a website of the Popular Front for the Liberation of Palestine (PFLP), a US-designated foreign terrorist organization, and thereby knowingly aided and abetted the PFLP in the attack ¹²¹³. This is a private civil suit concerning the provision of general internet-infrastructure services to a designated organization rather than a defence-contracting or export-licence matter, and no independent confirmation of its outcome or current docket status was located. In 2017, an Israeli advocacy organization publicly pressured Cloudflare to stop providing anti-DDoS services to Hamas-affiliated sites, threatening legal action under US anti-terrorism law; no confirmation was located that Cloudflare altered its policy in response, and the outcome remains unknown ¹⁴. No public evidence identified of any government decision by the United States, European Union, United Kingdom, or Israel to grant, deny, suspend, or revoke an export licence specific to Cloudflare products for Israeli military or security end-users. No public evidence identified of arms-embargo-specific enforcement actions against Cloudflare regarding Israel.

Civil Society Scrutiny & Documented Investigations

Cloudflare does not appear in the OHCHR database of businesses involved in Israeli settlements in the occupied West Bank, as updated in September 2025 to cover 158 entities from 11 countries ¹⁵¹⁶. No mention of Cloudflare was located in OHCHR report A/HRC/59/23, “From economy of occupation to economy of genocide” (Special Rapporteur Francesca Albanese, 2 July 2025), based on available search-engine indexing of the report text and companion coverage, though a full line-by-line PDF review was not independently completed ¹⁷. Cloudflare does not appear on the Who Profits company database, on the AFSC Investigate database, or on Wikipedia’s “List of companies operating in West Bank settlements” ¹⁸⁴⁵. The Anti-Defamation League’s “Keeping the Lights On” report criticizes Cloudflare for providing DDoS-protection and CDN services to extremist and terrorism-linked sites generally, but this report is not specific to Israeli military or security supply chains and does not allege defence-sector contracting ¹⁹. A crowdsourced boycott-tracking site lists Cloudflare with a claim that it “actively powers and protects Israeli infrastructure… while providing critical support to conflict-affiliated actors”; this is an unverified activist claim rather than a substantiated institutional divestment decision or peer-reviewed NGO investigation, and no pension-fund or sovereign-wealth-fund divestment from Cloudflare on Israel-defence grounds was identified. No public evidence identified of any Cloudflare policy change or end-use-monitoring commitment specifically addressing Israeli-military-adjacent supply-chain concerns; the company’s standing public position, articulated by CEO Matthew Prince in coverage of its Hamas- and Netanyahu-related service provision, frames Cloudflare as neutral infrastructure - “Both sides have an absolute right to tell their story… We’re not providing material support for anybody” ³. Cloudflare has publicly documented its DDoS-mitigation activity in support of Israeli sites, including missile-alert websites, since 7 October 2023 ²⁰²¹. Cloudflare’s Project Galileo program, which provides free protective services to vulnerable civil-society and public-interest websites, is documented on the company’s own program page but was not identified in the memo as having a specific Israeli-military-relevant application ²². Cloudflare’s 2025 Form DEF 14A proxy statement was reviewed for board composition; No public evidence identified that Cloudflare’s named controlling principals or board members hold defense-board roles, Israeli defense-prime equity, or FIDF/reservist-fund donations, based on general web searches combining board members with Israel/Unit 8200 terms ²³.

End Notes