Political Audit: Cloudflare

Cloudflare - Political Audit

Corporate Communications & Public Stance

Cloudflare’s public position on providing infrastructure to parties in conflict has been articulated by CEO Matthew Prince since at least 2014 as strict service-neutrality: “Both sides have an absolute right to tell their story. We’re not providing material support for anybody. We’re not sending money, or helping people arm themselves.” ¹² Cloudflare simultaneously provided reverse-proxy/DDoS-protection services to Israeli PM Benjamin Netanyahu’s personal website and to Hamas-affiliated websites, with a company spokesperson stating “Since we’re not a host, terminating a customer would not remove content from the Internet” ¹. In 2017 the Israeli legal advocacy group Shurat HaDin publicly pressured Cloudflare to shut down a Hamas-linked propaganda site, arguing there is “no difference between providing… Internet services… and providing money, weaponry and financial services to a terrorist organization”; Cloudflare told the Washington Times it was “aware of obligations under U.S. law and is in compliance” ³⁴⁵. Cloudflare’s October 2023 corporate blog coverage of the Israel-Hamas war is framed in strictly technical/network-observational terms, documenting DDoS attacks against Israeli and Palestinian news outlets and Gaza connectivity outages attributed to power loss, without an explicit statement of Cloudflare’s own political position ⁶⁷⁸. No public evidence identified of a distinct, named corporate statement of support or solidarity for either Israeli or Palestinian civilians comparable to Cloudflare’s Ukraine commentary.

By contrast, on Russia-Ukraine, Cloudflare took an explicit, named public policy position: Prince wrote a blog post in early 2022 rejecting a Ukrainian government request to cut off Russian sites, stating “Russia needs more internet access, not less,” a position reached “in consultation with government and civil society experts” ⁹¹⁰¹¹. No equivalent named policy statement mirroring the Ukraine post was identified for Israel-Palestine; coverage there remains confined to technical traffic/attack reporting ⁶⁷⁸. This constitutes a documented asymmetry in the register of Cloudflare’s public communication between the two conflicts.

Operations in Occupied or Contested Territories

Cloudflare operates a data center in Tel Aviv, described as its “135th data center,” located within Israel’s internationally recognized 1949 borders and not within the Occupied Palestinian Territories ¹². No public evidence identified of Cloudflare data centers, offices, or named reseller/distributor operations located within the West Bank, East Jerusalem, Golan Heights, or Israeli settlements. No public evidence identified of Cloudflare or its subsidiaries in the UN OHCHR settlement-business database, Who Profits, or AFSC investigate.afsc.org listings.

DAWN (Democracy for the Arab World Now) submitted evidence in September 2024 to the U.S. Departments of Treasury and Justice alleging Cloudflare provided DNS services to four websites owned by Benzion Gopstein, a U.S.-sanctioned Israeli extremist tied to the Kahanist “Jewish Power” party and the banned Lehava organization, calling for domain seizure and stronger sanctions-screening compliance ¹³. No Cloudflare response to this specific matter was documented in that source. The ADL’s May 2026 report “Keeping the Lights On” separately alleges Cloudflare infrastructure sustains ISIS-linked propaganda outlets - one of which reportedly characterized the Gaza war as “a religious war against all Jews everywhere” - as well as unrelated extremist/accelerationist content, and states Cloudflare “did not substantively respond to three ADL reports” while inconsistently enforcing its own policy against at least one site ¹⁴.

Cloudflare disclosed in a September 2019 amended S-1 filing ahead of its IPO a voluntary self-disclosure to U.S. Treasury/OFAC, stating its products were “used by, or for the benefit of, certain individuals and entities included in OFAC’s Specially Designated Nationals and Blocked Persons List, including entities identified in OFAC’s counter-terrorism and counter-narcotics trafficking sanctions programs, or affiliated with governments currently subject to comprehensive U.S. sanctions,” and that “a small number of these parties made payments” to the company ^15161718. This matter was referenced as remaining under ongoing OFAC review as of Cloudflare’s FY2023 and FY2024 10-K filings ¹⁹²⁰. No entity names are disclosed in the SEC filing text itself, and No public evidence identified corroborating an unverified claim that a related OFAC review of Gopstein-linked domains was closed without penalty in April 2026. No public evidence identified of an organized, named BDS-movement or NGO-led boycott/divestment/sanctions campaign against Cloudflare specifically tied to Israel-Palestine grounds, as distinct from the extremism-hosting criticism raised by ADL and DAWN.

Internal Governance, Content & Retail Policies

No public evidence identified of HR actions, disciplinary measures, terminations, or union-related legal actions against Cloudflare employees over pro-Palestinian speech or activism, in contrast to documented 2024 actions at comparator companies Google and Microsoft ²¹. Cloudflare’s December 2022 blog post “Applying Human Rights Frameworks to our approach to abuse” articulates a UN Guiding Principles on Business and Human Rights-based framework - covering fair process, proportionality, and transparency - governing abuse/moderation decisions, and lists U.S. sanctions compliance (SDN list; Cuba, North Korea, Syria, Iran, Crimea/Luhansk/Donetsk) as one basis for service termination, without Israel/Palestine-specific moderation criteria ²². Cloudflare’s content-moderation practice has drawn scrutiny in other high-profile cases, including its 2019 decision to stop service to 8chan, which Prince described as “a cesspool of hate” ²³, and its 2022 decision to drop Kiwi Farms following harassment concerns, a move examined for its ad hoc, non-transparent decision process ²⁴²⁵²⁶. The ADL’s May 2026 report separately alleges inconsistent enforcement of Cloudflare’s stated abuse policy, including regarding a Gaza-war-referencing ISIS-linked outlet ¹⁴. Retail and supply-chain conduct rules are not applicable: Cloudflare is a cloud infrastructure/software services company with no physical retail product or supply chain subject to country-of-origin labeling regimes, and No public evidence identified of such practices.

Brand Heritage & State Partnerships

No public evidence identified that Cloudflare’s commercial branding invokes military heritage, defense-sector origin, or state-security lineage; its founding narrative traces to Project Honey Pot spam-research work and a 2004 Harvard Business School venture competition. A recurring claim that Cloudflare is “expanding its R&D center in Israel following discussions between CEO Matthew Prince and Israeli Prime Minister Benjamin Netanyahu” could not be corroborated against primary sourcing and is excluded from findings as an unverified artifact. Cloudflare’s confirmed March 2024 Middle East expansion covers a new Dubai Internet City office and 17 regional network locations (Dubai, Riyadh, Kuwait, Doha, Amman, Beirut, Baghdad, Jeddah, Muscat, Manama, Erbil); Israel is not named in this announcement ²⁷. No public evidence identified of Cloudflare hosting Israeli government officials, accepting Israeli state honors, or sponsoring “Brand Israel”-style cultural or PR campaigns.

Lobbying, Advocacy, Financing & Logistics

OpenSecrets records Cloudflare Inc. as a federally registered lobbying client, with reported year-to-date lobbying spend of $40,000 per its summary page ²⁸²⁹. No public evidence identified in the retrieved OpenSecrets summaries of lobbying activity specifically itemized as Israel-Palestine policy, anti-boycott legislation, or trade-restriction advocacy. No public evidence identified of Cloudflare corporate PAC contributions to candidates tied to Israel-Palestine-related legislation such as the Israel Anti-Boycott Act. No public evidence identified of Cloudflare corporate donations to FIDF, JNF/KKL, Lev Echad, Israeli reservist funds, Regavim, Im Tirtzu, or other settlement/military-welfare organizations. On crisis asset mobilization, No public evidence identified of Cloudflare directing free services or infrastructure specifically to the Israeli state, IDF, or state-aligned NGOs during the conflict, beyond its general, non-exclusive Project Galileo program, which Cloudflare states protected both Israeli and Palestinian civil-society organizations after October 7, 2023, including a UK-based Palestinian human-rights organization that received protection after DDoS attacks coinciding with an October 2023 pro-Palestine demonstration in London ³⁰³¹. Cloudflare also operates the Athenian Project, an election-security offering, though no Israel-Palestine-specific nexus was identified for that program ³².

Corporate Structure & Primary Mission

Cloudflare, Inc. is a U.S.-domiciled, NYSE-listed (ticker NET) commercial cloud infrastructure and cybersecurity company ¹⁹²⁰. No public evidence identified of any state-held golden share, sovereign ownership stake, or founding charter tying its primary corporate mission to the advancement of any state’s geopolitical goals, Israeli or otherwise; its stated mission of helping “build a better Internet” is commercial and infrastructure-oriented per its SEC filings ¹⁹²⁰³³.

Executive & Leadership Footprint

No public evidence identified of personal donations by CEO/Co-Chair Matthew Prince, President/Co-Chair Michelle Zatlyn, or other named executives or board members to FIDF, JNF, or other military-welfare or settlement organizations. Prince’s documented public statements on the Israel-Palestine conflict are limited to his 2014 neutrality quote and subsequent technical company blog commentary ¹²⁶⁷⁸; no op-eds, signed public letters, or social-media advocacy specifically addressing Israel-Palestine were identified for Prince or Zatlyn. By comparison, Prince authored a named, first-person public policy blog post on the Russia-Ukraine conflict in 2022 ⁹¹⁰¹¹. Cloudflare’s board, per 2025 appointments, includes Matthew Prince (CEO/Co-Chair), Michelle Zatlyn (President/Co-Chair), Scott Sandell (NEA Executive Chairman/CIO, Lead Independent Director since 2019, board member since 2010), and 2025 appointees Stacey Cunningham (former NYSE President), John Graham-Cumming (former Cloudflare CTO), and Dr. Karim Lakhani (Harvard Business School professor); Maria Eitel departed the board in 2025 after seven years ^34353637. No public evidence identified connecting any of these individuals to CFI, AIPAC, ADL anti-BDS advocacy, USISTF, Regavim, Im Tirtzu, or other named pro-Israel/anti-BDS advocacy organizations, or to Israeli defense/surveillance/cyber-firm equity investments.

End Notes