On Guard Against Cyberthreats

Cloudflare, one of the world’s leading web security, edge computing, and content delivery network providers, helps organizations make sure everything they do that is connected to the internet is fast, secure, and reliable. In addition to serving diverse commercial clients, which range from hobbyist websites to small and midsized businesses and Fortune 1000 companies, the firm is committed to serving the public good.

In 2021, the firm launched Cloudflare Impact, its first comprehensive corporate responsibility and environmental, social, and governance initiative. That effort included the Pledge 1% initiative, a commitment by the firm to donate 1% of its products and employee time to serve local and online communities. Cloudflare Impact now encompasses many of the company’s longstanding community-oriented projects. Since 2017, the firm has donated $24.4 million worth of services, and 2,094 internet properties are now protected under Cloudflare Impact programs.

Support for Human Rights

In 2021, Cloudflare established its first comprehensive international human rights policy, which outlines how the firm implements its commitment to human rights with all its products and operations. As of 2022, all new employees receive training in this policy as part of their onboarding. In 2021, the firm also became a member of the Global Network Initiative. Through this effort, technology companies, human rights groups, organizations supporting freedom of the press, academics, and investors work together to set the global standard for responsible decision-making while also advocating against government restrictions on human rights and press freedom. Cloudflare is also now one of 12 companies that participate in the United Nations (U.N.) B-Tech Tech Company Community of Practice, which provides guidance and resources for implementing the U.N. Guiding Principles on Business and Human Rights in the technology space and for emerging technologies, in particular.

The Subtleties of Cloudflare’s Continued Operations in Russia

After the invasion of Ukraine and internationally imposed sanctions against Russia, there was pointed criticism, notably by The Washington Post, of the companies, including Cloudflare, that chose to continue doing business in Russia. Some American officials defended these companies, noting that the tech companies were providing ordinary Russians with the means to find independent news sources and connect with activities and nonprofit organizations in Ukraine that were working to oppose the war.

Before the war’s outbreak, Cloudflare had developed a sanctions compliance program that it believes enables the firm to respond quickly to new sanctions and regulations as they are implemented. To comply with the sanctions against Russia, Cloudflare closed off paid access to its network and systems in sanctioned regions. It also terminated any customers that the firm identified as tied to the sanctions, including Russian financial institutions, Russian influence campaigns, and the Russian-affiliated governments of Donetsk and Luhansk, two cities that are inside the internationally recognized borders of Ukraine.

The firm never had offices or employees in Russia, and it took steps to ensure that no taxes, fees, or other types of payments were made to the Russian government. The firm, however, did not entirely pull out of Russia. In the view of Cloudflare co-founder and CEO Matthew Prince, Russian citizens needed more internet, not less. As he noted in a blog response to the media criticism of the tech firms that didn’t fully exit Russia, the conflict brought a dramatic increase in requests from Russian networks for worldwide media. That surge, as he explained, demonstrated Russian citizens’ need and desire for news about the war beyond the information provided by the Russian government.

In the view of the Sands Capital investment team, the firm made the right decision. It complied with the sanctions by terminating sanctioned customers. By not completely exiting the country, its operations have helped provide Russian citizens with access to external information about the conflict. Its presence has also helped vulnerable groups that can help organize the Russian people’s opposition to their government’s actions. Given that Cloudflare’s revenue from the region is minimal, it is also clear that the firm’s motives are not financial. In Sands Capital’s view, simply criticizing Cloudflare as one of the companies that did not leave the country fails to recognize the important role it plays there.

At the same time, Cloudflare has extended its services to the Ukrainian government and telecom organizations at no cost to protect them against DDoS (distributed denial of service) attacks, thereby helping to ensure that they can continue to operate. Through Project Galileo (see more below), Cloudflare is assisting 60 organizations in Ukraine and the region, with 25 percent of those onboarded since the start of the crisis. Many of the new groups are nongovernmental organizations, people dislocated from the country since the invasion’s start, journalists, and other groups that have been assisting refugees and sharing vital information.

Helping Public Interest Groups Stay Online

In 2014, Cloudflare established Project Galileo to respond to the rise in cyberattacks against journalists, social activists, and minority interest groups. These groups have been flooded with malicious traffic designed to knock them offline. The company’s goal is to help ensure free expression online for these vulnerable groups. Project Galileo now supports 1,600 civil society organizations in 111 countries, collectively protecting them from an average of 53 million cyber threats per day. In 2021, the value of the services provided by Project Galileo exceeded $3 million. Organizations that benefit from this support include the American Civil Liberties Union, Amnesty International, the Anti-Defamation League, the Committee to Protect Journalists, the National Coalition Against Censorship, and the National Endowment for Democracy.

Keeping Information on Elections Secure and Reliable

Since 2017, Cloudflare’s Athenian Project has been working to empower the people who safeguard U.S. election websites. The firm provides its enterprise-level service to state and local governments to help them effectively manage the websites they use to administer elections. These websites provide the public with details on where to vote, how to vote, who is running for office, and what measures are on ballots. They also hold voter registration information and vote tabulation data. These sites have increasingly come under attack by malicious actors, and government officials have historically had small budgets and limited resources to fend off attacks and keep their sites online.

As Cloudflare CEO Prince explains, the goal of the Athenian Project is to “help ensure the political process has integrity and that people can trust it and rely on it.”

Since the outset of the Athenian Project, 292 state and local governments in 30 U.S. states have received free Cloudflare services. In 2021, the value of those donated services exceeded $5 million. The firm also expanded this support in 2021 by extending it to governments outside the United States.

Helping Underserved Communities Access the Internet

Cloudflare wants to address the fact that half the world’s population doesn’t have access to the internet, and even in areas where it is available, access can be prohibitively expensive for many. In 2021, Cloudflare launched Project Pangea to provide free internet connection services for rural, nonprofit, and local community networks, especially in underserved areas.

Community Service That Provides Practical Rewards, Too

Cloudflare can provide these valuable community services without a significant hit to its profitability because its network incurs very low marginal costs to service the incremental customer. As a result, the social benefits provided by initiatives like Athenian Project or Project Galileo meaningfully outweigh the incremental costs to Cloudflare of offering these services.

Cloudflare’s global presence and easy-to-sign-up-for free and premium services enable it to have a massive, diverse global customer base that gives Cloudflare unrivaled visibility into cyberattacks around the world. The level of threat intelligence that Cloudflare can gather gives it an advantage relative to competitors that serve a smaller, pure enterprise customer base.

Sustainable Development Goals

The Sands Capital six investment criteria tend to lead us to businesses that are innovators or vital facilitators of change in industries undergoing significant transformation. Cloudflare is one of many portfolio businesses that create impact by addressing at least one major social or environmental challenge identified by the United Nations Sustainable Development Goals (SDGs). Through the initiatives described here, Cloudflare and the organizations it assists support SDG 3, Good Health and Well-Being; SDG 4, Quality Education; SDG 5, Gender Equality; SDG 8, Decent Work and Economic Growth; SDG 9, Industry, Innovation and Infrastructure; SDG 10, Reduced Inequalities; SDG 11, Sustainable Cities and Communities; and SDG 16, Peace, Justice and Strong Institutions.