US company resumes unlawfully protecting Hamas terror website

Last month, I noticed that the Hamas Al Qassam Brigades website was protected from DDoS attacks by an American company, Cloudflare.

After a number of my readers contacted the company and federal authorities, that service seemed to end. 

This morning, however, I saw that it was back.

Reuters reported on Cloudflare's defense of its actions last week:

Founded in 2010, CloudFlare markets itself as an Internet intermediary that shields websites from distributed denial-of-service, or DDoS, attacks, the crude but effective weapon that hackers use to bludgeon websites until they go dark. The 40-person company claims to route up to 5 percent of all Internet traffic through its global network.

Prince calls his company the "Switzerland" of cyber-space - assiduously neutral and open to all comers. But just as companies like Twitter, YouTube and Facebook have faced profound questions about the balance between free speech and openness on the Internet and national security and law enforcement concerns, CloudFlare's business has posed another thorny question: what kinds of services, if any, should an American company be allowed to offer designated terrorists and cyber criminals?

CloudFlare's unusual position at the heart of this debate came to the fore last month, when the Israel Defense Forces sought help from CloudFlare after its website was struck by attackers based in Gaza. The IDF was turning to the same company that provides those services to Hamas and the al-Quds Brigades, according to publicly searchable domain information. Both Hamas and al-Quds, the military wing of the Palestinian Islamic Jihad, are designated by the United States as terrorist groups.

Under the USA Patriot Act, U.S. firms are forbidden from providing "material support" to groups deemed foreign terrorist organizations. But what constitutes material support - like many other facets of the law itself - has been subject to intense debate.

CloudFlare's dealings have attracted heated criticism in the blogosphere from both Israelis and Palestinians, but Prince defended his company as a champion of free speech.

"Both sides have an absolute right to tell their story," said Prince, a 38-year old former lawyer. "We're not providing material support for anybody. We're not sending money, or helping people arm themselves."

Prince noted that his company only provides defensive capabilities that enable websites to stay online.

"We can't be sitting in a role where we decide what is good or what is bad based on our own personal biases," he said. "That's a huge slippery slope."

Claims of "free speech" are always suspect from a company that profits from it.

It is not a free speech issue. It is a question of law.

Nevertheless, instead of trusting Cloudflare's interpretation of the law, we should look at the law itself.

18 USC § 2339B prohibits providing material support or resources to designated foreign terrorist organizations.

Whoever knowingly provides material support or resources to a foreign terrorist organization, or attempts or conspires to do so, shall be fined under this title or imprisoned not more than 15 years, or both, and, if the death of any person results, shall be imprisoned for any term of years or for life. To violate this paragraph, a person must have knowledge that the organization is a designated terrorist organization (as defined in subsection (g)(6)), that the organization has engaged or engages in terrorist activity (as defined in section 212(a)(3)(B) of the Immigration and Nationality Act), or that the organization has engaged or engages in terrorism (as defined in section 140(d)(2) of the Foreign Relations Authorization Act, Fiscal Years 1988 and 1989).

What is the definition of "material support"? That comes from 2339A:

Definitions.— As used in this section—
(1) the term “material support or resources” means any property, tangible or intangible, or service, including currency or monetary instruments or financial securities, financial services, lodging, training, expert advice or assistance, safehouses, false documentation or identification, communications equipment, facilities, weapons, lethal substances, explosives, personnel (1 or more individuals who may be or include oneself), and transportation, except medicine or religious materials;
(2) the term “training” means instruction or teaching designed to impart a specific skill, as opposed to general knowledge; and
(3) the term “expert advice or assistance” means advice or assistance derived from scientific, technical or other specialized knowledge.

The bolded sections appear to all be clear violations by Cloudflare of federal law. Cloudflare is providing a service to Hamas (and, apparently, Islamic Jihad)  where Internet communication is being routed through Cloudflare servers before going onto the website of the terror groups. Cloudflare will customize the service and help their clients implement it using their own expertise, and it clearly provides technical assistance and advice to designated terror organizations.

Even Cloudflare's Prince seems to know that he is providing services to Hamas in violation of the law:

"Our network can't be used to launch an attack, so it's not like we're supplying bullets to either side. But we are supplying the flak jackets to both sides, and that's been a very humbling experience to be in the middle of."

That analogy is apt. Providing flak jackets would indeed be a violation of the Patriot Act, as would providing anything that allows terrorists to protect themselves.

Given that Cloudflare has clearly chosen to accept Hamas money instead of following the US Patriot Act, it seems that the US government needs to explicitly say whether Cloudflare is violating the law and to follow through.

US readers want to contact their local members of Congress or senators to ask them about whether they agree that Cloudflare is breaking the law, and what they will do about it.