Politics Blog Cloudflare Subpoena

Hello. I was in practically the same situation: I hosted a political site via cloudflare that some people took exception to. In my case they took the example of clearly satirical cartoons (that were uploaded by users - not my own content)and claimed they promoted violence. Cloudflare immediately terminated my account without warning and refused to refund me for the remainder of the month. The harasser then went on to contact my host and after a campaign of reporting every cartoon over the course of several months the host decided it wasn't worth the headache anymore and dropped me also. This experience really soured me on the lack of defense of free speech in the US. I'm afraid I have nothing to offer but my sympathies. If you're reading this and hosting political content on Cloudflare please act accordingly.

Using Cloudflare for anything risky seems short-sighted, but rather than just complaining about that, here is a proposed solution: https://njal.la/ (not affiliated, just a grateful user)

100% focused on privacy, relatively cheap, available over Tor, established by Peter Sunde (of ThePirateBay/IPredator/Piratbyrån fame) and finally in 2020 RIAA and MPA both complained about Njalla which gives a bit more confidence Njalla haven't completely sold out yet.

I don't think I'd even go for a mainstream US service like AWS, Google or Cloudflare if I what I want to host is even slightly controversial-but-not-illegal or where I prefer the hosting provider not to know who I am.

(worth noting though, Njalla is still a company who has to follow the applicable laws, so unsure how much it would have helped in OPs case)

There's no such thing as a subpoena in the UK, just equivalents. I guess you translated it for an international audience, but can you clarify exactly what Cloudflare received? From what court? What did it require them to disclose?

Cloudflare do not guarantee protection against your identity being discovered when the law is involved, they are not a service for anonymity against the law. You will need to make peace with your identity being revealed. Although too late now, there are other options for publishing online with anonymity.

Remember, Cloudflare is a for-profit corporation that is listed on the stock market and are held accountable to local laws. While over the years they've done an excellent job of positioning themselves as fighting the good fight, they're not an activist organization and they are solely accountable to their shareholders.

If you sign up for a paid Cloudflare account, you're essentially submitting to what is called KYC (know your customer) in the banking industry by handing over payment information which personally identifies you. This opens you up to this kind of thing.

Cloudflare does not provide a level of anonymity. Instead it creates one more way to identify you.

As an aside, what is happening in the UK regarding free speech is worth keeping an eye on, no matter where you lean politically and how you feel about the players. It is going to shape the future of the global internet. It's also creating sharp divisions between the incoming conservative US administration and the left leaning UK labor government over there, and it will be interesting to see what the "special relationship" looks like coming out of the next four years.

If you do not yet have legal representation, you need to obtain it immediately to defend your rights in your jurisdiction.

Your best option is to transfer all ownership of the web page out of your control to someone you trust in a territory that has better 1st amendment protections, such as the USA. I'd be happy to help with that. My email is in my profile.

It makes me sad to see the current speech protections eroding so quickly in the UK. Anything I can do to help.

For four months, I was stuck in a nightmare with traderup.com, unable to access my funds due to a PIN issue. Despite numerous attempts to resolve the problem by contacting their customer support, I was repeatedly promised a solution within 24 hours, but nothing came through. I checked my inbox and spam folders, but I never received any follow-up emails. I even tried reaching out through their Telegram channel, but that led to no progress either. It became clear that traderup.com was doing everything it could to prevent me from accessing my money, Feeling completely helpless and desperate, I searched online for a solution and found Blockchain Cyber Retrieve. Although I was initially skeptical, their professional and attentive team quickly put my mind at ease. They acted swiftly and, within a week, I had my funds back. Blockchain Cyber Retrieve truly saved me when no one else could. I highly recommend their services to anyone facing similar issues.

CONTACT THEM ON: WhatsApp:+1520 564 8300 Email: blockchaincyberretrieve@post.com

Is Cloudflare here acting in an inappropriate manner? If the poster had instead been hosted by any regular host in the US, Dreamhost, AWS, Squarespace?

Would they most likely do the same?

Is Cloudflare in this instance acting a midle layer between the actual hosting entity and the Internet? Or is Cloudflare the hosting company as well?

I do know that Cloudflare have at times done more for some of their users I would not expet them to fight a court order evertime they recieve one.

I know there are several companies offering anonymous hosting and most of those I would not trust to do even regular hoosting.

Running an anonymous website is difficult. Running an anonymous website is difficult, where users are allowed to upload content that is posted on the site is even more difficult.

Do you do anything to monetize the site? That would be impossible, I think.

I would think a static site (just local html , imagesand as litle javascript as possible wuold be good.

Then finding a hosting enentity of some form outside of US / EU juristrition. Paying in cash without ever meeting. (Cash is harder to trace than bitcoin) (Depending on handover).

and ensure that the hosting provider flushes all logs every 5 mins or so.

Stragenluy I htink part of the package would be to flush teh site in a second if it became needed

Keep in mind that your registant details of your .com domain might also be disclosed.

Your domain is at Tucows:

>Tucows Privacy Policy prohibits the release of registrant information without express permission from the registrant except under limited circumstances such as when necessary to comply with ICANN’s Whois publication requirements or when required to comply with law or legal process properly served on Tucows or one of its affiliates.

https://tucowsdomains.com/help/legal-submissions/tucows-inc-...

Perhaps this is an unhelpful question, but do you have a link to this blog? Ideally to the story about the former councillor? Getting a sense of what exactly is going on here might help, and I don't think that linking it to this new HN account will impact your privacy.

Someone I know who was in a similar position went through a similar effort to you only to find out once they were represented that cloudflare had handed over they and their readers data in advance of the deadline.

Sorry to hear this, my heart is with you.

I heard quite a few folks run political dissident content from non-western countries. I wonder if they are in danger too, given how easy Cloudflare share info without any notification.

This is very concerning, specially due to the size and omnipresence of Cloudflare. What are the alternatives here? How can we guarantee freedom of press to journalists on the internet?

Another option: Scorched Earth/Mutually Assured Destruction. Anonymously send the post to the guy's wife.

If he no longer has anything to lose, he may let up.

I feel like all of the posts here are only going to the list of problems for the potential lawsuit (as photomatt found out for their WP engine thing.)

Is that not what the courts are for?

Do you want Cloudflare to act as a judge? If they find your calling out misinformation resonable you then want them to act as a legal shield for you?

I do understand and accept the need for privacy when running such a blog. But who should judge whether you got your facts wrong?

Surely it is no fun going to court. But around here I would not be afraid to go myself for a simple case. And I do mean simple: If you are damn sure what the facts are.

But then it might be the thing with judicial lineage: Objective vs subjective truth. French or British style system. In the US I would be scared senseless without representation. Is that inherited from the UK way of thinking?

Sorry for your situation. If your origin has been handed over, are you not already cooked (so to speak)? Who's your host? Surely they have your details as well.

I'm not saying this is right, it's just the reality of the situation: your opsec precluded anonymity in the face of the legal system when you tied your personal information to the blog you were publishing.

Like others have said, its time to get legal representation. The first thing they're going to tell you is to under no circumstances post things about your case in social media outlets. Good luck.

LOL I Googled anonymous hosting providers.

I wanted to see what advice would be offered ot someone who just wanted to get set up and be safe.

The first link on Google as:

"Best anonymous hosting in 2025: ranked" by "Cybernews" https://cybernews.com/best-web-hosting/anonymous-web-hosting...

Listing such known privacy maniacs 1 Hostinger 2 Namecheap 3 Dreamhost

Yeah......

Then we had TechRadar, they are more known "Best anonymous hosting of 2024" https://www.techradar.com/best/anonymous-hosting

- Hostinger - Hostgator - Namecheap.

Then a whole bunch more that all seemed to find Hostinger to be THE PLACE for your anonymous privacy super secure hosting.

Now I know a lot better, but if your average Betty wanted to get set up to do some whistle blowing and followed these recommendations she would be F**d.

Unhelpful for this situation, but NearlyFreeSpeech.Net is a pretty great host and their general policy is to tell people to pound sand for any requests.

Specifically in the face of a subpoena from a US court, they are bound by law to comply. There’s really no way around this. If a company wishes to remain in operation, they cannot flout the laws of the jurisdiction they operate within. That said, their policy is firm that they require legally binding instructions before acting and that they will alert you unless bound by law not to. This is a stronger guarantee than most hosts.

From their privacy policy:

> Unless legally prohibited, we will inform you of any cooperation we provide to any law enforcement authorities.

https://www.nearlyfreespeech.net/about/privacy

Are you being ddosed? the site doesn't load

Welcome to why we've always warned people to learn to sustainably self-host. After a while, the deep pocketed will begin to use disintermediation and deplatforming against you.

It's hard. It seems like it shouldn't be necessary, but it is.