Ask HN: Politics Blog Cloudflare Subpoena
I run an anonymous political blog in the UK calling out misinformation. I use Cloudflare. A former Councillor in the UK has taken issue with a factual story written about him. He has somehow managed to get a Subpoena against Cloudflare, they have not challenged it, and they intend to hand over my details. This will cause me and my family to be put in danger, as many people do not like being called out on the site. Cloudflare have already given my sites origin IP without any notification, causing this individual to harass my host. I am struggling to get representation and I have asked many media groups. I know @eastdakota is the CEO of Cloudflare and I am appealing to him for help. Please don't throw me to the wolves. I would be grateful if anyone could get this message to him.
114 comments
[ 2.2 ms ] story [ 144 ms ] threadWhat? Why?
This may sound like a slight from an American, but I truly don't mean it that way. This is an honest expression/question.
My (probably poor) understanding is that there is not general free speech in the UK, that the free speech guarantees only apply to members of parliament (and/or maybe other government reps?), and not to individual citizens. At least, constitutionally. Am I wrong about that? Are there legal protections for "free speech" for average citizens in the UK?
Cloudflare could move to quash the subpoena, but unless your contract says they must, that's at their discression, and unless your contract says you'll pay for it, something they would have to pay for.
If you had representation, you could move to quash the subpoena, too. And then it would be challenged.
Free speech doesn't necessarily imply anonymous speech either.
Thanks for replying. I wasn't sure what I was able to do and did not wish to spam. This is the article. It did not actually name him, but when he started to harass the site, and try to have it taken down, I started to document this in further stories. Unfortunately he is unrelenting. Apologies if the language in the title offends anyone. The site has matured since then and has over 10k unique visitors per month.
https://debunkingtamworth.com/2023/10/tamworth-borough-counc...
If you can't get Cloudflare to stand behind you, or a lawyer willing to take your case, a last-ditch attempt might be to reach out to the person who made the claim you published; if they have evidence then you'd be in a much stronger position, since truth is an absolute defense against defamation in the UK.
I wish you luck, I think you're being treated very unfairly here.
I'm unfortunately not that important as a customer for Cloudflare to care. But it is rather chilling that they won't defend free speech.
* Flokinet (long standing host standing for freespeech, very seriously presented)
* Njalla (created by PirateBay founder, will actually troll any copyright trolls, but seems reliable)
* Cockbox (a silly but also likely reliable option)
Also it seems that you'd have been fine using Cloudflare without giving them any identifying details - when I signed up way long ago, they didn't ask for anything...
Some notes:
* Flokinet offers DDOS protection.
* Njalla offers Domain Registry.
* cockbox is colocated through Flokinet.
* Probably don't use cockbox...
I'll be blunt. I believe in the UK (as in NZ) a statement of truth or opinion is not defamatory. One would still have to go through the motions though, to prove it.
Reading the blog post I am left with the feeling you are on thin ice. You don't qualify it as an opinion and it doesn't sound you have evidence to support the claims. Screenshots may not suffice. You would need witnesses and statements or documents to prove it.
You will need these if the person unmasks your address and brings a case to court.
As usual IANAL.
Speaking from my own experience,
Fortunately in UK civil courts are less aggressive than the US courts on laying foundation for evidence. If evidence is challenged you'll have to fight out the merits of the challenge, to be decided on a more likely than not basis. But it isn't like the US where it's so easy for evidence to be precluded on procedural grounds.
OTOH, UK disclosure is way less powerful than US discovery and subponea power. The plus side for the OP is that for the same reason their opponent should have less power to damage them by fishing for private information. Unfortunately, it seems like OP's opponent has managed to buy their way into the best (for them) of all worlds by using US representation to subpoena cloudflare's records. In the UK it's unusual and extremely difficult to force third party disclosure, which means that if OP needs records from someone else to prove their case they may be screwed.
In fairness it was not what the blog was set up to do and have since reverted to cause. I was going to take the articles down but after being harassed felt less inclined.
Why put that headline on the post without any evidence to back it up?
No I can still reach it. It is using Cloudflare still and there's been no report.
It is meant to challenge everyone outside of the UK for security.
Most providers won't even tell you when your data has been subject to a subpoena.
I'm not saying this is right, it's just the reality of the situation: your opsec precluded anonymity in the face of the legal system when you tied your personal information to the blog you were publishing.
Like others have said, its time to get legal representation. The first thing they're going to tell you is to under no circumstances post things about your case in social media outlets. Good luck.
I realise opsec was lax on the Cloudflare side but I never imagined they would do this with no questions asked.
Cloudflare (or any other company) does not have your best interest in mind, just their bottom line. They will fold to any legal system if there are no regulations against them folding.
If he no longer has anything to lose, he may let up.
So you think it's OK to end a political career via website while remaining anonymous?
You're playing big boy games with kid tactics.
Trying to mock someone for the absolutely valid tactic of wanting to be anonymous due to the very real threat of life-ruining retaliation is extremely childish and short-sighted.
The allegations otherwise would probably have been used as blackmail. You are mitigating blackmail, or exposing a fraudulent political operator.
Both useful regardless of if he did it or not. His response makes him look more like he did it.
Cloudflare do not guarantee protection against your identity being discovered when the law is involved, they are not a service for anonymity against the law. You will need to make peace with your identity being revealed. Although too late now, there are other options for publishing online with anonymity.
I did not expect a subpoena to be issued in the first place, without any test to see if the person has a valid claim.
I did think about blogging about it. Unfortunately I don't think it will help.
If you're unable to find a lawyer, contact the court directly to seek advice on responding: you should be able to file a response yourself.
That said, keep in mind, if the person chasing you is willing to hire a lawyer to file in California, they're probably not going to stop pursuing you. They'll file again and again for different reasons in different jurisdictions. Cloudflare have your identity and will give it up every time they are asked to by a court, it doesn't take much for an enterprising adversary to get access to it.
At a minimum, get off Cloudflare immediately.
I intend to get off Cloudflare if they are going to behave like this.
While it may not solve your immediate problem of wishing to remain anonymous, it may be worthwhile writing of this to Private Eye. (https://www.private-eye.co.uk/). If they shine a light on you, shining it back may be your best bet.
As someone who runs a political blog in the UK, you are almost certainly aware of the magazine's existence. However for others, the magazine features a consistent section of the shameful acts one finds across local councils across the UK. While the readership is niche and the content is almost exclusively in print, not online, it has an outsized impact in media and political circles.
I'm amazed that this can happen so easily in the US. I realise the US courts probably don't care about UK citizens, but free speech is free speech. I realise that's not without consequence, there's been nothing untrue said about this individual to warrant this action.
From what I understand anyone in the UK can make claims, file cases, etc…, against anyone else.
Edit: They may take action in another jurisdiction where they posesss some advantage, but it would have to be taken up in UK courts to actually mete out formal punishment.
How is that relevant when they would still need to go to a UK court to go after you in some way?
Which is what you are afraid of, I’m assumming?
Free speech (as in the first amendment) allows you to say most things, it does not however compel others to broadcast or host your speech. So there is no free speech argument for a service provider to be required to host your website or protect it with a reverse proxy.
You can speak, but nobody is required to give you a megaphone and nobody is required to listen.
> there is no free speech argument
You really mean there is no first amendment argument. There is still an abstract free speech argument.
Another example: SLAPP laws that effectively intimidate people into silence are a free speech issue but not a first amendment issue.
Further, if SLAPP laws did burden speech, then that would be a first amendment issue since they are enacted by states which are bound by it.
Just because companies are legally allowed to remove content (e.g. the owner of Twitter removing content critical of Tesla) does not mean there are no free speech issues. That would be like saying there are no free speech issues in China as long as you follow the law.
Further, just because the law says a thing doesn’t mean I have to agree with it. Laws have legal authority not moral authority, so even if a company is legally allowed to do something doesn’t end the conversation.
100% focused on privacy, relatively cheap, available over Tor, established by Peter Sunde (of ThePirateBay/IPredator/Piratbyrån fame) and finally in 2020 RIAA and MPA both complained about Njalla which gives a bit more confidence Njalla haven't completely sold out yet.
I don't think I'd even go for a mainstream US service like AWS, Google or Cloudflare if I what I want to host is even slightly controversial-but-not-illegal or where I prefer the hosting provider not to know who I am.
(worth noting though, Njalla is still a company who has to follow the applicable laws, so unsure how much it would have helped in OPs case)
It's hard. It seems like it shouldn't be necessary, but it is.
If you sign up for a paid Cloudflare account, you're essentially submitting to what is called KYC (know your customer) in the banking industry by handing over payment information which personally identifies you. This opens you up to this kind of thing.
Cloudflare does not provide a level of anonymity. Instead it creates one more way to identify you.
As an aside, what is happening in the UK regarding free speech is worth keeping an eye on, no matter where you lean politically and how you feel about the players. It is going to shape the future of the global internet. It's also creating sharp divisions between the incoming conservative US administration and the left leaning UK labor government over there, and it will be interesting to see what the "special relationship" looks like coming out of the next four years.
I heard quite a few folks run political dissident content from non-western countries. I wonder if they are in danger too, given how easy Cloudflare share info without any notification.
Do you want Cloudflare to act as a judge? If they find your calling out misinformation resonable you then want them to act as a legal shield for you?
I do understand and accept the need for privacy when running such a blog. But who should judge whether you got your facts wrong?
Surely it is no fun going to court. But around here I would not be afraid to go myself for a simple case. And I do mean simple: If you are damn sure what the facts are.
But then it might be the thing with judicial lineage: Objective vs subjective truth. French or British style system. In the US I would be scared senseless without representation. Is that inherited from the UK way of thinking?
That's naive. You wouldn't be afraid to suffer 100k in costs up front just to deal with a completely meritless case? ... and if the litigant is aggressive and dishonest enough to survive summary dismissal then in the UK you can easily be immediately on the hook for hundreds of thousands of dollars in their legal costs for your failed attempt to get it summarily dismissed. (As the UK will award costs hearing by hearing)
The courts are an adversarial system where you're at risk of ruin, you have to put forward your best fight even if the case is stupid. If you phone it in, get less than completely competent representation, put in a lackluster defense you're in grave risk of losing.
Our civil courts has replaced the duel as a method of resolving disputes, but in many senses it is still a duel. Less bloody, somewhat more biased towards justice, sure. But when you're standing there pistols at dawn and your opponent draws, standing there complaining that they suck and their duel is dumb will only get you shot. You have to draw and you only get one chance.
The severity of the case is the severity of the credible worst case outcome. And totally losing even an absurd case is, sadly, almost always a credible outcome. Sure, you're more likely to win a stupid and meritless case (presuming you don't flub the defense by not taking it seriously)-- but the consequences should you lose aren't diminished by the case being dumb.
Would they most likely do the same?
Is Cloudflare in this instance acting a midle layer between the actual hosting entity and the Internet? Or is Cloudflare the hosting company as well?
I do know that Cloudflare have at times done more for some of their users I would not expet them to fight a court order evertime they recieve one.
This is standard industry practice, not just in the U.S., but also in Europe and the UK.
Hosting providers, telcos, social media platforms, and other similar entities generally comply with court orders or subpoenas directed at their customers.
It’s uncommon for these companies to challenge such orders unless there’s a very compelling legal reason to do so - i.e. some crazy demand.
Running an anonymous website is difficult. Running an anonymous website is difficult, where users are allowed to upload content that is posted on the site is even more difficult.
Do you do anything to monetize the site? That would be impossible, I think.
I would think a static site (just local html , imagesand as litle javascript as possible wuold be good.
Then finding a hosting enentity of some form outside of US / EU juristrition. Paying in cash without ever meeting. (Cash is harder to trace than bitcoin) (Depending on handover).
and ensure that the hosting provider flushes all logs every 5 mins or so.
Stragenluy I htink part of the package would be to flush teh site in a second if it became needed
Friendly reminder. Treat criminals the same way you want to be treated, because the line separating a good citizen from a criminal is very fuzzy at times.
I wanted to see what advice would be offered ot someone who just wanted to get set up and be safe.
The first link on Google as:
"Best anonymous hosting in 2025: ranked" by "Cybernews" https://cybernews.com/best-web-hosting/anonymous-web-hosting...
Listing such known privacy maniacs 1 Hostinger 2 Namecheap 3 Dreamhost
Yeah......
Then we had TechRadar, they are more known "Best anonymous hosting of 2024" https://www.techradar.com/best/anonymous-hosting
- Hostinger - Hostgator - Namecheap.
Then a whole bunch more that all seemed to find Hostinger to be THE PLACE for your anonymous privacy super secure hosting.
Now I know a lot better, but if your average Betty wanted to get set up to do some whistle blowing and followed these recommendations she would be F**d.
Specifically in the face of a subpoena from a US court, they are bound by law to comply. There’s really no way around this. If a company wishes to remain in operation, they cannot flout the laws of the jurisdiction they operate within. That said, their policy is firm that they require legally binding instructions before acting and that they will alert you unless bound by law not to. This is a stronger guarantee than most hosts.
From their privacy policy:
> Unless legally prohibited, we will inform you of any cooperation we provide to any law enforcement authorities.
https://www.nearlyfreespeech.net/about/privacy
>Cloudflare requires valid legal process such as a subpoena or a foreign government equivalent of a subpoena before providing this type of information to either foreign or domestic government authorities or civil litigants.
https://www.cloudflare.com/transparency/
>It is our policy to notify our customers of a subpoena or other legal process requesting their customer or billing information before disclosure of information, whether that legal process comes from the government or private parties involved in civil litigation, unless legally prohibited.
https://cf-assets.www.cloudflare.com/slt3lc6tev37/6g60HDCGGk...
https://www.nearlyfreespeech.net/help/abuse#foreign