Major cybersecurity software provider Cloudflare on Sept. 3 blocked messaging board Kiwi Farms, citing an “unprecedented emergency and immediate threat to human life.”
In a statement on the company’s blog, Cloudflare co-founder and CEO Matthew Prince said that “[v]isitors to any of the Kiwifarms sites that use any of Cloudflare’s services will see a Cloudflare block page and a link to this post.”
“Kiwifarms may move their sites to other providers and, in doing so, come back online, but we have taken steps to block their content from being accessed through our infrastructure,” he wrote.
As of late Sept. 3 to Sept. 5, an error message appeared on the Kiwi Farms website saying: “Blocked: Due to an imminent and emergency threat to human life, the content of this site is blocked from being accessed through Cloudflare’s infrastructure.”
“This is an extraordinary decision for us to make and, given Cloudflare’s role as an Internet infrastructure provider, a dangerous one that we are not comfortable with,” Prince said.
“However, the rhetoric on the Kiwifarms site and specific, targeted threats have escalated over the last 48 hours to the point that we believe there is an unprecedented emergency and immediate threat to human life unlike we have previously seen from Kiwifarms or any other customer before.”
Prince also said on Twitter that the threats had escalated “in spite of proactively working with law enforcement” such that “it became enough of an imminent emergency we could no longer wait for them to act.”
Kiwi Farms is an internet forum that’s been used by some people to harass others.
It was originally set up as “CWCki Forums” in 2013 before its current name was adopted in 2014. The “CWC” stands for the initials of a person who was first noticed in 2007 posting comic art on another internet forum, 4chan. Kiwi Farms had been launched originally in efforts to harass the individual.
Campaign to Drop Kiwi Farms
Clara “Keffals” Sorrenti, a Canadian Twitch streamer and political activist, started the #dropwikifarms campaign after facing continued harassment by users on the site.
In a Twitter post on Aug. 18, Sorrenti shared: “On August 5th I left my home after I was swatted. I thought I would be safe at a hotel until I was doxxed. Things are escalating, and now I am in hiding. I need everyone to share this as widely as possible. I am scared of what is going to come next.”
Late Sept. 3, the campaign responded to the block, saying it was “happy” with Cloudflare’s decision.
“Today Cloudflare has dropped the notorious far-right hate forum Kiwi Farms … Kiwi Farms has been around for over a decade, and at no point in the site’s history have they come under this much fire,” the statement from the #dropwikifarms campaign reads. “This is a historical moment where thousands of people have stood up and taken a stance against online harassment and hate.”
“While we should celebrate today, this may not be the end of their community … if we continue to stand together and fight back, we can see this until the end,” campaign organizers said, adding, “As long as websites like Kiwi Farms remain active, we’ll keep fighting.”
Threat to Human Life Cited
Prince acknowledged that a “pressure campaign” had begun about two weeks ago “with the goal to deplatform Kiwi Farms.” The same pressure campaign had also targeted Cloudflare and other providers that Kiwi Farm used, he noted.
But Cloudflare is “not taking this action directly because of the pressure campaign,” he said of the block.
“[W]e are committed as a security provider to protecting our customers even when they run deeply afoul of popular opinion or even our own morals … We continue to believe that the best way to relegate cyberattacks to the dustbin of history is to give everyone the tools to prevent them.
“However, as the pressure campaign escalated, so did the rhetoric on the Kiwifarms site. Feeling attacked, users of the site became even more aggressive. Over the last two weeks, we have proactively reached out to law enforcement in multiple jurisdictions highlighting what we believe are potential criminal acts and imminent threats to human life that were posted to the site.”
Prince said that while Kiwi Farms “has frequently been host to revolting content,” that alone “does not create an emergency situation that necessitates the action we are taking today.” He cited the “imminent and emergency threat to human life which continues to escalate” as the reason for blocking Kiwi Farms.
Prince said the blocking of Kiwi Farms is a “hard case,” adding, “we would caution anyone from seeing it as setting precedent.”
“For an infrastructure provider like Cloudflare, legal process is still the correct way to deal with revolting and potentially illegal content online,” Prince said.
He added that Cloudflare does not believe that terminating security services is appropriate “even to revolting content.”
“In a law-respecting world, the answer to even illegal content is not to use other illegal means like DDoS attacks to silence it.”
His message echoed a lengthy statement that the company had posted on Aug. 31 outlining its abuse policies and approach.
No Discussion Prior to Block
Kiwi Farms owner Josh “Null” Moon said in a statement on Telegram late on Sept. 3 that Cloudflare’s decision to block the site was “done without any discussion.”
“The message I’ve received is a vague suspension notice. The message from Matthew Prince is unclear. If there is any threat to life on the site, I have received no communication from any law enforcement,” Moon said on Telegram before posting alternative links to Kiwi Farms.
In a later, more lengthy statement the following day, Moon alleged that Prince had lied in his statement announcing the block of Kiwi Farms.
“Cloudflare CEO Matthew Prince stated an imminent threat to human life was why he revoked our service. He elaborates in his post, and claims violent rhetoric had ramped up. This seems to be based off one of two things: 1. A post made on 4chan’s /pol/ with a picture taken outside an apartment in Ireland which references the forum. 2. A series of posts made by one user, @Washizu Iwao (formerly @Serotonin). This means that a community with 16,000 daily sign-ins is being punished for the behavior of a single user, or a person not even on our website,” Moon wrote.
Moon noted that the user “Washizu Iwao” had made an offending post threatening violence, after which the same user deleted the post 14 minutes after it had been posted, and two minutes after the #DropKiwiFarms campaign posted to Twitter about it. Moon also noted that the user had “joined in 2020, but the account remained inactive until July, 2022,” and had “made a single, low-effort post in an on-topic board before going dormant again until August 21st,” and that every subsequent post from the same user was being posted in the “Keffals thread” on the messaging board.
“This person is not an active member of the community. This appears to be a sleeper account someone had gotten access to in July, and kept on hand to use like this.”
‘Never Been a Violent Incident in Our History’: Kiwi Farms Owner
Moon said he believes that “something scared” Prince, prompting him to block Kiwi Farms just days after the CEO released an Aug. 31 statement defending Cloudflare as a service provider and not a regulatory body. “I don’t know what it was, but it achieved the desired result,” Moon wrote.
“At Cloudflare, with enough pressure, a single post by a strange account can be made to threaten a 9-year-old community and the tens of thousands of people who have used it every day for years. There has never been a violent incident in our history, which cannot be said for many other sites still on Cloudflare. This narrative feels like a lie spun up to save face,” Moon wrote on Sept. 4.
“Contrary to any other time Cloudflare has refused service, the error page for our domain is unique. It exists to defend Cloudflare’s decision making and to defame our community as a dangerous organization with zero substance besides Matthew Prince’s own words. He has never felt it necessary to seize a domain and convert it to a P.R. statement for Cloudflare before today.
“Even now, I have received zero communication from Cloudflare or any law enforcement agency regarding #DropKiwiFarms or its members,” Moon added. “This concerns me and should deeply concern everyone about the state of the Internet.”
On Sept. 5, Moon issued another lengthy statement on Telegram. He wrote, in part: “Cloudflare was both our application-level DDoS mitigation and our domain registrar. They have given me a way to transfer my domains to another registrar. I do not know what registrar to send it to because I do not have faith in any company.”
“This is an organized attack,” he said of the efforts that resulted in Cloudflare’s block. “There is a coalition of criminals trying to frame the forum for their behavior. These criminals provide opportunities for professional victims to amplify their message. Journalists canonize the crimes as the behavior of the forum itself, which becomes the effective truth for the general public.
“This is a machine that was built up formerly against 8chan and activates any time the cathedral wants to test the new fronts of its censorship. It is a massive amalgamation of various interests. I am one person. The financial limitations aren’t even the real problem—the problem is, I am powerless alone. There is no amount of money I can throw to convince people to be brave and be free. This is just the reality of our country.”
Update: This article has been updated with latest statements from Kiwi Farms owner Joshua Moon.