Cloudflare joins the Global Network Initiative
Cloudflare has announced that it has joined the Global Network Initiative (GNI), a nonprofit that sets standards for how information and communications technology (ICT) companies handle freedom of expression and privacy issues. The company will begin with observer status while it works to formalize its human rights policies and procedures.
The move aligns with Cloudflare's stated mission of helping build a better Internet. The company already provides free services to human rights activists, independent journalists, and election-related entities that are vulnerable to cyberattack, and publishes a biannual Transparency Report detailing government requests for customer data.
The business case for human rights
The relationship between corporations and human rights is relatively recent. While the International Covenant on Civil and Political Rights and other UN instruments have long defined human rights as protections against state action, businesses were not traditionally considered duty-bearers under international law.
That changed in 2005, when the UN Secretary-General appointed Harvard Professor John Ruggie as the first Special Representative for Business and Human Rights. In 2008, Ruggie proposed the "Protect, Respect and Remedy" framework, which holds that states have an obligation to protect human rights, while businesses have a responsibility to respect them. That responsibility exists independent of whether a state meets its own obligations. The framework was later incorporated into the UN Guiding Principles on Business and Human Rights, endorsed by the UN Human Rights Council in 2011.
Why Cloudflare is changing its approach
Cloudflare's network now operates in more than 100 countries, with over a billion unique IP addresses passing through it daily. With that global reach comes greater responsibility, the company says — particularly given that privacy is protected under Article 17 of the International Covenant on Civil and Political Rights.
Cloudflare has historically relied on three principles when responding to law enforcement requests for subscriber information: due process, respect for customer privacy, and notice to affected parties. The company says its intent is to "follow the law, and not to make law enforcement's job any harder, or easier."
However, those principles depend on good-faith legal systems with judicial oversight and political legitimacy. As Cloudflare expands into jurisdictions where those safeguards are weaker, due process and transparency alone may not be sufficient. To improve consistency in how it works with governments worldwide, Cloudflare will incorporate human rights training and human rights impact assessments into its decision-making processes.
Cloudflare acknowledges there are limits to what a company can or should do operating globally. It is committed to more formally documenting its efforts under the UN Guiding Principles, and has partnered with GNI to help get there.
What GNI does
Launched in 2008, GNI brings together ICT companies, civil society organizations, academic experts, and investors. Its GNI Principles are based on international human rights law and informed by the UN Guiding Principles. GNI gives companies concrete guidance on implementing those principles and serves as a multistakeholder voice when governments impose restrictions or make demands.
When companies join GNI, they agree to independent assessments of their implementation. That assessment reviews internal systems, policies, and procedures, and examines specific cases showing how the company applies the principles in practice.
Next steps
Cloudflare will hold observer status for the next year while working with GNI staff to implement and document formal human rights practices and training. Its first independent assessment will come after it becomes a full member.
The company frames the move as an exciting step, but also notes that more work remains in its effort to build a better, more sustainable Internet.
