A decade of keeping at-risk voices online

Project Galileo, Cloudflare's program providing free security services to journalists, human rights groups, and nonprofits, marks its tenth anniversary this year. What began as a response to a single incident now shields more than 2,600 organizations across 111 countries from cyberattacks. The program has grown from 14 original civil society partners to 54 today, with the number of protected entities more than quadrupling in the last five years alone.

An accidental origin story

The program's roots trace back to a difficult lesson. In 2014, Cloudflare's free tier did not include DDoS mitigation. When a free customer came under heavy attack, the company would stop proxying traffic to protect its own network. One evening, an engineer on call faced such an attack from a site that was exhausting Cloudflare resources. Following the standard playbook, the engineer pushed the button to send traffic back to the origin—effectively kicking the site off the Internet.

The site turned out to be an independent Ukrainian newspaper reporting on Russia's invasion of Crimea. The publication had tried to pay for services but couldn't: Russia had targeted Ukraine's financial infrastructure, taking banking institutions offline. The engineer had no way of knowing the site's importance. The incident prompted a commitment within Cloudflare: no organization serving such a critical public purpose should go offline simply because it couldn't pay.

Deciding which organizations deserved protection required outside expertise. Cloudflare turned to civil society groups to help identify those in need. The program's name references Galileo Galilei, persecuted in the 1600s for publishing conclusions that contradicted Church doctrine. His book was banned and his ideas suppressed for over a century—an early reminder that attempts to silence threatening ideas long predate the Internet.

From basic DDoS protection to full security suites

Cloudflare's network has expanded dramatically since 2014, from data centers in fewer than 30 cities to a presence in 320 cities across more than 120 countries. Product offerings have grown in parallel, and Project Galileo participants benefit from that expansion. When Cloudflare launched its Zero Trust services, it made them free for Galileo participants to guard against data loss and malware. After acquiring Area 1, the company extended its email security products to the same group at no cost.

Cloudflare has also built tools to make adoption easier for small organizations. The Social Impact Portal and a Zero Trust roadmap for civil society help onboard participants, while Cloudflare teams assist with troubleshooting when issues arise.

The impact on small organizations can be profound. At a recent anniversary event in Washington, DC, attendees heard from a small French nonprofit that lost 17 years of data to ransomware before receiving protection. The services help organizations defend not only against nation-state actors determined to take them offline, but also against common ransomware and phishing threats.

Speaking at that event, Damon Wilson, President of the National Endowment for Democracy, described the situation faced by Buka, an independent news outlet in Bosnia:

Earlier this year they suffered a DDoS attack, during which their servers were overwhelmed by up to 700 million page requests. And the sheer volume suggests the attackers had significant resources, making it a particularly severe threat.

But by onboarding Buka into Project Galileo, we were able to help them restore their site's functionality, and now Buka's website is equipped to withstand even the most sophisticated attacks, ensuring that their critical reporting continues uninterrupted, exactly at the time when the Republika Srpska government is looking to close and restrict independent civic voices in that part of Bosnia.

Partnerships that extend the reach

Collaboration has been central to Project Galileo's approach. In 2023, the CyberPeace Institute proposed a joint initiative: help onboard development and humanitarian organizations through their CyberPeace Builders program, then analyze the phishing campaigns targeting them. The insights gained could be shared as real-time security alerts with other civil society groups. Cloudflare worked with CyberPeace to enable volunteers to onboard organizations to Area 1 tools and give analysts access to threat indicators across the collective.

Government partnerships matter as well. Cloudflare has worked with the Joint Cyber Defense Collaborative (JCDC), run by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), on its High-Risk Communities initiative. JCDC launched a web page this year outlining cybersecurity resources for civil society communities, including tools and services nonprofits can use—Project Galileo among them.

Beyond Galileo: a template for impact programs

Project Galileo's influence extends beyond its direct beneficiaries. In 2022, following Russia's invasion of Ukraine, Cloudflare offered services to Ukrainian critical infrastructure facing a barrage of cyberattacks. The State Department's Special Envoy and Coordinator for Digital Freedom shared an email from Ukraine's Deputy Foreign Minister at the anniversary event:

It is absolutely definite that Cloudflare services provide a vital layer of cybersecurity within the Ukrainian segment of cyberspace. Numerous DDoS attacks are directed at state electronic services, fintech, official information sources. So if there was no Cloudflare as a proven protection against DDoS attacks, it would have serious consequences causing chaos, especially when these attacks are synchronized by the enemy in parallel with kinetic attacks.

Cloudflare also launched sections of its Radar service to help civil society monitor Internet outages, route hijacks, and other traffic anomalies, and participates in the Freedom Online Coalition's Task Force on Internet Shutdowns.

Project Galileo helped establish a pattern within Cloudflare for serving at-risk populations at no cost. Related programs include:

  • Athenian Project (2017): protects election-related domains for state and local governments so citizens can access voter registration, polling places, and election results.
  • Cloudflare for Campaigns (2020): secures US political candidates' websites and internal data, run in partnership with Defending Digital Campaigns.
  • Project Pangea (2021): provides secure Internet access for community networks supporting underserved communities.
  • Project Safekeeping (2022): supports at-risk critical infrastructure entities in Australia, Japan, Germany, Portugal, and the UK with Zero Trust and application security.
  • Project Cybersafe Schools (2023): equips small US public school districts with Zero Trust services including email protection and DNS filtering.
  • Project Secure Health (2024): provides security tools to Australian general practitioner clinics to protect patient data from breaches, ransomware, phishing, and insider threats.

Defending the open Internet model

The context for this work has grown more difficult. Global Internet freedom has declined for thirteen consecutive years, as documented by Freedom House, a Project Galileo partner. Governments have responded to challenges like election interference and critical infrastructure attacks with increasingly aggressive attempts to control aspects of the Internet.

Yet the underlying conviction remains: the single, global Internet built on agreed standards, where any network can exchange data with any other, has created extraordinary opportunities for civil society voices to be heard. Addressing the real harms of a permissionless network requires careful, surgical responses—not abandoning the model that made those voices possible. Projects like Galileo represent that approach: preserve the open Internet while working to protect those most at risk of being silenced on it.