Data Privacy Day 2021: Building for a Connected World

The pandemic has made the Internet far more central to daily life than ever before. With work, school, and social events conducted remotely, the need for an always-on, always secure, and always private Internet has never been more apparent. This year’s Data Privacy Day arrives as both regulations and technology continue to evolve in response to these changing dynamics.

Over the past year, the global conversation around data protection has been anything but quiet. New legislation and amendments are emerging worldwide, and the trend toward data localization is growing. For 2021, the focus will be on helping customers navigate these complexities and on developing technologies that make privacy the default.

The most significant legal development of 2020 was the Court of Justice of the European Union’s “Schrems II” decision, which invalidated the EU-U.S. Privacy Shield. This ruling obligates data controllers to ensure that additional safeguards are in place when transferring EU personal data to U.S. processors, a direct consequence of the court’s interpretation of U.S. surveillance laws. The decision has since been followed by draft guidance from the European Data Protection Board (EDPB) and new draft standard contractual clauses from the EU Commission, all of which emphasize the need for rigorous due diligence and impact assessments.

While Europe leads this charge, the trend is global. India’s Personal Data Protection Bill, potentially becoming law in 2021, would restrict certain data from leaving the country. Brazil’s LGPD, in effect since 2020, establishes requirements for contractual guarantees in cross-border processing. The U.S. is also weighing comprehensive federal privacy regulation, and several other nations are amending existing laws to strengthen protections.

Given this shifting legal landscape, data processors must anticipate more stringent requirements. Our approach is to maintain comprehensive safeguards that address concerns over government and legal access to data. We have long maintained strict policies, which are now detailed in a new paper, “Cloudflare’s Policies around Data Privacy and Law Enforcement Requests.” These policies are based on public commitments, which our CEO has stated we “will fight like hell to never do”:

  • Never turn over our or our customers' encryption or authentication keys.
  • Never install law enforcement software or equipment on our network.
  • Never provide a feed of customer content transiting our network to law enforcement.
  • Never modify customer content at the request of law enforcement or another third party.

Adapting to Localization Requirements

Data localization pressures are not only legal. Highly regulated sectors like banking and healthcare often adopt their own best-practice guidance, imposing extra requirements for data processed outside a subject’s home country. This complexity makes it difficult for companies to update products and business processes to remain compliant.

Recognizing that our customers must meet unique compliance needs, we are continuing work on the Cloudflare Data Localization Suite, announced in December 2020. The Suite helps customers build local requirements into their global operations, giving them control over where data resides and how it is handled. This includes:

  1. Mitigating DDoS attacks at the data center nearest the end user.
  2. Decrypting TLS and applying services like WAF and CDN within a preferred region.
  3. Using Keyless SSL and Geo Key Manager to store private keys in a user-specified region.
  4. Delivering logs securely to the storage location of your choice with Edge Log Delivery.

Advancing Privacy-Enhancing Protocols

A privacy-respecting Internet requires empowering users with technology that limits the amount of personal data leaving their control. This principle is behind our work on several new protocols designed to address remaining gaps in online privacy.

Encrypted Client Hello (ECH)

Traditional TLS handshakes reveal privacy-sensitive parameters, such as the Server Name Indication (SNI), in plaintext. While the Encrypted SNI (ESNI) extension offered an initial improvement, it left other handshake details exposed. The emerging Encrypted Client Hello (ECH) extension aims to close this gap by encrypting the entire ClientHello message, protecting all privacy-sensitive parameters. This is a significant upgrade to TLS that will help secure end-user privacy as the protocol evolves.

OPAQUE: Minimizing Password Exposure

Passwords remain a weak link. They are hard to manage, difficult to store securely, and prone to leakage and brute-force attacks. The OPAQUE protocol, an asymmetric Password-Authenticated Key Exchange (aPAKE), offers a more secure alternative by ensuring that a server never sees the plaintext password. Instead, the server stores a secret envelope that is locked by both the user’s password and a server-held secret key. During login, a cryptographic exchange unlocks the envelope for the client so it can derive an encryption key, without exposing the password to the server. We have released a reference implementation of the core protocol in Go and a demo TLS integration, with a Typescript client implementation in development.

Oblivious DNS-over-HTTPS (ODoH)

Encrypting DNS requests with DoH protects the query's contents. However, in the “digital envelope” analogy, even the outside metadata—the sender, recipient, requesting times, and visited domains—paints a detailed picture. To address this, we are supporting Oblivious DoH (ODoH), a proposed standard created with engineers from Apple and Fastly. ODoH separates IP addresses from queries by introducing a proxy between the client and resolver. The proxy knows only where to send a query, while the resolver knows only the proxy’s origin, ensuring that no single entity can link a query to its requester. This is made possible by our work with leading proxy partners, including PCCW, SURF, and Equinix.

Securing for a Post-Quantum Future

Today’s encrypted data may not remain secure indefinitely. The rise of quantum computers, potentially 10 to 15 years away, threatens current public key cryptography. Preparing for this reality is a pressing concern. We have been closely following NIST’s efforts to define new post-quantum algorithms and, last year, collaborated with Google on the TLS Post-Quantum Experiment to test new key exchange mechanisms on a global scale.

In addition, our research team is working with University of Waterloo and Radboud University on a new protocol called KEMTLS, which is fully post-quantum and relies only on public-key encryption. On the implementation side, we have developed high-speed assembly versions of several NIST finalists, including Kyber and Dilithium, in our CIRCL cryptography library. Our goal is to deploy post-quantum cryptography for most internal services by the end of 2021 and to be among the first to offer these cipher suites to customers.

As the world evolves, the demand for privacy remains constant. Regulators will continue to shape policy, and we will continue to develop and deploy the standards and tools necessary for a more private Internet.