Nine Years In, Project Galileo Looks Beyond Web Protection

Cloudflare’s Birthday Week has become a yearly ritual, but the company has applied a similar approach to Project Galileo since its launch in 2014. Anniversaries for the program typically bring a recap of lessons learned and new feature announcements. This year, however, the team behind the project noticed something different: Project Galileo was no longer just a standalone initiative. It had become a thread running through much of Cloudflare’s work with civil society, governments, and privacy advocates, often acting as the bridge between them.

What started as a way to keep journalism and media sites online has evolved into something broader. The ninth anniversary is less about a single milestone and more about how the program has expanded in scope, and how Cloudflare plans to use it to protect vulnerable groups going forward.

From Free Tools to a Growing Partnership Network

The original goal of Project Galileo was straightforward. Cloudflare already offered free services, including unmetered DDoS protection, but conversations with the Committee to Protect Journalists and others suggested more could be done for important but vulnerable voices. The program was launched to provide free access to additional Cloudflare services for qualifying organizations.

The immediate challenge was defining who should qualify. Cloudflare did not want to make those calls alone, so it recruited a group of respected organizations in journalism, human rights, and civil advocacy to review applicants. At launch, 14 partners signed on. Nine years later, that number has grown to 50, including the Council of Europe and the Business & Human Rights Resource Centre. All of the original partners are still involved, often reviewing and approving new participants on a daily basis.

Today, Project Galileo protects more than 2,271 organizations across 111 countries. The expanding partner list has also driven several adjacent initiatives.

  • New areas of support: In September 2022, Cloudflare extended Project Galileo services to abortion rights groups through a partnership with the Digital Defense Fund, providing privacy and security tools to organizations supporting reproductive freedom.
  • Internal network security: In 2022, Cloudflare added Zero Trust security products to Project Galileo and the Athenian Project. This extended protection beyond web properties to internal networks for organizations like CyberPeace Institute, Meedan, the Organization of American States (OAS), and the Information Technology Disaster Resource Center (ITDRC). The Cloudflare Social Impact Portal was created to help nonprofits onboard these products with tailored instructions and tutorials.
  • Tracking shutdowns: In 2021, the Cloudflare Radar team launched an alert tool with Access Now, Internews, the Carter Center, the National Democratic Institute, the Internet Society, and the International Foundation for Electoral Systems. A year later, alerts were integrated into Radar 2.0 with API access, letting civil society groups and journalists automatically pull Cloudflare network data into their own monitoring tools.
  • Government collaboration: Work with Project Galileo partners has led to knowledge sharing with the US State Department, USAID, and other agencies on global privacy and security protocols. As part of the 2023 Summit for Democracy, Cloudflare committed to making post-quantum encryption available at no charge to all customers, including Project Galileo participants.

The program's growth has also seeded other projects. The community that developed around Project Galileo has helped launch new ideas for advancing human rights online, and this year's focus is on affordable security tools and lessons learned from protecting high-risk groups.

Ninth Anniversary: Phishing Defense and a Threat Report

For the ninth anniversary, Cloudflare is extending its partnership with the CyberPeace Institute to bring Area 1 email security tools to Development and Humanitarian Organizations (DHOs). The institute will onboard NGOs from its CyberPeace Builders program and serve as a central hub for feeding real-time phishing alerts to civil society groups.

"United against cyber threats, the CyberPeace Institute and CloudFlare stand tall, safeguarding civil society organizations from the treacherous tide of phishing campaigns. Together, we defend the defenders and empower the champions of peace in the digital realm." — Stéphane Duguin, CEO, CyberPeace Institute

To make complex security concepts more accessible, Cloudflare has also published a Zero Trust Roadmap for high-risk organizations as part of the Impact Portal.

For the anniversary, Cloudflare also released a Radar report on the threats faced by organizations protected under Project Galileo. The report highlights groups that were at the center of public debate over the last year, including those supporting LGBTQ+ rights, civil society, pro-choice advocacy, and organizations in Ukraine.

Key findings from the report:

  • Between July 1, 2022, and May 5, 2023, Cloudflare mitigated 20 billion attacks against Project Galileo organizations, averaging nearly 67.7 million attacks per day over the 10-month period.
  • LGBTQ+ organizations saw an average of 790,000 mitigated attacks per day, with the majority classified as DDoS attacks.
  • Attacks on civil society organizations are generally on the rise. One prominent organization saw attack request volume climb to 667,000 requests per second, amid otherwise little to no traffic.
  • In Ukraine, traffic spikes to emergency response and disaster relief organizations coincided with bombings over the same 10-month period.

Cloudflare also added new case studies and expanded the Social Impact Portal with security guidance. The company is sponsoring Access Now's RightsCon in Costa Rica, where it will bring together Project Galileo civil society partners to discuss digital rights.

Beyond Protection

Over the past year, Project Galileo has proven useful beyond simply defending vulnerable websites. It has become a vehicle for extending Cloudflare's expertise and protection to a range of groups tackling digital security issues. As the program moves into its next year, the focus remains on finding new ways to expand protections to at-risk groups worldwide.

Organizations seeking protection under Project Galileo can apply at cloudflare.com/galileo.