Last year, members of the hacker collective UgNazi, whose exploits include pilfering user account information from eBay and crashing the CIA.gov website, broke into Prince’s cell phone and email accounts.
“It was a personal affront,” Prince said. “But we never kicked them off either.”
Prince said CloudFlare would comply with a valid court order to remove a customer, but that the Federal Bureau of Investigation has never requested a takedown. The company has agreed to turn over information to authorities on “exceedingly rare” occasions, he acknowledged, declining to elaborate.
“Any company that doesn’t do that won’t be in business long,” Prince said. But in an email, he added: “We have a deep and abiding respect for our users’ privacy, disclose to our users whenever possible if we are ordered to turn over information and would fight an order that we believed was not proper.”
Juliannne Sohn, an FBI spokeswoman, declined to comment.
Michael Sussmann, a former Justice Department lawyer who prosecuted computer crimes, said U.S. law enforcement agencies may in fact prefer that the Web’s most wanted are parked behind CloudFlare rather than a foreign service over which they have no jurisdiction.
Federal investigators “want to gather information from as many sources as they can, and they’re happy to get it,” Sussmann said.
In an era of rampant cyber warfare, Prince acknowledged he is something of a war profiteer, but with a wrinkle.
“We’re not selling bullets,” he said. “We’re selling flak jackets.”