Security Experts:

CloudFlare Releases Transparency Report for First Half of 2015

Web performance and security company CloudFlare has released a report detailing the number of requests it received from government agencies in the first half of 2015.

CloudFlare said it received 12 subpoenas between January 1, 2015 and June 30, 2015, the same number as in the second half of 2014. These subpoenas, ten of which have been answered, affect a total of 12 accounts and 139 domains.

While the number of subpoenas has remained the same, the number of court orders increased considerably. In the first half of 2015, the company was hit with 50 court orders, more than it received in the entire last year. The content delivery network responded to 49 of the court orders, which affect a total of 2,120 domains and 96 accounts.

The transparency report, which is published on a semiannual basis, shows that CloudFlare received three search warrants and one pen register/trap and trace order, and answered all of them. Records show that the company has not received any wiretap orders.

As for National Security Letters (NSLs) and Foreign Intelligence Surveillance Act (FISA) orders, companies are not allowed to disclose the exact number. CloudFlare says it has received between 0 and 249 such national security orders. The firm has pointed out that even if the actual number is 249, only less than 0.005 percent of customer accounts would be impacted.

The CDN has pointed out that one of the requests received in the first half of 2015 came from a foreign law enforcement agency. The request was issued via a United States court through a mutual legal assistance treaty (MLAT). CloudFlare has noted that it is not subject to foreign jurisdictions and it only accepts requests that come through the U.S. court system.

It’s worth noting that the requests detailed in the transparency report are for both CloudFlare and StopTheHacker, the anti-malware firm acquired in February 2014.

The company says it has never handed over SSL keys to anyone, it has never installed law enforcement software or hardware on its network, it has never bowed to political pressure, and it has never provided law enforcement agencies a feed of customer content.

“If CloudFlare were asked to do any of the above, we would exhaust all legal remedies, in order to protect its customers from what we believe are illegal or unconstitutional requests,” the company said.

Related: Amazon Details Government Data Requests in First Transparency Report

view counter
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.