Cloudflare’s 2025 Impact Report and a More Open Internet

Hello everyone and welcome to This Week in NET. It's January the 23rd, 2026 edition. It's our first episode of the year. We're already in 2026. So this week it's all about Cloudflare's impact report that was published in December. I'm João Tomé, based in Lisbon, Portugal. And joining me is Patrick Day from our Impact and Policy team. Patrick is also in Lisbon. Patrick will help us unpack some of the key findings of the report. Before we get started, in this shorter episode than usual, next week we'll have a longer one more related to Iran shutdown and also DDoS attacks. But first let's give a quick look at what's been happening on We had two big acquisitions announcements. So Astro is joining Cloudflare, bringing the creators of the Astro framework in-house as we double down on making it the best option for content-driven sites. And also Humanative, an AI data marketplace that turns content into structured searchable data is also joining Cloudflare. So expanding our developer and AI ecosystem. Hopefully in the acquisitions, some of this expansion of the developer and AI ecosystem, there's a lot to unpack there. We also published in our blog a deep dive on a DNS incident that became far more interesting than expected. So our public resolver, 1.1.1, made a small memory optimization that changed the order in which it returns certain DNS records. So that change exposed a decades-old ambiguity in the original DNS rulebook. So some systems, for example, including parts of Linux and some Cisco devices relied on the old order. And when it shifted, they didn't handle it well. We've seen this over and over in our blog in recent years and also in our show. In this case, we've sent and proposed a clarification to the standards body to prevent similar issues in the future. So that was a very popular blog on Hacker News. You should definitely read if you like these more technical blogs. From the event side, we covered the severe Internet shutdown in Iran that began on January the 8th. So it's almost two weeks of a very big country completely disconnected from the Internet. There has been some blimps of Internet traffic since this Thursday. 15% was the top. 15% of usual traffic was what we saw for a few hours. Iran is mostly without the Internet for political reasons. This is a government shutdown. As discussed, we're going to talk about more on this topic next week. But there's a blog in our blog that covers the first days of this shutdown. We also examined BGP anomalies observed in Venezuela during a period of heightened geopolitical tension, of course, with the military operation that brought Nicolas Maduro to justice in New York. About this specifically, there were some indications that BGP anomalies were related to the military operation. In this blog from earlier this year, we explained that that was not the case. Also, more recently in the blog, we explained how we mitigated a vulnerability in Cloudflare's ACME validation logic used for automated certificate issuances. So this is all about certificates. It's a very also technical blog that you can read about this specific vulnerability. So that's the roundup. Now let's jump into the impact report with Patrick Day. So Joao, as you know, Cloudflare has a really big and important mission to help build a better Internet. So every year we do the impact report. And essentially the goal of that is to explain what we mean by that and all the ways that we're working across the company towards that mission. So everything from how we do technical standards at IETF and sort of the very basic fabric of the Internet, how we release privacy-enhancing technologies, how we release our free services, how we support important and vulnerable organizations all over the world, like human rights defenders and civil society organizations, how we protect democratic elections and political candidates. So it covers sort of the whole range of all the things we mean when we say that we're helping build a better Internet. This is our fifth version, which sounds crazy to think about in hindsight. I think every year we do a little bit better job of reaching farther across the organization. And I think the easiest story for us has always been to talk about our impact programs, which are the programs that we run, our team runs specifically at Cloudflare. So Project Galileo, as I talked about, the Athenian Project, where we protect democratic elections and so forth. I think what we've really tried to do is focus on sort of all the technical things that we do and explain what those mean in the context of the Internet. So this year we talk about post-quantum encryption and open source projects that we support. And we try to get a flavor of all the different things happening across the company, not just sort of the things that we work on in public policy or in impact or our free services, but really get as broad a lens as we can. Cloudflare, as you know, puts out a lot of technical information about all the things we do with our products and services and how the Internet works. I think the specific focus of the impact report is to explain to someone without a technical background why that's important. So we focus on democracy and human rights and startup innovation and sort of all those big global themes about development and the Internet that we try to make that translation from the technical to the real world and make it accessible for everybody. I started Cloudflare six years ago, and a lot of times when I would go and sort of represent the company or talk about Project Galileo, the first question is always, what is Cloudflare? What do we do? And then sort of the technical questions that stem from that about how the Internet works and so forth, I find that not to be the case anymore. I mean, I think in part because of how we've grown as a company and sort of the information we try to put out proactively about how things work, including the Internet, it's a totally different conversation at this point. And it often is focused on sort of how we can move things forward rather than sort of the basics of how our services work or how the Internet works. It's interesting, there's a page we started last year that's kind of consolidating sort of all the things I talked about and how they're important to the principles of the free and open Internet. And I think it's, we did that page again this year with some, a few small tweaks that you probably have to be really in the weeds to pay attention to, but essentially, you know, themes that have emerged in the last 12 months about, you know, access to AI infrastructure or digital equity or making sure that, you know, the future AI ecosystem is diverse and not sort of overly concentrated in a particular country or a particular company. And so, you know, we've tried to, I think the page looks very similar from year to year, but we've kind of shifted the principles that we've focused on as a company over that period. And so I think that'll be sort of a cool way to track sort of how our thinking evolves over time or what are the sort of dynamic policy issues that the company has talked about in the preceding year. So that's a way, a part of the report where that's captured. You know, it was really cool. I actually, there was a message on LinkedIn that I didn't know was coming and we just sort of, a colleague of mine who works on the impact team happened across, but it was from sort of someone we had worked with to help protect the Moldovan elections. That's one of the things we read about in this year's report. We have a project called the Athenian Project where we provide free cybersecurity services to election entities, mostly in the U.S., but we've sort of started to move sort of outside and around the world to help protect election commissions. One of the major sort of stories from the year was our work on the elections in Moldova, which happened in the fall and Cloudflare was able to play a part in, in helping protect that election infrastructure. We actually got a lovely note, you know, showing one of the pages of the impact report where that was discussed from someone we worked with in the Prime Minister Moldova's office, just talking about, you know, our products and how they helped. And so it's funny, you know, we don't do a lot of sort of proactive distribution of the report. We kind of write it and make it available. And, and so it's cool when you sort of see it, you know, reflected back to you, if somebody's taking a look at it, including someone that we work with and think highly of and had nice things to say, that was really cool. One of the things we did during birthday week this year was sort of take some of the work that the company had done with publishers over the course of the year and helping them protect their websites and make that available for free through Project Galileo. So I mentioned a couple of times what Project Galileo is our largest impact program. We provide free cybersecurity services to human rights defenders and civil society organizations, over 3,000 organizations in 120 countries. So we made all those sort of AI monitoring tools available for over 715 journalist organizations that are protected under Project Galileo. So they now have those same types of tools that we're working with some of the largest media companies in the world. And so, you know, I think through that process and making that announcement and figuring out what types of services or whether it makes sense for sort of small independent local news organizations that participate in Project Galileo, I think we got really good feedback about how important it was for them to be able to understand how AI models were interacting with their websites and then sort of having the same types of tools that large organizations have to control that access and sort of protect their original reporting. That was a really cool story this year and something, you know, we were really happy to highlight. I think just this week we started our tracker for things that we wanted to keep track of for our 2026 report. I think a couple of things. One, you know, we'll have midterm elections in the U.S. I mentioned the Athenian Project. We protect state and local election websites and organizations in 33 states in the U.S., as well as about 400 political campaigns through Cloudflare for Campaign. So that'll be a lot. That'll be a busy work. And I think, you know, one of the benefits of providing those services, as you know, is we're also able to track cyber attacks. So we can see sort of patterns in cyber attacks on election infrastructure over the course of the year and making sure the public has access to that and we're transparent about it. I think that's something we'll definitely be working on. I think AI will continue to be a pretty big story. I think Cloudflare as a company is sort of developing more and more security tools to support sort of AI applications and so forth. I think we're always looking for ways that we can provide those to the non-profit community and make sure that, you know, those organizations that need that type of technology can have access to it, even if they don't sort of have the resources to pay for it. I think everybody at this point has a pretty intuitive understanding of how important the Internet is in our lives. I think what we try to do with the Impact Report, and I hope comes through to those who are taking a look at it, is how important sort of the decisions that are made about the Internet, from the technical all the way through to sort of the global policy discussion, are as important to things like democracy and human rights and sustainability and global development, all those sort of big themes that I think we connect to in our everyday lives, just understanding how sort of the smaller pieces of how the Internet functions are relevant to those broader discussions. We try to do, you know, I don't want to be overly ambitious with what we do with the report, but that is something we spend a lot of time thinking about. How do we make sure that the deeply technical things we do are understandable to as broad an audience as we can, including those who are sort of following policy debates or in the free and open Internet, et cetera, make sure they have all that information.