In May 2018, the Middle East-focused free speech and information access group Majal suffered a major cyberattack. Someone had managed to infiltrate a Majal Amazon Web Services account, access a content repository and backups, and wipe out six months of user data and posts across the organization's various message boards and social media platforms.

"The more time we took trying to figure out what was going on, the more damage the hackers were doing," says Bahrain-based Esra’a Al Shafei, Majal's founder and director. "I remember my heart was beating out of my chest, because this is my life’s work that was falling in front of me—a lot of years of investment, people risking their lives to produce this kind of content, people who had risked deportation, imprisonment for the kind of content that we host on our platform."

Majal eventually reconstructed the lost data from offline backups, but the incident underscored to Al Shafei how vulnerable the organization was online. Majal faced DDoS attacks, defacements, and malicious script injections for years but couldn't afford pricey digital defenses on its shoestring budget. So Al Shafei wrote to the internet infrastructure firm Cloudflare and its initiative called Project Galileo, which offers free defense tools and technical support to human rights groups, activists, journalists, and artistic organizations around the world.

"We used to think maybe we should just shut down, because we thought if we can’t protect our users, what’s the point?" Al Shafei says. "But things have been a lot more stable since we joined the program in August. And knowing that that capability is out there is very comforting—that when we get attacked someone will collaborate with us."

Project Galileo, launched five years ago in June 2014, has grown to support nearly 600 organizations. The service is often compared to Alphabet's Project Shield, first announced in October 2013, which also provides free DDoS protection and other defenses to vulnerable humanitarian and free speech groups. But multiple Project Galileo users, along with Cloudflare itself, note that organizations benefit from having choices about who to work with. Cloudflare's CEO Matthew Prince says that he wishes even more companies would offer similar services.

"In this time where so many tech companies are rightfully being criticized for being kind of myopic in their view, there’s plenty to criticize us for too, but Project Galileo is one of those things that we’re incredibly proud of," he says. "Especially when there are well-resourced, state-sponsored attacks making sure that there are multiple lines of defense that people have. And even though the attacks that we see sometimes are really big and hairy—and do occasionally cause issues for us—we definitely will continue to do this."

Prince says that Cloudflare's work with Project Galileo clients is a big part of what emboldened the company to eventually offer free, unmetered DDoS protection to all of its users. In recent statistics collected for Project Galileo's fifth anniversary, Cloudflare found that every organization that uses the services had dealt with digital attacks over the last month, and 60 percent experienced daily attacks. Some of this is par for the course on the internet these days, given the prevalence of sweeping, untargeted attacks that aim to find any weakness possible on any site. But Prince says that Project Galileo users are more likely than most to experience pernicious, targeted attacks.

Rather than project its own politics onto decisions about who should receive free services, Cloudflare works with an advisory board of organizations like Amnesty International and the Center for Democracy & Technology to vet coverage requests. A green light from any single partner—which started as a cast of 15 and is now up to 28—is enough for approval. And Project Galileo will cover both nonprofits and small commercial entities, just so long as they have a demonstrated need and are doing politically or artistically important work.