Cloudflare's Project Galileo Turns 12: Civil Society Under Fire

Cloudflare's Project Galileo, the free cybersecurity program for journalists, human rights defenders, and nonprofits, just turned 12. To mark the occasion, Cloudflare published its first comprehensive report on cyberattacks targeting civil society — and the numbers are grim.

The report, drawing on data from over 3,400 protected domains across 120 countries, shows that civil society groups are not just attacked more often — they're attacked harder. DDoS attacks remain the most common threat, but the defining characteristic is duration: some attacks stretch for days or weeks, not hours. That's a sustained attempt to silence, not just annoy.

Worse, these organizations face attempts to exploit website vulnerabilities at a rate seven times higher than the average Cloudflare customer. Media organizations are hit hardest. Journalists operating in exile see malicious traffic rates nearly four times higher than journalism organizations overall. And nearly 10% of all emails processed for civil society groups contain potential phishing material.

The report calls for simple, affordable cybersecurity for all, greater transparency around attacks and internet shutdowns, and default AI and post-quantum protections. Cloudflare plans to produce this report annually, which should give us a useful longitudinal view of how threat actors evolve their tactics against these targets.

Beyond the report, Cloudflare released 16 case studies profiling Project Galileo participants — from the Ukraine War Archive documenting war crimes to China Digital Times covering censorship. They also announced new partners in the Asia-Pacific region, including EngageMedia and the OpenCulture Foundation, as part of a push to reach more organizations outside North America and Europe.

Project Galileo now relies on 59 civil society partners to vet applicants. That's a lot of volunteer hours, but it's also a sign that the program has built real trust. The partnerships have also spawned adjacent initiatives, like the email security collaboration with Protect.ngo and work with UNICEF's Giga project to measure school connectivity.

If you're an engineer building for the public interest, this report is worth a read. The data on attack patterns — especially the duration of DDoS and the prevalence of vulnerability scanning — is a reminder that threat models for civil society are fundamentally different from those for commercial SaaS. Standard mitigations may not be enough.