Cloudflare CEO Matthew Prince Talks Internet Capacity and Security

How's the internet holding up?
article cover

Francis Scialabba

7 min read

Last Friday, we released the COVID-19 Traffic Report, which, among other things, breaks down the recent surge in online traffic.

As a follow up, I chatted with Cloudflare CEO and Emerging Tech Brew subscriber Matthew Prince about internet services and scaling up capacity. Cloudflare provides online infrastructure and security services to other businesses.

This interview has been edited and condensed for clarity.

Morning Brew: This is a unique time, with billions of people under some form of lockdown and internet usage way up. In a lot of past crises, there hasn’t been this aspect of mandatory lockdown or quarantine. I wanted to get your perspective on the infrastructure situation. Is everything holding up okay?

Matthew Prince: So when we talk about the internet, there are three different components to it. The first is what I call the lowercase "i" internet, which are the applications that run on top of the internet, whether that’s Facebook or Zoom or Netflix.

The second, which those all sit on top of, is what I call the uppercase "I" internet. That’s the collection of networks interconnecting each other to make it so that I can be sitting in my home and get a message to almost anyone anywhere in the world. That is a conglomeration, it’s what holds everything together.

And then the last-mile part, the ISPs (internet service providers) we all pay a monthly fee to.

The headline story is really that the entire system is holding up incredibly well. There are very few public utilities, where you could go to peak utilization from a narrow window of time each day to where you're essentially seeing peak utilization throughout the entire day. The electrical grid, sewer system, or transportation system would fall over. And yet the Internet has by and large worked really well.

Brew: So how’s the situation for the apps?

Prince: We have seen over the last couple weeks relatively minor disruptions when apps get capacity issues. Almost every video conferencing provider has had some regional problem. But those get solved quickly.

Living through it today is radically different than this would have been just even 10 years ago. The cloud fundamentally means that people can scale up their applications so that there aren’t the same number of bottlenecks. If you're a video conferencing service worker but your usage has gone up 20x, which is what Zoom has seen, you can use public cloud services in order to meet additional demand.

I think a real difference between 10 years ago and today is that applications have elasticity and ability to scale. On a regional scale, we’re seeing anywhere from a 20% increase in utilization to places where usage is doubling. It generally corresponds to how locked down a particular region is. The other thing is we’re seeing larger increases in places where internet penetration is actually lower.

Take South Korea and Italy. They had similar timing with shelter in place orders. We saw a much larger increase in Italy than we did in South Korea, which was on the low end, the 10% to 20% range. We think that’s because South Korea is a much more wired, always-on culture. Italy is a much less internet penetrated population.

We’re all talking about flattening the curve. Another place where we’re kind of flattening the curve is peak internet utilization. And I think it's unlikely that we're going to see anything over the coming weeks that’s going to dramatically overwhelm the Internet.

Brew: What have you noticed with video?

Prince: If multiple people are trying to stream from a Netflix or YouTube, what you're effectively doing is just downloading a whole bunch of files. Due to limitations with Europe’s DSL systems, there was concern that as people increased their streaming usage, that could be a problem.

Video streaming is a very, very high bandwidth application. Under normal circumstances, Netflix is about 15% of all internet bandwidth. YouTube is around that same amount. So the two of them are approximately 30%. They were reportedly seeing as much as a doubling of utilization.

Keep up with the innovative tech transforming business

Tech Brew keeps business leaders up-to-date on the latest innovations, automation advances, policy shifts, and more, so they can make informed decisions about tech.

So that’s a big deal. I think it was really responsible for those services, Disney+, and other streaming services to voluntarily decrease their highest resolution video. Just by cutting the video streaming quality, it probably frees up enough capacity that the increase kind of gets netted out by the lower resolution. That’s sort of a rough estimate.

They did that preemptively, kind of as good internet citizens.

Brew: In the traffic report, I wrote about changes in upstream and downstream peaks. People are uploading way more data during the day from home networks, which weren’t built with the same capabilities as office networks. So that’s a new challenge for all of us. Am I getting that right?

Prince: If you’re doing something that’s bidirectional, such as a Zoom call, that means you actually have to generate the content from your home and send it back out. In our household where we have two people, we’re on a 5 megabit upload capacity, that’s more than enough for both my wife and I to be doing simultaneous video calls.

But if we had four kids and they were all trying to use video, then we might start to hit capacity. So the quality of video going out to all the other people might degrade. Or you may just not be able to send video out at all and downgrade to a lower bandwidth application (such as audio).

A lot of the world, including Europe and the U.S., are switching to direct fiber connection. Fiber has a lot more capacity and is more symmetrical. Most business connections are symmetrical.

Brew: I know Cloudflare also offers security services. What have you noticed with malicious cyber activity since we all started locking down?

Prince: Almost immediately, we saw an increase in phishing attacks that were referencing the crisis. We didn’t see an increase in overall phishing attacks but a shift in messaging.

So today’s three weeks into Cloudflare going into mandatory work from home. In the first week, we were pleasantly surprised that there was not a dramatic increase in cyberattacks that we were seeing. So last week that trend changed. We saw about a 70% increase in attacks we detected online.

By and large, it looked like that was relatively amateur cyberattacks. While it sounds absurd, we’ve seen this before. When kids are off school, cyberattacks go up. I think that what happened two weeks ago was a bunch more kids around the world thinking "What do we do?"

Some said let’s create TikToks, others said let’s try and cyberattack the internet. We’ve seen that trend back down.

Brew: Kid hackers, fascinating. What about nation state activity on the other end of the spectrum?

Prince: The troubling trend is that we are seeing an uptick in attacks targeting various U.S. infrastructure and also elections infrastructure. These seem to be more sophisticated attacks, that at times have hallmarks of nation state associations. Unfortunately, cybercriminals and nation states are looking for the chance to attack.

We’re monitoring this, we’re briefing law enforcement. So far we haven’t seen anything particularly novel, but it’s right to worry about people being distracted and cybersecurity staffing levels. This may be an opportunity for someone to take advantage of the crisis.

Brew: Last question: So you’re doubling your internship class?

Prince: We recognized this was a place where we could use the extra hands. And unlike other businesses, we weren’t suffering as much. I think it became a no-brainer that we increase the size of our internship class. And each one of them will have real work to do. We have plenty for interns to do right now, there’s no shortage of work.

Keep up with the innovative tech transforming business

Tech Brew keeps business leaders up-to-date on the latest innovations, automation advances, policy shifts, and more, so they can make informed decisions about tech.