The Global Internet Forum to Counter Terrorism (GIFCT) has launched an updated version of its Incident Response Framework (IRF), which creates a more streamlined process designed to respond to the current threat landscape and the needs of our member companies.
The new IRF was developed in consultation with a wide variety of stakeholders across various industries, including an independent review of GIFCT’s incident response policies and a multi-stakeholder Working Group. The revised IRF developed through these processes, and reflecting stakeholder feedback from prior activations, will enable GIFCT and its members to better respond to offline events through information sharing, streamlined communication, and tailored support while increasing transparency and maximizing member benefit.
“The redesigned IRF reflects the valuable feedback of both GIFCT members and our wider multistakeholder community. By making the framework more efficient and expanding its scope to address a broader range of harms, it equips member companies to keep pace with an evolving threat landscape. This redesigned IRF strengthens our collective ability to prevent terrorists and violent extremists from exploiting digital platforms and further our shared mission of building safer online environments.”– Naureen Chowdhury Fink, GIFCT Executive Director.
GIFCT’s revised Incident Response Framework is composed of three response types:
- Perpetrator Content Incident (PCI)
- Digital Footprint Incident (DFI)
- Incident Advisory
These protocols are designed to respond to the distinct types of online activity produced during and in the aftermath of terrorist and violent extremist events.
The Perpetrator Content Incident is designed to coordinate a response to online, perpetrator-produced content directly related to a terrorist or violent extremist event and support members to identify and respond to prevent the spread of this content.
The Digital Footprint Incident can facilitate information sharing and cross-platform support when the perpetrator of an attack had a significant online presence, but did not produce media as part of the attack.
The Incident Advisory is a flexible framework designed to respond to terrorist or violent extremist events that may occur in a highly unclear information environment, or are not obviously time-bound. This framework allows GIFCT to provide support to members adapting to complex incidents as they unfold, with the possibility of transitioning to a different IRF protocol once additional information is available.
These processes were developed to respond to the evolving landscape of terrorist and violent extremist use of the internet and to improve responses to most effectively mitigate harms. They reflect the changing nature of terrorist and violent extremist attacks, and adversarial use of emerging technologies and digital media to support their attacks and goals. They also allow GIFCT to work closely with platforms to better understand the context, the signals involved, and build a more comprehensive threat picture alongside our members.
GIFCT remains committed to continuously improving and adapting responses to terrorist and violent extremist exploitation of the internet while upholding the fundamental and universal human rights that terrorists and violent extremists seek to undermine.
