Incident Response Activity

The Incident Response Framework  is a process by which GIFCT member companies quickly become aware of, assess, and address potential content circulating online resulting from an offline terrorist or violent extremist event.

Overlaps with Hash Sharing

The Perpetrator Content Incident (PCI) overlaps with GIFCT’s Hash Sharing Database. This is due to the PCI being designed to respond to offline terrorist or violent extremist events involving the creation of perpetrator-produced content. This content may include the live stream of murder or attempted murder produced by the attack’s perpetrator or an accomplice. In previous IRF  iterations, this overlap was a feature of the now-retired Content Incident Protocol (CIP) and Content Incident (CI).

Once a PCI is activated,  all hashes of an attacker’s video or other related content may be shared in the GIFCT hash database, which gives members the ability to detect if the content is being re-shared on their respective platforms. Furthermore, communications and situational awareness updates are established among all GIFCT members to identify and address risks and needs during an activation.

The PCI  can only be activated after following a multi-step process that includes the formal activation decision from GIFCT’s operating board. Following that decision, GIFCT works to communicate the decision, review content assets, and inform GIFCT member companies and relevant governments that content from the offline violent incident is manifesting online.