This summer marked a unique opportunity for GIFCT to engage three distinct stakeholder communities – civil society, government, and tech – at three key events within a few weeks of each other: GNET’s Sixth Annual Conference and GIFCT’s Multi-Stakeholder Forum, UN Counter-Terrorism Week, and TrustCon. These engagements reinforced a founding principle of GIFCT’s work: preventing terrorist and violent extremist exploitation of digital spaces requires a whole-of-society approach, as no single actor can address these threats alone.
Together, the events offered an important opportunity to identify shared threats, trends, and commonalities across sectors, and what bridges can fill gaps towards collaboration. As industry leaders, senior policymakers, and global partners develop their own responses to evolving threats, these events reinforced the criticality of cross-sector collaboration and knowledge sharing.
GIFCT’s Multi-Stakeholder Forum
The Threat Landscape
Speakers at all three events highlighted similar evolutions in the threat dynamics. For the past three decades, policy and practice have focused on organized transnational groups with identifiable command-and-control structures and organizational identities. While some of these threats persist, the online threat landscape is now increasingly hybridized and decentralized, and adversarial strategies have adapted to measures adopted by platforms.
The events underscored that emerging technologies are changing how terrorists and violent extremists engage both on and offline; the online and offline dimensions of radicalization are becoming more intertwined; and there is a critical need to continue investing in safer offline environments for young people. Building on list-based approaches, participants highlighted the need to leverage behavioral indicators and signals for improved prevention efforts.
Hybridized, Decentralized Harm
Industry, government, and civil society perspectives converged on a key point: diversity across ideological, behavioral, and operational lines is challenging counterterrorism approaches online and offline, particularly in environments of shrinking resources. Converging harms mean that child sexual abuse material, criminal organizations, and terrorist and violent extremist content increasingly overlap, demanding coordinated responses that break down silos that exist within organizations and between them, such as trust and safety, law enforcement, government agencies, or practitioner communities, for example. Violent harms relating to what many practitioners are calling “nihilistic violent extremism” challenge the classification of harms by ideology, motivation, or group association. The actions of violent nonstate actors, including terrorist groups, in contexts of armed conflict, cross-border criminality, and governance challenges make clear the importance of cross-sectoral learning and adaptation from good practices.
Emerging Technologies
Emerging technologies have created unprecedented opportunities for adversarial actors, affecting radicalization timelines, the scope and reach of groups and individuals, and patterns of attacks that increasingly include online components. Terrorists and violent extremists are adapting these emerging technologies in new ways, from shifting financing to smaller-scale, undetectable cryptocurrency microtransactions to leveraging the reach and destructive power of drones. Agentic actions, in particular, are poised to have a profound effect, raising new questions about existing legal and policy frameworks, particularly at the international level, where the cooperative architecture built after 9/11 has long underpinned global legal, operational, and policy coordination. The speed, scope, and versatility of tools available to adversarial actors challenge traditionally slower policymaking processes and industry tools, which require continuous adaptation.
Youth Exploitation, Radicalization, and Behavior-Based Prevention
The exploitation of children by violent groups, including terrorists, is not new. However, what now unfolds in gaming, social media, and online subcultures can translate into real-world harm with greater speed and intensity, and in many cases, blurring the boundaries between perpetrator and victim, a distinction that shapes how practitioners, law enforcement, and governments respond. Protections for children and the duty to prevent harm may be in contradiction with concerns about taking law enforcement action before crimes are committed, for example.
This ambiguity underscores a broader shift: as ideological lines blur and perpetrators draw on multiple, overlapping strands of extremism, behavioral patterns and signals are becoming more reliable indicators than ideology alone. In a world of emojis and memes, images and sounds, context becomes crucial for practitioners tasked with acting on harmful content. Cross-sector collaboration to understand and identify these signals enables intervention at the interest stage rather than only the action stage, highlighting that combining list-based and behavior-based approaches remains key to effective prevention. Yet despite considerable discussion of youth-related harms, youth voices themselves remain largely absent from these conversations.
UN Counter-Terrorism Week
Stronger Together: The Critical Need for Collaboration
Historically the purview of state actors, effective terrorism prevention and mitigation now requires the engagement and participation of the private sector and civil society, which can deepen collective understanding and drive innovative solutions, while upholding fundamental human rights obligations.
Despite this recognition, many professional communities remain deeply siloed, and both intra- and inter- organizational cooperation can be challenging, particularly if there is a trust deficit. Civil society, governments and international organizations, and industry and its partners each operate on different timelines and toward different goals, even as the evolution of today’s threats has created an unprecedented need for collaboration among them. But in an era of shifting resources, research and analysis, boosting efficiencies, optimizing existing resources, and developing more equitable and complementary divisions of labor has become essential; in an era of fractious consensus, finding bases for partnership is key.
Signal Sharing
Evolutions in the threat landscape underscore the need for broadened signal sharing to expand the toolkit available to tech companies, while ensuring that human rights are embedded across all workstreams.
GIFCT’s own signal-sharing initiatives, including the 2026 Signals Community of Practice to further explore members’ needs regarding cross-platform signal sharing and opportunities to refine the hash-sharing database, reflect this effort to expand innovative solutions across its membership. Similarly, GIFCT’s updated Incident Response Framework enhances industry awareness of ongoing incidents while supporting members in identifying and actioning digital components in line with their own policies.
As part of a longstanding commitment to human rights, GIFCT recently updated its Human Rights Policy, joined the UN 2026 Tech for Victims of Terrorism Working Groups, and works with international actors to help ensure counterterrorism efforts continue to reflect international human rights obligations, lessons learned, and good practice as they evolve both online and offline.
Resilience, Literacy, and Education
Digital literacy plays an important role in building resilience. Each sector brings its own lexicon, approaches, and structures, but a better shared understanding of platform and digital dynamics is critical as communities and practitioners alike grapple with online content and its implications. Tools and information-sharing resources, including GIFCT’s Definitions and Legislation Project and Campaign Toolkit, support this work.
Industry approaches, including in-product interventions such as redirects, custom messaging, and gated content, are being integrated as prevention mechanisms, but their efficacy underscores the importance of collaboration, as they are only credible and effective when developed in partnership with civil society. Building on lessons learned and tried-and-tested solutions remains key, and as trust and safety approaches mature, it is equally important to integrate lessons from offline prevention experience into online responses.
Partnerships in Practice
Concrete examples of cross-sector collaboration illustrate the partnerships in practice. Examples include EUROPOL’s Referral Action Days, which bring together law enforcement agencies in coordinated content moderation operations to identify and flag terrorist and violent extremist content; the UK’s Prevent program, which focuses on identifying vulnerable individuals early and intervening before they enter the stages of radicalization; Project RHYOBASALT, which represents the UK’s national response to the COM network threat; and Australia’s Step Together program, which offers a prevention and early intervention helpline and digital support service.
GIFCT’s own Working Groups and outputs, alongside partnerships reflected across this summer’s events, including the Regional Workshop in Spain and the Global Multi-Stakeholder Forum in London, and its broader network of global partners, including the International Institute for Justice and the Rule of Law, the Aqaba Process, the UN, the Organization for Security and Co-operation in Europe, Hedayah, and Public Safety Canada, for example, further illustrate this collaborative model. So too does GIFCT’s engagement with civil society and research partners such as its academic research arm, the Global Network on Extremism and Technology, the Institute for Strategic Dialogue, Mythos Labs, VoxPol, the Konrad Adenauer Foundation, and many others.
GNET’s Sixth Annual Conference
Conclusion
All three sectors represent key GIFCT stakeholder communities, and while each operates according to its own needs, dynamics, and structures, this summer’s events underscored just how many commonalities exist among them. They reinforced that today’s evolving threats require critical dialogue among researchers, practitioners, and policymakers alike to move beyond siloed frameworks and adopt flexible, rights-respecting information-sharing solutions for cross-platform coordination.
This is fundamentally about expanding the toolkit available to all stakeholders, not discarding tried-and-tested approaches. A global perspective is essential: these threats are not confined to specific geographies or platforms, and responses tested or applied in only one context will have limited effectiveness. From downstream enforcement to upstream intervention, tech, civil society, law enforcement, and policymakers all have critical roles to play in protecting vulnerable communities online and pursuing the partnerships necessary to address the harms of today’s threat landscape.
