GIFCT invests in the development and distribution of groundbreaking technological solutions to support member companies committed to preventing terrorist and violent extremists from exploiting their platforms while protecting human rights.
Content Incident Protocol
The Global Internet Forum to Counter Terrorism’s (GIFCT) Content Incident Protocol (CIP) is a process by which GIFCT member companies become aware of, quickly assess, and act on potential content circulating online resulting from a real-world terrorism or violent extremist event. The CIP was created in April 2019 and announced in July 2019 in response to the tragedy in Christchurch.
How does it work?
No one individual or organization can activate a content incident. Rather, the protocol is based on the existence of content online relating to the real-world terrorism or violent extremism event—like Christchurch and Halle—and potential distribution of that content, including a live stream of murder or attempted murder produced by the attack’s perpetrator or an accomplice.
By declaring a CIP, all hashes of an attacker’s video and other related content is shared in the GIFCT hash database with other GIFCT member platforms. Furthermore, a continuous stream of communication is established among all GIFCT founding members to identify and address risks and needs during an active CIP.
The CIP is a multi-step process, including a decision to activate the CIP, communication of that decision, a review of content assets, and other steps, to inform GIFCT member companies and relevant governments about content from the real-world event that may be manifesting online. A CIP ends with an official “conclusion” determined by impacted GIFCT platforms once the volume of content has noticeably decreased.
The GIFCT CIP is a standalone industry process, but was designed to be easily integrated into external crisis response procedures, including the Christchurch Call Shared Crisis Response Protocol developed in response to the commitments of the Christchurch Call to Action to eliminate terrorist and violent extremist content online and the EU’s Crisis Response Protocol. Platforms that join the GIFCT are dedicated to responsibly addressing terrorist content on their services.
How did it evolve?
During the CIP development process, drafts of this protocol were shared and discussed with a range of stakeholders. The CIP was tested in a “controlled” environment in September 2019 during the first multi-stakeholder tabletop exercise at Europol HQ in The Hague, where tech industry representatives, European law enforcement authorities and third-party governments walked through a six-part, real-world scenario to determine applicability of both the CIP and the EU’s Crisis Response Protocol. The CIP was tested a second time in a similarly controlled environment at a workshop in Wellington, New Zealand, in December 2019. The CIP is a dynamic, “living” process that the GIFCT will continue to refine and evolve over time.
CIP Incidents to Date
The GIFCT has initiated the CIP twice in response to two, separate real-world events.
Halle, Germany: The first CIP was activated on 9 October 2019 following the shooting in Halle, Germany when the attacker filmed his attack and the livestream was circulated on GIFCT member platforms. Ultimately, GIFCT shared hashes, or digital “fingerprints”, from 36 visually-distinct videos from the attack so member platforms could detect and remove the content.
As of July 2020, material from this CIP constituted 2% of content in the hash-sharing database.
Glendale, Arizona: The second CIP was activated on 20 May 2020 following the shooting in Glendale, Arizona. The CIP was declared due to:
- The existence of video of the shooting, apparently produced and distributed by the perpetrator
- The video depicts murder and attempted murder, and
- The video spread from its original location and appeared on GIFCT platforms.
As of July 2020, material from this CIP constituted 0.1% of content in the hash-sharing database.
CIP Assessment Process
The CIP assessment process has been initiated 100 separate times between March 2019 and November 2020.