[spb_row element_name=”Intro Row” wrap_type=”full-width-contained” row_bg_type=”color” row_bg_color=”#ffffff” color_row_height=”content-height” bg_type=”cover” parallax_image_height=”content-height” parallax_image_movement=”fixed” parallax_image_speed=”standard” bg_video_loop=”yes” parallax_video_height=”window-height” row_top_style=”none” row_bottom_style=”none” parallax_video_overlay=”none” row_overlay_opacity=”0″ remove_element_spacing=”no” row_col_spacing=”0″ row_col_pos=”default” row_col_equal_heights=”no” row_expanding=”no” row_animation=”none” row_animation_delay=”0″ minimize_row=”yes” simplified_controls=”no” custom_css_percentage=”no” custom_css=”margin-top: 0px;margin-bottom: 0px;padding-top: 20px;padding-left: 20px;padding-right: 20px;padding-bottom: 20px;” border_styling_global=”default” width=”1\/1″ el_position=”first last”] [spb_blank_spacer height=”60px” responsive_vis=”hidden-xs” width=”1\/1″ el_position=”first last”] [spb_blank_spacer height=”60px” responsive_vis=”hidden-xs” width=”1\/6″ el_position=”first”] [spb_text_block animation=”none” animation_delay=”0″ simplified_controls=”yes” custom_css_percentage=”no” padding_vertical=”0″ padding_horizontal=”0″ margin_vertical=”0″ custom_css=”margin-top: 0px;margin-bottom: 0px;” border_size=”0″ border_styling_global=”default” width=”2\/3″]<\/p>\n
The Incident Response Framework (IRF) <\/b>is one of the most important ways GIFCT facilitates this effort. The IRF is a mechanism of streamlining member communication to respond to terrorist and violent extremist events in which perpetrators use digital platforms as part of their violence.<\/p>\n
[\/spb_text_block] [spb_blank_spacer height=”30px” responsive_vis=”hidden-xs” width=”1\/6″ el_position=”last”] [spb_blank_spacer height=”30px” responsive_vis=”hidden-xs” width=”1\/1″ el_position=”first last”] [\/spb_row] [spb_row element_name=”Origin Row” wrap_type=”full-width-contained” row_bg_type=”color” color_row_height=”content-height” bg_type=”cover” parallax_image_height=”content-height” parallax_image_movement=”fixed” parallax_image_speed=”standard” bg_video_loop=”yes” parallax_video_height=”window-height” row_top_style=”none” row_bottom_style=”none” parallax_video_overlay=”none” row_overlay_opacity=”0″ remove_element_spacing=”no” row_col_spacing=”0″ row_col_pos=”default” row_col_equal_heights=”no” row_expanding=”no” row_animation=”none” row_animation_delay=”0″ minimize_row=”yes” simplified_controls=”no” custom_css_percentage=”no” custom_css=”margin-top: 0px;margin-bottom: 0px;padding-top: 20px;padding-left: 20px;padding-right: 20px;padding-bottom: 20px;” border_styling_global=”default” width=”1\/1″ el_position=”first last”] [spb_blank_spacer height=”30px” width=”1\/1″ el_position=”first last”] [spb_blank_spacer height=”30px” width=”1\/6″ el_position=”first”] [spb_text_block animation=”none” animation_delay=”0″ simplified_controls=”yes” custom_css_percentage=”no” padding_vertical=”0″ padding_horizontal=”0″ margin_vertical=”0″ custom_css=”margin-top: 0px;margin-bottom: 0px;” border_size=”0″ border_styling_global=”default” width=”2\/3″]<\/p>\n
The Incident Response Framework was established by GIFCT members in response to the live-streamed attacks in Christchurch, New Zealand in March 2019<\/b>. GIFCT acts as a communication hub for members to share situational awareness regarding ongoing offline incidents that might result in the online spread of perpetrator produced violent content.<\/p>\n
[\/spb_text_block] [spb_blank_spacer height=”30px” width=”1\/6″ el_position=”last”] [spb_blank_spacer height=”30px” width=”1\/1″ el_position=”first last”] [\/spb_row] [spb_row element_name=”Activation Row” wrap_type=”full-width-contained” row_bg_type=”color” row_bg_color=”#ffffff” color_row_height=”content-height” bg_type=”cover” parallax_image_height=”content-height” parallax_image_movement=”fixed” parallax_image_speed=”standard” bg_video_loop=”yes” parallax_video_height=”window-height” row_top_style=”none” row_bottom_style=”none” parallax_video_overlay=”none” row_overlay_opacity=”0″ remove_element_spacing=”no” row_col_spacing=”0″ row_col_pos=”default” row_col_equal_heights=”no” row_expanding=”no” row_animation=”none” row_animation_delay=”0″ minimize_row=”yes” simplified_controls=”no” custom_css_percentage=”no” custom_css=”margin-top: 0px;margin-bottom: 0px;padding-top: 20px;padding-left: 20px;padding-right: 20px;padding-bottom: 20px;” border_styling_global=”default” width=”1\/1″ el_position=”first last”] [spb_blank_spacer height=”30px” width=”1\/1″ el_position=”first last”] [spb_blank_spacer height=”30px” width=”1\/6″ el_position=”first”] [spb_text_block animation=”none” animation_delay=”0″ simplified_controls=”yes” custom_css_percentage=”no” padding_vertical=”0″ padding_horizontal=”0″ margin_vertical=”0″ custom_css=”margin-top: 0px;margin-bottom: 0px;” border_size=”0″ border_styling_global=”default” width=”2\/3″]<\/p>\n
GIFCT\u2019s Incident Response Framework is composed of three non-hierarchical activation types which seek to counter a variety of methods by which perpetrator of terrorist or violent extremist events may seek to exploit digital platforms to spread content which graphically depicts or explicitly glorifies their violence.<\/p>\n
[\/spb_text_block] [spb_blank_spacer height=”30px” width=”1\/6″ el_position=”last”] [spb_blank_spacer height=”30px” width=”1\/1″ el_position=”first last”] [spb_icon_box title=”Perpetrator Content Incident (PCI)” box_type=”animated” box_icon_type=”icon” icon=”sf-im-full-screen2″ animate_svg=”no” target=”_self” animation=”none” animation_delay=”0″ icon_color=”#6785af” animated_box_style=”coloured” animated_box_rounded=”yes” width=”1\/3″ el_position=”first”]<\/p>\n
An activation is designed to coordinate a response to online, perpetrator-produced content directly related to a terrorist or violent extremist event. This is intended to empower members to respond to the spread of perpetrator-produced content.<\/p>\n
[\/spb_icon_box] [spb_icon_box title=”Digital Footprint Incident (DFI)” box_type=”animated” box_icon_type=”icon” icon=”sf-im-fingerprint-2″ animate_svg=”no” target=”_self” animation=”none” animation_delay=”0″ icon_color=”#6785af” animated_box_style=”coloured” animated_box_rounded=”yes” width=”1\/3″]<\/p>\n
An activation in which the perpetrator(s) or accomplices of a terrorist or violent extremist event has a significant online presence but did not produce media as part of the attack. This is intended to empower members to discover tactics used by attack perpetrators who may seek to exploit digital platforms.<\/p>\n
[\/spb_icon_box] [spb_icon_box title=”Incident Advisory (IA)” box_type=”animated” box_icon_type=”icon” icon=”sf-im-speach-bubbledialog” animate_svg=”no” target=”_self” animation=”none” animation_delay=”0″ icon_color=”#6785af” animated_box_style=”coloured” animated_box_rounded=”yes” width=”1\/3″ el_position=”last”]<\/p>\n
An intentionally flexible activation which is designed to respond to terrorist or violent extremist events which may occur in an extremely unclear information environment, or is not obviously time-bound in the short term.\u00a0 This is intended to empower members and raise awareness of complex incidents which challenge conventional incident response.<\/p>\n
[\/spb_icon_box] [spb_blank_spacer height=”30px” width=”1\/1″ el_position=”first last”] [\/spb_row] [spb_row element_name=”CIP \/ Closing Row” wrap_type=”full-width-contained” row_bg_type=”color” color_row_height=”content-height” bg_type=”cover” parallax_image_height=”content-height” parallax_image_movement=”fixed” parallax_image_speed=”standard” bg_video_loop=”yes” parallax_video_height=”window-height” row_top_style=”none” row_bottom_style=”none” parallax_video_overlay=”none” row_overlay_opacity=”0″ remove_element_spacing=”no” row_col_spacing=”0″ row_col_pos=”default” row_col_equal_heights=”no” row_expanding=”no” row_animation=”none” row_animation_delay=”0″ minimize_row=”yes” simplified_controls=”no” custom_css_percentage=”no” custom_css=”margin-top: 0px;margin-bottom: 0px;padding-top: 20px;padding-left: 20px;padding-right: 20px;padding-bottom: 20px;” border_styling_global=”default” width=”1\/1″ el_position=”first last”] [spb_blank_spacer height=”60px” responsive_vis=”hidden-xs” width=”1\/1″ el_position=”first last”] [spb_blank_spacer height=”60px” responsive_vis=”hidden-xs” width=”1\/6″ el_position=”first”] [spb_text_block animation=”none” animation_delay=”0″ simplified_controls=”yes” custom_css_percentage=”no” padding_vertical=”0″ padding_horizontal=”0″ margin_vertical=”0″ custom_css=”margin-top: 0px;margin-bottom: 0px;” border_size=”0″ border_styling_global=”default” width=”2\/3″]<\/p>\n
To ensure continued efficacy, the Incident Response Framework has been periodically updated through a deliberative multistakeholder process. Initially, the Incident Response Framework included one activation type, the Content Incident Protocol (CIP)<\/a> which was modeled on GIFCT\u2019s response to the March 2019 Christchurch attacks. Over time, the framework grew<\/a> to include the Content Incident (CI), and Incident (I) activations. In 2025, after reviewing multistakeholder feedback, GIFCT once again refined its Incident Response Framework to better counter the evolving threat landscape. The refinement involved the retiring the previous activation types, and the creation of the current Incident Response Framework.<\/p>\n