GIFCT Incident Response Framework

Protocol for coordinating across platforms during a violent attack.

Made by GIFCTCrisis and incident response

About GIFCT Incident Response Framework

The Incident Response Framework is a mechanism for streamlining member communication when terrorist and violent extremist events involve perpetrators using digital platforms. GIFCT members established the framework in response to the live-streamed attacks in Christchurch, New Zealand in March 2019. GIFCT is an independent, not-for-profit organization launched in 2017 that brings together the technology industry, government, civil society, and academia.

Membership has expanded to include over 40 diverse platforms committed to cross-industry efforts to counter the spread of terrorist and violent extremist content online. In 2025, GIFCT refined the framework after reviewing multi-stakeholder feedback to better counter the evolving threat landscape.

Drafted from gifct.org · not yet confirmed by GIFCT

How it works

GIFCT's Incident Response Framework is the playbook member platforms follow when a terrorist or violent extremist attack is unfolding online, especially a livestream. It defines escalation levels (from monitoring to a full Content Incident), who convenes, how hashes of the attacker's footage and manifesto get shared through the Hash Sharing Database in near real time, and how members report back. The 2019 Christchurch attack is why it exists.

It's a document and a process, not software. Joining GIFCT is what gives you access to the live coordination; the framework itself is public so you can align your own runbook to it.