Broadening the GIFCT Hash-Sharing Database Taxonomy: An Assessment and Recommended Next Steps July 2021 Acknowledgements The Global Internet Forum to Counter Terrorism would like to thank all of our stakeholders and partners for their interest in and commitment to this body of work. We are especially grateful to our GIFCT member companies, members of our Independent Advisory Committee (IAC), and civil society representatives for their feedback throughout this process, as well as to the GIFCT interns—Maggie Frankel, Aaron Tielemans, and Ye Bin Won—who provided significant support in the production of this series. GIFCT is also enormously appreciative of the time, expertise, and innovative thinking that all of the authors of the subsequent papers contributed to this project. Table of Contents Introduction 4 Nicholas J. Rasmussen and Johannah Lowin Background: A Guide to the Taxonomy of GIFCT’s Hash-Sharing Database 9 GIFCT Staff Practical and Technical Considerations in Expanding the GIFCT Hash-Sharing Database 12 Erin Saltman and Tom Thorley Expanding the Hash-Sharing Database 25 Daniel Byman and Chris Meserole Dynamic Matrix of Extremisms and Terrorism (DMET): A Continuum Approach Towards Identifying Different Degrees of Extremisms 42 Marten Risius, Kevin M. Blasiak, Susilo Wibisono, Rita Jabri-Markwell, and Winnifred Louis A Taxonomy for the Classification of Post-Organizational Violent Extremist and Terrorist Content 78 Jacob Davey, Milo Comerford, Jakob Guhl, Will Baldet, and Chloe Colliver A Practical Taxonomy for Online Terrorist Content 102 William Braniff, Matthew Feldman, Eviane Leidig, Adam Hadley, Ghayda Hassan, Ray Serrato Taxonomy Expansion and the Global Terrorism Database: Effectively Leveraging Academic Data Collection Initiatives 116 Erin Miller Defining and Classifying Terrorist Content Online: Leveraging National Countering Violent Extremism Strategies and Action Plans 128 Sara Zeiger, Farangiz Atamuradova, Denis Suljic, and Petra Regeni Conclusion & Initial Next Steps 150 GIFCT Staff Appendix: Definitions of Terrorism & Violent Extremism 154 Nayanka Paquete Perdigao, Sarah Kenny, and Aaron Tielemans 3 Introduction By Nicholas J. Rasmussen and Johannah Lowin Broadening the GIFCT Hash-Sharing Database Taxonomy: An Assessment and Recommended Next Steps Introduction By Nicholas J. Rasmussen and Johannah Lowin Anders Breivik’s 1,518-page document released prior to the killing of 77 people at a government center and summer camp in Oslo, Norway in 2011. Brenton Tarrant’s essay published before the mass shooting of 55 people at two mosques during Friday prayer in Christchurch, New Zealand in 2019. Patrick Crusius’s tract posted before the massacre of 23 people at the Walmart in El Paso, Texas later that year. All three of these detailed online manifestos are widely recognized as terrorist and violent extremist propaganda and disseminated among online sympathizers and members of white supremacy groups. Yet none of these writings — though they incite and inspire violence1 — currently qualifies for inclusion in the Global Internet Forum to Counter Terrorism’s hash- sharing database of terrorist and violent extremist content. The reason for this is twofold: First, when several leading tech companies came together five years ago to establish the hash-sharing database, they agreed to include hashes of only a narrow subset of content. To find common ground, the original scope of the database was limited to material associated with organizations on the United Nations Security Council’s Consolidated Sanctions List. In practice, that meant that nearly all hashes reflected content related to al-Qaeda, the Taliban, the Islamic State, or other groups that the United Nations had designated as terrorist organizations. As writings penned and published by far-right extremist attackers, none of the above manifestos met those criteria. Second, the database in its current form only includes hashes of images or video and not PDF documents, which is how manifestos tend to surface and circulate online. Although the database has evolved over time to include hashes of content related to three specific attacks that have triggered GIFCT’s Content Incident Protocol — a set of procedures developed to hasten the removal of content from a live-streamed event — that does not include PDFs.2 As a result, while hashes of perpetrator-produced video footage of the devastating Christchurch attacks can be shared among members in the database, hashes of the perpetrator’s manifesto — which the El Paso shooter cited as direct inspiration several months later — cannot. 1 Like many such manifestos, the three mentioned here go so far as to feature detailed instructions for others to follow and/or careful reasoning for specific tactical choices. 2 In order for a CIP to be activated, all four of the following conditions must be met: 1) a real-world terrorist, violent extremist, or mass violence event; 2) has been recorded or broadcast via livestream; 3) depicting murder or attempted murder; and 4) is being distributed on GIFCT member platforms or so broadly online that such distribution appears inevitable. Since the attacks in Christchurch, New Zealand in March 2019 initiated the creation of the CIP process, GIFCT has activated the CIP twice in response to offline attacks when perpetrator-produced content was shared on GIFCT member platforms: in Halle, Germany in October 2019 and in Glendale, Arizona in May 2020. 5 Unfortunately, the lifecycle of a terrorist manifesto rarely ends with the attack. Instead, these writings become like “the baton in a relay race of extremists, passed from one terrorist murderer to the next through online communities.”3 For instance, Tarrant’s manifesto cited Breivik’s attack as an inspiration and also claimed knowledge of manifestos by other far-right extremists, such as Dylann Roof, the perpetrator of the Charleston, South Carolina church shooting in 2015.4 Following the Christchurch attack, Tarrant’s manifesto was subsequently cited by Crusius, the El Paso shooter,5 and an unnamed Singaporean teenage far-right extremist whose attack was foiled by authorities.6 This pattern is common throughout the far-right extremist milieu as terrorist manifestos often cite, credit, and praise predecessors. Allowing terrorist manifestos to proliferate across the internet — unfettered and readily accessible — therefore contributes to the violent extremist culture of citation and heightens the risk of future attacks. A Rights-Based, Multi-Stakeholder Approach: Manifestos are but one example of the sort of harmful content linked to terrorism and violent extremism that GIFCT’s hash-sharing database can and must evolve to address. One year ago, at the first Global Summit of the newly independent GIFCT, our team committed to leading a global multi-stakeholder effort to explore how to expand the hash-sharing database’s utility, reach, and impact. As part of this year-long initiative, GIFCT put human rights — including, but not limited to, freedom of speech and privacy — at the forefront of the process. At the advice of key civil society stakeholders involved in a range of GIFCT work and initiates, GIFCT engaged the firm Business for Social Responsibility (BSR) to undertake a forward-looking human rights impact assessment of the organization at this foundational moment. The recommendations in that report, released in full last week, helped shape and inform every element of this effort. Chief among the report’s findings was a widespread view among our stakeholder community that the narrow scope of the database reflects broader discrimination and bias in the counterterrorism field, specifically a disproportionate focus on Islamist extremist content rather than white supremacist content.7 Indeed, the assessment identified GIFCT’s review of the hash-sharing database’s taxonomy as a key opportunity “to proactively address bias in the counterterrorism field.”8 As GIFCT increasingly aims to focus on behavior and content, in addition to dangerous individuals and organizations, this project seeks to do 3 J.M. Berger, “The Strategy of Violent White Supremacy is Evolving,” The Atlantic, August 7, 2019. 4 Ari Ben Am and Gabriel Weinman, “Fabricated Martyrs: The Warrior-Saint Icons of Far-Right Terrorism,” Perspectives on Terrorism 14, no. 5 (October 2020): 140. 5 Jacob Ware, “Testament to Murder: The Violent Far-Right’s Increasing Use of Terrorist Manifestos,” ICCT, March 20, 2020. 6 Max Walden, “Singaporean teenager arrested for allegedly planning Christchurch-inspired machete attack on mosques,” ABC News, June 27, 2021, Link 7 “Human Rights Assessment: Global Internet Forum to Counter Terrorism,” Business for Social Responsibility, 2021. 8 Business for Social Responsibility, “Human Rights Assessment,” 26. 6 Broadening the GIFCT Hash-Sharing Database Taxonomy: An Assessment and Recommended Next Steps just that. The Series The first piece in this collection, “Practical and Technical Considerations in Expanding the GIFCT Hash-Sharing Database,” offers a practical lens through which to view the insights and recommendations from the independent academic papers that follow. Co- authored by GIFCT Director of Programming Erin Saltman and Director of Technology Tom Thorley, this chapter draws on a series of interviews with each GIFCT member to review the technical feasibility of various approaches to expansion. As our diverse array of members must ultimately be able to implement an expanded taxonomy in order for it to be valuable, this initial chapter outlines the