GIFCT: organizational authority, financing and signal correction

Acquisition closed 9 September 2026. Bounded primary-source run; no database access, harmful-content inspection, account, outreach or payment. No canonical case changes. This packet separates current public descriptions, dated instruments and reported operation. It does not decide the legal effect of Australia's DIS section6; root owns that statutory connection and the BSR assessment.

What the acquired structure establishes

GIFCT has a company-led governing body, membership conditions and a disciplinary mechanism controlling access to shared infrastructure. The providers retain responsibility for their own moderation decisions. A shared hash can therefore transmit an upstream classification without itself constituting a universal removal order. Correction inside that infrastructure is documented; downstream restoration remains a separate evidentiary question.

Current organizational structure. The official governance page identifies Meta, Microsoft and YouTube as founding-company Operating Board members, with Discord and Twitch the elected at-large members for 2026; Meta chairs in 2026. The general membership elects at-large members annually. The Board supplies strategic guidance and oversight. The current IAC roster includes Australia's Department of Home Affairs in an advisory role; that role is not database access. The IAC advises on priorities and performance, has a civil-society majority and a nongovernment chair. The current page states the Operating Board periodically reviews IAC composition. Source: [current governance](http[local research file] substantive lines65–151, observed9September 2026. Current roster is not the 2021 roster.

The official FAQ describes GIFCT as a501(c)(3) nonprofit, daily operations led by Executive Director Naureen Chowdhury Fink, member funding since inception and nonfounder contributions from 2021. This is an organizational self-description; it is not an independently acquired incorporation document. [Explainers](http[local research file] lines69–121 and footer. A bounded secondary tax-index search identifies the probable legal entity Global Internet Forum to Counter Terrorism Inc., EIN 84-4586487. The original return content was not acquired, so that identifier remains a retrieval lead, not independently established primary legal identity here.

Dated financing and membership changes. The 2025 annual report records $3,760,921 in combined member/external contributions and $3,239,223 expenses, of which $2,296,459 is programming/delivery. Within that category it allocates $215,588 to incident response/HSDB, $1,226,367 member support, $391,669 GNET, $347,193 engagement/events and $115,642 working groups. These are report-level figures, not audited accounts, bank receipts or donor-specific allocations; the table uses the dollar symbol without separately labeling currency. Mandatory membership dues began in 2025. The report says membership support moved from a partner-based model to GIFCT's own MAP; its diagram places confirmation of full membership with GIFCT, members and Operating Board, without publishing a precise voting threshold. X ended membership in 2025, attributed to its focus on internal trust/safety; the source does not report expulsion. Source: [2025 Annual and Transparency Report](http[local research file] PDF 7–9,28,30; printed9–14,46,49. Do not reconstruct a donor's content veto from financial support.

The access gate. The current membership page requires annual tiered dues and six substantive criteria, including a public terrorism/violent-extremism prohibition, a functioning reports/appeals route, relevant technical interest, transparency and human-rights commitments. The public resource guide expressly says GIFCT assists policy drafting but does not prescribe exact wording. Sources: [membership](http[local research file] lines65–87,171–187; resource guide.

Who decides a hash qualifies, and what happens afterward

The current HSDB page distinguishes exact cryptographic matching from perceptual similarity and describes member-supplied hashes and labels, with agreement/disagreement feedback. It says GIFCT does not dictate enforcement. [HSDB](http[local research file] substantive lines65–89. The 2025 report adds that GIFCT itself can create hashes and limits access to GIFCT plus member technology companies completing the information-sharing agreement. It expressly separates matching from each platform's independent action; its listed companies are integrated or integrating, not all proved operational. Same annual report, PDF 11/printed17.

The currently linked December 2022 v1.0 taxonomy supplies distinct qualifying routes: UN-sanctioned terrorist entities, qualifying perpetrator/incident content, or a behavior framework. The behavioral route requires more than a general ideological label: the document combines nongovernment status, a distinguishable extremist identifier, a hate-based mission and advocacy of civilian/vigilante violence toward that mission. Its URL provision names TAT's TCAP but says GIFCT includes associated hashes only when GIFCT's own inclusion parameters also hold. This is a filter between systems, not automatic import of every TCAP designation. [Taxonomy](http[local research file] PDF 3–5. Its incident terminology is historically dated; do not silently carry 2022 IRF details across the 2025 revision.

Actual correction, with a meaningful limit. The 2022 report describes a member sampling/review exercise, corrected labels and removed hashes. It says another member sees a contributor's removal the next time it accesses the database. Separately, feedback on two hashes led the contributor to revisit a nonviolent music video and remove the hashes; some hashes were also removed cautiously when originals were no longer retained. Source:2022 report PDF 32–35. Its feedback sample is explicitly nonrandom and cannot establish a whole-database false-positive rate. The 2025 report still describes member review/removal, varying original-content retention and feedback on about2% of hashes. Same annual report PDF 13/printed21. Neither establishes that a removed hash compelled a member to restore a post or account. No universal signal-expiry period or downstream correction service-level agreement was acquired.

Enforcement of member rules, separate from user appeals

The 2025 annual report's PDF 11 link points directly to Tech Solutions Code of Conduct v1.0,2022. Its public version omits detailed acceptable-use examples for operational security. Leadership enforces after consulting the affected organization and in consultation with the Operating Board. Available sanctions run from correction/warning to temporary technology bans, permanent bans or membership revocation, with graduated Board/IAC/public disclosure. An accused organization has10business days after notification to appeal; the Board has30business days to affirm, change or reverse and may consult the IAC. Its determination is final within this process. This is an organizational access appeal, not a platform user's content remedy. Source: [Code](http[local research file] all6pages, especiallyPDF 2–5. The existence of authority is established; no specific disciplinary exercise was proved in this run.

Advisory independence has defined dependencies. The current governance page links a January 2026-path IAC TOR whose first page calls the text draft. Its7pages provide a nongovernment majority, IAC election of its chair, that chair's nonvoting Board participation and remuneration by GIFCT. They provide Board endorsement of appointments, budgeted secretariat/participation support, reciprocal summarized minutes and formal Board responses to IAC recommendations. Conflict provisions require disclosure and recorded recusal for direct interests, while allowing specified exceptions. The chair/secretariat are therefore structurally supported by the organization being advised; this is disclosed architecture, not proof of compromised judgment. Signed/adopted status and actual minutes/recusals were not acquired. [Current-linked TOR](http[local research file] PDF 1–7, especially1–5. The upload directory is not an established enactment date.

Forest implications and finite frontier

The strongest next discriminating record is the information-sharing agreement's correction clause plus one paired correction receipt: originating classification withdrawal, delivery to a receiving platform, its acknowledged review and actual disposition. This would separate interoperable correction from reversible enforcement. GIFCT/member custodians hold those records; the public code does not supply them.

For money and authority, the missing record is current audited/IRS financial detail joined to an actual donor agreement or board instrument identifying budget approval and any earmarked decision rights. Current reports establish resources and membership dues, not per-funder operational commands. The EIN lead above is useful for a later selected finance run; it is not a reason to expand this one.

Candidate relations are typed as: Operating Board→GIFCT strategic/governance oversight; member→GIFCT dues obligation; GIFCT→eligible member shared-tool access; member/GIFCT→HSDB taxonomy-qualified signal contribution; HSDB→provider identification input; provider→its content independent policy action; contributor→HSDB reported correction; Board→disciplined organization final internal appeal decision. The IAC→Board relation is advice, not a veto; Home Affairs→IAC is participation, not database access. These distinctions preserve both shared upstream influence and independent recipient discretion. No new nodes or edges were written into the case.

Reading custody and closed routes

All nine originals listed below were acquired by an ordinary unauthenticated GET and hash-checked again before closure. Their complete URLs, timestamps, original/derivative state and exact reading scopes are in gifct-captures.json. Original retention does not imply a full read. Annual-report page numbers here are PDF pages; some PDF pages contain printed spreads. The 2025 report was reached from GIFCT's transparency page; taxonomy from the current HSDB page; TOR from current governance; Code from the report's exact PDF 11 link annotation.

Resource-guide web-reader text was read only through lines80–131 for the policy and appeals statements. The original page's full body was not retained. The initial Code-link text extraction returned no link; reading the report's own PDF link annotation resolved the document. A large first PDF extraction was truncated; decisive omitted TOR and annual pages were reread in compact page-specific form. The saved gifct-scoped-extracts.txt is a normalized derivative of listed PDF ranges, not an original or a transcript of a full-report read (SHA256 a0bd63ee596773e9e901425dd3bbda85367b2f62e58ec3a7035d0a9c42c58535).

Legal-identity route: [ProPublica's IRS-derived index](http[local research file] and [2023 return wrapper](http[local research file] identify the entity/EIN and iframe locations. The two nested IRS990PF/ScheduleB readers returned nonretryable unsafe-open errors. Those routes were closed without alternative retrieval; no tax-return contents or donor names from that unacquired filing are relied upon. The legal identifier is therefore expressly secondary in this packet. No other funder or organization branch was opened. Root's BSR 2021/2026-policy lane and Hubble's TAT lane remain separate.