The TCAP Tiered Alert System – Full Policy

The TCAP Tiered Alert System is a prioritisation framework for alerting tech platforms that will be adopted as part of Phase II of the TCAP’s expansion in July 2023.

Tiers infographic

The Tiers

Below, we briefly outline each of the TCAP tiers explaining their purpose, legal grounding, and the types of content they will include. Please note, full detailed policies for each tier are also available on our website and are linked below.

Tier 1 – Threat To Life (TTL)

Purpose: Tier 1 alerts tech platforms and law enforcement to online content indicating a high threat to life, supporting responses to emergency incidents, and mitigating the threat posed by online violent extremist content.

Legal grounding: UK Police and Home Office Policy.

Content example(s): Statement indicating specific and imminent violent intent.

Tier 2 – Crisis

Purpose: Tier 2 alerts tech platforms and law enforcement to “crisis content” or content produced by terrorist attack perpetrator(s) which is then disseminated online. This will include the real-time alerting of content during an ongoing crisis governed by our upcoming Incident Response Policy, as well as the alerting of historical material produced by terrorist attack perpetrators.

Legal grounding: New Zealand Classification Office, various terrorism legislation.

Content example(s): Terrorist manifesto or livestream

Tier 3 – Designation

Purpose: Tier 3 alerts tech platforms to official propaganda produced by terrorist entities designated by selected democratic nations states and supranational institutions.

Legal grounding: Terrorist designation lists.

Content example(s): Islamic State official propaganda video.

Tier 4 – Promotional

Purpose: Tier 4 alerts tech companies to material that directly supports designated terrorist organisations, glorifies terrorists or terrorist acts, or provides instructions for the purpose of terrorism. Tier 4 is split into three taxonomic categories: Unofficial media outlets, Inspirational material, and Instructional material.

Legal grounding: EU Terrorist Content Online (TCO), UK Terrorism Act (TACT)

Content example(s): Pro-Islamic State propaganda video; gamified version of Christchurch livestream; Terrorist bomb manual.


Tier 5 – Recommended

Tier 5 will cover content that is not necessarily illegal but that is closely affiliated with terrorism and violent extremism. This list will be developed with expert consultation and relate to violent extremist entities and material that incite violence and terrorist tactics.

More details about this tier will be released in due course.

As of 13 July 2023, the first four TCAP tiers (Tiers 1, 2.2, 3 and 4) with the exception of ongoing crisis content (Tier 2.1) will be operational. As we expand our Inclusion Policy to include new terrorist entities, we will continue to lay out our reasoning in blogs accessible on the website. When we launch our Incident Response Policy covering live crisis content later this year will we also publish this policy on the website.

Grounding principles of TCAP expansion

Threat response

The TCAP Tiered Alert System provides a prioritisation framework for tech platforms to assess terrorist content on their services based on the severity of risk of offline harm and therefore urgency of moderation decisions. By adopting this tiered framework, we are improving the TCAP’s capacity to support vulnerable platforms and law enforcement to respond to “Threat to Life (TTL)” (Tier 1) incidents and “Crisis” (Tier 2) situations concerning viral online content, such as terrorist manifestos and livestreams, produced by terrorist attack perpetrators.

The ability of the TCAP to respond effectively to these crisis situations which present imminent threats to public safety will be reinforced through real-time alerting of content to tech platforms and law enforcement. The new capability to alert law enforcement agencies across the globe through the TCAP will improve timely escalation and response to online threats of violence. Furthermore, the TCAP Incident Response Policy will outline how the TCAP’s extensive alerting infrastructure will be utilised to notify a wide range of tech platforms, especially smaller ones, to crisis content as it spreads. Law enforcement will only be alerted to TTL and live crisis content to ensure necessary escalation and will not receive alerts relating to any other TCAP content.

Holistic approach

Beyond crisis response, the Tiered Alert System is designed to widen the TCAP’s Inclusion Policy to capture a broader range of terrorist content. There has been a growing recognition in the field of online counterterrorism of the need to move beyond a purely group-based approach to understanding and defining terrorist content online.[1] Through the TCAP Tiered System, we will move beyond a reliance on terrorist designation to reflect and counter the post-organisational nature of the global terrorist threat.

Tier 4 will therefore cover material that goes beyond official content produced by designated terrorist entities (Tier 3) and crisis content (Tier 2). It will cover material that directly supports designated terrorist organisations, glorifies terrorists or terrorist acts (including supporter-generated material), or provides instructions for the purpose of terrorism. Thus, in our view it reflects the next level of severity in terms of the degree to which the material promotes terrorist activity and the likelihood it will inspire offline violence. The inclusion of “Inspirational material” in Tier 4 reflects our recognition of the far-right terrorist threat, in particular militant accelerationism and the ‘sanctification’ of terrorists by violent far-right online communities.

Rule of law

Throughout the TCAP’s development, we have grounded our approach in the rule of law to avoid setting undue speech norms and infringing on the right to freedom of speech. This meant initially limiting our inclusion of terrorist content to official propaganda content produced by terrorist entities designated by selected democratic nation states and supranational institutions. Since then, we have separately included terrorist material associated with individual attack perpetrators as part of our commitment to the Christchurch Call to Action and where this material has been banned by the New Zealand Classification Office.

However, designation systems are slow to respond to a rapidly evolving threat picture and are insufficient for tackling the threat of far-right entities as well as lone and non-affiliated terrorist actors.[2] Despite moving beyond a reliance on designation, we will continue to ground our approach in the rule of law by providing legal bases for our policies and providing strict criteria for the inclusion of terrorist content. For instance, Tier 4 will cover content that is promotional of terrorist activities and therefore highly like to be illegal based on two pieces of legislation that address terrorist content online: The European Union Terrorist Content Online (TCO) and the United Kingdom Terrorism Act (TACT). Additionally, our Oversight Board will provide an important legal and civil society safeguard by ensuring terrorist content we alert to tech companies complies with our own Inclusion Policy.

[1] Global Internet Forum to Counter Terrorism (GIFCT), Broadening the GIFCT Hash-Sharing Database Taxonomy: An Assessment and Recommend Next Steps

[2] Tech Against Terrorism, Who Designates Terrorism?