As soon as at least two independent indicators are available—such as technical forensic data, confirmed CERT reports, payment or communication traces—the GPP Secretariat can immediately order emergency measures and add the affected person or entity to the official GPP blacklist.