The bulk of incident response will remain based on voluntary action by the actors running Internet infrastructure and services. Voluntary action typically takes the form of one party notifying another about potential abuse and asking it to act against it. The project aims to identify when and how notification regimes prove to be the most effective and how this effectiveness could be further enhanced.