Is it ok for us to scan everything coming in? And if we all agree that scanning is okay we should then be more focused on the notification process: who should be notified and in what capacity? How can peers be made compliant?