Once the customs-server is a separate but internal service, opsec will have a script that will be able to connect to the customs server (vpn? ssh port forwarding? not sure yet what the mechanism will be) and block IPs and emails.

After discussing this issue with opsec, they don't really need the blocks to be permanent. Blocking for 1 day is good enough, but we may even be able to get away with shorter bans so it doesn't sound like we need an unblock facility for now.