9 ms·
Err, I am not a fan of this. The identity requirements imply that that services will at the very least request enough information to identify that you are a US
by anfilt 6y ago
Err, I am not a fan of this. The identity requirements imply that that services will at the very least request enough information to identify that you are a US citizen.
It also seems to make IP logging a requirement: "Internet Protocol addresses used for access or administration and the date and time of each such access or administrative action, related to ongoing verification of such foreign person’s ownership of such an Account"
- Terretta 6y agoIn the 80s and 90s, I imagined the ‘Net as borderless. That didn’t last long, and because it’s so long gone, this seems not to really add any scope to that creep. That said... First point seems less worrisome until you see the intent to have access to access patterns (not just IPs, also timings) outside the US by non-US persons. Note the “or” and remember “corporations are people”, as well as remembering there are no loopholes to pick at here until after it’s drafted. The intent is clear: The term “United States Infrastructure as a Service Product” means any Infrastructure as a Service Product owned by any United States person or operated within the territory of the United States of America; On the second point, is there any reputable CSP that doesn’t have the IPs used for access or administration? Is there any that doesn’t already geo-check the edge accesses for proactive threat management? This language could also give legal air cover to enrich domestic CSP security practices.