In the 80s and 90s, I imagined the ‘Net as borderless. That didn’t last long, and because it’s so long gone, this seems not to really add any scope to that cre

In the 80s and 90s, I imagined the ‘Net as borderless. That didn’t last long, and because it’s so long gone, this seems not to really add any scope to that creep. That said... First point seems less worrisome until you see the intent to have access to access patterns (not just IPs, also timings) outside the US by non-US persons. Note the “or” and remember “corporations are people”, as well as remembering there are no loopholes to pick at here until after it’s drafted. The intent is clear: The term “United States Infrastructure as a Service Product” means any Infrastructure as a Service Product owned by any United States person or operated within the territory of the United States of America; On the second point, is there any reputable CSP that doesn’t have the IPs used for access or administration? Is there any that doesn’t already geo-check the edge accesses for proactive threat management? This language could also give legal air cover to enrich domestic CSP security practices.