That's right. We have to assume that companies are always going to do whatever they can to get around regulation. The regulatory system needs to think of compan

That's right. We have to assume that companies are always going to do whatever they can to get around regulation. The regulatory system needs to think of companies as nimble attackers in its threat model, and the system needs to be capable of responding with the same nimbleness.