“Without stronger definitions, the law could be used to force the dismantling of critical privacy and architecture, such as breaking encryption, overriding users’ data deletion controls, or building remote access capability, all of which could facilitate foreign interference and weaken global user privacy,” Patell argued.