” If attackers located in country A compromise a device that was made in country B, installed in country C, and exfiltrates data to country D, which rules apply?”