Even if a new piece of software is fully open source, has passed code audit, and promises not to transmit data, it may still run on platforms controlled by U.S. companies, rely on runtimes maintained by U.S. companies, and distribute updates through certificates issued by U.S. companies—any one of these layers can become an entry point for exercising control.