[dsaber]

But how can they accurately identify a request as being by an actual US citizen?

[eitally]

For that matter, how can they identify any individual as a US citizen when the commercial systems they're monitoring (phone, email, etc) often don't know? What about foreign workers on visas, or US expats abroad, or simple business travelers.

[Vivtek]

We expats abroad are not protected. I guess we're just not loyal enough.