The new rule has provoked numerous concerns over the short time of the four-day reporting requirement, the need for a national security exemption, and conflicts with proposed reporting laws around critical infrastructure.