Has that policy been evaluated in a threat and risk assessment? I'm not arguing that it's necessary. I'm just asking the question of whether that policy was viewed through that lens of risk and threat assessment.
On May 9th, 2013. See this statement in context.